我々は多くの受験生にFortinetのNSE6_EDR_AD-7.0試験に合格させたことに自慢したことがないのです。IT業界での競争が激しいですから、我々は発展のために改善し続けなければなりません。だから、我々の専門家たちはタイムリーにFortinetのNSE6_EDR_AD-7.0資料を更新していて、我々の商品を利用している受験生にFortinetのNSE6_EDR_AD-7.0試験の変革とともに進めさせます。
| Section | Objectives |
|---|---|
| Topic 1: Forensics and Investigation | - Event analysis and telemetry review - Endpoint investigation workflows |
| Topic 2: Installation and Deployment | - Server and console installation requirements - Agent deployment and onboarding |
| Topic 3: System Administration and Troubleshooting | - System monitoring and health checks - Troubleshooting common FortiEDR issues |
| Topic 4: FortiEDR Architecture and Components | - System architecture and deployment models - FortiEDR components overview (agents, management console, collectors) |
| Topic 5: Policy Configuration and Management | - Policy tuning and exclusions - Prevention and detection policies |
| Topic 6: Threat Detection and Response | - Incident detection and alert handling - Automated response actions and remediation |
>> NSE6_EDR_AD-7.0日本語版対策ガイド <<
今、私たちFortinetは非常に競争の激しい世界に住んでいます。あなたがまともな仕事を見つけて高い給料を稼ぎたいなら、あなたは優れた能力と豊富な知識を所有していなければなりません。この状況では、NSE6_EDR_AD-7.0ガイドトレントを所有することは非常に重要です。特定の分野で優れた能力を習得し、仕事をうまく処理できるからです。私たちが提供するNSE6_EDR_AD-7.0試験準備は、NSE6_EDR_AD-7.0試験に合格し、簡単にNSE6_EDR_AD-7.0試験トレントを所有するという夢を実現するのに役立ちます。
質問 # 11
Refer to the Exhibit:
Based on the event shown in the exhibit, which two statements about the event are true? (Choose two answers)
正解：B、D
解説：
The correct answers are A and B .
The exhibit shows the event classification as Malicious , classified by FortinetCloudServices , and the history states that device R2D2-kvm63 was moved from the Training Collector Group to the High Security Collector Group . This is a Playbook action. The FortiEDR guide explains that after classification changes, the Overview pane displays the history of automatic FortiEDR actions, including Playbook policy-related actions .
The guide specifically lists Move device to High Security Group under Investigation actions in Playbook policies. It states that a checkmark in a classification column means the device is automatically moved to the High Security Collector Group when a security event with that classification is triggered. So the exhibit proves that Playbooks are configured for this event.
The second correct answer is B because the triggered rule is under Training * Extended Detection . The FortiEDR guide states that the eXtended Detection Policy logs events and displays them in the Incidents tab, but no blocking options are provided for this policy.
Option C is wrong because moving a device to the High Security Collector Group is not the same as isolating the device. Isolation would block communication to/from the affected Collector. The exhibit shows a Collector Group move, not isolation.
Option D is wrong because Extended Detection does not block. The guide explicitly says Extended Detection events are logged and displayed, with no blocking options provided.
=========
質問 # 12
You are asked to configure a query to run every 15 minutes, automatically searching for specific registry modifications across all endpoints. Which FortiEDR feature must you configure? (Choose one answer)
正解：D
解説：
The correct answer is C.
The FortiEDR guide explains that Threat Hunting searches across endpoint activity events, including registry activity. It states that Threat Hunting can search based on attributes of files, registry keys and values, network, processes, event log, and activity event types. This fits the requirement to search for specific registry modifications across endpoints.
The guide also explains that after filtering activity events, the query can be saved and defined as a Scheduled Query. It says: "Scheduled Query: Mark this option to automate the process of detecting threats so that this query is run automatically according to the schedule that you define." It also states that a security event is automatically created in the Incidents tab when matches are detected, and notifications can be sent through email, Syslog, and other configured methods.
The guide further states that the Repeat Every/On options define the frequency and schedule when the query runs. Therefore, a 15-minute recurring query is handled through the Scheduled Query capability in Threat Hunting, not Communication Control, policy override, or a manual Playbook trigger.
Strictly speaking, the guide calls this a scheduled query under Threat Hunting saved queries, not a
"communication control rule" or "manual query." Option C is the intended answer.
=========
質問 # 13
Within the FortiEDR architecture, which component needs JumpBox capabilities to enable authenticated and controlled communication with FortiAnalyzer? (Choose one answer)
正解：B
解説：
The correct answer is A. Core.
For FortiAnalyzer / FortiAnalyzer Cloud integration, the FortiEDR 7.0.0 Administration Guide states that one prerequisite is "A Jumpbox with connectivity to FortiAnalyzer." The same section says to refer to Setting up the FortiEDR Core for details about installing a FortiEDR Core and configuring it as a Jumpbox. In the connector configuration, the guide also states that the Jumpbox field is used to select the FortiEDR Jumpbox that will communicate with FortiAnalyzer or FortiAnalyzer Cloud.
So, the FortiEDR component associated with JumpBox capability is the Core. The Central Manager must have connectivity to Fortinet Cloud Services, but it is not the component configured as the JumpBox. The Aggregator handles registration, configuration, and monitoring between Collectors/Cores and Central Manager, and the Reputation Server is unrelated to FortiAnalyzer JumpBox communication in this context.
=========
質問 # 14
Refer to the exhibit.
Based on the exhibit, which statement about this threat hunting query is true? (Choose one answer)
正解：A
解説：
The correct answer is A .
The exhibit shows a FortiEDR Threat Hunting saved query using RemotePort:3389, scoped to a specific device, with Scheduled Query enabled, classification set to Suspicious , and a repeat interval of 15 minutes .
TCP port 3389 is the standard RDP port, so the query is designed to detect RDP-related network activity for the selected endpoint.
The FortiEDR guide states that saving a Threat Hunting query can define it as a scheduled query to automate threat detection. It further states that when a scheduled query runs and detects matches, a security event is automatically created in the Incidents tab , and notifications are sent according to the security event configuration.
Option B is too absolute and therefore wrong. The specific query shown uses a network field, but Threat Hunting itself can search activity events across files, registry, network, processes, and event logs. Option C is wrong because the Community Query checkbox is not selected, so it is not configured as a shared community
/global query. The guide states that Community Query must be selected to share the query with the FortiEDR community, including other organizations.
Option D is wrong because a scheduled Threat Hunting query generates an incident; it does not automatically block RDP unless additional playbook actions are configured. The guide says scheduled queries generate security events and may trigger configured playbook actions, but the query itself is not a blocking control.
=========
質問 # 15
Refer to the exhibit:
You are asked to block applications based on hash attributes. Which two factors must you consider when applying the hash value? (Choose two answers)
正解：A、C
解説：
The FortiEDR 7.0.0 Administration Guide states that when manually adding applications to be blocked, you can define the application using Hash or using any combination of File Name / Path / Signer attributes. This means hashes can be used independently and do not require filename, path, or signer attributes.
The guide also states that each hash is a unique identifier of an individual application, and the exhibit itself shows the hash field note: "SHA-1 or SHA-2 or MD5." Therefore, the hash must use a supported hash format, making D correct.
For multiple hash entries, the uploaded guide text says they must be comma separated , while the exhibit note says "You can enter multiple hashes comma separated." So the technically exact guide wording supports comma separation, not line separation. However, given your answer choices, A is clearly trying to test the requirement that multiple hashes must be separated correctly. The option wording says "line- separated," which is not exact against the guide; the better wording would be comma-separated . Since no
"comma-separated" option is provided, A is the intended separation-related answer, but the wording is flawed.
Option B is definitely wrong because hash mode is an alternative to attributes. Option C is also not the best answer because, although each hash uniquely identifies a file/application variant, the operational requirement is not that "hashes must be unique to each application" in the way the option implies. Hashes may represent different variants of the same application.
質問 # 16
......
当社は、NSE6_EDR_AD-7.0の実際の質問が最も信頼できるものであることを保証できます。約10年の開発を経て、高品質のNSE6_EDR_AD-7.0学習教材を開発し、すべてのお客様に忍耐するために努力を払っています。さらに、NSE6_EDR_AD-7.0学習資料が古くなっているのではないかと思われるかもしれません。 NSE6_EDR_AD-7.0の実際の質問は高速で更新されます。また、NSE6_EDR_AD-7.0テストガイドを1年間無料でお楽しみいただけますので、時間とお金を節約できます。最新のNSE6_EDR_AD-7.0学習資料をメールでお送りします。
NSE6_EDR_AD-7.0的中合格問題集: https://www.passtest.jp/Fortinet/NSE6_EDR_AD-7.0-shiken.html