100% PASS RATE Fortinet Certification NSE6_EDR_AD-7.0 Certified Exam DUMP with 35 Questions [Q20-Q37]

Rate this post

100% PASS RATE Fortinet Certification NSE6_EDR_AD-7.0 Certified Exam DUMP with 35 Questions

Updates For the Latest NSE6_EDR_AD-7.0 Free Exam Study Guide!

Fortinet NSE6_EDR_AD-7.0 Exam Syllabus Topics:

Section	Weight	Objectives
Topic 1: FortiEDR Installation and Configuration	25%	– Collector Agent installation methods – Initial configuration and licensing – Communication Manager setup – Pre-installation requirements and planning – Management Platform deployment
Topic 2: Administration and Maintenance	10%	– Log management and export – System monitoring and diagnostics – Backup and recovery procedures – Upgrade and patch management – User management and role-based access
Topic 3: FortiEDR Architecture and Components	20%	– FortiEDR core architecture overview – Collector Agent components and functionality – Management Platform architecture – Communication Manager and Cloud Console
Topic 4: Threat Detection and Response	20%	– Forensic data collection – Real-time threat blocking – Event analysis and investigation – Automated threat remediation – Incident response workflows
Topic 5: Policy Management and Security Profiles	25%	– Application control rules – Default security policies overview – Policy assignment and targeting – Custom policy creation and modification – Exclusion configuration

Q20. Refer to the exhibit.

What observation can you make about the ConnectivityTestAppNew.exe incident? (Choose one answer)

A rule assigned action is set to block but the policy is in simulation mode.

The incident has not been handled by a console administrator.

The incident was archived from the console unhandled.

The incident was handled automatically by the communication control policy.

Q21. Which two Python commands are supported when using FortiEDR Connect to directly access a protected device shell? (Choose two answers)

%upload_file

%ipconfig_all

%psexec

%timestamp

Q22. Refer to the exhibits.

What happens when the net user command runs on an endpoint? (Choose one answer)

It triggers an immediate endpoint alert.

It blocks CLI commands by default.

It triggers an incident when the query matches the target process (net.exe).

It triggers FortiEDR rules because the activity is not suspicious.

Q23. What specific action does FortiEDR take when the Zero Trust Device Tagging playbook is activated?
(Choose one answer)

It removes unmanaged endpoints from FortiClient EMS.

It assigns a default tag to all endpoints.

It updates FortiClient EMS through an API and assigns a classification fabric tag.

It disables the endpoint until a tag is assigned.

Q24. Refer to the Exhibit:

A FortiEDR analyst is prioritizing response efforts. One application has a vulnerability score of Critical but an Unknown ACI rating, while another has a Medium vulnerability score with active ACI evidence of adversary targeting. Which application must be addressed first? (Choose one answer)

Both applications should be treated equally because patching is necessary.

The application with the Critical vulnerability score should be addressed first.

The decision depends only on asset criticality, not scores.

The application with the Medium vulnerability score and ACI evidence should be addressed first.

Q25. You added three new applications to FortiEDR using only the Path attribute. What are two expected outcomes of this configuration? (Choose two answers)

These applications will be disabled until explicitly enabled.

Only applications in the specified directory paths will be blocked.

These applications will be blocked only if the file name also matches.

All instances of these applications will be blocked, regardless of location.

Q26. A company requires a global communication policy for a FortiEDR multi-tenant environment. Which recommendation must you make? (Choose one answer)

Create a separate communication control policy for each organization.

Create a new communication control policy and apply it to multiple organizations.

Create a new communication control policy and delegate it to other organizations.

Create a new communication control policy and assign it globally to all organizations.

Q27. Refer to the exhibits.

The application policy logs and application details are shown. Collector C8092231196 is a member of the Finance group. In this scenario, what must you do to block the FileZilla application? (Choose one answer)

Assign the Simulation Communication Control Policy to the DBA group.

Deny the application in the Finance policy.

Assign the Finance policy to the DBA group.

Assign the Finance policy to a broader collector group, such as the Default Collector Group.

Q28. Refer to the Exhibit:

Based on the incident details shown in the exhibit, which two statements about this incident are true? (Choose two answers)

The destination IP address is blocked by FortiGate.

The incident occurred on only one device.

The incident is classified by the FortiEDR Core.

The incident has already been fully handled.

Q29. An employee leaves the company and no longer has access to the FortiEDR system. You must ensure GDPR compliance regarding the employee’s personal data stored in FortiEDR. Which two data types must be removed to meet GDPR requirements? (Choose two answers)

Device and user name

Installed applications

Installed OS name

IP address and MAC address

Q30. Refer to the exhibit.

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two answers)

The event is marked as Handled.

FCS classified the event as malicious.

The user was able to launch TestApplication.exe.

TestApplication.exe is sophisticated malware.

Q31. A collector triggers a suspicious security incident that is initially flagged as potentially malicious. The environment is connected to the FortiEDR Cloud Service (FCS) for classification. How does FCS process the event for accurate classification? (Choose one answer)

By data processing, comprehensive automated analysis, and comprehensive manual analysis

By relying solely on the FortiGate firewall policies

By comparing the event against only local signatures

By correlating collector logs only

Q32. Which two statements correctly describe the IoT probing process on FortiEDR? (Choose two answers)

Collectors running on servers are always used for IoT probing.

It identifies nearby devices by retrieving details such as hostname and IP address.

Only healthy collectors participate in IoT probing.

It captures all traffic from neighboring devices for deep packet inspection.

Q33. You are asked to create a playbook to isolate a device with a collector. Which action category does isolating a device with a collector fall under? (Choose one answer)

Investigation

Remediation

Custom

Notifications