View all questions & answers for the NSE 6 - FortiClient EMS 7.4 Administrator Exam Materials exam

NSE 6 - FortiClient EMS 7.4 Administrator Exam Materials - Question #27 Discussion

Comment Image Comment Image Comment Image

The security team plans to leverage their existing Fortinet Security Fabric infrastructure to create an automated response capability to isolate compromised endpoints. Their environment consists of FortiClient EMS, FortiGate firewalls, and FortiAnalyzer. Which two configurations are required to quarantine endpoints based on indicator of compromise (IOC) verdicts from the security fabric deployment? (Choose two answers)

  • A. A FortiAnalyzer playbook configured to notify FortiGate about IOC incidents
  • B. An automation stitch configured on FortiGate for host quarantine
  • C. FortiClient configured to send traffic and security logs to FortiAnalyzer
  • D. The IOC feature enabled in the malware endpoint protection profile
Correct Answer: B,C

Brave-Dump Community Votes

Answer: B, C (1 vote) 100%

Community Explanations & Comments (1)

Anonymous99 1 year ago
Selected: B, C
Refer FCP - FortiClient EMS 7.4 Administrator Study_Guide pg 290