View all questions & answers for the NSE 6 - FortiEDR 7.0 Administrator Exam Materials exam

NSE 6 - FortiEDR 7.0 Administrator Exam Materials - Question #4 Discussion

Comment Image Comment Image Comment Image
Question Diagram

Refer to the exhibit. Based on the exhibit, which statement about this threat hunting query is true? (Choose one answer)

  • A. A security incident will be generated whenever the device attempts an RDP connection.
  • B. The query is limited to detecting network activity and does not inspect process behavior.
  • C. The query is configured as a global hunting rule and is automatically visible across all organizations.
  • D. RDP connections will be automatically blocked and classified as suspicious.
Correct Answer: A

Brave-Dump Community Votes

Answer: A (2 votes) 100%

Community Explanations & Comments (2)

Anonymous User 5 months ago
Selected: A
• Threat hunting queries are made for automated activity detection and they could be scheduled.
https://community.fortinet.com/t5/Blogs/How-Threat-hunters-Can-Create-Scheduled-Queries-and-Custom/ba-p/238197
• No action will be done in this query because there is not a playbook configured and associated to it (playbooks could be associated to do actions) = No blocking
https://community.fortinet.com/t5/FortiEDR/Technical-Tip-FortiEDR-threat-hunting-overview-and-best/ta-p/421672
• The “Custom Query” option is not selected which means it is not visible to all organizations.
Administration Guide FortiEDR 7.2.1 p139 : https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/50bc9e02-d6cb-11f0-8b43-d2943efe5b2f/FortiEDR-7.2.1-Administration_Guide.pdf
Brave-Dumps.com Admin 3 months ago
Selected: A
Study Guide page 213

“Schedule queries to automate threat detection.”

“If a query matches a threat in the defined schedule, an event appears on the Incidents tab.”

“If a query matches a threat in the defined schedule, an event appears on the Incidents tab, and FortiEDR generates email and Syslog notifications.”