Free Fortinet NSE6_EDR_AD-7.0 Practice Exam with Questions & Answers

The correct answers are A and C .

For Fortinet Security Fabric correlation through FortiAnalyzer or FortiAnalyzer Cloud, the FortiEDR guide states that FortiEDR can integrate with FortiAnalyzer/FortiAnalyzer Cloud “to correlate data between FortiEDR and the Fortinet Security Fabric and issue eXtended detection alerts.” To complete this, you must configure an eXtended Detection Source connector and enable eXtended Detection rules and FortiEDR Threat Hunting event collection.

The prerequisites include connectivity from the FortiEDR Central Manager to Fortinet Cloud Services (FCS) . The same prerequisite list also requires either a FortiAnalyzer administrator account with JSON API access enabled or, for FortiAnalyzer Cloud, a valid FortiCloud API user with read/write access to the FortiAnalyzer Cloud portal.

Option B is wrong because a Forensics add-on license is not listed as a requirement for this integration. Option D is badly worded and not correct. A Jumpbox with connectivity to FortiAnalyzer is required, and the guide points to FortiEDR Core setup for Jumpbox configuration, but the answer option says Core with core-only functionality , which is not the stated requirement.

=========

Add applications to the application control manager.

Assign collector groups to the policy.

Enable the blocklist rule on the application control policy.

“The applications must be added to the Application Control Manager under the user-defined group”

“Collector groups must be assigned to this policy”

“The blocklist rule must be enabled on the Application Control Policy.”

The correct sequence is to add applications to Application Control Manager, assign the relevant Collector Groups to the Application Control policy, and enable the blocklist rule. Application Control prevents designated executables from launching, whereas Communication Control regulates outbound application communication. FortiEDR automatically places manually added applications in its User-defined group, so creating a separate application group is unnecessary. Collector Groups receive policy assignments directly; application groups are not assigned to individual Collectors. Newly added applications are disabled by default and must also be enabled for blocking, unless the administrator has changed the default application state.

The best answers are A and D , but be careful: A is directly verified by the guide; D is the only remaining statement that can be true in policy context, but it is weaker than A.

The FortiEDR 7.0.0 Administration Guide states that the Communication Control tab identifies communicating applications detected in the organization. More specifically, the Applications page lists “all communicating applications detected in your organization that have ever attempted to communicate.” Therefore, if software exists on a user’s computer but does not appear in the Communication Control application list, the most direct explanation is that it has not attempted external communication .

The guide also explains that FortiEDR Communication Control reduces the scope of administration because Security/IT only needs to handle applications that communicate externally. It also states that non-authorized applications can still execute, and only their outgoing communication is prevented. This confirms that the Communication Control application list is not a full software inventory; it is a list of applications that have communicated or attempted communication.

Option B is not correct. If an application were blocked due to FortiEDR security-policy enforcement after a connection attempt, FortiEDR would generate security-event visibility in the Incidents workflow, not simply hide the application from Communication Control. FortiEDR Collectors send communication-related data for Communication Control, and security events are sent for enforcement/monitoring purposes.

Option C is also wrong. Reputation score affects policy decisions and application risk evaluation, but it does not cause an application to be ignored or excluded from the application list. The guide says each application in the Applications page shows a reputation indicator, which proves reputation is displayed for listed applications rather than used to hide them.

For option D , if the application has never attempted communication, Communication Control has no observed communication event to list. In exam logic, this can be interpreted as the application is not currently being denied by Communication Control policies. However, the stronger technical truth is this: Communication Control does not list installed software; it lists applications that have attempted to communicate.

=========

The correct answer is B. Deny the application in the Finance policy .

The FortiEDR 7.0.0 Administration Guide states that Communication Control policies define the actions to be taken for a given application or application version . It also states that each Communication Control policy applies to specific Collector Groups , and all devices that belong to those Collector Groups follow that policy. A Collector Group can be assigned to only one Communication Control policy.

In the exhibit, the Collector C8092231196 is stated to be a member of the Finance group. Therefore, to block FileZilla for that Collector, the application action must be set to Deny under the Finance policy , because that is the policy context that applies to the Collector’s group.

The guide also explains that you can modify a policy action for an application/version so that the selected application is explicitly set to Allow or Deny for the relevant policy. When modified this way, the Application/Version Details area shows the action as manually changed and excluded from the original policy action.

Option A is wrong because assigning a Simulation Communication Control Policy to the DBA group does not affect a Collector in the Finance group. Option C is wrong because assigning the Finance policy to the DBA group would affect DBA Collectors, not the Finance Collector in the scenario. Option D is wrong because assigning the Finance policy to a broader group such as Default Collector Group is unnecessary and could over-broaden the policy impact. The precise action is to deny FileZilla in the policy that applies to the Collector’s own group: Finance policy .

=========

Comprehensive and Detailed 100 to 150 words of Explanation From FortiEDR 7.0 Administrator topics:

“This action blocks the communication to/from the affected Collector.”

“A Firewall Connector must already be configured in order to perform this action.”

FortiEDR Playbooks support separate remediation and investigation actions. The firewall-blocking action depends on the configured FortiGate connector, while Collector-based device isolation operates through the protected endpoint. If FortiGate is unreachable, the firewall action cannot complete successfully, but the independent Collector isolation action can still execute. The intended outcome is therefore successful device isolation with a failure recorded for the unsuccessful response.

Verification qualification: The documented firewall action blocks malicious remote addresses, not file hashes directly. Additionally, the Administration Guide does not explicitly define the overall playbook status when one action fails. Consequently, D is the strongest intended answer, but its aggregate failure-status behavior is not conclusively verified by the cited documentation.

The correct answer is C.

The FortiEDR 7.0.0 Administration Guide explains that Identity Management integration can use FortiClient EMS. The connector requires API credentials or FortiCloud credentials depending on whether FortiClient EMS is on-premises or cloud-based. The guide states that for the out-of-the-box action, such as Zero Trust device tagging on FortiClient EMS, FortiEDR tags the device as non-trusted in the identity management system and specifies the classification tag to apply in the Tag name field.

The guide also lists predefined FortiClient EMS 7.2 or later fabric tags used by FortiEDR, including FortiEDR_Malicious, FortiEDR_PUP, FortiEDR_Suspicious, FortiEDR_Likely_Safe, and FortiEDR_Probably_Good. These tags are used by FortiClient EMS to tag the endpoint based on FortiEDR classification.

Finally, the guide states that to configure the automated response, the administrator must go to Security Settings > Playbooks, open the relevant Playbook policy, and place a checkmark in the relevant classification column next to the Zero Trust device tagging row under Remediation. FortiEDR is then configured to automatically tag a device as non-trusted when a security event is triggered.

Options A, B, and D are wrong. FortiEDR does not remove unmanaged endpoints, does not apply a default tag to every endpoint, and does not disable the endpoint merely until a tag is assigned. The action is API-based FortiClient EMS tagging tied to FortiEDR event classification

The correct answers are A. %upload_file and B. %ipconfig_all .

The FortiEDR 7.0.0 Administration Guide states that FortiEDR Connect opens a console that provides direct access to a FortiEDR-protected device through a remote shell connection. This allows administrators to respond to incidents, run commands and scripts, collect and download forensic data, and remediate threats. The guide also states that the FortiEDR Connect terminal has a prompt where commands can be typed, and the Help button displays the supported commands and their parameters.

The guide further confirms that FortiEDR Connect supports FortiEDR-specific commands, Windows command-line access through %cmd , and Python commands.

For the exact command list, Fortinet’s official FortiEDR Connect technical tip lists the supported commands. In that list, %ipconfig_all is explicitly described as returning extended IP information, and %upload_file is explicitly described as uploading a file to the specified path. ( Fortinet Community )

Options C. %psexec and D. %timestamp are not listed as supported FortiEDR Connect commands in the official Fortinet command list. Therefore, they must not be selected.

=========

=========

The correct answer is A .

The FortiEDR 7.0.0 Administration Guide states that the FortiEDR Cloud Service (FCS) enriches and enhances system security by performing deep, thorough analysis and investigation about the classification of a security event. It determines the exact classification of security events with a high degree of accuracy.

The guide further explains that the FCS classification process is performed through data enrichment and enhanced deep analysis and investigation enabled by automated and manual processes . These processes may include intelligence services, static and dynamic file analysis, sandboxing, flow analysis through machine learning, commonality analysis, crowdsourced data deduction, and more.

Therefore, FCS does not rely only on FortiGate firewall policies, local signatures, or raw Collector log correlation. It performs enriched cloud-based automated and manual analysis to classify the incident accurately.

=========

The correct answer is B .

In the exhibit, the incident status clearly shows Unhandled at the incident level and also on the event rows. The FortiEDR guide explains that every detected security event is initially marked as unread and unhandled , and these statuses help multiple FortiEDR Central Manager users track whether anyone has read and handled the message.

The guide also states that when a FortiEDR Central Manager user marks a security event as Handled , all users see it as handled. The process is performed by selecting the event and clicking Handle Incident or the flag icon, then saving the incident handling details.

So the valid observation from the exhibit is that the incident has not been handled by a console administrator .

Option A is not supported by the exhibit. There is no visible evidence that the policy is in Simulation mode. Option C is wrong because the incident is still visible, not archived or deleted. Option D is wrong because the status is explicitly Unhandled ; it was not handled automatically by a Communication Control policy.

=========

The correct answer is A. Investigation .

The FortiEDR 7.0.0 Administration Guide states that Investigation actions enable administrators to isolate a device or assign it to a high-security Collector Group for further investigation of the device’s activity. Under the Investigation section, the guide lists the available investigation action types, including “Isolate device with Collector,” “Isolate device with NAC,” and “Move device to High Security Group.”

For Isolate device with Collector , the guide explains that the action blocks communication to and from the affected Collector, and it applies only to endpoint Collectors. If the Playbook policy is configured to isolate a device for a malicious event, then when a malicious security event is triggered, the device is isolated from communicating with the outside world for both sending and receiving.

So, this is not a Remediation , Custom , or Notification action. In FortiEDR Playbook policy terminology, Isolate device with Collector belongs under Investigation .

=========