Fortinet NSE6_EDR_AD-7.0 Exam Syllabus Topics:
| Section | Objectives |
|---|---|
| Topic 1: FortiEDR Architecture and Components | - FortiEDR components overview (agents, management console, collectors) - System architecture and deployment models |
| Topic 2: Policy Configuration and Management | - Prevention and detection policies - Policy tuning and exclusions |
| Topic 3: Forensics and Investigation | - Endpoint investigation workflows - Event analysis and telemetry review |
| Topic 4: Installation and Deployment | - Agent deployment and onboarding - Server and console installation requirements |
| Topic 5: System Administration and Troubleshooting | - Troubleshooting common FortiEDR issues - System monitoring and health checks |
| Topic 6: Threat Detection and Response | - Incident detection and alert handling - Automated response actions and remediation |
Fortinet NSE 6 - FortiEDR 7.0 Administrator Sample Questions:
1. Refer to the exhibit.
Based on the exhibit, which statement about this threat hunting query is true? (Choose one answer)
A) A security incident will be generated whenever the device attempts an RDP connection.
B) RDP connections will be automatically blocked and classified as suspicious.
C) The query is configured as a global hunting rule and is automatically visible across all organizations.
D) The query is limited to detecting network activity and does not inspect process behavior.
2. What specific action does FortiEDR take when the Zero Trust Device Tagging playbook is activated?
(Choose one answer)
A) It assigns a default tag to all endpoints.
B) It disables the endpoint until a tag is assigned.
C) It removes unmanaged endpoints from FortiClient EMS.
D) It updates FortiClient EMS through an API and assigns a classification fabric tag.
3. Refer to the Exhibit:
A FortiEDR analyst is prioritizing response efforts. One application has a vulnerability score of Critical but an Unknown ACI rating, while another has a Medium vulnerability score with active ACI evidence of adversary targeting. Which application must be addressed first? (Choose one answer)
A) Both applications should be treated equally because patching is necessary.
B) The decision depends only on asset criticality, not scores.
C) The application with the Medium vulnerability score and ACI evidence should be addressed first.
D) The application with the Critical vulnerability score should be addressed first.
4. An employee leaves the company and no longer has access to the FortiEDR system. You must ensure GDPR compliance regarding the employee's personal data stored in FortiEDR. Which two data types must be removed to meet GDPR requirements? (Choose two answers)
A) Installed applications
B) IP address and MAC address
C) Device and user name
D) Installed OS name
Solutions:
| Question # 1 Answer: A | Question # 2 Answer: D | Question # 3 Answer: C | Question # 4 Answer: B,C |
713 Customer Reviews
Quality and ValueITCertKing Practice Exams are written to the highest standards of technical accuracy, using only certified subject matter experts and published authors for development - no all study materials.
Tested and ApprovedWe are committed to the process of vendor and third party approvals. We believe professionals and executives alike deserve the confidence of quality coverage these authorizations provide.
Easy to PassIf you prepare for the exams using our ITCertKing testing engine, It is easy to succeed for all certifications in the first attempt. You don't have to deal with all dumps or any free torrent / rapidshare all stuff.
Try Before BuyITCertKing offers free demo of each product. You can check out the interface, question quality and usability of our practice exams before you decide to buy.
