GoShikenは多くのIT職員の夢を達成することであるウェブサイトです。IT夢を持っていたら、速くGoShikenに来ましょう。 GoShikenにはすごいトレーニング即ち FortinetのNSE6_EDR_AD-7.0試験トレーニング資料があります。これはIT職員の皆が熱望しているものです。あなたが試験に合格することを助けられますから。
| Section | Weight | Objectives |
|---|---|---|
| Security Settings and Policies | 25% | - Fortinet Cloud Service (FCS) integration - Playbooks creation and management - Security policies configuration - Communication control policies |
| Monitoring and Troubleshooting | 10% | - Performance and issue diagnosis - System monitoring and health checks - Log and alert troubleshooting |
| FortiEDR System Architecture and Deployment | 25% | - Inventory management and system tools - Architecture and technical positioning - Multi-tenancy deployment - API-based management operations - Installation and deployment process |
| Events, Forensics, and Threat Hunting | 25% | - Threat hunting data interpretation - Threat hunting profiles and queries - Security event and alert analysis - Forensic analysis and incident investigation |
| Integration and Security Fabric | 15% | - FortiXDR deployment and configuration - Fortinet Security Fabric integration |
それでもNSE6_EDR_AD-7.0認定試験に腹を立て、インターネット上の専門のNSE6_EDR_AD-7.0学習ガイド教材を無意識に探している場合、受験者がキーの整理に役立つ最高のNSE6_EDR_AD-7.0試験準備教材を選択するのに良い方法です。知識を効果的かつ迅速に。ご購入前に、参照用に無料のPDFデモをダウンロードできます。製品を購入すると、10分以内に製品を受け取ることができます。NSE6_EDR_AD-7.0試験にあまり時間をかける必要はありませんが、短時間で認定資格を取得できます。
質問 # 14
Refer to the exhibit:
You configured an execution prevention exclusion with both File Name = app.exe and Path = C:\Tools. What will FortiEDR do? (Choose one answer)
正解：C
解説：
The correct answer is B. Exclude only app.exe when it is running from C:\Tools.
The FortiEDR 7.0.0 Administration Guide explains that the Exclusion Manager is used to define which processes, files, or domains are excluded from Security Policies monitoring. For Process Exclusions, FortiEDR does not inspect actions performed by specific processes, and those processes are identified by the attributes defined by the administrator.
The guide further explains that process/source attributes can include File Name, Path, Hash, and Signer. It also states that when an exclusion contains multiple conditions, an AND relationship exists between the conditions. If an OR relationship is required, a separate exclusion must be created.
In this exhibit, both conditions are selected:
File Name = app.exe
Path = C:\Tools
Because FortiEDR applies an AND relationship between multiple exclusion conditions, the exclusion applies only when both conditions match. Therefore, FortiEDR excludes app.exe only when it is located/running from C:\Tools.
Option A is wrong because no Signer condition is selected. Option C is wrong because that would apply if only the file name were used broadly. Option D is wrong because FortiEDR is not excluding every file in C:
\Tools; it is excluding the process that matches both the file name and path conditions.
質問 # 15
Refer to the Exhibit:
Based on the incident details shown in the exhibit, which two statements about this incident are true? (Choose two answers)
正解：B、D
解説：
The correct answers are A and C .
The exhibit shows an audit/response action stating that IP address 74.125.235.20 was added to malicious IP addresses on firewall FortiGate . This matches the FortiEDR playbook action Block address on Firewall .
The guide states that this action ensures connections to remote malicious addresses associated with the security event are blocked, and that a firewall connector must already be configured for this action. It also explains that a checkmark in a classification column means communication with the affected destination is automatically blocked when a security event with that classification is triggered.
Option C is the second best answer because FortiEDR events are initially classified by FortiEDR detection logic/Core, and the guide states that classifications are initially determined by the Core but can later be changed automatically by FortiEDR Cloud Service or manually. The exhibit shows "Classification Changed To: Suspicious (By Fortinet)" , but it does not say the event was manually classified by an administrator. So the event classification process is FortiEDR-driven, with later Fortinet/FCS-style automatic classification possible.
Option B is wrong. The exhibit shows one raw-data row with device cwinserv-32 +2 , which indicates more than one affected device/raw item is represented in the aggregation. So it did not occur on only one device.
Option D is wrong because the incident rows clearly show Unhandled . The guide states that security events are initially marked as unread and unhandled, and the unread/unhandled status helps users track whether anyone has read and handled the event.
=========
質問 # 16
You are asked to create a playbook to isolate a device with a collector. Which action category does isolating a device with a collector fall under? (Choose one answer)
正解：B
解説：
The correct answer is A. Investigation .
The FortiEDR 7.0.0 Administration Guide states that Investigation actions enable administrators to isolate a device or assign it to a high-security Collector Group for further investigation of the device's activity. Under the Investigation section, the guide lists the available investigation action types, including "Isolate device with Collector," "Isolate device with NAC," and "Move device to High Security Group." For Isolate device with Collector , the guide explains that the action blocks communication to and from the affected Collector, and it applies only to endpoint Collectors. If the Playbook policy is configured to isolate a device for a malicious event, then when a malicious security event is triggered, the device is isolated from communicating with the outside world for both sending and receiving.
So, this is not a Remediation , Custom , or Notification action. In FortiEDR Playbook policy terminology, Isolate device with Collector belongs under Investigation .
=========
質問 # 17
You are asked to configure a query to run every 15 minutes, automatically searching for specific registry modifications across all endpoints. Which FortiEDR feature must you configure? (Choose one answer)
正解：A
解説：
The correct answer is C.
The FortiEDR guide explains that Threat Hunting searches across endpoint activity events, including registry activity. It states that Threat Hunting can search based on attributes of files, registry keys and values, network, processes, event log, and activity event types. This fits the requirement to search for specific registry modifications across endpoints.
The guide also explains that after filtering activity events, the query can be saved and defined as a Scheduled Query. It says: "Scheduled Query: Mark this option to automate the process of detecting threats so that this query is run automatically according to the schedule that you define." It also states that a security event is automatically created in the Incidents tab when matches are detected, and notifications can be sent through email, Syslog, and other configured methods.
The guide further states that the Repeat Every/On options define the frequency and schedule when the query runs. Therefore, a 15-minute recurring query is handled through the Scheduled Query capability in Threat Hunting, not Communication Control, policy override, or a manual Playbook trigger.
Strictly speaking, the guide calls this a scheduled query under Threat Hunting saved queries, not a
"communication control rule" or "manual query." Option C is the intended answer.
=========
質問 # 18
Refer to the exhibits.
You are attempting to move a collector into the High Security Collector Group for isolation but encounter an error in the API request as shown in the exhibit. To successfully isolate the collector, which API parameter must you correct? (Choose one answer)
正解：B
解説：
The correct answer is A. Set the organization parameter to Default .
From the first exhibit, the API query result for the Collector shows:
* Collector name: Desktop-PC
* Collector group name: Engineering
* Organization: Default
* State: Running
But in the second exhibit, the API request is using:
* organization = Fortinet-Training
* collectors = Desktop-PC
* targetCollectorGroup = High Security Collector Group
That organization value is wrong. The Collector belongs to the Default organization, so the API request must reference the Collector's actual organization. Otherwise FortiEDR cannot locate or move that Collector under the organization specified in the request.
The FortiEDR guide confirms that Collector Groups are used to assign different FortiEDR policies to different Collectors, and that Collectors can be moved between groups/organizations in the Inventory workflow. In Hoster view, FortiEDR shows Collectors from all organizations and allows moving Collectors between organizations, but the organization context must match the Collector being managed.
Option B is wrong because the exhibit shows the API request is authorized; the failure is a 400 Bad Request , not an authentication failure. Option C is wrong because the endpoint shown is already a move/update operation using PUT, and the issue is not the HTTP method. Option D is wrong because Engineering is the current Collector Group. The goal is to move the Collector to High Security Collector Group , so changing the target back to Engineering would not isolate or harden the Collector.
=========
質問 # 19
......
日常から離れて理想的な生活を求めるには、職場で高い得点を獲得し、試合に勝つために余分なスキルを習得する必要があります。同時に、社会的競争は現代の科学、技術、ビジネスの発展を刺激し、NSE6_EDR_AD-7.0試験に対する社会の認識に革命をもたらし、人々の生活の質に影響を与えます。 NSE6_EDR_AD-7.0試験問題は、あなたの夢をかなえるのに役立ちます。さらに、NSE6_EDR_AD-7.0ガイドトレントに関する詳細情報を提供する当社のWebサイトにアクセスできます。
NSE6_EDR_AD-7.0日本語版トレーリング: https://www.goshiken.com/Fortinet/NSE6_EDR_AD-7.0-mondaishu.html