NSE5_EDR-5.0 Practice Test

Review 44 NSE5-EDR-5-0 practice questions with answer explanations and community insights.

Question 1

What is true about classifications assigned by Fortinet Cloud Service (FCS)?

  1. FCS revises the classification of the core based on its database.
  2. The core only assigns a classification if FCS is not available.
  3. FCS is responsible for all classifications.
  4. The core is responsible for all classifications if FCS playbooks are disabled.

Question 2

Based on the forensics data shown in the exhibit, which two statements are true? (Choose two.)

  1. The device cannot be remediated.
  2. The execution prevention policy has blocked this event.
  3. The event was blocked because the certificate is unsigned.
  4. Device C8092231196 has been isolated.

Question 3

Refer to the exhibit. Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

  1. The NGAV policy has blocked TestApplication.exe.
  2. FCS classified the event as malicious.
  3. TestApplication.exe is sophisticated malware.
  4. The user was able to launch TestApplication.exe.

Question 4

How does FortiEDR implement post-infection protection?

  1. By insurance against ransomware
  2. By preventing data exfiltration or encryption even after a breach occurs
  3. By real-time filtering to prevent malware from executing
  4. By using methods used by traditional EDR

Question 5

Which scripting language is supported by the FortiEDR action manager?

  1. TCL
  2. Bash
  3. Perl
  4. Python