Certification FortiEDR Naja 12-12-2024

Question 1

Which connectors can you use for the FortiEDR automated incident response?

Accepted Answer

FortiNAC

Question 2

Which connectors can you use for the FortiEDR automated incident response?

Accepted Answer

FortiGate

Question 3

FortiEDR core classified event as inconclusive, later FCS revised it as malicious.What playbook actions are applied ?

Accepted Answer

Playbook actions applied to malicious events

Question 4

Collector state & active connections. Collector unable to connect to aggregator IP address 10.160.6.100. How to solve it

Accepted Answer

Reinstall collector agent and use port 8081

Question 5

Based on the event shown in the exhibit, which statement about the event are true?

Accepted Answer

TestApplication.exe is sophisticated malware.

Question 6

What is the benefit of using file hash along with the file name in a threat hunting repository search?

Accepted Answer

It helps to check the malware even if its variant uses a different filename

Question 7

What is an advantage of using communication control rules?

Accepted Answer

They automatically block at-risk applications from communicating.

Question 8

FortiXDR relies on which feature as part of its automated extended response?

Accepted Answer

Playbooks

Question 9

Based on the event exception shown in the exhibit, which statement about the exception is true?

Accepted Answer

The exception is applied only on device C8092231196.

Question 10

What format must API calls use to communicate with FortiEDR?

Accepted Answer

JSON

Question 11

Collector C8092231196 is a member of the Finance group.What must an administrator do to block the FileZilla application?

Accepted Answer

Deny application in Finance policy

Question 12

Based on the FortiEDR status output shown in the exhibit, which statement about the FortiEDR collector is true?

Accepted Answer

The collector device cannot reach the central manager.

Question 13

Which statement is true about the remediation function in the threat hunting module?

Accepted Answer

The file is removed from the affected collectors.

Question 14

Which scripting language is supported by the FortiEDR action manager?

Accepted Answer

Python

Question 15

An admin needs to restrict access to the ADMINISTRATION tab for a specific account. What role should the admin assign ?

Accepted Answer

Local Admin

Question 16

An admin finds a third party free software that does not appear in the application list in the Com ctrl csl.What is true

Accepted Answer

The application has not made any connection attempts

Question 17

Which statement about FCS playbooks is true?

Accepted Answer

They must be enabled by Fortinet Support.

Question 18

Approximately how many new malware samples can AV-TEST detect every day?

Accepted Answer

350,000

Question 19

Based on the postman output shown in the exhibit, why is the user getting an unauthorized error?

Accepted Answer

API access is disabled on the central manager.

Question 20

What is the purpose of the Threat Hunting feature?

Accepted Answer

Identify all instances of known malicious file/hash & notify affected users

Question 21

Based on the forensics data shown in the exhibit, which statement is true ?

Accepted Answer

The forensics data is displayed in the stacks view.

Question 22

Based on the event exception shown in the exhibit, which statement about the exception is true?

Accepted Answer

The system owner can modify the trigger rules parameters.

Question 23

What is the role of a collector in the communication control policy?

Accepted Answer

A collector can quarantine unsafe applications from communicating

Question 24

Which security policy has all of its rules disabled by default?

Accepted Answer

Ransomware Prevention

Question 25

In the default view, what do you see in the Collectors list when you click the Inventory tab?

Accepted Answer

All the collectors in your organization that are in a Degraded state

Question 26

What is true about classifications assigned by Fortinet Cloud Service (FCS)?

Accepted Answer

FCS is responsible for all classifications.

Question 27

Based on the event shown in the exhibit, which statement about the event is true?

Accepted Answer

The policy is in simulation mode.

Question 28

Based on the forensics data shown in the exhibit, which statement is true ?

Accepted Answer

An exception has been created for this event.

Question 29

What does it mean if an event is marked as Unhandled?

Accepted Answer

No console user has evaluated the event and marked it as handled.

Question 30

How does FortiEDR implement post-infection protection?

Accepted Answer

By preventing data exfiltration or encryption even after a breach occurs

Question 31

Which two statements about the FortiEDR solution are true?

Accepted Answer

It provides pre-infection & post-infect° protect° & It is Windows OS only

Question 32

A FortiEDR event is causing a performance issue with a third-party application.What must you do first about the event?

Accepted Answer

Investigate the event to verify whether or not the application is safe

Question 33

What is an advantage of using communication control rules?

Accepted Answer

Reduce amount of administration required to maintain communication control.

Question 34

Which two types of remote authentication does the FortiEDR management console support?

Accepted Answer

TACACS & Radius

Question 35

You are investigating an event triggered by WannaCry with a hash rated as safe in VT. What is the most likely reason?

Accepted Answer

You selected the stack of safe parent process, not the stack that triggered

Question 36

An admin finds a third party free software that does not appear in the application list in the Com ctrl csl.What is true

Accepted Answer

The app is ignored as reputation score is acceptable by the security policy

Question 37

Based on the FortiEDR status output shown in the exhibit, which statement about the FortiEDR collector is true?

Accepted Answer

The collector has been installed with an incorrect registration password

Question 38

Which statement about FCS playbooks is true?

Accepted Answer

They apply automatic exceptions.

Question 39

Based on the threat hunting event details shown in the exhibit, which statement about the event is true?

Accepted Answer

The PING.EXE process was blocked.

Question 40

Based on the event shown in the exhibit, which statement about the event are true?

Accepted Answer

The user was able to launch TestApplication.exe.

Question 41

Which statement is true about the remediation function in the threat hunting module?

Accepted Answer

The file is quarantined.

Question 42

FortiXDR relies on which feature as part of its automated extended response?

Accepted Answer

Playbooks

Question 43

What is NOT ones of the three advantages of using the FortiEDR collector agent?

Accepted Answer

It lives in the cloud.

Question 44

Based on the event shown in the exhibit, which statement about the event is true?

Accepted Answer

Playbooks is configured for this event.

Question 45

A company requires a global communication policy for a FortiEDR multi-tenant env. How can the administrator achieve this

Accepted Answer

An administrator creates a new communication control policy for each Organi

Question 46

Based on the threat hunting event details shown in the exhibit, which statement about the event is true?

Accepted Answer

The activity event is associated with the file action.

Question 47

On FortiEDR, what is the response time gap?

Accepted Answer

The delay between detecting a problem and responding to it

Question 48

Based on the threat hunting query shown in the exhibit, which of the following is true?

Accepted Answer

RDP connections will be blocked and classified as suspicious.

Question 49

Which FortiEDR component is required to find malicious files on the entire network of an organization?

Accepted Answer

FortiEDR Central Manager

Question 50

Which threat hunting profile is the most resource intensive?

Accepted Answer

Comprehensive

Certification FortiEDR Naja 12-12-2024

Questions 50

Certification FortiEDR Naja 12-12-2024

Questions 50