NSE5_EDR-5.0 Free Practice Test

Refer to the exhibit.

Based on the threat hunting query shown in the exhibit which of the following is true?

1. A. RDP connections will be blocked and classified as suspicious
2. B. A security event will be triggered when the device attempts a RDP connection
3. C. This query is included in other organizations
4. D. The query will only check for network category

Correct Answer: B

What is the role of a collector in the communication control policy?

1. A. A collector blocks unsafe applications from running
2. B. A collector is used to change the reputation score of any application that collector runs
3. C. A collector records applications that communicate externally
4. D. A collector can quarantine unsafe applications from communicating

Correct Answer: A

Refer to the exhibit.

Based on the threat hunting event details shown in the exhibit, which two statements about the event are true? (Choose two.)

1. A. The PING EXE process was blocked
2. B. The user fortinet has executed a ping command
3. C. The activity event is associated with the file action
4. D. There are no MITRE details available for this event

Correct Answer: AD

What is true about classifications assigned by Fortinet Cloud Sen/ice (FCS)?

1. A. The core is responsible for all classifications if FCS playbooks are disabled
2. B. The core only assigns a classification if FCS is not available
3. C. FCS revises the classification of the core based on its database
4. D. FCS is responsible for all classifications

Correct Answer: C