EDR example

What is true about classifications assigned by Fortinet Cloud Service (FCS)?

• FCS revises the classification of the core based on its database.

• The core only assigns a classification if FCS is not available.

• FCS is responsible for all classifications.

• The core is responsible for all classifications if FCS playbooks are disabled.

Based on the forensics data shown in the exhibit, which two statements are true? (Choose two.)

• The device cannot be remediated.

• The execution prevention policy has blocked this event.

• The event was blocked because the certificate is unsigned.

• Device C8092231196 has been isolated.

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

• The NGAV policy has blocked TestApplication.exe.

• FCS classified the event as malicious.

• TestApplication.exe is sophisticated malware.

• The user was able to launch TestApplication.exe.

How does FortiEDR implement post-infection protection?

• By insurance against ransomware

• By preventing data exfiltration or encryption even after a breach occurs

• By real-time filtering to prevent malware from executing

• By using methods used by traditional EDR

Which scripting language is supported by the FortiEDR action manager?

• TCL

• Bash

• Perl

• Python

Which security policy has all of its rules disabled by default?

• Exfiltration Prevention

• Execution Prevention

• Device Control

• Ransomware Prevention

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

• The policy is in simulation mode.

• The device is moved to isolation.

• The event has been blocked.

• Playbooks is configured for this event.

Which connectors can you use for the FortiEDR automated incident response? (Choose two.)

• FortiSandbox

• FortiSiem

• FortiNAC

• FortiGate

Which FortiEDR component is required to find malicious files on the entire network of an organization?

• FortiEDR Aggregator

• FortiEDR Threat Hunting Repository

• FortiEDR Central Manager

• FortiEDR Core

Which threat hunting profile is the most resource intensive?

• Inventory

• Comprehensive

• Standard Collection

• Default