100% Free NSE 5 Network Security Analyst NSE5_EDR-5.0 Dumps PDF Demo Cert Guide Cover [Q18-Q35]

NO.18 A company requires a global communication policy for a FortiEDR multi-tenant environment.
How can the administrator achieve this?

An administrator creates a new communication control policy and shares it with other organizations

A local administrator creates new a communication control policy and shares it with other organizations

A local administrator creates a new communication control policy and assigns it globally to all organizations

An administrator creates a new communication control policy for each organization

NO.19 Which two statements are true about the remediation function in the threat hunting module? (Choose two.)

The file is removed from the affected collectors

The threat hunting module sends the user a notification to delete the file

The file is quarantined

The threat hunting module deletes files from collectors that are currently online.

NO.20 An administrator needs to restrict access to the ADMINISTRATION tab inthe central manager for a specific account.
What role should the administrator assign to this account?

Admin

User

Local Admin

REST API

NO.21 Refer to the exhibit.

Based on the threat hunting query shown in the exhibit which of the following is true?

RDP connections will be blocked and classified as suspicious

A security event will be triggered when the device attempts a RDP connection

This query is included in other organizations

The query will only check for network category

NO.22 Refer to the exhibits.

The exhibits show application policy logs and application details Collector C8092231196 is a member of the Finance group What must an administrator do to block the FileZilia application?

Deny application in Finance policy

Assign Finance policy to DBA group

Assign Finance policy to Default Collector Group

Assign Simulation Communication Control Policy to DBA group

NO.23 What is true about classifications assigned by Fortinet Cloud Sen/ice (FCS)?

The core is responsible for all classifications if FCS playbooks are disabled

The core only assigns a classification if FCS is not available

FCS revises the classification of the core based on its database

FCS is responsible for all classifications

NO.24 How does FortiEDR implement post-infection protection?

By preventing data exfiltration or encryption even after a breach occurs

By using methods used by traditional EDR

By insurance against ransomware

By real-time filtering to prevent malware from executing

NO.25 Exhibit.

Based on the event shown in the exhibit which two statements about the event are true? (Choose two.)

The device is moved to isolation.

Playbooks is configured for this event.

The event has been blocked

The policy is in simulation mode

NO.26 What is the role of a collector in the communication control policy?

A collector blocks unsafe applications from running

A collector is used to change the reputation score of any application that collector runs

A collector records applications that communicate externally

A collector can quarantine unsafe applications from communicating

NO.27 Which connectors can you use for the FortiEDR automated incident response? (Choose two.)

FortiNAC

FortiGate

FortiSiem

FortiSandbox

NO.28 Refer to the exhibits.

The exhibits show the collector state and active connections. The collector is unable to connect to aggregator IP address 10.160.6.100 using default port.
Based on the netstat command output what must you do to resolve the connectivity issue?

Reinstall collector agent and use port 443

Reinstall collector agent and use port 8081

Reinstall collector agent and use port 555

Reinstall collector agent and use port 6514

NO.29 Which scripting language is supported by the FortiEDR action managed?

TCL

Python

Perl

Bash

100% Free NSE 5 Network Security Analyst NSE5_EDR-5.0 Dumps PDF Demo Cert Guide Cover [Q18-Q35]

Leave a Reply Cancel reply

NSE5_EDR-5.0 Practice Tests

Related Certifications

Recent Posts

Categories

Archives