EXAM NSE5_EDR-5.0

Which two types of remote authentication does the FortiEDR management console support? (Choose two.)

• TACACS

• Radius

• LDAP

• SAML

Which two types of traffic are allowed while the device is in isolation mode? (Choose two.)

• HTTP sessions

• ICMP sessions

• Incoming RDP connections

• Outgoing SSH connections

Which FortiEDR component must have JumpBox functionality to connect with FortiAnalyzer?

• Collector

• Aggregator

• Core

• Central manager

Which two statements are true about the remediation function in the threat hunting module? (Choose two.)

• The file is quarantined.

• The file is removed from the affected collectors.

• The threat hunting module deletes files from collectors that are currently online.

• The threat hunting module sends the user a notification to delete the file.

Which FortiEDR component is required to find malicious files on the entire network of an organization?

• FortiEDR Core

• FortiEDR Central Manager

• FortiEDR Threat Hunting Repository

• FortiEDR Aggregator

A company requires a global communication policy for a FortiEDR multi-tenant environment.
How can the administrator achieve this?

• An administrator creates a new communication control policy and shares it with other organizations.

• • A local administrator creates a new communication control policy and shares it with other organizations.

• A local administrator creates a new communication control policy and assigns it globally to all organizations.

• An administrator creates a new communication control policy for each organization.

FortiXDR relies on which feature as part of its automated extended response?

• Security Policies

• Forensic

• Playbooks

• Communication Control

A company requires a global exception for a FortiEDR multi-tenant environment.

How can the administrator achieve this?

• The local administrator can create a new exception and share it with other organizations.

• A user account can create a new exception and share it with other organizations.

• The administrator can create a new exception and assign it globally to all organizations.

• The administrator can create a new exception policy for each organization hosted on FortiEDR.

An administrator needs to restrict access to the ADMINISTRATION tab in the central manager for a specific account.
What role should the administrator assign to this account?

• User

• Admin

• REST API

• Local Admin

What is the purpose of the Threat Hunting feature?

• Execute playbooks to isolate affected collectors in the organization

• Find and delete all instances of a known malicious file or hash in the organization

• Delete any file from any collector in the organization

• Identify all instances of a known malicious file or hash and notify affected users