Free Fortinet NSE 5 – FortiEDR 5.0 Exam NSE5_EDR-5.0 Exam Practice Test

Which two statements about the FortiEDR solution are true? (Choose two.)

• It provides pre-infection and post-infection protection
• It is Windows OS only
• It provides central management
• It provides pant-to-point protection

A FortiEDR security event is causing a performance issue with a third-parry application. What must you do first about the event?

• Contact Fortinet support
• Terminate the process and uninstall the third-party application
• Immediately create an exception
• Investigate the event to verify whether or not the application is safe

What is true about classifications assigned by Fortinet Cloud Sen/ice (FCS)?

• The core is responsible for all classifications if FCS playbooks are disabled
• The core only assigns a classification if FCS is not available
• FCS revises the classification of the core based on its database
• FCS is responsible for all classifications

FortiXDR relies on which feature as part of its automated extended response?

• Playbooks
• Security Policies
• Forensic
• Communication Control

The FortiEDR axe classified an event as inconclusive, out a few seconds later FCS revised the classification to malicious. What playbook actions ate applied to the event?

• Playbook actions applied to inconclusive events
• Playbook actions applied to handled events
• Playbook actions applied to suspicious events
• Playbook actions applied to malicious events

How does FortiEDR implement post-infection protection?

• By preventing data exfiltration or encryption even after a breach occurs
• By using methods used by traditional EDR
• By insurance against ransomware
• By real-time filtering to prevent malware from executing

Which FortiEDR component is required to find malicious files on the entire network of an organization?

• FortiEDR Aggregator
• FortiEDR Central Manager
• FortiEDR Threat Hunting Repository
• FortiEDR Core

What is the purpose of the Threat Hunting feature?

• Delete any file from any collector in the organization
• Find and delete all instances of a known malicious file or hash in the organization
• Identify all instances of a known malicious file or hash and notify affected users
• Execute playbooks to isolate affected collectors in the organization

Which two types of remote authentication does the FortiEDR management console support? (Choose two.)

• Radius
• SAML
• TACACS
• LDAP

Which connectors can you use for the FortiEDR automated incident response? (Choose two.)

• FortiNAC
• FortiGate
• FortiSiem
• FortiSandbox