Fortinet NSE5_EDR-5.0 Exam Questions Instant Access

Question 1

What is the benefit of using file hash along with the file name in a threat hunting repository search?

AIt helps to make sure the hash is really a malware

BIt helps to check the malware even if the malware variant uses a different file name

CIt helps to find if some instances of the hash are actually associated with a different file

DIt helps locate a file as threat hunting only allows hash search

Answer : C

Question 2

An administrator needs to restrict access to the ADMINISTRATION tab in the central manager for a specific account.

What role should the administrator assign to this account?

AAdmin

BUser

CLocal Admin

DREST API

Answer : C

Question 3

Which two types of remote authentication does the FortiEDR management console support? (Choose two.)

ARadius

BSAML

CTACACS

DLDAP

Answer : A, D

Question 4

An administrator finds a third party free software on a user's computer mat does not appear in me application list in the communication control console

Which two statements are true about this situation? (Choose two)

AThe application is allowed in all communication control policies

BThe application is ignored as the reputation score is acceptable by the security policy

CThe application has not made any connection attempts

DThe application is blocked by the security policies

Answer : A, D

Question 5

How does FortiEDR implement post-infection protection?

ABy preventing data exfiltration or encryption even after a breach occurs

BBy using methods used by traditional EDR

CBy insurance against ransomware

DBy real-time filtering to prevent malware from executing

Answer : D

Question 6

Refer to the exhibit.

Based on the threat hunting query shown in the exhibit which of the following is true?

ARDP connections will be blocked and classified as suspicious

BA security event will be triggered when the device attempts a RDP connection

CThis query is included in other organizations

DThe query will only check for network category

Answer : B

Question 7

Which two statements are true about the remediation function in the threat hunting module? (Choose two.)

AThe file is removed from the affected collectors

BThe threat hunting module sends the user a notification to delete the file

CThe file is quarantined

DThe threat hunting module deletes files from collectors that are currently online.

Answer : B, C

Fortinet NSE 5 - FortiEDR 5.0 NSE5_EDR-5.0 Exam Questions