NSE5_EDR-5.0 Dumps - Kickstart your Career with Real Updated Questions
Earn Quick And Easy Success With NSE5_EDR-5.0 Dumps
Fortinet NSE5_EDR-5.0 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
NEW QUESTION 11
How does FortiEDR implement post-infection protection?
- A. By insurance against ransomware
- B. By real-time filtering to prevent malware from executing
- C. By using methods used by traditional EDR
- D. By preventing data exfiltration or encryption even after a breach occurs
Answer: B
NEW QUESTION 12
Exhibit.
Based on the forensics data shown in the exhibit which two statements are true? (Choose two.)
- A. The device cannot be remediated
- B. The event was blocked because the certificate is unsigned
- C. The execution prevention policy has blocked this event.
- D. Device C8092231196 has been isolated
Answer: B,D
NEW QUESTION 13
Which FortiEDR component is required to find malicious files on the entire network of an organization?
- A. FortiEDR Threat Hunting Repository
- B. FortiEDR Core
- C. FortiEDR Aggregator
- D. FortiEDR Central Manager
Answer: C
NEW QUESTION 14
FortiXDR relies on which feature as part of its automated extended response?
- A. Playbooks
- B. Security Policies
- C. Forensic
- D. Communication Control
Answer: B
NEW QUESTION 15
Which two statements are true about the remediation function in the threat hunting module? (Choose two.)
- A. The file is removed from the affected collectors
- B. The file is quarantined
- C. The threat hunting module sends the user a notification to delete the file
- D. The threat hunting module deletes files from collectors that are currently online.
Answer: B,C
NEW QUESTION 16
What is the role of a collector in the communication control policy?
- A. A collector can quarantine unsafe applications from communicating
- B. A collector blocks unsafe applications from running
- C. A collector is used to change the reputation score of any application that collector runs
- D. A collector records applications that communicate externally
Answer: B
NEW QUESTION 17
A company requires a global communication policy for a FortiEDR multi-tenant environment.
How can the administrator achieve this?
- A. An administrator creates a new communication control policy and shares it with other organizations
- B. A local administrator creates a new communication control policy and assigns it globally to all organizations
- C. A local administrator creates new a communication control policy and shares it with other organizations
- D. An administrator creates a new communication control policy for each organization
Answer: B
NEW QUESTION 18
Refer to the exhibit.
Based on the threat hunting query shown in the exhibit which of the following is true?
- A. RDP connections will be blocked and classified as suspicious
- B. This query is included in other organizations
- C. A security event will be triggered when the device attempts a RDP connection
- D. The query will only check for network category
Answer: C
NEW QUESTION 19
Which two types of remote authentication does the FortiEDR management console support? (Choose two.)
- A. LDAP
- B. TACACS
- C. Radius
- D. SAML
Answer: A,C
NEW QUESTION 20
Exhibit.
Based on the event shown in the exhibit which two statements about the event are true? (Choose two.)
- A. The event has been blocked
- B. The policy is in simulation mode
- C. The device is moved to isolation.
- D. Playbooks is configured for this event.
Answer: B,D
NEW QUESTION 21
A FortiEDR security event is causing a performance issue with a third-parry application. What must you do first about the event?
- A. Contact Fortinet support
- B. Immediately create an exception
- C. Terminate the process and uninstall the third-party application
- D. Investigate the event to verify whether or not the application is safe
Answer: B
NEW QUESTION 22
Refer to the exhibit.
Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)
- A. TestApplication exe is sophisticated malware
- B. FCS classified the event as malicious
- C. The NGAV policy has blocked TestApplication exe
- D. The user was able to launch TestApplication exe
Answer: A,C
NEW QUESTION 23
......
Free NSE5_EDR-5.0 pdf Files With Updated and Accurate Dumps Training: https://freecert.test4sure.com/NSE5_EDR-5.0-exam-materials.html