Fortinet NSE 5 - FortiEDR 5.0 Exam (NSE5_EDR-5.0) Practice Test

Questions # 1:

FortiXDR relies on which feature as part of its automated extended response?

Options:

Playbooks

Security Policies

Forensic

Communication Control

Questions # 2:

Which FortiEDR component is required to find malicious files on the entire network of an organization?

Options:

FortiEDR Aggregator

FortiEDR Central Manager

FortiEDR Threat Hunting Repository

FortiEDR Core

Questions # 3:

A FortiEDR security event is causing a performance issue with a third-parry application. What must you do first about the event?

Options:

Contact Fortinet support

Terminate the process and uninstall the third-party application

Immediately create an exception

Investigate the event to verify whether or not the application is safe

Questions # 4:

Refer to the exhibits.

Question # 4

The exhibits show application policy logs and application details Collector C8092231196 is a member of the Finance group

What must an administrator do to block the FileZilia application?

Options:

Deny application in Finance policy

Assign Finance policy to DBA group

Assign Finance policy to Default Collector Group

Assign Simulation Communication Control Policy to DBA group

Questions # 5:

Refer to the exhibits.

Question # 5

The exhibits show the collector state and active connections. The collector is unable to connect to aggregator IP address 10.160.6.100 using default port.

Based on the netstat command output what must you do to resolve the connectivity issue?

Options:

Reinstall collector agent and use port 443

Reinstall collector agent and use port 8081

Reinstall collector agent and use port 555

Reinstall collector agent and use port 6514

Questions # 6:

Exhibit.

Question # 6

Based on the forensics data shown in the exhibit, which two statements are true? (Choose two.)

Options:

An exception has been created for this event

The forensics data is displayed m the stacks view

The device has been isolated

The exfiltration prevention policy has blocked this event

Questions # 7:

Which threat hunting profile is the most resource intensive?

Options:

Comprehensive

Inventory

Default

Standard Collection

Questions # 8:

Refer to the exhibit.

Question # 8

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

Options:

The NGAV policy has blocked TestApplication exe

TestApplication exe is sophisticated malware

The user was able to launch TestApplication exe

FCS classified the event as malicious

Questions # 9:

What is true about classifications assigned by Fortinet Cloud Sen/ice (FCS)?

Options:

The core is responsible for all classifications if FCS playbooks are disabled

The core only assigns a classification if FCS is not available

FCS revises the classification of the core based on its database

FCS is responsible for all classifications

Viewing page 1 out of 1 pages

Viewing questions 1-10 out of questions

Weekend Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple70

Pass the Fortinet NSE 5 Network Security Analyst NSE5_EDR-5.0 Questions and answers with ExamsMirror

Exam NSE5_EDR-5.0 Premium Access

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

TOP CODES