Fortinet NSE6_EDR_AD-7.0 Fortinet NSE 6 - FortiEDR 7.0 Administrator Exam Practice Test

The correct answers are B and C .

The exhibit shows:

FortiEDR Service: Up

FortiEDR Driver: Up

FortiEDR Status: Degraded (no configuration)

This means the local Collector service and driver are running, but the Collector has not received valid configuration. In FortiEDR, a Collector must register and communicate with the FortiEDR Aggregator to receive its configuration. The guide states that the Collector initially sends registration information to the FortiEDR Aggregator using SSL, sends ongoing health/status/security-event information, and receives its configuration from the Aggregator.

During installation, a non-customized Windows Collector requires the correct Aggregator address , Aggregator port 8081 , and registration password . The guide explicitly states that the Aggregator port should be specified as 8081 , and that the registration password must be entered during installation.

Therefore, an incorrect registration password or incorrect port number can prevent proper registration/configuration retrieval, resulting in a degraded/no-configuration state.

Option A is not the best answer because Windows Firewall being enabled by itself does not automatically cause this FortiEDR status; only if it blocks required FortiEDR communication would it matter, and the option is too generic. Option D is also not correct as written because the Collector receives configuration from the Aggregator , not directly from the Central Manager. The guide describes Collector-to-Aggregator communication for registration and configuration.

=========

The correct answer is C. The user account does not have the REST API role assigned .

The exhibit shows a Postman request to the FortiEDR Central Manager REST endpoint:

/management-rest/inventory/list-collectors

The response is 401 Unauthorized , which means the request reached the FortiEDR API endpoint but the supplied user credentials are not authorized for REST API access.

The FortiEDR 7.0.0 Administration Guide states that when adding or editing a user, the Rest API advanced option controls whether the user is allowed to access the FortiEDR Central Manager through API calls. The guide defines this option as: “Rest API — Specifies whether to allow the user to access the FortiEDR Central Manager through API calls.”

Therefore, the most accurate cause is that the account being used in Postman does not have the Rest API permission enabled.

Option A is incorrect because the request uses GET against a list endpoint, and an unsupported method would not normally be represented by this user-authentication failure. Option B is not supported by the exhibit or guide wording; the guide describes enabling REST API access per user. Option D is incorrect because first-login password reset is not the direct cause of this REST API authorization failure. The guide separately discusses password reset and password policy behavior, but that is not what the API error indicates.

The correct answers are C and D .

The exhibit shows an exception created/updated by FortinetCloudServices after the file Update.exe was classified as Good . This aligns with the FortiEDR Cloud Service behavior described in the guide. The guide states that once FCS is connected, it can enable Tuning , which means automated security event exception/allowlisting. After a triggered security event is reclassified as Safe, an automated cross-environment exception can be pushed downstream and the event expires, preventing it from triggering again.

Option C is correct because the Event Exceptions window includes Triggered Rules , and the guide states that when editing an exception, the administrator can modify the Collector Groups , Destinations , Users , and the pairs of rules and processes that define the exception in the Triggered Rules area.

Option D is the Fortinet/FCS-related statement supported by the guide’s FCS behavior. The guide says FCS can enable follow-up actions, including Tuning through automated exceptions and Playbook Actions , and that playbook policy remediation actions are based on the final FCS determination.

Option A is wrong because the exhibit explicitly states “All the Raw Data Items are covered.” A partial exception would mean not all raw data items are covered. The guide explains that if an exception does not cover all raw data items, FortiEDR displays a different indicator and distinguishes covered from non-covered raw data items.

Option B is wrong because the exception scope in the exhibit is set to All groups , All destinations , and All users . The comment references device C8092231196, but that is not the same as saying the exception applies only to that device.

=========

The correct answers are B and C .

The FortiEDR 7.0.0 Administration Guide has a specific troubleshooting section named “A FortiEDR Collector does not display in the INVENTORY tab.” It states that after a Collector is first launched, it registers with the FortiEDR Central Manager and appears in the Inventory tab. If it does not appear, the first checks are to confirm that the device where the Collector is installed is powered on and has Internet connectivity, and to validate that ports 8081 and 555 are available and not blocked by another third-party product.

Option B is therefore correct in the exam sense because ports 8081 and 555 must be open for FortiEDR communication. More precisely, the Collector communicates with the Aggregator on port 8081 and the Core on port 555 , not directly to the Central Manager in every architecture. The option wording says “between the collector and the central manager,” which is technically loose, but the required troubleshooting item is still the port availability.

Option C is also correct because the same guide says to check that the endpoint is powered on and connected. In practical FortiEDR troubleshooting, this includes confirming the FortiEDR Collector service/driver are running on the endpoint; otherwise the Collector cannot register or report health.

Option A is not listed in the FortiEDR guide as a required step for this issue. Option D is not the best answer because the guide says logs are generally retrieved when Fortinet Support requests them, and Collector logs can only be exported for Collectors in Running status; a newly installed Collector that does not appear in Inventory cannot normally be selected from Central Manager for log export.

The correct answer is B .

In the exhibit, the incident status clearly shows Unhandled at the incident level and also on the event rows. The FortiEDR guide explains that every detected security event is initially marked as unread and unhandled , and these statuses help multiple FortiEDR Central Manager users track whether anyone has read and handled the message.

The guide also states that when a FortiEDR Central Manager user marks a security event as Handled , all users see it as handled. The process is performed by selecting the event and clicking Handle Incident or the flag icon, then saving the incident handling details.

So the valid observation from the exhibit is that the incident has not been handled by a console administrator .

Option A is not supported by the exhibit. There is no visible evidence that the policy is in Simulation mode. Option C is wrong because the incident is still visible, not archived or deleted. Option D is wrong because the status is explicitly Unhandled ; it was not handled automatically by a Communication Control policy.

=========

The correct answer is A. Set the organization parameter to Default .

From the first exhibit, the API query result for the Collector shows:

Collector name: Desktop-PC

Collector group name: Engineering

Organization: Default

State: Running

But in the second exhibit, the API request is using:

organization = Fortinet-Training

collectors = Desktop-PC

targetCollectorGroup = High Security Collector Group

That organization value is wrong. The Collector belongs to the Default organization, so the API request must reference the Collector’s actual organization. Otherwise FortiEDR cannot locate or move that Collector under the organization specified in the request.

The FortiEDR guide confirms that Collector Groups are used to assign different FortiEDR policies to different Collectors, and that Collectors can be moved between groups/organizations in the Inventory workflow. In Hoster view, FortiEDR shows Collectors from all organizations and allows moving Collectors between organizations, but the organization context must match the Collector being managed.

Option B is wrong because the exhibit shows the API request is authorized; the failure is a 400 Bad Request , not an authentication failure. Option C is wrong because the endpoint shown is already a move/update operation using PUT, and the issue is not the HTTP method. Option D is wrong because Engineering is the current Collector Group. The goal is to move the Collector to High Security Collector Group , so changing the target back to Engineering would not isolate or harden the Collector.

=========

The correct answer is B. Exclude only app.exe when it is running from C:\Tools.

The FortiEDR 7.0.0 Administration Guide explains that the Exclusion Manager is used to define which processes, files, or domains are excluded from Security Policies monitoring. For Process Exclusions, FortiEDR does not inspect actions performed by specific processes, and those processes are identified by the attributes defined by the administrator.

The guide further explains that process/source attributes can include File Name, Path, Hash, and Signer. It also states that when an exclusion contains multiple conditions, an AND relationship exists between the conditions. If an OR relationship is required, a separate exclusion must be created.

In this exhibit, both conditions are selected:

File Name = app.exe

Path = C:\Tools

Because FortiEDR applies an AND relationship between multiple exclusion conditions, the exclusion applies only when both conditions match. Therefore, FortiEDR excludes app.exe only when it is located/running from C:\Tools.

Option A is wrong because no Signer condition is selected. Option C is wrong because that would apply if only the file name were used broadly. Option D is wrong because FortiEDR is not excluding every file in C:\Tools; it is excluding the process that matches both the file name and path conditions.

The correct answer is A. Investigation .

The FortiEDR 7.0.0 Administration Guide states that Investigation actions enable administrators to isolate a device or assign it to a high-security Collector Group for further investigation of the device’s activity. Under the Investigation section, the guide lists the available investigation action types, including “Isolate device with Collector,” “Isolate device with NAC,” and “Move device to High Security Group.”

For Isolate device with Collector , the guide explains that the action blocks communication to and from the affected Collector, and it applies only to endpoint Collectors. If the Playbook policy is configured to isolate a device for a malicious event, then when a malicious security event is triggered, the device is isolated from communicating with the outside world for both sending and receiving.

So, this is not a Remediation , Custom , or Notification action. In FortiEDR Playbook policy terminology, Isolate device with Collector belongs under Investigation .

=========

Add applications to the application control manager.

Assign collector groups to the policy.

Enable the blocklist rule on the application control policy.

“The applications must be added to the Application Control Manager under the user-defined group”

“Collector groups must be assigned to this policy”

“The blocklist rule must be enabled on the Application Control Policy.”

The correct sequence is to add applications to Application Control Manager, assign the relevant Collector Groups to the Application Control policy, and enable the blocklist rule. Application Control prevents designated executables from launching, whereas Communication Control regulates outbound application communication. FortiEDR automatically places manually added applications in its User-defined group, so creating a separate application group is unnecessary. Collector Groups receive policy assignments directly; application groups are not assigned to individual Collectors. Newly added applications are disabled by default and must also be enabled for blocking, unless the administrator has changed the default application state.

Comprehensive and Detailed 100 to 150 words of Explanation From FortiEDR 7.0 Administrator topics:

“This action blocks the communication to/from the affected Collector.”

“A Firewall Connector must already be configured in order to perform this action.”

FortiEDR Playbooks support separate remediation and investigation actions. The firewall-blocking action depends on the configured FortiGate connector, while Collector-based device isolation operates through the protected endpoint. If FortiGate is unreachable, the firewall action cannot complete successfully, but the independent Collector isolation action can still execute. The intended outcome is therefore successful device isolation with a failure recorded for the unsuccessful response.

Verification qualification: The documented firewall action blocks malicious remote addresses, not file hashes directly. Additionally, the Administration Guide does not explicitly define the overall playbook status when one action fails. Consequently, D is the strongest intended answer, but its aggregate failure-status behavior is not conclusively verified by the cited documentation.