Fortinet NSE6_EDR_AD-7.0 Dumps Questions Answers

The correct answer is C .

The exhibit shows a Threat Hunting saved query named CLI Command with the query:

Target.Process.Filename ( " net.exe " )

It is configured as a Scheduled Query , classified as Suspicious , and set to repeat every 15 minutes . The FortiEDR guide states that saving a Threat Hunting query allows it to be defined as a scheduled query to automate threat detection. When the scheduled query runs and detects matching activity, a security event is automatically created in the Incidents tab .

The guide also states that scheduled queries run automatically according to the configured schedule, and each time a match is detected, FortiEDR generates a security event in the Incidents tab and sends notifications according to the security event configuration.

So, when the endpoint runs:

net user edruser password! /ADD

FortiEDR records the relevant process activity, and when the scheduled query runs, it matches the target process net.exe and creates an incident/security event. It is not immediate by default because the query is scheduled every 15 minutes. It also does not block CLI commands by default unless playbook actions or policy controls are configured. The activity is treated according to the saved query classification, which in the exhibit is Suspicious .

=========

Add applications to the application control manager.

Assign collector groups to the policy.

Enable the blocklist rule on the application control policy.

“The applications must be added to the Application Control Manager under the user-defined group”

“Collector groups must be assigned to this policy”

“The blocklist rule must be enabled on the Application Control Policy.”

The correct sequence is to add applications to Application Control Manager, assign the relevant Collector Groups to the Application Control policy, and enable the blocklist rule. Application Control prevents designated executables from launching, whereas Communication Control regulates outbound application communication. FortiEDR automatically places manually added applications in its User-defined group, so creating a separate application group is unnecessary. Collector Groups receive policy assignments directly; application groups are not assigned to individual Collectors. Newly added applications are disabled by default and must also be enabled for blocking, unless the administrator has changed the default application state.

The correct answers are A and C .

For Fortinet Security Fabric correlation through FortiAnalyzer or FortiAnalyzer Cloud, the FortiEDR guide states that FortiEDR can integrate with FortiAnalyzer/FortiAnalyzer Cloud “to correlate data between FortiEDR and the Fortinet Security Fabric and issue eXtended detection alerts.” To complete this, you must configure an eXtended Detection Source connector and enable eXtended Detection rules and FortiEDR Threat Hunting event collection.

The prerequisites include connectivity from the FortiEDR Central Manager to Fortinet Cloud Services (FCS) . The same prerequisite list also requires either a FortiAnalyzer administrator account with JSON API access enabled or, for FortiAnalyzer Cloud, a valid FortiCloud API user with read/write access to the FortiAnalyzer Cloud portal.

Option B is wrong because a Forensics add-on license is not listed as a requirement for this integration. Option D is badly worded and not correct. A Jumpbox with connectivity to FortiAnalyzer is required, and the guide points to FortiEDR Core setup for Jumpbox configuration, but the answer option says Core with core-only functionality , which is not the stated requirement.

=========