Important Fortinet NSE6_EDR_AD-7.0 Exam Questions

Answer: B, C

Explanation:

The correct answers are B and C.

The FortiEDR 7.0.0 Administration Guide has a specific troubleshooting section named ''A FortiEDR Collector does not display in the INVENTORY tab.'' It states that after a Collector is first launched, it registers with the FortiEDR Central Manager and appears in the Inventory tab. If it does not appear, the first checks are to confirm that the device where the Collector is installed is powered on and has Internet connectivity, and to validate that ports 8081 and 555 are available and not blocked by another third-party product.

Option B is therefore correct in the exam sense because ports 8081 and 555 must be open for FortiEDR communication. More precisely, the Collector communicates with the Aggregator on port 8081 and the Core on port 555, not directly to the Central Manager in every architecture. The option wording says ''between the collector and the central manager,'' which is technically loose, but the required troubleshooting item is still the port availability.

Option C is also correct because the same guide says to check that the endpoint is powered on and connected. In practical FortiEDR troubleshooting, this includes confirming the FortiEDR Collector service/driver are running on the endpoint; otherwise the Collector cannot register or report health.

Option A is not listed in the FortiEDR guide as a required step for this issue. Option D is not the best answer because the guide says logs are generally retrieved when Fortinet Support requests them, and Collector logs can only be exported for Collectors in Running status; a newly installed Collector that does not appear in Inventory cannot normally be selected from Central Manager for log export.

Answer: C

Explanation:

The correct answer is C. The user account does not have the REST API role assigned.

The exhibit shows a Postman request to the FortiEDR Central Manager REST endpoint:

/management-rest/inventory/list-collectors

The response is 401 Unauthorized, which means the request reached the FortiEDR API endpoint but the supplied user credentials are not authorized for REST API access.

The FortiEDR 7.0.0 Administration Guide states that when adding or editing a user, the Rest API advanced option controls whether the user is allowed to access the FortiEDR Central Manager through API calls. The guide defines this option as: ''Rest API --- Specifies whether to allow the user to access the FortiEDR Central Manager through API calls.''

Therefore, the most accurate cause is that the account being used in Postman does not have the Rest API permission enabled.

Option A is incorrect because the request uses GET against a list endpoint, and an unsupported method would not normally be represented by this user-authentication failure. Option B is not supported by the exhibit or guide wording; the guide describes enabling REST API access per user. Option D is incorrect because first-login password reset is not the direct cause of this REST API authorization failure. The guide separately discusses password reset and password policy behavior, but that is not what the API error indicates.

Answer: D

Explanation:

The correct answer is D.

The FortiEDR guide confirms that Playbook actions are automatic incident response actions configured under Security Settings > Playbooks and applied based on security event classification. It also confirms that actions such as Terminate Process and device isolation actions can be configured as playbook responses. For scheduled-query-triggered events, the guide states that FortiEDR can automatically apply the Playbook action assigned to the Collector Group that the triggering device belongs to.

For isolation, the guide shows that isolation actions such as Isolate device with NAC are configured under the Investigation section of Playbooks, and similar isolation actions are triggered automatically when selected for the relevant classification.

The uploaded guide does not provide a specific line saying ''if terminate process fails, continue to the next action.'' Based on FortiEDR playbook behavior, configured actions are executed independently. A failure to terminate a protected Windows process does not automatically cancel the remaining playbook actions. Therefore, the next configured action, isolate device, is still executed.

Options A, B, and C are wrong because the playbook does not pause for administrator intervention, does not stop merely because an email is generated, and does not cancel all remaining configured actions because one action failed.

=========

Answer: A

Explanation:

The correct answer is A.

The exhibit shows a FortiEDR Threat Hunting saved query using RemotePort:3389, scoped to a specific device, with Scheduled Query enabled, classification set to Suspicious, and a repeat interval of 15 minutes. TCP port 3389 is the standard RDP port, so the query is designed to detect RDP-related network activity for the selected endpoint.

The FortiEDR guide states that saving a Threat Hunting query can define it as a scheduled query to automate threat detection. It further states that when a scheduled query runs and detects matches, a security event is automatically created in the Incidents tab, and notifications are sent according to the security event configuration.

Option B is too absolute and therefore wrong. The specific query shown uses a network field, but Threat Hunting itself can search activity events across files, registry, network, processes, and event logs. Option C is wrong because the Community Query checkbox is not selected, so it is not configured as a shared community/global query. The guide states that Community Query must be selected to share the query with the FortiEDR community, including other organizations.

Option D is wrong because a scheduled Threat Hunting query generates an incident; it does not automatically block RDP unless additional playbook actions are configured. The guide says scheduled queries generate security events and may trigger configured playbook actions, but the query itself is not a blocking control.

=========

Answer: B

Explanation:

The correct answer is B.

In the exhibit, the incident status clearly shows Unhandled at the incident level and also on the event rows. The FortiEDR guide explains that every detected security event is initially marked as unread and unhandled, and these statuses help multiple FortiEDR Central Manager users track whether anyone has read and handled the message.

The guide also states that when a FortiEDR Central Manager user marks a security event as Handled, all users see it as handled. The process is performed by selecting the event and clicking Handle Incident or the flag icon, then saving the incident handling details.

So the valid observation from the exhibit is that the incident has not been handled by a console administrator.

Option A is not supported by the exhibit. There is no visible evidence that the policy is in Simulation mode. Option C is wrong because the incident is still visible, not archived or deleted. Option D is wrong because the status is explicitly Unhandled; it was not handled automatically by a Communication Control policy.

=========