View all questions & answers for the NSE 6 - FortiEDR 7.0 Administrator Exam Materials exam
NSE 6 - FortiEDR 7.0 Administrator Exam Materials - Question #6 Discussion
Community Explanations & Comments (1)
Brave-Dumps.com Admin
3 months ago
Selected: A, B
The triggered rule belongs to the eXtended Detection policy. Fortinet states that this policy provides detection only: events are logged and displayed, but no blocking options are provided. Therefore, the event operates as notification/simulation rather than prevention, which supports A. The policy is in simulation mode and confirms that D. The event has been blocked is incorrect.
The event history explicitly shows that the device was moved from the Training collector group to the High Security Collector Group. Fortinet documents Move device to High Security Group as an Automated Incident Response playbook action. This confirms A. Playbooks are configured for this event.
Moving a device to the High Security Collector Group is not the same as isolating it. Device isolation is a separate response action, so C. The device is moved to isolation is incorrect.
Correct answers: A and B.
The event history explicitly shows that the device was moved from the Training collector group to the High Security Collector Group. Fortinet documents Move device to High Security Group as an Automated Incident Response playbook action. This confirms A. Playbooks are configured for this event.
Moving a device to the High Security Collector Group is not the same as isolating it. Device isolation is a separate response action, so C. The device is moved to isolation is incorrect.
Correct answers: A and B.
Refer to the Exhibit: Based on the event shown in the exhibit, which two statements about the event are true? (Choose two answers)
Brave-Dump Community Votes