Prepare NSE6_EDR_AD-7.0 Question Answers – NSE6_EDR_AD-7.0 Exam Dumps [Q14-Q36]

13Oct 2026 by admin No Comments

Rate this post

Prepare NSE6_EDR_AD-7.0 Question Answers – NSE6_EDR_AD-7.0 Exam Dumps

Real Fortinet NSE6_EDR_AD-7.0 Exam Questions [Updated 2026]

Fortinet NSE6_EDR_AD-7.0 Exam Syllabus Topics:

Section	Weight	Objectives
Topic 1: Security Settings and Policies	25%	– Communication control policies – Playbooks creation and management – Security policies configuration – Fortinet Cloud Service (FCS) integration
Topic 2: Monitoring and Troubleshooting	10%	– System monitoring and health checks – Performance and issue diagnosis – Log and alert troubleshooting
Topic 3: Events, Forensics, and Threat Hunting	25%	– Threat hunting profiles and queries – Threat hunting data interpretation – Forensic analysis and incident investigation – Security event and alert analysis
Topic 4: FortiEDR System Architecture and Deployment	25%	– Inventory management and system tools – API-based management operations – Installation and deployment process – Multi-tenancy deployment – Architecture and technical positioning
Topic 5: Integration and Security Fabric	15%	– FortiXDR deployment and configuration – Fortinet Security Fabric integration

QUESTION 14
You discovered that a newly installed collector does not display on the Inventory tab in the central manager.
Which two troubleshooting steps must you perform? (Choose two answers)

Verify that the central manager can resolve the collector hostname through DNS.

Verify that TCP ports 8081 and 555 are open between the collector and the central manager.

Check whether the FortiEDR services are running on the collector device.

Export and review the collector logs from the Central Manager for connection errors.

QUESTION 15
Refer to the Exhibit:

Based on the FortiEDR status output shown in the exhibit, what are two reasons for the degraded state?
(Choose two answers)

The endpoint has windows firewall enabled.

The collector is installed with an incorrect registration password.

The collector is installed with an incorrect port number.

The endpoint cannot reach the central manager.

QUESTION 16
Refer to the Exhibit:

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two answers)

Playbooks are configured for this event.

The policy is in simulation mode.

The device is moved to isolation.

The event has been blocked.

QUESTION 17
Refer to the exhibit.

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two answers)

The event is marked as Handled.

FCS classified the event as malicious.

The user was able to launch TestApplication.exe.

TestApplication.exe is sophisticated malware.

QUESTION 18
Refer to the exhibit.

What observation can you make about the ConnectivityTestAppNew.exe incident? (Choose one answer)

A rule assigned action is set to block but the policy is in simulation mode.

The incident has not been handled by a console administrator.

The incident was archived from the console unhandled.

The incident was handled automatically by the communication control policy.

QUESTION 19
A playbook is configured with two actions: terminate process and isolate device. The terminate process action fails because the process is protected by Windows. What is the expected behavior for the second action, isolate device? (Choose one answer)

The playbook execution pauses and requires administrator intervention.

The playbook generates a notification email and execution stops.

The playbook execution stops because the action fails.

The playbook continues and executes the second action.

QUESTION 20
You added three new applications to FortiEDR using only the Path attribute. What are two expected outcomes of this configuration? (Choose two answers)

These applications will be disabled until explicitly enabled.

Only applications in the specified directory paths will be blocked.

These applications will be blocked only if the file name also matches.

All instances of these applications will be blocked, regardless of location.

QUESTION 21
An employee leaves the company and no longer has access to the FortiEDR system. You must ensure GDPR compliance regarding the employee’s personal data stored in FortiEDR. Which two data types must be removed to meet GDPR requirements? (Choose two answers)

Device and user name

Installed applications

Installed OS name

IP address and MAC address

QUESTION 22
Which two criteria are required for integrating FortiEDR with the Fortinet Security Fabric? (Choose two answers)

Central manager connected to FCS

A Forensics add-on license

A valid API user with access to connectors

Core with core-only functionality

QUESTION 23
A company requires a global communication policy for a FortiEDR multi-tenant environment. Which recommendation must you make? (Choose one answer)

Create a separate communication control policy for each organization.

Create a new communication control policy and delegate it to other organizations.

Create a new communication control policy and assign it globally to all organizations.

Create a new communication control policy and apply it to multiple organizations.

QUESTION 24
Refer to the exhibits.

The application policy logs and application details are shown. Collector C8092231196 is a member of the Finance group. In this scenario, what must you do to block the FileZilla application? (Choose one answer)

Assign the Simulation Communication Control Policy to the DBA group.

Deny the application in the Finance policy.

Assign the Finance policy to the DBA group.

Assign the Finance policy to a broader collector group, such as the Default Collector Group.

QUESTION 25
Refer to the exhibit.

Based on the exhibit, which two observations are true? (Choose two answers)

FortiEDR has classified this as suspicious.

This incident has been resolved.

FCS has classified this as malicious.

EDR has never encountered this malware before.

QUESTION 26
What specific action does FortiEDR take when the Zero Trust Device Tagging playbook is activated?
(Choose one answer)

It removes unmanaged endpoints from FortiClient EMS.

It assigns a default tag to all endpoints.

It updates FortiClient EMS through an API and assigns a classification fabric tag.

It disables the endpoint until a tag is assigned.

QUESTION 27
A collector triggers a suspicious security incident that is initially flagged as potentially malicious. The environment is connected to the FortiEDR Cloud Service (FCS) for classification. How does FCS process the event for accurate classification? (Choose one answer)

By data processing, comprehensive automated analysis, and comprehensive manual analysis

By relying solely on the FortiGate firewall policies

By comparing the event against only local signatures

By correlating collector logs only

NSE6_EDR_AD-7.0 Exam Dumps Pass with Updated 2026: https://www.practicematerial.com/NSE6_EDR_AD-7.0-exam-materials.html

Fortinet NSE6_EDR_AD-7.0 Exam Syllabus Topics:

Leave a Reply Cancel reply