Fortinet NSE6_EDR_AD-7.0 Exam Dumps

The correct answer is B.

In the exhibit, the incident status clearly shows Unhandled at the incident level and also on the event rows. The FortiEDR guide explains that every detected security event is initially marked as unread and unhandled, and these statuses help multiple FortiEDR Central Manager users track whether anyone has read and handled the message.

The guide also states that when a FortiEDR Central Manager user marks a security event as Handled, all users see it as handled. The process is performed by selecting the event and clicking Handle Incident or the flag icon, then saving the incident handling details.

So the valid observation from the exhibit is that the incident has not been handled by a console administrator.

Option A is not supported by the exhibit. There is no visible evidence that the policy is in Simulation mode. Option C is wrong because the incident is still visible, not archived or deleted. Option D is wrong because the status is explicitly Unhandled; it was not handled automatically by a Communication Control policy.

=========

The correct answer is C.

The FortiEDR 7.0.0 Administration Guide states that for on-premises deployments, the on-premise reputation service requests missing hashes from the cloud reputation service. If a proxy is not enabled, it requests the missing hashes from the cloud reputation service through the manager nginx. If a proxy is enabled, the on-premises reputation service requests the missing hashes through the proxy.

So, when the local reputation database does not contain the requested hash, the on-premises reputation server does not ignore the request, wait for endpoint input, or automatically block the application. It queries the cloud reputation service for the missing hash reputation data.

=========

The correct answer is C. The user account does not have the REST API role assigned.

The exhibit shows a Postman request to the FortiEDR Central Manager REST endpoint:

/management-rest/inventory/list-collectors

The response is 401 Unauthorized, which means the request reached the FortiEDR API endpoint but the supplied user credentials are not authorized for REST API access.

The FortiEDR 7.0.0 Administration Guide states that when adding or editing a user, the Rest API advanced option controls whether the user is allowed to access the FortiEDR Central Manager through API calls. The guide defines this option as: ''Rest API --- Specifies whether to allow the user to access the FortiEDR Central Manager through API calls.''

Therefore, the most accurate cause is that the account being used in Postman does not have the Rest API permission enabled.

Option A is incorrect because the request uses GET against a list endpoint, and an unsupported method would not normally be represented by this user-authentication failure. Option B is not supported by the exhibit or guide wording; the guide describes enabling REST API access per user. Option D is incorrect because first-login password reset is not the direct cause of this REST API authorization failure. The guide separately discusses password reset and password policy behavior, but that is not what the API error indicates.

The correct answer is A.

The FortiEDR 7.0.0 Administration Guide states that the FortiEDR Cloud Service (FCS) enriches and enhances system security by performing deep, thorough analysis and investigation about the classification of a security event. It determines the exact classification of security events with a high degree of accuracy.

The guide further explains that the FCS classification process is performed through data enrichment and enhanced deep analysis and investigation enabled by automated and manual processes. These processes may include intelligence services, static and dynamic file analysis, sandboxing, flow analysis through machine learning, commonality analysis, crowdsourced data deduction, and more.

Therefore, FCS does not rely only on FortiGate firewall policies, local signatures, or raw Collector log correlation. It performs enriched cloud-based automated and manual analysis to classify the incident accurately.

=========

The correct answers are C and D.

The guide states that for eXtended Detection Source integration, FortiEDR connects to external systems to collect activity logs. The aggregated data is then sent to Fortinet Cloud Services (FCS), where it is correlated and analyzed to detect malicious indications. Those malicious indications result in security events for eXtended Detection policy rule violations.

For FortiAnalyzer/FortiAnalyzer Cloud specifically, the guide states that this integration is used to correlate data between FortiEDR and the Fortinet Security Fabric and issue eXtended Detection alerts.

Option A is wrong because FCS does not send the original log record to FortiAnalyzer. FortiAnalyzer is the external source whose data is correlated with FortiEDR data. Option B is wrong because OS metadata is collected by the Collector and handled through FortiEDR components; the FCS role here is cloud-side enrichment, correlation, and detection, not sending OS metadata back to the manager.

=========