[Sep 29, 2023] Get Unlimited Access to NSE5_EDR-5.0 Certification Exam Cert Guide [Q10-Q28]

29 Sep, 2023 By admin NSE5_EDR-5.0, Fortinet 0 Comments

[Sep 29, 2023] Get Unlimited Access to NSE5_EDR-5.0 Certification Exam Cert Guide [Q10-Q28]

Rate this post

[Sep 29, 2023] Get Unlimited Access to NSE5_EDR-5.0 Certification Exam Cert Guide

Reliable Study Materials for NSE5_EDR-5.0 Exam Success For Sure

NO.10 An administrator needs to restrict access to the ADMINISTRATION tab inthe central manager for a specific account.
What role should the administrator assign to this account?

Admin

User

Local Admin

REST API

NO.11 Refer to the exhibit.

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

The NGAV policy has blocked TestApplication exe

TestApplication exe is sophisticated malware

The user was able to launch TestApplication exe

FCS classified the event as malicious

NO.12 Which two statements about the FortiEDR solution are true? (Choose two.)

It provides pre-infection and post-infection protection

It is Windows OS only

It provides central management

It provides pant-to-point protection

NO.13 A company requires a global communication policy for a FortiEDR multi-tenant environment.
How can the administrator achieve this?

An administrator creates a new communication control policy and shares it with other organizations

A local administrator creates new a communication control policy and shares it with other organizations

A local administrator creates a new communication control policy and assigns it globally to all organizations

An administrator creates a new communication control policy for each organization

NO.14 Refer to the exhibits.

The exhibits show application policy logs and application details Collector C8092231196 is a member of the Finance group What must an administrator do to block the FileZilia application?

Deny application in Finance policy

Assign Finance policy to DBA group

Assign Finance policy to Default Collector Group

Assign Simulation Communication Control Policy to DBA group

NO.15 Which FortiEDR component is required to find malicious files on the entire network of an organization?

FortiEDR Aggregator

FortiEDR Central Manager

FortiEDR Threat Hunting Repository

FortiEDR Core

NO.16 Exhibit.

Based on the event shown in the exhibit which two statements about the event are true? (Choose two.)

The device is moved to isolation.

Playbooks is configured for this event.

The event has been blocked

The policy is in simulation mode

NO.17 Exhibit.

Based on the forensics data shown in the exhibit which two statements are true? (Choose two.)

The device cannot be remediated

The event was blocked because the certificate is unsigned

Device C8092231196 has been isolated

The execution prevention policy has blocked this event.

NO.18 Refer to the exhibit.

Based on the event exception shown in the exhibit which two statements about the exception are true? (Choose two)

A partial exception is applied to this event

FCS playbooks is enabled by Fortinet support

The exception is applied only on device C8092231196

The system owner can modify the trigger rules parameters

NO.19 What is the purpose of the Threat Hunting feature?

Delete any file from any collector in the organization

Find and delete all instances ofa known malicious file or hash inthe organization

Identify all instances of a known malicious file or hash and notify affected users

Execute playbooks to isolate affected collectors in the organization

NO.20 Exhibit.

Based on the forensics data shown in the exhibit, which two statements are true? (Choose two.)

An exception has been created for this event

The forensics data is displayed m the stacks view

The device has been isolated

The exfiltration prevention policy has blocked this event

NO.21 Refer to the exhibits.

The exhibits show the collector state and active connections. The collector is unable to connect to aggregator IP address 10.160.6.100 using default port.
Based on the netstat command output what must you do to resolve the connectivity issue?