Fortinet NSE6_EDR_AD-7.0 問題集

質問 1：
Refer to Exhibit.

Based on the Postman output shown in the exhibit, why is the user receiving an unauthorized error? (Choose one answer)
A. The central manager is rejecting the request because of an unsupported HTTP method.
B. The user account does not have the REST API role assigned.
C. FortiEDR requires a password reset the first time a user logs in.
D. API access is disabled on the central manager.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
You added three new applications to FortiEDR using only the Path attribute. What are two expected outcomes of this configuration? (Choose two answers)
A. These applications will be blocked only if the file name also matches.
B. These applications will be disabled until explicitly enabled.
C. Only applications in the specified directory paths will be blocked.
D. All instances of these applications will be blocked, regardless of location.
正解：B,C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Within the FortiEDR architecture, which component needs JumpBox capabilities to enable authenticated and controlled communication with FortiAnalyzer? (Choose one answer)
A. Core
B. Reputation Server
C. Aggregator
D. Central manager
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 4：
When implementing an application block policy in FortiEDR, which three actions, in order, reflect the correct operational sequence? (Choose three.) Select an action in the left column and hold and drag it to a blank position in the column on the right. Place the three correct actions in order, starting with the first action at the top of the column. After you place an action, you can move it again if you want to change your answer before proceeding to the next question. You must drop three actions in the work area.
Select and drag the screen divider to change the viewable area of the source and work areas.

正解：

Explanation:
Add applications to the application control manager.
Assign collector groups to the policy.
Enable the blocklist rule on the application control policy.
"The applications must be added to the Application Control Manager under the user-defined group"
"Collector groups must be assigned to this policy"
"The blocklist rule must be enabled on the Application Control Policy." The correct sequence is to add applications to Application Control Manager, assign the relevant Collector Groups to the Application Control policy, and enable the blocklist rule. Application Control prevents designated executables from launching, whereas Communication Control regulates outbound application communication. FortiEDR automatically places manually added applications in its User-defined group, so creating a separate application group is unnecessary. Collector Groups receive policy assignments directly; application groups are not assigned to individual Collectors. Newly added applications are disabled by default and must also be enabled for blocking, unless the administrator has changed the default application state.
Reference: FortiEDR 7.0.0 Administration Guide, pages 216-224.