我々CertJukenでは、あなたは一番優秀なFortinet NSE6_EDR_AD-7.0問題集を発見できます。我が社のサービスもいいです。購入した前、弊社はあなたが準備したいNSE6_EDR_AD-7.0試験問題集のサンプルを無料に提供します。購入した後、一年間の無料サービス更新を提供します。Fortinet NSE6_EDR_AD-7.0問題集に合格しないなら、180日内で全額返金します。あるいは、他の科目の試験を変えていいです。
| Section | Weight | Objectives |
|---|---|---|
| Security Settings and Policies | 25% | - Fortinet Cloud Service (FCS) integration - Communication control policies - Playbooks creation and management - Security policies configuration |
| Events, Forensics, and Threat Hunting | 25% | - Threat hunting data interpretation - Forensic analysis and incident investigation - Security event and alert analysis - Threat hunting profiles and queries |
| Integration and Security Fabric | 15% | - Fortinet Security Fabric integration - FortiXDR deployment and configuration |
| Monitoring and Troubleshooting | 10% | - Log and alert troubleshooting - Performance and issue diagnosis - System monitoring and health checks |
| FortiEDR System Architecture and Deployment | 25% | - Inventory management and system tools - API-based management operations - Architecture and technical positioning - Installation and deployment process - Multi-tenancy deployment |
NSE6_EDR_AD-7.0の試験問題は頻繁に更新され、十分な数のテストバンクを取得して、理論と実践の傾向を追跡できることが保証されます。つまり、NSE6_EDR_AD-7.0トレーニング資料は多くの利点を高め、NSE6_EDR_AD-7.0ガイド急流をよりよく理解するためです。 NSE6_EDR_AD-7.0実践ガイドを購入して、私たちFortinetを信頼してください。それでも私たちを完全に信じられない場合は、NSE6_EDR_AD-7.0学習質問の機能と機能の紹介をお読みください。
質問 # 25
Refer to the exhibit.
Based on the exhibit, which statement about this threat hunting query is true? (Choose one answer)
正解：D
解説：
The correct answer is A .
The exhibit shows a FortiEDR Threat Hunting saved query using RemotePort:3389, scoped to a specific device, with Scheduled Query enabled, classification set to Suspicious , and a repeat interval of 15 minutes .
TCP port 3389 is the standard RDP port, so the query is designed to detect RDP-related network activity for the selected endpoint.
The FortiEDR guide states that saving a Threat Hunting query can define it as a scheduled query to automate threat detection. It further states that when a scheduled query runs and detects matches, a security event is automatically created in the Incidents tab , and notifications are sent according to the security event configuration.
Option B is too absolute and therefore wrong. The specific query shown uses a network field, but Threat Hunting itself can search activity events across files, registry, network, processes, and event logs. Option C is wrong because the Community Query checkbox is not selected, so it is not configured as a shared community
/global query. The guide states that Community Query must be selected to share the query with the FortiEDR community, including other organizations.
Option D is wrong because a scheduled Threat Hunting query generates an incident; it does not automatically block RDP unless additional playbook actions are configured. The guide says scheduled queries generate security events and may trigger configured playbook actions, but the query itself is not a blocking control.
=========
質問 # 26
Refer to the Exhibit:
Based on the incident details shown in the exhibit, which two statements about this incident are true? (Choose two answers)
正解：C、D
解説：
The correct answers are A and C .
The exhibit shows an audit/response action stating that IP address 74.125.235.20 was added to malicious IP addresses on firewall FortiGate . This matches the FortiEDR playbook action Block address on Firewall .
The guide states that this action ensures connections to remote malicious addresses associated with the security event are blocked, and that a firewall connector must already be configured for this action. It also explains that a checkmark in a classification column means communication with the affected destination is automatically blocked when a security event with that classification is triggered.
Option C is the second best answer because FortiEDR events are initially classified by FortiEDR detection logic/Core, and the guide states that classifications are initially determined by the Core but can later be changed automatically by FortiEDR Cloud Service or manually. The exhibit shows "Classification Changed To: Suspicious (By Fortinet)" , but it does not say the event was manually classified by an administrator. So the event classification process is FortiEDR-driven, with later Fortinet/FCS-style automatic classification possible.
Option B is wrong. The exhibit shows one raw-data row with device cwinserv-32 +2 , which indicates more than one affected device/raw item is represented in the aggregation. So it did not occur on only one device.
Option D is wrong because the incident rows clearly show Unhandled . The guide states that security events are initially marked as unread and unhandled, and the unread/unhandled status helps users track whether anyone has read and handled the event.
=========
質問 # 27
You added three new applications to FortiEDR using only the Path attribute. What are two expected outcomes of this configuration? (Choose two answers)
正解：C、D
解説：
The correct answers are A and B .
The FortiEDR 7.0.0 Administration Guide states that newly added applications are disabled by default , which means they are not blocked unless enabled. The guide further explains that the default state can be changed by enabling the Enable Default application state option in the Application Control Manager settings. Therefore, option A is correct.
Option B is also correct because Application Control allows an application to be defined by Hash or by any combination of File Name / Path / Signer . The guide says that the Path field specifies the path to the executable file of the application to be blocked. When using path-based matching, the enforcement is tied to the specified path criteria, not to every possible location of the same file.
Option C is wrong because the file name does not also need to match when only the Path attribute is used.
Option D is wrong because blocking all instances regardless of location applies when only the File Name field is used, not when the match is path-specific. The guide explicitly states that if only the File Name field is filled, the application is blocked no matter where the executable appears.
質問 # 28
Refer to the Exhibit:
A FortiEDR analyst is prioritizing response efforts. One application has a vulnerability score of Critical but an Unknown ACI rating, while another has a Medium vulnerability score with active ACI evidence of adversary targeting. Which application must be addressed first? (Choose one answer)
正解：B
解説：
The correct answer is D .
The FortiEDR 7.0.0 Administration Guide explains that FortiEDR displays two severity ratings for applications: NIST Severity and ACI Severity . NIST Severity is based on FortiEDR's vulnerability scoring system using the NIST Cybersecurity Framework. ACI Severity, however, is Adversary Centric Intelligence provided by FortiRecon and FortiGuard Threat Analysts, covering dark web, open-source, and technical threat intelligence, including threat actor insights . This helps administrators proactively assess risk, respond faster to incidents, understand attackers, and protect assets.
The guide also states that FortiEDR helps analysts prioritize alerts and incidents using risk factors such as severity of vulnerabilities , relevance of threat intelligence feeds , and severity of affected endpoints , so effort is focused on the most significant organizational risks.
Therefore, the application with Medium NIST severity but active ACI evidence of adversary targeting should be prioritized over an application with Critical NIST severity but Unknown ACI rating , because active adversary-centric intelligence indicates current attacker interest or exploitation relevance. In plain terms: a theoretical critical vulnerability matters, but an actively targeted vulnerability is the fire you put out first.
Option B is tempting but incomplete because it relies only on NIST/CVSS severity. FortiEDR's ACI rating exists specifically to add adversary context to prioritization. Option A is wrong because FortiEDR does not treat all vulnerable applications equally. Option C is wrong because asset criticality can matter, but the guide does not say prioritization depends only on asset criticality.
=========
質問 # 29
You are asked to configure a query to run every 15 minutes, automatically searching for specific registry modifications across all endpoints. Which FortiEDR feature must you configure? (Choose one answer)
正解：D
解説：
The correct answer is C.
The FortiEDR guide explains that Threat Hunting searches across endpoint activity events, including registry activity. It states that Threat Hunting can search based on attributes of files, registry keys and values, network, processes, event log, and activity event types. This fits the requirement to search for specific registry modifications across endpoints.
The guide also explains that after filtering activity events, the query can be saved and defined as a Scheduled Query. It says: "Scheduled Query: Mark this option to automate the process of detecting threats so that this query is run automatically according to the schedule that you define." It also states that a security event is automatically created in the Incidents tab when matches are detected, and notifications can be sent through email, Syslog, and other configured methods.
The guide further states that the Repeat Every/On options define the frequency and schedule when the query runs. Therefore, a 15-minute recurring query is handled through the Scheduled Query capability in Threat Hunting, not Communication Control, policy override, or a manual Playbook trigger.
Strictly speaking, the guide calls this a scheduled query under Threat Hunting saved queries, not a
"communication control rule" or "manual query." Option C is the intended answer.
=========
質問 # 30
......
CertJukenのNSE6_EDR_AD-7.0スタディガイドには、さまざまなニーズを満たすことができる3つの形式があります。PDFバージョン、ソフトウェアバージョン、オンラインバージョンです。 PDFバージョンを選択した場合は、NSE6_EDR_AD-7.0学習資料をダウンロードして、どこでも学習できるように印刷できます。新しいバージョンがリリースされた場合は、電子メールボックスへの新しいリンクが送信され、再度ダウンロードできます。ソフトウェアバージョンのNSE6_EDR_AD-7.0試験教材を使用すると、実際のFortinet NSE 6 - FortiEDR 7.0 Administrator試験と同じような環境で練習できます。また、NSE6_EDR_AD-7.0実践ガイドのAPPバージョンは、あらゆる種類の電子機器で利用できます。
NSE6_EDR_AD-7.0試験解答: https://www.certjuken.com/NSE6_EDR_AD-7.0-exam.html