NSE6_EDR_AD-7.0 Free Certification Exam Easy to Download PDF Format 2026
Get 100% Success with Latest Fortinet Certification NSE6_EDR_AD-7.0 Exam Dumps
NEW QUESTION # 20
Refer to the Exhibit:
Based on the FortiEDR status output shown in the exhibit, what are two reasons for the degraded state?
(Choose two answers)
- A. The collector is installed with an incorrect registration password.
- B. The collector is installed with an incorrect port number.
- C. The endpoint cannot reach the central manager.
- D. The endpoint has windows firewall enabled.
Answer: A,B
Explanation:
The correct answers are B and C .
The exhibit shows:
FortiEDR Service: Up
FortiEDR Driver: Up
FortiEDR Status: Degraded (no configuration)
This means the local Collector service and driver are running, but the Collector has not received valid configuration. In FortiEDR, a Collector must register and communicate with the FortiEDR Aggregator to receive its configuration. The guide states that the Collector initially sends registration information to the FortiEDR Aggregator using SSL, sends ongoing health/status/security-event information, and receives its configuration from the Aggregator.
During installation, a non-customized Windows Collector requires the correct Aggregator address , Aggregator port 8081 , and registration password . The guide explicitly states that the Aggregator port should be specified as 8081 , and that the registration password must be entered during installation.
Therefore, an incorrect registration password or incorrect port number can prevent proper registration
/configuration retrieval, resulting in a degraded/no-configuration state.
Option A is not the best answer because Windows Firewall being enabled by itself does not automatically cause this FortiEDR status; only if it blocks required FortiEDR communication would it matter, and the option is too generic. Option D is also not correct as written because the Collector receives configuration from the Aggregator , not directly from the Central Manager. The guide describes Collector-to-Aggregator communication for registration and configuration.
=========
NEW QUESTION # 21
You added three new applications to FortiEDR using only the Path attribute. What are two expected outcomes of this configuration? (Choose two answers)
- A. All instances of these applications will be blocked, regardless of location.
- B. These applications will be blocked only if the file name also matches.
- C. These applications will be disabled until explicitly enabled.
- D. Only applications in the specified directory paths will be blocked.
Answer: C,D
Explanation:
The correct answers are A and B .
The FortiEDR 7.0.0 Administration Guide states that newly added applications are disabled by default , which means they are not blocked unless enabled. The guide further explains that the default state can be changed by enabling the Enable Default application state option in the Application Control Manager settings. Therefore, option A is correct.
Option B is also correct because Application Control allows an application to be defined by Hash or by any combination of File Name / Path / Signer . The guide says that the Path field specifies the path to the executable file of the application to be blocked. When using path-based matching, the enforcement is tied to the specified path criteria, not to every possible location of the same file.
Option C is wrong because the file name does not also need to match when only the Path attribute is used.
Option D is wrong because blocking all instances regardless of location applies when only the File Name field is used, not when the match is path-specific. The guide explicitly states that if only the File Name field is filled, the application is blocked no matter where the executable appears.
NEW QUESTION # 22
Refer to the exhibit.
Based on the exhibit, which two observations are true? (Choose two answers)
- A. FCS has classified this as malicious.
- B. FortiEDR has classified this as suspicious.
- C. This incident has been resolved.
- D. EDR has never encountered this malware before.
Answer: A,D
Explanation:
The correct answers are C and D .
The exhibit shows the incident classification as Malicious . In the Activity Audit, the entry from FortinetCloudServices states: "Classification change: Malicious" and also says the file is classified as malicious. This directly proves that FCS classified the event as malicious . The FortiEDR guide explains that the audit history shows the chronology for classifying the security event and displays details when FortiEDR Cloud Service (FCS) reclassifies a security event after its initial classification by the Core.
The exhibit also states that the file was "Detected as Unknown malware." This supports option D in the exam wording: FortiEDR/FCS has classified the file as malicious, but it is being identified as unknown malware , meaning it was not recognized as a known malware family/signature at the time of classification.
The guide explains that FCS enhances classification using data enrichment, automated and manual analysis, file analysis, sandboxing, machine learning flow analysis, commonality analysis, crowdsourced data deduction, and other methods, so "unknown malware" can still be classified malicious by FCS.
Option A is wrong because the exhibit shows Malicious , not Suspicious. Option B is wrong because the incident status is Unhandled , not resolved or handled.
=========
NEW QUESTION # 23
Which two Python commands are supported when using FortiEDR Connect to directly access a protected device shell? (Choose two answers)
- A. %upload_file
- B. %psexec
- C. %ipconfig_all
- D. %timestamp
Answer: A,C
Explanation:
The correct answers are A. %upload_file and B. %ipconfig_all .
The FortiEDR 7.0.0 Administration Guide states that FortiEDR Connect opens a console that provides direct access to a FortiEDR-protected device through a remote shell connection. This allows administrators to respond to incidents, run commands and scripts, collect and download forensic data, and remediate threats.
The guide also states that the FortiEDR Connect terminal has a prompt where commands can be typed, and the Help button displays the supported commands and their parameters.
The guide further confirms that FortiEDR Connect supports FortiEDR-specific commands, Windows command-line access through %cmd , and Python commands.
For the exact command list, Fortinet's official FortiEDR Connect technical tip lists the supported commands.
In that list, %ipconfig_all is explicitly described as returning extended IP information, and %upload_file is explicitly described as uploading a file to the specified path. ( Fortinet Community ) Options C. %psexec and D. %timestamp are not listed as supported FortiEDR Connect commands in the official Fortinet command list. Therefore, they must not be selected.
=========
=========
NEW QUESTION # 24
A collector triggers a suspicious security incident that is initially flagged as potentially malicious. The environment is connected to the FortiEDR Cloud Service (FCS) for classification. How does FCS process the event for accurate classification? (Choose one answer)
- A. By data processing, comprehensive automated analysis, and comprehensive manual analysis
- B. By relying solely on the FortiGate firewall policies
- C. By correlating collector logs only
- D. By comparing the event against only local signatures
Answer: A
Explanation:
The correct answer is A .
The FortiEDR 7.0.0 Administration Guide states that the FortiEDR Cloud Service (FCS) enriches and enhances system security by performing deep, thorough analysis and investigation about the classification of a security event. It determines the exact classification of security events with a high degree of accuracy.
The guide further explains that the FCS classification process is performed through data enrichment and enhanced deep analysis and investigation enabled by automated and manual processes . These processes may include intelligence services, static and dynamic file analysis, sandboxing, flow analysis through machine learning, commonality analysis, crowdsourced data deduction, and more.
Therefore, FCS does not rely only on FortiGate firewall policies, local signatures, or raw Collector log correlation. It performs enriched cloud-based automated and manual analysis to classify the incident accurately.
=========
NEW QUESTION # 25
Within the FortiEDR architecture, which component needs JumpBox capabilities to enable authenticated and controlled communication with FortiAnalyzer? (Choose one answer)
- A. Core
- B. Reputation Server
- C. Central manager
- D. Aggregator
Answer: A
Explanation:
The correct answer is A. Core.
For FortiAnalyzer / FortiAnalyzer Cloud integration, the FortiEDR 7.0.0 Administration Guide states that one prerequisite is "A Jumpbox with connectivity to FortiAnalyzer." The same section says to refer to Setting up the FortiEDR Core for details about installing a FortiEDR Core and configuring it as a Jumpbox. In the connector configuration, the guide also states that the Jumpbox field is used to select the FortiEDR Jumpbox that will communicate with FortiAnalyzer or FortiAnalyzer Cloud.
So, the FortiEDR component associated with JumpBox capability is the Core. The Central Manager must have connectivity to Fortinet Cloud Services, but it is not the component configured as the JumpBox. The Aggregator handles registration, configuration, and monitoring between Collectors/Cores and Central Manager, and the Reputation Server is unrelated to FortiAnalyzer JumpBox communication in this context.
=========
NEW QUESTION # 26
A playbook is configured with two actions: terminate process and isolate device. The terminate process action fails because the process is protected by Windows. What is the expected behavior for the second action, isolate device? (Choose one answer)
- A. The playbook continues and executes the second action.
- B. The playbook generates a notification email and execution stops.
- C. The playbook execution stops because the action fails.
- D. The playbook execution pauses and requires administrator intervention.
Answer: A
Explanation:
The correct answer is D .
The FortiEDR guide confirms that Playbook actions are automatic incident response actions configured under Security Settings > Playbooks and applied based on security event classification. It also confirms that actions such as Terminate Process and device isolation actions can be configured as playbook responses. For scheduled-query-triggered events, the guide states that FortiEDR can automatically apply the Playbook action assigned to the Collector Group that the triggering device belongs to.
For isolation, the guide shows that isolation actions such as Isolate device with NAC are configured under the Investigation section of Playbooks, and similar isolation actions are triggered automatically when selected for the relevant classification.
The uploaded guide does not provide a specific line saying "if terminate process fails, continue to the next action." Based on FortiEDR playbook behavior, configured actions are executed independently. A failure to terminate a protected Windows process does not automatically cancel the remaining playbook actions.
Therefore, the next configured action, isolate device , is still executed.
Options A , B , and C are wrong because the playbook does not pause for administrator intervention, does not stop merely because an email is generated, and does not cancel all remaining configured actions because one action failed.
=========
NEW QUESTION # 27
Which two criteria are required for integrating FortiEDR with the Fortinet Security Fabric? (Choose two answers)
- A. Central manager connected to FCS
- B. Core with core-only functionality
- C. A valid API user with access to connectors
- D. A Forensics add-on license
Answer: A,C
Explanation:
The correct answers are A and C .
For Fortinet Security Fabric correlation through FortiAnalyzer or FortiAnalyzer Cloud, the FortiEDR guide states that FortiEDR can integrate with FortiAnalyzer/FortiAnalyzer Cloud "to correlate data between FortiEDR and the Fortinet Security Fabric and issue eXtended detection alerts." To complete this, you must configure an eXtended Detection Source connector and enable eXtended Detection rules and FortiEDR Threat Hunting event collection.
The prerequisites include connectivity from the FortiEDR Central Manager to Fortinet Cloud Services (FCS) . The same prerequisite list also requires either a FortiAnalyzer administrator account with JSON API access enabled or, for FortiAnalyzer Cloud, a valid FortiCloud API user with read/write access to the FortiAnalyzer Cloud portal.
Option B is wrong because a Forensics add-on license is not listed as a requirement for this integration.
Option D is badly worded and not correct. A Jumpbox with connectivity to FortiAnalyzer is required, and the guide points to FortiEDR Core setup for Jumpbox configuration, but the answer option says Core with core- only functionality , which is not the stated requirement.
=========
NEW QUESTION # 28
A collector attempts to access a known malicious website. FortiEDR is configured for eXtended detection with FortiAnalyzer. What two roles does Fortinet Cloud Services (FCS) perform in this process? (Choose two answers)
- A. FCS sends OS metadata to the FortiEDR manager.
- B. FCS correlates and analyzes the collected logs.
- C. FCS sends a log record to FortiAnalyzer.
- D. FCS identifies if a malicious event has taken place and reports the detection incident.
Answer: B,D
Explanation:
The correct answers are C and D .
The guide states that for eXtended Detection Source integration, FortiEDR connects to external systems to collect activity logs. The aggregated data is then sent to Fortinet Cloud Services (FCS) , where it is correlated and analyzed to detect malicious indications. Those malicious indications result in security events for eXtended Detection policy rule violations .
For FortiAnalyzer/FortiAnalyzer Cloud specifically, the guide states that this integration is used to correlate data between FortiEDR and the Fortinet Security Fabric and issue eXtended Detection alerts .
Option A is wrong because FCS does not send the original log record to FortiAnalyzer. FortiAnalyzer is the external source whose data is correlated with FortiEDR data. Option B is wrong because OS metadata is collected by the Collector and handled through FortiEDR components; the FCS role here is cloud-side enrichment, correlation, and detection, not sending OS metadata back to the manager.
=========
NEW QUESTION # 29
Which two statements correctly describe the IoT probing process on FortiEDR? (Choose two answers)
- A. It captures all traffic from neighboring devices for deep packet inspection.
- B. It identifies nearby devices by retrieving details such as hostname and IP address.
- C. Only healthy collectors participate in IoT probing.
- D. Collectors running on servers are always used for IoT probing.
Answer: B,C
Explanation:
The correct answers are B and C .
The FortiEDR 7.0.0 Administration Guide explains that IoT device discovery continuously identifies newly connected non-workstation devices, such as printers, cameras, and media devices. During discovery, each relevant Collector periodically probes nearby neighboring devices. The guide states that nearby devices usually respond by providing information about themselves, including the device/host name and IP address .
This directly supports option B .
Option C is also correct because the guide states that Collectors in degraded , disabled , or isolated states do not take part in the IoT probing process. It also says FortiEDR uses the most powerful Collectors in each subnet and excludes weaker Collectors, including disabled and degraded Collectors.
Option A is wrong because the guide explicitly says Collectors running on servers do not take part in IoT probing. Option D is wrong because IoT probing is not described as deep packet inspection of all neighboring traffic; it is a discovery/probing process used to identify nearby devices and collect basic device information.
=========
NEW QUESTION # 30
Refer to the exhibits.
The application policy logs and application details are shown. Collector C8092231196 is a member of the Finance group. In this scenario, what must you do to block the FileZilla application? (Choose one answer)
- A. Assign the Finance policy to the DBA group.
- B. Assign the Finance policy to a broader collector group, such as the Default Collector Group.
- C. Assign the Simulation Communication Control Policy to the DBA group.
- D. Deny the application in the Finance policy.
Answer: D
Explanation:
The correct answer is B. Deny the application in the Finance policy .
The FortiEDR 7.0.0 Administration Guide states that Communication Control policies define the actions to be taken for a given application or application version . It also states that each Communication Control policy applies to specific Collector Groups , and all devices that belong to those Collector Groups follow that policy. A Collector Group can be assigned to only one Communication Control policy.
In the exhibit, the Collector C8092231196 is stated to be a member of the Finance group. Therefore, to block FileZilla for that Collector, the application action must be set to Deny under the Finance policy , because that is the policy context that applies to the Collector's group.
The guide also explains that you can modify a policy action for an application/version so that the selected application is explicitly set to Allow or Deny for the relevant policy. When modified this way, the Application
/Version Details area shows the action as manually changed and excluded from the original policy action.
Option A is wrong because assigning a Simulation Communication Control Policy to the DBA group does not affect a Collector in the Finance group. Option C is wrong because assigning the Finance policy to the DBA group would affect DBA Collectors, not the Finance Collector in the scenario. Option D is wrong because assigning the Finance policy to a broader group such as Default Collector Group is unnecessary and could over-broaden the policy impact. The precise action is to deny FileZilla in the policy that applies to the Collector's own group: Finance policy .
=========
NEW QUESTION # 31
A company requires a global communication policy for a FortiEDR multi-tenant environment. Which recommendation must you make? (Choose one answer)
- A. Create a separate communication control policy for each organization.
- B. Create a new communication control policy and apply it to multiple organizations.
- C. Create a new communication control policy and assign it globally to all organizations.
- D. Create a new communication control policy and delegate it to other organizations.
Answer: A
NEW QUESTION # 32
You find third-party software on a user's computer that does not appear in the application list on the communication control console. Which two statements are true about this situation? (Choose two answers)
- A. The application is blocked by the security policies.
- B. The application has not made any connection attempts.
- C. The application is allowed in all communication control policies.
- D. The application is ignored because its reputation score is acceptable to the security policy.
Answer: B,C
Explanation:
The best answers are A and D , but be careful: A is directly verified by the guide; D is the only remaining statement that can be true in policy context, but it is weaker than A.
The FortiEDR 7.0.0 Administration Guide states that the Communication Control tab identifies communicating applications detected in the organization. More specifically, the Applications page lists "all communicating applications detected in your organization that have ever attempted to communicate." Therefore, if software exists on a user's computer but does not appear in the Communication Control application list, the most direct explanation is that it has not attempted external communication .
The guide also explains that FortiEDR Communication Control reduces the scope of administration because Security/IT only needs to handle applications that communicate externally. It also states that non-authorized applications can still execute, and only their outgoing communication is prevented. This confirms that the Communication Control application list is not a full software inventory; it is a list of applications that have communicated or attempted communication.
Option B is not correct. If an application were blocked due to FortiEDR security-policy enforcement after a connection attempt, FortiEDR would generate security-event visibility in the Incidents workflow, not simply hide the application from Communication Control. FortiEDR Collectors send communication-related data for Communication Control, and security events are sent for enforcement/monitoring purposes.
Option C is also wrong. Reputation score affects policy decisions and application risk evaluation, but it does not cause an application to be ignored or excluded from the application list. The guide says each application in the Applications page shows a reputation indicator, which proves reputation is displayed for listed applications rather than used to hide them.
For option D , if the application has never attempted communication, Communication Control has no observed communication event to list. In exam logic, this can be interpreted as the application is not currently being denied by Communication Control policies. However, the stronger technical truth is this:
Communication Control does not list installed software; it lists applications that have attempted to communicate.
=========
NEW QUESTION # 33
Refer to the Exhibit:
A FortiEDR analyst is prioritizing response efforts. One application has a vulnerability score of Critical but an Unknown ACI rating, while another has a Medium vulnerability score with active ACI evidence of adversary targeting. Which application must be addressed first? (Choose one answer)
- A. The decision depends only on asset criticality, not scores.
- B. The application with the Medium vulnerability score and ACI evidence should be addressed first.
- C. The application with the Critical vulnerability score should be addressed first.
- D. Both applications should be treated equally because patching is necessary.
Answer: B
Explanation:
The correct answer is D .
The FortiEDR 7.0.0 Administration Guide explains that FortiEDR displays two severity ratings for applications: NIST Severity and ACI Severity . NIST Severity is based on FortiEDR's vulnerability scoring system using the NIST Cybersecurity Framework. ACI Severity, however, is Adversary Centric Intelligence provided by FortiRecon and FortiGuard Threat Analysts, covering dark web, open-source, and technical threat intelligence, including threat actor insights . This helps administrators proactively assess risk, respond faster to incidents, understand attackers, and protect assets.
The guide also states that FortiEDR helps analysts prioritize alerts and incidents using risk factors such as severity of vulnerabilities , relevance of threat intelligence feeds , and severity of affected endpoints , so effort is focused on the most significant organizational risks.
Therefore, the application with Medium NIST severity but active ACI evidence of adversary targeting should be prioritized over an application with Critical NIST severity but Unknown ACI rating , because active adversary-centric intelligence indicates current attacker interest or exploitation relevance. In plain terms: a theoretical critical vulnerability matters, but an actively targeted vulnerability is the fire you put out first.
Option B is tempting but incomplete because it relies only on NIST/CVSS severity. FortiEDR's ACI rating exists specifically to add adversary context to prioritization. Option A is wrong because FortiEDR does not treat all vulnerable applications equally. Option C is wrong because asset criticality can matter, but the guide does not say prioritization depends only on asset criticality.
=========
NEW QUESTION # 34
......
Get Ready to Pass the NSE6_EDR_AD-7.0 exam Right Now Using Our Fortinet Certification Exam Package: https://prep4sure.real4prep.com/NSE6_EDR_AD-7.0-exam.html