View all questions & answers for the NSE 6 - FortiEDR 7.0 Administrator Exam Materials exam


NSE 6 - FortiEDR 7.0 Administrator Exam Materials-Question 6 Discussion
Comment Image Comment Image Comment Image

Refer to the Exhibit: Based on the event shown in the exhibit, which two statements about the event are true? (Choose two answers)

  • A. Playbooks are configured for this event.
  • B. The policy is in simulation mode.
  • C. The device is moved to isolation.
  • D. The event has been blocked.
Correct Answer: A,B

Brave-Dump Clients Votes

AB 100%

Comments



Brave-Dumps.com Admin 2026-07-11 03:47:31

Selected Answers: A, B


The triggered rule belongs to the eXtended Detection policy. Fortinet states that this policy provides detection only: events are logged and displayed, but no blocking options are provided. Therefore, the event operates as notification/simulation rather than prevention, which supports A. The policy is in simulation mode and confirms that D. The event has been blocked is incorrect.

The event history explicitly shows that the device was moved from the Training collector group to the High Security Collector Group. Fortinet documents Move device to High Security Group as an Automated Incident Response playbook action. This confirms A. Playbooks are configured for this event.

Moving a device to the High Security Collector Group is not the same as isolating it. Device isolation is a separate response action, so C. The device is moved to isolation is incorrect.

Correct answers: A and B.