NSE6_EDR_AD-7.0問題集、Fortinet実際の試験問題

質問 1

You are asked to create a playbook to isolate a device with a collector. Which action category does isolating a device with a collector fall under? (Choose one answer)

A. Investigation

B. Custom

C. Notifications

D. Remediation

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 2

Refer to the Exhibit:

Based on the FortiEDR status output shown in the exhibit, what are two reasons for the degraded state?
(Choose two answers)

A. The collector is installed with an incorrect registration password.

B. The collector is installed with an incorrect port number.

C. The endpoint cannot reach the central manager.

D. The endpoint has windows firewall enabled.

正解: A,B

解説: (PassTest メンバーにのみ表示されます)

質問 3

What specific action does FortiEDR take when the Zero Trust Device Tagging playbook is activated?
(Choose one answer)

A. It assigns a default tag to all endpoints.

B. It disables the endpoint until a tag is assigned.

C. It updates FortiClient EMS through an API and assigns a classification fabric tag.

D. It removes unmanaged endpoints from FortiClient EMS.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 4

A collector attempts to access a known malicious website. FortiEDR is configured for eXtended detection with FortiAnalyzer. What two roles does Fortinet Cloud Services (FCS) perform in this process? (Choose two answers)

A. FCS correlates and analyzes the collected logs.

B. FCS sends a log record to FortiAnalyzer.

C. FCS sends OS metadata to the FortiEDR manager.

D. FCS identifies if a malicious event has taken place and reports the detection incident.

正解: A,D

解説: (PassTest メンバーにのみ表示されます)

Fortinet NSE 6 - FortiEDR 7.0 Administrator - NSE6_EDR_AD-7.0 模擬練習