Online Access Free NSE5_EDR-5.0 Practice Test

What is true about classifications assigned by Fortinet Cloud Sen/ice (FCS)?

• A.FCS is responsible for all classifications
• B.The core only assigns a classification if FCS is not available
• C.The core is responsible for all classifications if FCS playbooks are disabled
• D.FCS revises the classification of the core based on its database

Refer to the exhibit.

Based on the threat hunting query shown in the exhibit which of the following is true?

• A.The query will only check for network category
• B.A security event will be triggered when the device attempts a RDP connection
• C.RDP connections will be blocked and classified as suspicious
• D.This query is included in other organizations

An administrator needs to restrict access to the ADMINISTRATION tab inthe central manager for a specific account.
What role should the administrator assign to this account?

• A.Admin
• B.User
• C.Local Admin
• D.REST API

Refer to the exhibit.

Based on the threat hunting event details shown in the exhibit, which two statements about the event are true?
(Choose two.)

• A.The user fortinet has executed a ping command
• B.The PING EXE process was blocked
• C.The activity event is associated with the file action
• D.There are no MITRE details available for this event