View all questions & answers for the NSE 6 - FortiClient EMS 7.4 Administrator Exam Materials exam

NSE 6 - FortiClient EMS 7.4 Administrator Exam Materials - Question #34 Discussion

Comment Image Comment Image Comment Image

What does an administrator need to configure in order to quarantine FortiClient endpoints using FortiAnalyzer playbooks? (Choose one answer)

  • A. Authorize FortiAnalyzer on FortiClient as a Fabric device.
  • B. Enable automation stitch on FortiAnalyzer.
  • C. Add FortiClient EMS as a fabric connector on FortiAnalyzer.
  • D. Use an API key to integrate FortiAnalyzer with FortiClient EMS.
Correct Answer: D

Brave-Dump Community Votes

Answer: D (2 votes) 50%
Answer: C (2 votes) 50%

Community Explanations & Comments (4)

Anonymous99 1 year ago
Selected: D
Refer FCP - FortiClient EMS 7.4 Administrator Study_Guide pg 295
Anonymous User 9 months ago
Selected: C
I think it C. Question asked "what need to configure". If you read on the study guide 295, Analyzer send API to run scan/create incident.
skouba 8 months ago
Selected: C
it comunicates over API, but the question is what you need to configure and the missing part is EMS fabric connector on FAZ. I love this stupid questions with 2 possible correct answers :-(
FME 7 months ago
Selected: D
To quarantine a FortiClient endpoint using FortiAnalyzer playbooks, you must have an integrated setup where FortiClient EMS 7.x manages endpoints and forwards logs to FortiAnalyzer. Key prerequisites include active telemetry, configured log forwarding, and API integration between FortiAnalyzer and FortiClient EMS to automate quarantine actions via SOC automation playbooks