Free Fortinet NSE 5 – FortiEDR 5.0 Exam NSE5_EDR-5.0 Exam Practice Test

A company requires a global communication policy for a FortiEDR multi-tenant environment.How can the administrator achieve this?

• An administrator creates a new communication control policy and shares it with other organizations
• A local administrator creates new a communication control policy and shares it with other organizations
• A local administrator creates a new communication control policy and assigns it globally to all organizations
• An administrator creates a new communication control policy for each organization

What is the benefit of using file hash along with the file name in a threat hunting repository search?

• It helps to make sure the hash is really a malware
• It helps to check the malware even if the malware variant uses a different file name
• It helps to find if some instances of the hash are actually associated with a different file
• It helps locate a file as threat hunting only allows hash search

An administrator needs to restrict access to the ADMINISTRATION tab in the central manager for a specific account.What role should the administrator assign to this account?

• Admin
• User
• Local Admin
• REST API

What is true about classifications assigned by Fortinet Cloud Sen/ice (FCS)?

• The core is responsible for all classifications if FCS playbooks are disabled
• The core only assigns a classification if FCS is not available
• FCS revises the classification of the core based on its database
• FCS is responsible for all classifications

Which security policy has all of its rules disabled by default?

• Device Control
• Ransomware Prevention
• Execution Prevention
• Exfiltration Prevention

Which FortiEDR component is required to find malicious files on the entire network of an organization?

• FortiEDR Aggregator
• FortiEDR Central Manager
• FortiEDR Threat Hunting Repository
• FortiEDR Core

What is the role of a collector in the communication control policy?

• A collector blocks unsafe applications from running
• A collector is used to change the reputation score of any application that collector runs
• A collector records applications that communicate externally
• A collector can quarantine unsafe applications from communicating

Which two statements about the FortiEDR solution are true? (Choose two.)

• It provides pre-infection and post-infection protection
• It is Windows OS only
• It provides central management
• It provides pant-to-point protection

Which two statements are true about the remediation function in the threat hunting module? (Choose two.)

• The file is removed from the affected collectors
• The threat hunting module sends the user a notification to delete the file
• The file is quarantined
• The threat hunting module deletes files from collectors that are currently online.

Which threat hunting profile is the most resource intensive?

• Comprehensive
• Inventory
• Default
• Standard Collection