NSE6_EDR_AD-7.0 Practice Questions

In the FortiEDR architecture, Fortinet Cloud Services (FCS) acts as the cloud-based threat intelligence and analytics backend. When a collector intercepts a potentially malicious event, the metadata is forwarded through the Core and Central Manager to FCS. FCS performs two primary roles in this process: it correlates and analyzes the collected event logs using cloud-based machine learning and threat intelligence, and it definitively identifies if a malicious event has taken place, subsequently reporting the detection incident back to the Central Manager. The Central Manager then handles forwarding these logs to FortiAnalyzer for eXtended detection (XDR).

A: The FortiEDR Central Manager, not FCS, is responsible for directly forwarding log records to FortiAnalyzer via syslog or API connectors.

B: OS metadata is gathered locally by the FortiEDR Collector and sent to the Core/Manager; it is not provided or sent by FCS.

1. Fortinet, "FortiEDR 7.0 Architecture Guide," Section: Fortinet Cloud Services (FCS), pp. 25-28.

2. Fortinet, "FortiEDR 7.0 NSE 6 Study Guide," Section: Threat Detection and FCS, pp. 45-48.

The correct answer is A. Core.

For FortiAnalyzer / FortiAnalyzer Cloud integration, the FortiEDR 7.0.0 Administration Guide states that one

prerequisite is ''A Jumpbox with connectivity to FortiAnalyzer.'' The same section says to refer to Setting up the

FortiEDR Core for details about installing a FortiEDR Core and configuring it as a Jumpbox. In the connector

configuration, the guide also states that the Jumpbox field is used to select the FortiEDR Jumpbox that will

communicate with FortiAnalyzer or FortiAnalyzer Cloud.

So, the FortiEDR component associated with JumpBox capability is the Core. The Central Manager must have

connectivity to Fortinet Cloud Services, but it is not the component configured as the JumpBox. The Aggregator

handles registration, configuration, and monitoring between Collectors/Cores and Central Manager, and the

Reputation Server is unrelated to FortiAnalyzer JumpBox communication in this context.

The correct answers are

A. %upload_file and

B. %ipconfig_all.

The FortiEDR 7.0.0 Administration Guide states that FortiEDR Connect opens a console that provides direct

access to a FortiEDR-protected device through a remote shell connection. This allows administrators to respond

to incidents, run commands and scripts, collect and download forensic data, and remediate threats. The guide

also states that the FortiEDR Connect terminal has a prompt where commands can be typed, and the Help

button displays the supported commands and their parameters.

The guide further confirms that FortiEDR Connect supports FortiEDR-specific commands, Windows command-

line access through %cmd, and Python commands.

For the exact command list, Fortinet's official FortiEDR Connect technical tip lists the supported commands. In

that list, %ipconfig_all is explicitly described as returning extended IP information, and %upload_file is explicitly

described as uploading a file to the specified path. (Fortinet Community)

Options

C. %psexec and

D. %timestamp are not listed as supported FortiEDR Connect commands in the official

Fortinet command list. Therefore, they must not be selected.

Under the General Data Protection Regulation (GDPR), personal data includes any information that can identify a natural person directly or indirectly. In the context of FortiEDR, device names, user names, IP addresses, and MAC addresses are classified as Personally Identifiable Information (PII) because they can be linked to a specific individual. To comply with GDPR right-to-be-forgotten requests, these specific data types must be purged or anonymized using FortiEDR's data privacy settings. Installed applications and OS names are generic system attributes and do not constitute personal data.

B. Installed applications are generic system configuration details and do not directly or indirectly identify a natural person under GDPR.

C. The installed OS name is non-identifying technical metadata, not Personally Identifiable Information (PII).

1. Fortinet, "FortiEDR 5.x Administration Guide," Chapter: System Administration, Section: Data Privacy and GDPR Compliance, pp. 210-212.

2. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 4(1) - Definition of Personal Data.

The Postman output shows an unauthorized response even though the request reaches the central manager. In FortiEDR, REST API access requires a user account with the REST API role/permission. If the account lacks that role, the central manager rejects the request as unauthorized. This is distinct from an unsupported HTTP method or disabled API service.

A. An unsupported HTTP method would result in a method-related error, not an authorization failure.

B. The exhibit indicates an authorization failure, not that REST API service is disabled globally.

D. A first-login password reset is not the cause indicated by the unauthorized API response.

- Fortinet, FortiEDR 7.0 REST API Reference, section “Authentication” — describes API authentication requirements.

- Fortinet, FortiEDR 7.0 REST API Reference, section “User roles and REST API access” — states REST API permissions/role are required.

- Fortinet, FortiEDR 7.0 Administration Guide, section “Administration / Users and roles” — explains assigning roles to FortiEDR users.

To trace the execution chain and identify the parent process that launched a malicious command, the process execution chain (or process tree) feature in the FortiEDR Forensics module must be used. This view visually maps the parent-child relationships of processes, allowing analysts to trace the origin of an attack, understand the execution context, and determine exactly which application or script spawned the malicious PowerShell instance. This is critical for understanding the root cause and delivery mechanism of the ransomware.

A. File Hash Lookup identifies if a file is known malware via threat intelligence, but it does not display the local execution chain or parent process.

B. Enabling behavior analysis is a proactive monitoring step for future events, not a forensic tool for tracing past execution chains.

D. Querying Network Connections identifies external C2 communications but does not reveal the local process execution chain or parent process.

1. Fortinet, "FortiEDR 5.x Administration Guide," Chapter: Forensics, Section: Process Tree Analysis, pp. 142-145.

2. Fortinet NSE 6 - FortiEDR Study Guide, Module: Forensics and Threat Hunting.

FortiEDR natively supports multi-tenancy by allowing the creation of child organizations (tenants) under a primary organization. This architecture provides centralized visibility and management at the corporate level while enabling regional security teams to manage their specific endpoints independently. Role-Based Access Control (RBAC) is utilized to restrict administrators' visibility and control to their assigned tenants, ensuring data isolation and operational autonomy without requiring multiple separate deployments.

A: Deploying separate instances defeats the purpose of native multi-tenancy and increases administrative overhead by requiring external API integrations for centralized visibility.

C: Security Fabric segmentation applies to network traffic, not administrative multi-tenancy or endpoint management isolation within the FortiEDR console.

D: IP-based access restrictions do not provide logical data isolation or proper multi-tenant administrative boundaries for endpoint management.

Fortinet, Inc. (2022). FortiEDR 5.0 Administration Guide. Document ID: FEDR-50-AG. Section: "Multi-Tenancy and Organizations", pp. 45-48.

Fortinet Training Institute (2023). FortiEDR Administrator Courseware. Module 2: "System Architecture and Multi-Tenancy".

FortiEDR's Threat Hunting module allows administrators to proactively search for indicators of compromise, such as specific registry modifications, file creations, or process executions. To automate this process, you must configure a scheduled query within a threat hunting profile. This feature enables the system to automatically execute predefined Lucene-based queries at specified intervals (e.g., every 15 minutes) across all endpoints. The results are continuously monitored, and alerts can be generated if the query returns matches for suspicious activities.

A. Communication control rules manage and restrict network traffic; they do not query endpoint telemetry or search for registry modifications.

B. Manual queries are executed on-demand by an analyst and cannot be automated or scheduled to run at regular intervals.

D. Playbooks are reactive mechanisms that respond to generated security events; they do not proactively query endpoints for raw telemetry.

1. Fortinet Inc., "FortiEDR 5.2 Administration Guide," Document ID: 09-520-735193-20210916, Section: Threat Hunting -> Scheduled Queries, pp. 302-305.

2. Fortinet Inc., "FortiEDR Security Architecture and Operations," NSE 6 Courseware, Module 6: Threat Hunting.

In FortiEDR, Communication Control policies govern which applications are allowed or blocked from communicating on the network. Since the collector (C8092231196) is a member of the Finance collector group, it inherits the policies assigned specifically to that group. To block the FileZilla application for this collector, an administrator must edit the Communication Control policy assigned to the Finance group (the Finance policy) and set the action for the FileZilla application to "Deny".

A. Assigning a policy to the DBA group will not affect a collector that resides in the Finance group.

C. Assigning the Finance policy to the DBA group changes the DBA group's rules, not the Finance group's rules.

D. Assigning the policy to a broader group does not specifically block the application for the Finance group and may cause unintended widespread impact.

Fortinet, "FortiEDR 5.0 Administration Guide," Communication Control Policies and Collector Groups, pp. 150-154.

Fortinet, "FortiEDR NSE 6 Study Guide," Application Control, p. 39.

The correct answers are C and D.

The exhibit shows an exception created/updated by FortinetCloudServices after the file Update.exe was

classified as Good. This aligns with the FortiEDR Cloud Service behavior described in the guide. The guide

states that once FCS is connected, it can enable Tuning, which means automated security event

exception/allowlisting. After a triggered security event is reclassified as Safe, an automated cross-environment

exception can be pushed downstream and the event expires, preventing it from triggering again.

Option C is correct because the Event Exceptions window includes Triggered Rules, and the guide states that

when editing an exception, the administrator can modify the Collector Groups, Destinations, Users, and the

pairs of rules and processes that define the exception in the Triggered Rules area.

Option D is the Fortinet/FCS-related statement supported by the guide's FCS behavior. The guide says FCS can

enable follow-up actions, including Tuning through automated exceptions and Playbook Actions, and that

playbook policy remediation actions are based on the final FCS determination.

Option A is wrong because the exhibit explicitly states ''All the Raw Data Items are covered.'' A partial

exception would mean not all raw data items are covered. The guide explains that if an exception does not

cover all raw data items, FortiEDR displays a different indicator and distinguishes covered from non-covered

raw data items.

Option B is wrong because the exception scope in the exhibit is set to All groups, All destinations, and All users.

The comment

device C8092231196, but that is not the same as saying the exception applies only to

that device.