Fortinet NSE6_EDR_AD-7.0 Practice Test Questions Answers

The correct answers are A and C .

The exhibit shows an audit/response action stating that IP address 74.125.235.20 was added to malicious IP addresses on firewall FortiGate . This matches the FortiEDR playbook action Block address on Firewall . The guide states that this action ensures connections to remote malicious addresses associated with the security event are blocked, and that a firewall connector must already be configured for this action. It also explains that a checkmark in a classification column means communication with the affected destination is automatically blocked when a security event with that classification is triggered.

Option C is the second best answer because FortiEDR events are initially classified by FortiEDR detection logic/Core, and the guide states that classifications are initially determined by the Core but can later be changed automatically by FortiEDR Cloud Service or manually. The exhibit shows “Classification Changed To: Suspicious (By Fortinet)” , but it does not say the event was manually classified by an administrator. So the event classification process is FortiEDR-driven, with later Fortinet/FCS-style automatic classification possible.

Option B is wrong. The exhibit shows one raw-data row with device cwinserv-32 +2 , which indicates more than one affected device/raw item is represented in the aggregation. So it did not occur on only one device.

Option D is wrong because the incident rows clearly show Unhandled . The guide states that security events are initially marked as unread and unhandled, and the unread/unhandled status helps users track whether anyone has read and handled the event.

=========

The correct answers are B and C .

The exhibit shows:

FortiEDR Service: Up

FortiEDR Driver: Up

FortiEDR Status: Degraded (no configuration)

This means the local Collector service and driver are running, but the Collector has not received valid configuration. In FortiEDR, a Collector must register and communicate with the FortiEDR Aggregator to receive its configuration. The guide states that the Collector initially sends registration information to the FortiEDR Aggregator using SSL, sends ongoing health/status/security-event information, and receives its configuration from the Aggregator.

During installation, a non-customized Windows Collector requires the correct Aggregator address , Aggregator port 8081 , and registration password . The guide explicitly states that the Aggregator port should be specified as 8081 , and that the registration password must be entered during installation.

Therefore, an incorrect registration password or incorrect port number can prevent proper registration/configuration retrieval, resulting in a degraded/no-configuration state.

Option A is not the best answer because Windows Firewall being enabled by itself does not automatically cause this FortiEDR status; only if it blocks required FortiEDR communication would it matter, and the option is too generic. Option D is also not correct as written because the Collector receives configuration from the Aggregator , not directly from the Central Manager. The guide describes Collector-to-Aggregator communication for registration and configuration.

=========

The correct answer is A. Core.

For FortiAnalyzer / FortiAnalyzer Cloud integration, the FortiEDR 7.0.0 Administration Guide states that one prerequisite is “A Jumpbox with connectivity to FortiAnalyzer.” The same section says to refer to Setting up the FortiEDR Core for details about installing a FortiEDR Core and configuring it as a Jumpbox. In the connector configuration, the guide also states that the Jumpbox field is used to select the FortiEDR Jumpbox that will communicate with FortiAnalyzer or FortiAnalyzer Cloud.

So, the FortiEDR component associated with JumpBox capability is the Core. The Central Manager must have connectivity to Fortinet Cloud Services, but it is not the component configured as the JumpBox. The Aggregator handles registration, configuration, and monitoring between Collectors/Cores and Central Manager, and the Reputation Server is unrelated to FortiAnalyzer JumpBox communication in this context.

=========

The correct answers are B and C .

The FortiEDR 7.0.0 Administration Guide has a specific troubleshooting section named “A FortiEDR Collector does not display in the INVENTORY tab.” It states that after a Collector is first launched, it registers with the FortiEDR Central Manager and appears in the Inventory tab. If it does not appear, the first checks are to confirm that the device where the Collector is installed is powered on and has Internet connectivity, and to validate that ports 8081 and 555 are available and not blocked by another third-party product.

Option B is therefore correct in the exam sense because ports 8081 and 555 must be open for FortiEDR communication. More precisely, the Collector communicates with the Aggregator on port 8081 and the Core on port 555 , not directly to the Central Manager in every architecture. The option wording says “between the collector and the central manager,” which is technically loose, but the required troubleshooting item is still the port availability.

Option C is also correct because the same guide says to check that the endpoint is powered on and connected. In practical FortiEDR troubleshooting, this includes confirming the FortiEDR Collector service/driver are running on the endpoint; otherwise the Collector cannot register or report health.

Option A is not listed in the FortiEDR guide as a required step for this issue. Option D is not the best answer because the guide says logs are generally retrieved when Fortinet Support requests them, and Collector logs can only be exported for Collectors in Running status; a newly installed Collector that does not appear in Inventory cannot normally be selected from Central Manager for log export.

The correct answer is C. The user account does not have the REST API role assigned .

The exhibit shows a Postman request to the FortiEDR Central Manager REST endpoint:

/management-rest/inventory/list-collectors

The response is 401 Unauthorized , which means the request reached the FortiEDR API endpoint but the supplied user credentials are not authorized for REST API access.

The FortiEDR 7.0.0 Administration Guide states that when adding or editing a user, the Rest API advanced option controls whether the user is allowed to access the FortiEDR Central Manager through API calls. The guide defines this option as: “Rest API — Specifies whether to allow the user to access the FortiEDR Central Manager through API calls.”

Therefore, the most accurate cause is that the account being used in Postman does not have the Rest API permission enabled.

Option A is incorrect because the request uses GET against a list endpoint, and an unsupported method would not normally be represented by this user-authentication failure. Option B is not supported by the exhibit or guide wording; the guide describes enabling REST API access per user. Option D is incorrect because first-login password reset is not the direct cause of this REST API authorization failure. The guide separately discusses password reset and password policy behavior, but that is not what the API error indicates.