Fortinet NSE 5 - FortiEDR 5.0 Free Sample Questions

FortiEDR's multi-tenancy is built around the concept of 'Organizations'. Each Organization is a self-contained unit with its own devices, policies, events, and administrators. Data and administrative access are strictly isolated at the Organization level by design, which is the primary mechanism for achieving the required segregation. While RBAC and device groups are used for granular control within an Organization, they do not provide the foundational separation between tenants.

The FortiEDR REST API uses specific endpoints to manage resources. To generate a collector installation package that is tied to a particular tenant (Organization), the API call must be made to an endpoint that is scoped to that Organization's ID. The correct endpoint structure is /api/v1/organizations/{org_id}/installers, where {org_id} is the unique identifier for the newly created customer Organization. The other options are either incorrectly formatted or do not scope the request to a specific organization.

The most secure and precise method for creating an exception is to use the application's cryptographic hash (SHA-256). This ensures that only the exact, unaltered proprietary application is allowed to run. An exception based on file path is less secure, as malware could potentially replace the legitimate file at that location. Disabling the policy or setting it to log-only mode would significantly weaken the security for all other applications on the devices, which is not desirable.

FortiEDR playbooks execute actions sequentially. If the 'Stop on Failure' option is enabled (which is common), and a preceding action like 'Isolate Device' fails or times out (e.g., due to network issues with the endpoint), the playbook will halt execution and subsequent actions like 'Terminate Process' will not be attempted. The administrator should check the playbook execution logs for failures in the 'Isolate Device' step.

The Forensics analysis view is designed for deep-dive investigations into endpoint activity. It collects and correlates a rich set of data, including process creation, file modifications, registry changes, and network connections, presenting them in a timeline and process tree. This allows the analyst to filter for the specific device, locate the PowerShell execution event, and then examine all subsequent activities, including network connections made by svchost.exe, to reconstruct the attack chain directly.

To construct this threat hunting query, the analyst needs to specify the type of event to look for and the specific attributes of that event. The core event is the creation of a process. Therefore, 'Event Type: Process Creation' is the correct starting point. Then, to find the specific utility and its arguments, two filters are needed: one to specify the process name (wmic.exe) and another to search within its command line for the specific malicious arguments (process call create). While both filters are correct, the question asks for two required components, and the event type is fundamental. The combination of Process Creation event type and filters on Process Name and Process Command Line is necessary.

The 'Block address with FortiGate' action in a FortiEDR playbook requires a specific parameter: the name of an existing address group on the target FortiGate. FortiEDR adds the offending IP address to this pre-defined group, which must then be used in a firewall policy on the FortiGate to deny traffic. If this address group name is missing or misspelled in the playbook action configuration, FortiEDR cannot tell the FortiGate where to place the IP, and the block will fail even if the Fabric connection is healthy.

Secure communications, especially those involving certificates and authentication, are highly dependent on synchronized system time. If the server's clock has drifted significantly from the Central Manager's clock, the TLS/SSL handshake required to establish a secure connection can fail. This leads to a cycle where the collector attempts to connect, fails the security check, disconnects, and then retries, causing the observed 'flapping'. This should be one of the first things to check when network connectivity is confirmed to be stable.

FortiEDR's multi-tenancy model enforces strict data isolation between Organizations (tenants). Resources such as threat hunting profiles, security policies, and events created within one Organization are not visible or accessible to another. A Global Administrator manages the system and Organizations but does not create content that is automatically shared across these isolated tenant environments. Each tenant administrator must create and manage their own threat hunting profiles.

This configuration correctly specifies all the necessary parameters. 'Action: Block' defines the desired outcome. 'Direction: Outgoing' targets traffic originating from the endpoint. 'Protocol: Any' (or TCP specifically) covers the connection type. 'Remote Address' is where the list of malicious domains or IPs would be entered. 'Application: Any' ensures the rule applies regardless of which process (e.g., browser, email client) initiates the connection, providing comprehensive protection.