Prepare For Realistic NSE5_EDR-5.0 Dumps PDF – 100% Passing Guarantee [Q15-Q35]

Rate this post

Prepare For Realistic NSE5_EDR-5.0 Dumps PDF – 100% Passing Guarantee

Check the Available NSE5_EDR-5.0 Exam Dumps with 30 Q’s

Fortinet NSE5_EDR-5.0 Exam Syllabus Topics:

Topic	Details
Topic 1	Analyze threat hunting data FortiEDR troubleshooting, Configure playbooks, Deploy FortiXDR
Topic 2	Perform alert analysis on FortiEDR security events and logs Explain FortiEDR architecture and technical positioning
Topic 3	Investigate security events using forensics analysis Deploy FortiEDR multi-tenancy
Topic 4	Explain Fortinet Cloud Service (FCS) Configure communication control policy
Topic 5	Events, forensics, and threat hunting Analyze security events and alerts
Topic 6	Use API to carry out FortiEDR management functions FortiEDR security settings and policies

NEW QUESTION 15
FortiXDR relies on which feature as part of its automated extended response?

Playbooks

Security Policies

Forensic

Communication Control

NEW QUESTION 16
What is true about classifications assigned by Fortinet Cloud Sen/ice (FCS)?

The core is responsible for all classifications if FCS playbooks are disabled

The core only assigns a classification if FCS is not available

FCS revises the classification of the core based on its database

FCS is responsible for all classifications

NEW QUESTION 17
A FortiEDR security event is causing a performance issue with a third-parry application. What must you do first about the event?

Contact Fortinet support

Terminate the process and uninstall the third-party application

Immediately create an exception

Investigate the event to verify whether or not the application is safe

NEW QUESTION 18
Refer to the exhibit.

Based on the threat hunting event details shown in the exhibit, which two statements about the event are true?
(Choose two.)

The PING EXE process was blocked

The user fortinet has executed a ping command

The activity event is associated with the file action

There are no MITRE details available for this event

NEW QUESTION 19
Refer to the exhibit.

Based on the postman output shown in the exhibit why is the user getting an unauthorized error?

The user has been assigned Admin and Rest API roles

FortiEDR requires a password reset the first time a user logs in

Postman cannot reach the central manager

API access is disabled on the central manager

NEW QUESTION 20
An administrator finds a third party free software on a user’s computer mat does not appear in me application list in the communication control console Which two statements are true about this situation? (Choose two)

The application is allowed in all communication control policies

The application is ignored as the reputation score is acceptable by the security policy

The application has not made any connection attempts

The application is blocked by the security policies

NEW QUESTION 21
What is the benefit of using file hash along with the file name in a threat hunting repository search?

It helps to make sure the hash is really a malware

It helps to check the malware even if the malware variant uses a different file name

It helps to find if some instances of the hash are actually associated with a different file

It helps locate a file as threat hunting only allows hash search

NEW QUESTION 22
Refer to the exhibits.

The exhibits show the collector state and active connections. The collector is unable to connect to aggregator IP address 10.160.6.100 using default port.
Based on the netstat command output what must you do to resolve the connectivity issue?

Reinstall collector agent and use port 443

Reinstall collector agent and use port 8081

Reinstall collector agent and use port 555

Reinstall collector agent and use port 6514

NEW QUESTION 23
Exhibit.

Based on the event shown in the exhibit which two statements about the event are true? (Choose two.)

The device is moved to isolation.

Playbooks is configured for this event.

The event has been blocked

The policy is in simulation mode

NEW QUESTION 24
Refer to the exhibit.

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

The NGAV policy has blocked TestApplication exe

TestApplication exe is sophisticated malware

The user was able to launch TestApplication exe

FCS classified the event as malicious

NEW QUESTION 25
Which two statements are true about the remediation function in the threat hunting module? (Choose two.)

The file is removed from the affected collectors

The threat hunting module sends the user a notification to delete the file

The file is quarantined

The threat hunting module deletes files from collectors that are currently online.

NEW QUESTION 26
Refer to the exhibits.

The exhibits show application policy logs and application details Collector C8092231196 is a member of the Finance group What must an administrator do to block the FileZilia application?