When monitoring a communication control policy, which of the following actions is appropriate if legitimate traffic is being blocked?

Adjust the relevant rule to allow the legitimate traffic

Reassign the policy to a different group

Increase the logging level for the policy

A SOC analyst is reviewing logs from a communication control policy that blocks outbound traffic to known malicious domains. The analyst notices that a legitimate application is being blocked because it uses a domain that is on the block list. The application is critical for business operations. What should the analyst do?

Create an allow rule for the specific application and destination, and keep the block rule for other traffic.

Change the enforcement mode of the policy to 'Log' to allow the traffic.

Delete the block rule for the domain entirely.

Remove the domain from the block list and add a log rule for it.

What is the primary purpose of a communication control policy in FortiEDR?

To monitor and report on endpoint performance metrics

To manage and enforce rules for network communications initiated by endpoints

To encrypt all network traffic between endpoints and the FortiEDR cloud

To manage firewall settings on the corporate network perimeter

In FortiEDR, what does the enforcement mode of a communication control policy determine?

The priority of the policy compared to other policies

The frequency at which the policy is applied to endpoints

Whether the policy is active and enforcing rules or only logging violations

The protocol used for communication between the endpoint and the FortiEDR cloud

An administrator is creating a communication control policy for a group of servers that must only communicate with a specific update server on TCP 443. The administrator wants to ensure that any other outbound traffic is blocked. What is the correct order of steps to achieve this?

Create the policy, assign it to the group, deploy it, and then define the rules.

Create the policy, define the rules, assign the policy to the group, and deploy it.

Define the rules, create the policy, deploy it, and assign it to the group.

Assign the policy to the group, create the policy, define the rules, and deploy it.

FortinetNSE 6 - FortiSIEM Analyst

Domain 2Objective 1

Configure Communication Control Policy NSE6-FORTISIEM-ANALYST Practice Questions (Page 1)

Part of the FortiEDR Security Settings and Policies domain, which makes up ~24% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~7–11 in this domain), expect 2–3 from this objective — we provide 14 practice questions to prepare you well beyond it. (estimate)

14questions here

3free pages

5concepts

Questions 1–5

1foundation · easy
When monitoring a communication control policy, which of the following actions is appropriate if legitimate traffic is being blocked?
Select an answer first
2expert · hard
A SOC analyst is reviewing logs from a communication control policy that blocks outbound traffic to known malicious domains. The analyst notices that a legitimate application is being blocked because it uses a domain that is on the block list. The application is critical for business operations. What should the analyst do?
Select an answer first
3foundation · easy
What is the primary purpose of a communication control policy in FortiEDR?
Select an answer first
4foundation · easy
In FortiEDR, what does the enforcement mode of a communication control policy determine?
Select an answer first
5application · medium
An administrator is creating a communication control policy for a group of servers that must only communicate with a specific update server on TCP 443. The administrator wants to ensure that any other outbound traffic is blocked. What is the correct order of steps to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTISIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTISIEM-ANALYST” is a trademark of its owner, used for identification only.