FORTIEDR

What is the purpose of the Threat Hunting feature?

• Delete any file from any collector in the organization

• Find and delete all instances of a known malicious file or hash in the organization

• Identify all instances of a known malicious file or hash and notify affected users

• Execute playbooks to isolate affected collectors in the organization

A FortiEDR security event is causing a performance issue with a third-parry application. What must you do first about the event?

• Contact Fortinet support

• Terminate the process and uninstall the third-party application

• Immediately create an exception

• Investigate the event to verify whether or not the application is safe

Which two types of remote authentication does the FortiEDR management console support?(Choose two.)

• Radius

• SAML

• TACACS

• LDAP

How does FortiEDR implement post-infection protection?

• By preventing data exfiltration or encryption even after a breach occurs

•   By using methods used by traditional EDR

• By insurance against ransomware

• By real-time filtering to prevent malware from executing

What is the benefit of using file hash along with the file name in a threat hunting repository search?

• It helps to make sure the hash is really a malware

• It helps to check the malware even if the malware variant uses a different file name

• It helps to find if some instances of the hash are actually associated with a different file

• It helps locate a file as threat hunting only allows hash search

An administrator needs to restrict access to the ADMINISTRATION tab in the central manager for a specific account. What role should the administrator assign to this account?

• ADMIN

• USER

• LOCAL ADMIN

• REST API

Which connectors can you use for the FortiEDR automated incident response? (Choose two.)

• FortiNAC

• FortiGate

• FortiSiem

• FortiSandbox

What is true about classifications assigned by Fortinet Cloud Service(FCS)?

• The core is responsible for all classifications if FCS playbooks are disabled

• The core only assigns a classification if FCS is not available

• FCS revises the classification of the core based on its database

• FCS is responsible for all classifications

A company requires a global communication policy for a FortiEDR multi-tenant environment. How can the administrator achieve this?

• An administrator creates a new communication control policy and shares it with other organizations

• A local administrator creates new a communication control policy and shares it with other organizations

• A local administrator creates a new communication control policy and assigns it globally to all organizations

• An administrator creates a new communication control policy for each organization

Which two statements are true about the remediation function in the threat hunting module? (Choose two.)

• The file is removed from the affected collectors

• The threat hunting module sends the user a notification to delete the file

• The file is quarantined

• The threat hunting module deletes files from collectors that are currently online.