NewDumps為通過NSE6_EDR_AD-7.0考試提供最完整有效的方案，幫祝廣大考生在考試中獲得更多的優勢。確保你只獲得最新的和最有效的Fortinet NSE6_EDR_AD-7.0考古題，我們也希望客戶能隨時隨地的訪問，于是有了多個版本的題庫資料。PDF版的題庫方便你閱讀，為你真實地再現NSE6_EDR_AD-7.0考試題目，軟件版本的題庫作為一個測試引擎，可以幫你模擬真實的NSE6_EDR_AD-7.0考試環境，為考生做好充足的考前準備。通過Fortinet NSE6_EDR_AD-7.0考試不再是夢想，我們的考古題就可以確保你成功。
| Section | Objectives |
|---|---|
| Threat Detection and Response | - Automated response actions and remediation - Incident detection and alert handling |
| Policy Configuration and Management | - Policy tuning and exclusions - Prevention and detection policies |
| System Administration and Troubleshooting | - Troubleshooting common FortiEDR issues - System monitoring and health checks |
| FortiEDR Architecture and Components | - FortiEDR components overview (agents, management console, collectors) - System architecture and deployment models |
| Installation and Deployment | - Server and console installation requirements - Agent deployment and onboarding |
| Forensics and Investigation | - Endpoint investigation workflows - Event analysis and telemetry review |
你在煩惱什麼呢？是因為Fortinet的NSE6_EDR_AD-7.0認證考試而煩惱嗎？確實，NSE6_EDR_AD-7.0考試是一門很難通過的考試。但是你也不用過分擔心。只要你利用了適當的方法，輕鬆地通過考試也不是不可能的。那麼你知道什麼是適當的方法嗎？使用NewDumps的NSE6_EDR_AD-7.0資料就是一種最好不過的方法。NewDumps一直以來幫助了很多參加IT認定考試的考生，並且得到了大家的一致好評。這個資料可以保證你一次通過考試，請放心使用。
問題 #26
You discovered that a newly installed collector does not display on the Inventory tab in the central manager.
Which two troubleshooting steps must you perform? (Choose two answers)
答案：B,C
解題說明：
The correct answers are B and C .
The FortiEDR 7.0.0 Administration Guide has a specific troubleshooting section named "A FortiEDR Collector does not display in the INVENTORY tab." It states that after a Collector is first launched, it registers with the FortiEDR Central Manager and appears in the Inventory tab. If it does not appear, the first checks are to confirm that the device where the Collector is installed is powered on and has Internet connectivity, and to validate that ports 8081 and 555 are available and not blocked by another third-party product.
Option B is therefore correct in the exam sense because ports 8081 and 555 must be open for FortiEDR communication. More precisely, the Collector communicates with the Aggregator on port 8081 and the Core on port 555 , not directly to the Central Manager in every architecture. The option wording says "between the collector and the central manager," which is technically loose, but the required troubleshooting item is still the port availability.
Option C is also correct because the same guide says to check that the endpoint is powered on and connected.
In practical FortiEDR troubleshooting, this includes confirming the FortiEDR Collector service/driver are running on the endpoint; otherwise the Collector cannot register or report health.
Option A is not listed in the FortiEDR guide as a required step for this issue. Option D is not the best answer because the guide says logs are generally retrieved when Fortinet Support requests them, and Collector logs can only be exported for Collectors in Running status; a newly installed Collector that does not appear in Inventory cannot normally be selected from Central Manager for log export.
問題 #27
What specific action does FortiEDR take when the Zero Trust Device Tagging playbook is activated?
(Choose one answer)
答案：D
問題 #28
Refer to the Exhibit:
Based on the event shown in the exhibit, which two statements about the event are true? (Choose two answers)
答案：A,B
解題說明：
The correct answers are A and B .
The exhibit shows the event classification as Malicious , classified by FortinetCloudServices , and the history states that device R2D2-kvm63 was moved from the Training Collector Group to the High Security Collector Group . This is a Playbook action. The FortiEDR guide explains that after classification changes, the Overview pane displays the history of automatic FortiEDR actions, including Playbook policy-related actions .
The guide specifically lists Move device to High Security Group under Investigation actions in Playbook policies. It states that a checkmark in a classification column means the device is automatically moved to the High Security Collector Group when a security event with that classification is triggered. So the exhibit proves that Playbooks are configured for this event.
The second correct answer is B because the triggered rule is under Training * Extended Detection . The FortiEDR guide states that the eXtended Detection Policy logs events and displays them in the Incidents tab, but no blocking options are provided for this policy.
Option C is wrong because moving a device to the High Security Collector Group is not the same as isolating the device. Isolation would block communication to/from the affected Collector. The exhibit shows a Collector Group move, not isolation.
Option D is wrong because Extended Detection does not block. The guide explicitly says Extended Detection events are logged and displayed, with no blocking options provided.
=========
問題 #29
Refer to Exhibit.
Based on the Postman output shown in the exhibit, why is the user receiving an unauthorized error? (Choose one answer)
答案：A
解題說明：
The correct answer is C. The user account does not have the REST API role assigned .
The exhibit shows a Postman request to the FortiEDR Central Manager REST endpoint:
/management-rest/inventory/list-collectors
The response is 401 Unauthorized , which means the request reached the FortiEDR API endpoint but the supplied user credentials are not authorized for REST API access.
The FortiEDR 7.0.0 Administration Guide states that when adding or editing a user, the Rest API advanced option controls whether the user is allowed to access the FortiEDR Central Manager through API calls. The guide defines this option as: "Rest API - Specifies whether to allow the user to access the FortiEDR Central Manager through API calls." Therefore, the most accurate cause is that the account being used in Postman does not have the Rest API permission enabled.
Option A is incorrect because the request uses GET against a list endpoint, and an unsupported method would not normally be represented by this user-authentication failure. Option B is not supported by the exhibit or guide wording; the guide describes enabling REST API access per user. Option D is incorrect because first- login password reset is not the direct cause of this REST API authorization failure. The guide separately discusses password reset and password policy behavior, but that is not what the API error indicates.
問題 #30
You are asked to create a playbook to isolate a device with a collector. Which action category does isolating a device with a collector fall under? (Choose one answer)
答案：C
解題說明：
The correct answer is A. Investigation .
The FortiEDR 7.0.0 Administration Guide states that Investigation actions enable administrators to isolate a device or assign it to a high-security Collector Group for further investigation of the device's activity. Under the Investigation section, the guide lists the available investigation action types, including "Isolate device with Collector," "Isolate device with NAC," and "Move device to High Security Group." For Isolate device with Collector , the guide explains that the action blocks communication to and from the affected Collector, and it applies only to endpoint Collectors. If the Playbook policy is configured to isolate a device for a malicious event, then when a malicious security event is triggered, the device is isolated from communicating with the outside world for both sending and receiving.
So, this is not a Remediation , Custom , or Notification action. In FortiEDR Playbook policy terminology, Isolate device with Collector belongs under Investigation .
=========
問題 #31
......
NewDumps 的 NSE6_EDR_AD-7.0 題庫是隨著 Fortinet 認證廠商對其做出的變化而變化的，確保了題庫的覆蓋率在96％以上，保證考生能順利通過 Fortinet NSE6_EDR_AD-7.0 考試，獲取認證證書。我們的 Fortinet NSE6_EDR_AD-7.0 模拟测试题具有最高的专业技术含量，供具有相关专业知识的专家和学者学习和研究之用。你還可以登陸我們題庫網站下載更多想要的認證考試題庫資料。
新版NSE6_EDR_AD-7.0題庫: https://www.newdumpspdf.com/NSE6_EDR_AD-7.0-exam-new-dumps.html