Fortinet NSE5_EDR-5.0 Exam Questions Instant Access

Question 1

An administrator needs to restrict access to the ADMINISTRATION tab in the central manager for a specific account.

What role should the administrator assign to this account?

AAdmin

BUser

CLocal Admin

DREST API

Answer : C

Question 2

Exhibit.

Based on the forensics data shown in the exhibit, which two statements are true? (Choose two.)

AAn exception has been created for this event

BThe forensics data is displayed m the stacks view

CThe device has been isolated

DThe exfiltration prevention policy has blocked this event

Answer : C, D

Question 3

An administrator finds a third party free software on a user's computer mat does not appear in me application list in the communication control console

Which two statements are true about this situation? (Choose two)

AThe application is allowed in all communication control policies

BThe application is ignored as the reputation score is acceptable by the security policy

CThe application has not made any connection attempts

DThe application is blocked by the security policies

Answer : A, D

Question 4

Refer to the exhibits.

The exhibits show the collector state and active connections. The collector is unable to connect to aggregator IP address 10.160.6.100 using default port.

Based on the netstat command output what must you do to resolve the connectivity issue?

AReinstall collector agent and use port 443

BReinstall collector agent and use port 8081

CReinstall collector agent and use port 555

DReinstall collector agent and use port 6514

Answer : B

Question 5

What is the benefit of using file hash along with the file name in a threat hunting repository search?

AIt helps to make sure the hash is really a malware

BIt helps to check the malware even if the malware variant uses a different file name

CIt helps to find if some instances of the hash are actually associated with a different file

DIt helps locate a file as threat hunting only allows hash search

Answer : C

Question 6

Refer to the exhibit.

Based on the threat hunting query shown in the exhibit which of the following is true?

ARDP connections will be blocked and classified as suspicious

BA security event will be triggered when the device attempts a RDP connection

CThis query is included in other organizations

DThe query will only check for network category

Answer : B

Question 7

Which connectors can you use for the FortiEDR automated incident response? (Choose two.)

AFortiNAC

BFortiGate

CFortiSiem

DFortiSandbox

Answer : B, C

Fortinet NSE 5 - FortiEDR 5.0 NSE5_EDR-5.0 Exam Questions