What is the primary purpose of monitoring the effectiveness of a communication control policy in FortiEDR?

To verify that the policy does not block any legitimate traffic

To reduce the number of alerts generated by the system

To ensure the policy is applied to all endpoints automatically

To identify and adjust rules based on alerts and logs to maintain security

Which of the following elements must be specified when defining a communication rule in FortiEDR?

Protocol, action, and user identity

Destination, action, and application name

Source, destination, and time of day

Source, destination, protocol, and action

A security analyst is reviewing the logs from a communication control policy that blocks outbound connections to known command-and-control (C2) servers. The analyst notices that a specific endpoint is repeatedly attempting to connect to a new IP address that is not on the block list. The analyst wants to update the policy to block this new IP. What should the analyst do?

Change the enforcement mode of the policy to 'Log' to see more details.

Delete the existing policy and create a new one with the new IP.

Add a new rule to the existing policy that blocks the new IP address.

Wait for the policy to automatically update with the new IP.

When configuring a new communication control policy in FortiEDR, which of the following is a required initial step?

Assigning the policy to endpoints

Defining the policy name and description

After creating a communication control policy in FortiEDR, what must be done for the policy to take effect on endpoints?

Enable the policy in the global settings

Wait for the next scheduled policy update

Restart all endpoints in the organization

Assign the policy to the relevant endpoints or groups and deploy it

FortinetNSE 6 - FortiSIEM Analyst

Domain 2Objective 1

Configure Communication Control Policy NSE6-FORTISIEM-ANALYST Practice Questions (Page 2)

Part of the FortiEDR Security Settings and Policies domain, which makes up ~24% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~7–11 in this domain), expect 2–3 from this objective — we provide 14 practice questions to prepare you well beyond it. (estimate)

14questions here

3free pages

5concepts

Questions 6–10

6foundation · easy
What is the primary purpose of monitoring the effectiveness of a communication control policy in FortiEDR?
Select an answer first
7foundation · easy
Which of the following elements must be specified when defining a communication rule in FortiEDR?
Select an answer first
8application · medium
A security analyst is reviewing the logs from a communication control policy that blocks outbound connections to known command-and-control (C2) servers. The analyst notices that a specific endpoint is repeatedly attempting to connect to a new IP address that is not on the block list. The analyst wants to update the policy to block this new IP. What should the analyst do?
Select an answer first
9foundation · easy
When configuring a new communication control policy in FortiEDR, which of the following is a required initial step?
Select an answer first
10foundation · easy
After creating a communication control policy in FortiEDR, what must be done for the policy to take effect on endpoints?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTISIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTISIEM-ANALYST” is a trademark of its owner, used for identification only.