NSE6_EDR_AD-7.0 試験問題を無料オンラインアクセス

Refer to the exhibit.

An event exception is shown. Which two statements about the exception are true? (Choose two answers)

• A.The system owner can modify the trigger rules parameters.
• B.The exception is applied only on device C8092231196.
• C.A partial exception is applied to this event.
• D.FCS playbooks are enabled by Fortinet support.

A collector attempts to access a known malicious website. FortiEDR is configured for eXtended detection with FortiAnalyzer. What two roles does Fortinet Cloud Services (FCS) perform in this process? (Choose two answers)

• A.FCS correlates and analyzes the collected logs.
• B.FCS identifies if a malicious event has taken place and reports the detection incident.
• C.FCS sends a log record to FortiAnalyzer.
• D.FCS sends OS metadata to the FortiEDR manager.

A collector triggers a suspicious security incident that is initially flagged as potentially malicious. The environment is connected to the FortiEDR Cloud Service (FCS) for classification. How does FCS process the event for accurate classification? (Choose one answer)

• A.By relying solely on the FortiGate firewall policies
• B.By comparing the event against only local signatures
• C.By correlating collector logs only
• D.By data processing, comprehensive automated analysis, and comprehensive manual analysis

An employee leaves the company and no longer has access to the FortiEDR system. You must ensure GDPR compliance regarding the employee's personal data stored in FortiEDR. Which two data types must be removed to meet GDPR requirements? (Choose two answers)

• A.Installed OS name
• B.IP address and MAC address
• C.Installed applications
• D.Device and user name

Refer to the Exhibit:

A FortiEDR analyst is prioritizing response efforts. One application has a vulnerability score of Critical but an Unknown ACI rating, while another has a Medium vulnerability score with active ACI evidence of adversary targeting. Which application must be addressed first? (Choose one answer)

• A.The decision depends only on asset criticality, not scores.
• B.The application with the Medium vulnerability score and ACI evidence should be addressed first.
• C.Both applications should be treated equally because patching is necessary.
• D.The application with the Critical vulnerability score should be addressed first.