Verified & Latest NSE6_EDR_AD-7.0 Dump Q&As with Correct Answers [Q17-Q37]

Verified & Latest NSE6_EDR_AD-7.0 Dump Q&As with Correct Answers

Latest NSE6_EDR_AD-7.0 dumps - Instant Download PDF

NEW QUESTION # 17
Refer to the exhibits.

You are attempting to move a collector into the High Security Collector Group for isolation but encounter an error in the API request as shown in the exhibit. To successfully isolate the collector, which API parameter must you correct? (Choose one answer)

• A. Set the target collector group parameter to Engineering group.
• B. Change the HTTP method in the request from PUT to POST.
• C. Update the authorization credentials in the API header.
• D. Set the organization parameter to Default.

Answer: D

Explanation:
The correct answer is A. Set the organization parameter to Default .
From the first exhibit, the API query result for the Collector shows:
* Collector name: Desktop-PC
* Collector group name: Engineering
* Organization: Default
* State: Running
But in the second exhibit, the API request is using:
* organization = Fortinet-Training
* collectors = Desktop-PC
* targetCollectorGroup = High Security Collector Group
That organization value is wrong. The Collector belongs to the Default organization, so the API request must reference the Collector's actual organization. Otherwise FortiEDR cannot locate or move that Collector under the organization specified in the request.
The FortiEDR guide confirms that Collector Groups are used to assign different FortiEDR policies to different Collectors, and that Collectors can be moved between groups/organizations in the Inventory workflow. In Hoster view, FortiEDR shows Collectors from all organizations and allows moving Collectors between organizations, but the organization context must match the Collector being managed.
Option B is wrong because the exhibit shows the API request is authorized; the failure is a 400 Bad Request , not an authentication failure. Option C is wrong because the endpoint shown is already a move/update operation using PUT, and the issue is not the HTTP method. Option D is wrong because Engineering is the current Collector Group. The goal is to move the Collector to High Security Collector Group , so changing the target back to Engineering would not isolate or harden the Collector.
=========

NEW QUESTION # 18
Refer to the exhibit.

What observation can you make about the ConnectivityTestAppNew.exe incident? (Choose one answer)

• A. The incident has not been handled by a console administrator.
• B. A rule assigned action is set to block but the policy is in simulation mode.
• C. The incident was handled automatically by the communication control policy.
• D. The incident was archived from the console unhandled.

Answer: A

Explanation:
The correct answer is B .
In the exhibit, the incident status clearly shows Unhandled at the incident level and also on the event rows.
The FortiEDR guide explains that every detected security event is initially marked as unread and unhandled
, and these statuses help multiple FortiEDR Central Manager users track whether anyone has read and handled the message.
The guide also states that when a FortiEDR Central Manager user marks a security event as Handled , all users see it as handled. The process is performed by selecting the event and clicking Handle Incident or the flag icon, then saving the incident handling details.
So the valid observation from the exhibit is that the incident has not been handled by a console administrator .
Option A is not supported by the exhibit. There is no visible evidence that the policy is in Simulation mode.
Option C is wrong because the incident is still visible, not archived or deleted. Option D is wrong because the status is explicitly Unhandled ; it was not handled automatically by a Communication Control policy.
=========

NEW QUESTION # 19
You are asked to configure a query to run every 15 minutes, automatically searching for specific registry modifications across all endpoints. Which FortiEDR feature must you configure? (Choose one answer)

• A. A manual query linked to a policy override
• B. A scheduled query defined within a threat hunting profile
• C. A new playbook trigger based on the registry change event
• D. A communication control rule with a 15-minute delay

Answer: B

Explanation:
The correct answer is C.
The FortiEDR guide explains that Threat Hunting searches across endpoint activity events, including registry activity. It states that Threat Hunting can search based on attributes of files, registry keys and values, network, processes, event log, and activity event types. This fits the requirement to search for specific registry modifications across endpoints.
The guide also explains that after filtering activity events, the query can be saved and defined as a Scheduled Query. It says: "Scheduled Query: Mark this option to automate the process of detecting threats so that this query is run automatically according to the schedule that you define." It also states that a security event is automatically created in the Incidents tab when matches are detected, and notifications can be sent through email, Syslog, and other configured methods.
The guide further states that the Repeat Every/On options define the frequency and schedule when the query runs. Therefore, a 15-minute recurring query is handled through the Scheduled Query capability in Threat Hunting, not Communication Control, policy override, or a manual Playbook trigger.
Strictly speaking, the guide calls this a scheduled query under Threat Hunting saved queries, not a
"communication control rule" or "manual query." Option C is the intended answer.
=========

NEW QUESTION # 20
Refer to the exhibit.

Based on the exhibit, which statement about this threat hunting query is true? (Choose one answer)

• A. The query is limited to detecting network activity and does not inspect process behavior.
• B. The query is configured as a global hunting rule and is automatically visible across all organizations.
• C. RDP connections will be automatically blocked and classified as suspicious.
• D. A security incident will be generated whenever the device attempts an RDP connection.

Answer: D

Explanation:
The correct answer is A .
The exhibit shows a FortiEDR Threat Hunting saved query using RemotePort:3389, scoped to a specific device, with Scheduled Query enabled, classification set to Suspicious , and a repeat interval of 15 minutes .
TCP port 3389 is the standard RDP port, so the query is designed to detect RDP-related network activity for the selected endpoint.
The FortiEDR guide states that saving a Threat Hunting query can define it as a scheduled query to automate threat detection. It further states that when a scheduled query runs and detects matches, a security event is automatically created in the Incidents tab , and notifications are sent according to the security event configuration.
Option B is too absolute and therefore wrong. The specific query shown uses a network field, but Threat Hunting itself can search activity events across files, registry, network, processes, and event logs. Option C is wrong because the Community Query checkbox is not selected, so it is not configured as a shared community
/global query. The guide states that Community Query must be selected to share the query with the FortiEDR community, including other organizations.
Option D is wrong because a scheduled Threat Hunting query generates an incident; it does not automatically block RDP unless additional playbook actions are configured. The guide says scheduled queries generate security events and may trigger configured playbook actions, but the query itself is not a blocking control.
=========

NEW QUESTION # 21
A company requires a global communication policy for a FortiEDR multi-tenant environment. Which recommendation must you make? (Choose one answer)

• A. Create a separate communication control policy for each organization.
• B. Create a new communication control policy and delegate it to other organizations.
• C. Create a new communication control policy and apply it to multiple organizations.
• D. Create a new communication control policy and assign it globally to all organizations.

Answer: A

NEW QUESTION # 22
Refer to the Exhibit:

Based on the incident details shown in the exhibit, which two statements about this incident are true? (Choose two answers)

• A. The destination IP address is blocked by FortiGate.
• B. The incident has already been fully handled.
• C. The incident occurred on only one device.
• D. The incident is classified by the FortiEDR Core.

Answer: A,D

Explanation:
The correct answers are A and C .
The exhibit shows an audit/response action stating that IP address 74.125.235.20 was added to malicious IP addresses on firewall FortiGate . This matches the FortiEDR playbook action Block address on Firewall .
The guide states that this action ensures connections to remote malicious addresses associated with the security event are blocked, and that a firewall connector must already be configured for this action. It also explains that a checkmark in a classification column means communication with the affected destination is automatically blocked when a security event with that classification is triggered.
Option C is the second best answer because FortiEDR events are initially classified by FortiEDR detection logic/Core, and the guide states that classifications are initially determined by the Core but can later be changed automatically by FortiEDR Cloud Service or manually. The exhibit shows "Classification Changed To: Suspicious (By Fortinet)" , but it does not say the event was manually classified by an administrator. So the event classification process is FortiEDR-driven, with later Fortinet/FCS-style automatic classification possible.
Option B is wrong. The exhibit shows one raw-data row with device cwinserv-32 +2 , which indicates more than one affected device/raw item is represented in the aggregation. So it did not occur on only one device.
Option D is wrong because the incident rows clearly show Unhandled . The guide states that security events are initially marked as unread and unhandled, and the unread/unhandled status helps users track whether anyone has read and handled the event.
=========

NEW QUESTION # 23
You are asked to create a playbook to isolate a device with a collector. Which action category does isolating a device with a collector fall under? (Choose one answer)

• A. Custom
• B. Notifications
• C. Investigation
• D. Remediation

Answer: C

Explanation:
The correct answer is A. Investigation .
The FortiEDR 7.0.0 Administration Guide states that Investigation actions enable administrators to isolate a device or assign it to a high-security Collector Group for further investigation of the device's activity. Under the Investigation section, the guide lists the available investigation action types, including "Isolate device with Collector," "Isolate device with NAC," and "Move device to High Security Group." For Isolate device with Collector , the guide explains that the action blocks communication to and from the affected Collector, and it applies only to endpoint Collectors. If the Playbook policy is configured to isolate a device for a malicious event, then when a malicious security event is triggered, the device is isolated from communicating with the outside world for both sending and receiving.
So, this is not a Remediation , Custom , or Notification action. In FortiEDR Playbook policy terminology, Isolate device with Collector belongs under Investigation .
=========

NEW QUESTION # 24
Refer to the exhibits.

What happens when the net user command runs on an endpoint? (Choose one answer)

• A. It triggers FortiEDR rules because the activity is not suspicious.
• B. It triggers an immediate endpoint alert.
• C. It triggers an incident when the query matches the target process (net.exe).
• D. It blocks CLI commands by default.

Answer: C

Explanation:
The correct answer is C .
The exhibit shows a Threat Hunting saved query named CLI Command with the query:
Target.Process.Filename ( " net.exe " )
It is configured as a Scheduled Query , classified as Suspicious , and set to repeat every 15 minutes . The FortiEDR guide states that saving a Threat Hunting query allows it to be defined as a scheduled query to automate threat detection. When the scheduled query runs and detects matching activity, a security event is automatically created in the Incidents tab .
The guide also states that scheduled queries run automatically according to the configured schedule, and each time a match is detected, FortiEDR generates a security event in the Incidents tab and sends notifications according to the security event configuration.
So, when the endpoint runs:
net user edruser password! /ADD
FortiEDR records the relevant process activity, and when the scheduled query runs, it matches the target process net.exe and creates an incident/security event. It is not immediate by default because the query is scheduled every 15 minutes. It also does not block CLI commands by default unless playbook actions or policy controls are configured. The activity is treated according to the saved query classification, which in the exhibit is Suspicious .
=========

NEW QUESTION # 25
An employee leaves the company and no longer has access to the FortiEDR system. You must ensure GDPR compliance regarding the employee's personal data stored in FortiEDR. Which two data types must be removed to meet GDPR requirements? (Choose two answers)

• A. IP address and MAC address
• B. Installed OS name
• C. Device and user name
• D. Installed applications

Answer: A,C

Explanation:
The correct answers are A. Device and user name and D. IP address and MAC address .
The FortiEDR 7.0.0 Administration Guide states that the GDPR feature is implemented in Administration > Settings > Personal Data Handling . It is used to remove relevant data for an employee or FortiEDR user who no longer has access to or uses the FortiEDR system. The guide explicitly identifies the personal data as device name, IP address, MAC address, and user name . It further states: "You must remove all device name, IP address, MAC address, and user name data from FortiEDR in order to fully comply with the GDPR standard." Therefore, installed applications and installed OS name are not the required GDPR personal data types in this FortiEDR procedure. The required removal is performed iteratively for the employee's/user's device name , IP address , MAC address , and user name . The guide also instructs administrators to continue removing the other required data: IP address, MAC address, and user name , and to delete any reports that may contain the user's data.

NEW QUESTION # 26
A company requires a global communication policy for a FortiEDR multi-tenant environment. Which recommendation must you make? (Choose one answer)

• A. Create a separate communication control policy for each organization.
• B. Create a new communication control policy and delegate it to other organizations.
• C. Create a new communication control policy and apply it to multiple organizations.
• D. Create a new communication control policy and assign it globally to all organizations.

Answer: A

Explanation:
The correct answer is A. Create a separate communication control policy for each organization .
The key point is that Communication Control is not available in Hoster view . In a FortiEDR multi-tenant environment, Hoster view is the view used to display information for all organizations together. However, the guide clearly states under the Hoster view section: "Communication Control - The Communication Control window is not available in Hoster view." That means you cannot create one global Communication Control policy from Hoster view and assign it across all organizations. Options B , C , and D all assume cross-organization/global Communication Control policy assignment, but the guide does not support that capability. The practical recommendation is to configure Communication Control policies separately inside each organization.
The guide contrasts this with Security Policies, where in Hoster view the Security Policies page displays all policies from all organizations and supports cloning a security policy from one organization to another. That statement is for Security Policies , not Communication Control policies.
=========

NEW QUESTION # 27
Refer to the exhibit.

Based on the exhibit, which two observations are true? (Choose two answers)

• A. FCS has classified this as malicious.
• B. This incident has been resolved.
• C. EDR has never encountered this malware before.
• D. FortiEDR has classified this as suspicious.

Answer: A,C

Explanation:
The correct answers are C and D .
The exhibit shows the incident classification as Malicious . In the Activity Audit, the entry from FortinetCloudServices states: "Classification change: Malicious" and also says the file is classified as malicious. This directly proves that FCS classified the event as malicious . The FortiEDR guide explains that the audit history shows the chronology for classifying the security event and displays details when FortiEDR Cloud Service (FCS) reclassifies a security event after its initial classification by the Core.
The exhibit also states that the file was "Detected as Unknown malware." This supports option D in the exam wording: FortiEDR/FCS has classified the file as malicious, but it is being identified as unknown malware , meaning it was not recognized as a known malware family/signature at the time of classification.
The guide explains that FCS enhances classification using data enrichment, automated and manual analysis, file analysis, sandboxing, machine learning flow analysis, commonality analysis, crowdsourced data deduction, and other methods, so "unknown malware" can still be classified malicious by FCS.
Option A is wrong because the exhibit shows Malicious , not Suspicious. Option B is wrong because the incident status is Unhandled , not resolved or handled.
=========

NEW QUESTION # 28
Refer to the exhibit:

You are asked to block applications based on hash attributes. Which two factors must you consider when applying the hash value? (Choose two answers)

• A. Hashes must be used with at least one attribute, such as a filename or path.
• B. Hashes must be line-separated.
• C. Hashes must follow supported formats.
• D. Hashes must be unique to each application.

Answer: B,C

Explanation:
The FortiEDR 7.0.0 Administration Guide states that when manually adding applications to be blocked, you can define the application using Hash or using any combination of File Name / Path / Signer attributes. This means hashes can be used independently and do not require filename, path, or signer attributes.
The guide also states that each hash is a unique identifier of an individual application, and the exhibit itself shows the hash field note: "SHA-1 or SHA-2 or MD5." Therefore, the hash must use a supported hash format, making D correct.
For multiple hash entries, the uploaded guide text says they must be comma separated , while the exhibit note says "You can enter multiple hashes comma separated." So the technically exact guide wording supports comma separation, not line separation. However, given your answer choices, A is clearly trying to test the requirement that multiple hashes must be separated correctly. The option wording says "line- separated," which is not exact against the guide; the better wording would be comma-separated . Since no
"comma-separated" option is provided, A is the intended separation-related answer, but the wording is flawed.
Option B is definitely wrong because hash mode is an alternative to attributes. Option C is also not the best answer because, although each hash uniquely identifies a file/application variant, the operational requirement is not that "hashes must be unique to each application" in the way the option implies. Hashes may represent different variants of the same application.

NEW QUESTION # 29
Refer to Exhibit.

Based on the Postman output shown in the exhibit, why is the user receiving an unauthorized error? (Choose one answer)

• A. API access is disabled on the central manager.
• B. The central manager is rejecting the request because of an unsupported HTTP method.
• C. FortiEDR requires a password reset the first time a user logs in.
• D. The user account does not have the REST API role assigned.

Answer: D

Explanation:
The correct answer is C. The user account does not have the REST API role assigned .
The exhibit shows a Postman request to the FortiEDR Central Manager REST endpoint:
/management-rest/inventory/list-collectors
The response is 401 Unauthorized , which means the request reached the FortiEDR API endpoint but the supplied user credentials are not authorized for REST API access.
The FortiEDR 7.0.0 Administration Guide states that when adding or editing a user, the Rest API advanced option controls whether the user is allowed to access the FortiEDR Central Manager through API calls. The guide defines this option as: "Rest API - Specifies whether to allow the user to access the FortiEDR Central Manager through API calls." Therefore, the most accurate cause is that the account being used in Postman does not have the Rest API permission enabled.
Option A is incorrect because the request uses GET against a list endpoint, and an unsupported method would not normally be represented by this user-authentication failure. Option B is not supported by the exhibit or guide wording; the guide describes enabling REST API access per user. Option D is incorrect because first- login password reset is not the direct cause of this REST API authorization failure. The guide separately discusses password reset and password policy behavior, but that is not what the API error indicates.

NEW QUESTION # 30
A playbook is configured with two actions: terminate process and isolate device. The terminate process action fails because the process is protected by Windows. What is the expected behavior for the second action, isolate device? (Choose one answer)

• A. The playbook generates a notification email and execution stops.
• B. The playbook execution stops because the action fails.
• C. The playbook execution pauses and requires administrator intervention.
• D. The playbook continues and executes the second action.

Answer: D

Explanation:
The correct answer is D .
The FortiEDR guide confirms that Playbook actions are automatic incident response actions configured under Security Settings > Playbooks and applied based on security event classification. It also confirms that actions such as Terminate Process and device isolation actions can be configured as playbook responses. For scheduled-query-triggered events, the guide states that FortiEDR can automatically apply the Playbook action assigned to the Collector Group that the triggering device belongs to.
For isolation, the guide shows that isolation actions such as Isolate device with NAC are configured under the Investigation section of Playbooks, and similar isolation actions are triggered automatically when selected for the relevant classification.
The uploaded guide does not provide a specific line saying "if terminate process fails, continue to the next action." Based on FortiEDR playbook behavior, configured actions are executed independently. A failure to terminate a protected Windows process does not automatically cancel the remaining playbook actions.
Therefore, the next configured action, isolate device , is still executed.
Options A , B , and C are wrong because the playbook does not pause for administrator intervention, does not stop merely because an email is generated, and does not cancel all remaining configured actions because one action failed.
=========

NEW QUESTION # 31
......

The Ultimate Fortinet NSE6_EDR_AD-7.0 Dumps PDF Review: https://actualtests.realvalidexam.com/NSE6_EDR_AD-7.0-real-exam-dumps.html