新建题库06110803

manager.

Which two troubleshooting steps must you perform? (Choose two.)

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

Based on the exhibit, which statement about this treat hunting query is true?

What observation can you make about the Connectivity TestAppNew.exe incident?

What are two expected outcomes of this configuration? (Choose two.)

An event exception is shown.

Which two statements about the exception are true? (Choose two.)

A FortiEDR analyst is prioritizing response efforts.

One application has a vulnerability score of Critical but an Unknown ACI rating, while another has a

Medium vulnerability score with active ACI evidence of adversary targeting.

Which application must be addressed first?

You configured an execution prevention exclusion with both File Name =app.exe and Path = C:\Tools\

What will FortiEDR do?

authenticated and controlled communication with FortiAnalyzer?

then isolate the device that generated the malicious hash event.

What is the expected behavior if FortiGate is unreachable?

The terminate process action fails because the process is protected by Windows.

What is the expected behavior for the second action, isolate device?

You are attempting to move a collector into the High Security Collector Group for isolation but encounter

an error in the API request as shown on the exhibit.

To successfully isolate the collector, which API parameter must you correct?

communication control console.

Which two statements are true about this situation? (Choose two.)

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

Which recommendation must you make?

The application policy logs and application details are shown. Collector C8092231196 is a member of the

Finance group.

In this scenario, what must you do to block the FileZilla application?

registry modifications across all endpoints.

Which FortiEDR feature must you configure?

The environment is connected to the FortiEDR Cloud Service (FCS) for classification.

How does FCS process the event for accurate classification?

You are asked to block applications based on hash attributes.

Which two factors must you consider when applying the hash value? (Choose two.)