Fortinet NSE5_EDR-5.0 Practice Verified Answers - Pass Your Exams For Sure! [2023]
Valid Way To Pass NSE 5 Network Security Analyst's NSE5_EDR-5.0 Exam
Fortinet NSE5_EDR-5.0 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION 11
Which two statements are true about the remediation function in the threat hunting module? (Choose two.)
- A. The file is removed from the affected collectors
- B. The file is quarantined
- C. The threat hunting module sends the user a notification to delete the file
- D. The threat hunting module deletes files from collectors that are currently online.
Answer: B,C
NEW QUESTION 12
A FortiEDR security event is causing a performance issue with a third-parry application. What must you do first about the event?
- A. Contact Fortinet support
- B. Immediately create an exception
- C. Terminate the process and uninstall the third-party application
- D. Investigate the event to verify whether or not the application is safe
Answer: B
NEW QUESTION 13
What is the purpose of the Threat Hunting feature?
- A. Delete any file from any collector in the organization
- B. Identify all instances of a known malicious file or hash and notify affected users
- C. Execute playbooks to isolate affected collectors in the organization
- D. Find and delete all instances ofa known malicious file or hash inthe organization
Answer: B
NEW QUESTION 14
Which security policy has all of its rules disabled by default?
- A. Execution Prevention
- B. Exfiltration Prevention
- C. Device Control
- D. Ransomware Prevention
Answer: D
NEW QUESTION 15
Which two types of remote authentication does the FortiEDR management console support? (Choose two.)
- A. LDAP
- B. TACACS
- C. Radius
- D. SAML
Answer: A,C
NEW QUESTION 16
Which two statements about the FortiEDR solution are true? (Choose two.)
- A. It provides pant-to-point protection
- B. It is Windows OS only
- C. It provides central management
- D. It provides pre-infection and post-infection protection
Answer: A,D
NEW QUESTION 17
Refer to the exhibit.
Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)
- A. TestApplication exe is sophisticated malware
- B. FCS classified the event as malicious
- C. The NGAV policy has blocked TestApplication exe
- D. The user was able to launch TestApplication exe
Answer: A,C
NEW QUESTION 18
FortiXDR relies on which feature as part of its automated extended response?
- A. Playbooks
- B. Security Policies
- C. Forensic
- D. Communication Control
Answer: B
NEW QUESTION 19
Exhibit.
Based on the event shown in the exhibit which two statements about the event are true? (Choose two.)
- A. The event has been blocked
- B. The policy is in simulation mode
- C. The device is moved to isolation.
- D. Playbooks is configured for this event.
Answer: B,D
NEW QUESTION 20
Refer to the exhibit.
Based on the FortiEDR status output shown in the exhibit, which two statements about the FortiEDR collector are true? (Choose two.)
- A. The collector has been installed with an incorrect port number
- B. The collector device has windows firewall enabled
- C. The collector has been installed with an incorrect registration password
- D. The collector device cannot reach the central manager
Answer: A,D
NEW QUESTION 21
What is the benefit of using file hash along with the file name in a threat hunting repository search?
- A. It helps to check the malware even if the malware variant uses a different file name
- B. It helps locate a file as threat hunting only allows hash search
- C. It helps to find if some instances of the hash are actually associated with a different file
- D. It helps to make sure the hash is really a malware
Answer: C
NEW QUESTION 22
The FortiEDR axe classified an event as inconclusive, out a few seconds later FCS revised the classification to malicious. What playbook actions ate applied to the event?
- A. Playbook actions applied to suspicious events
- B. Playbook actions applied to handled events
- C. Playbook actions applied to malicious events
- D. Playbook actions applied to inconclusive events
Answer: C
NEW QUESTION 23
......
Fortinet NSE5_EDR-5.0 Pre-Exam Practice Tests | VCEDumps: https://testinsides.vcedumps.com/NSE5_EDR-5.0-examcollection.html
