Configure Communication Control Policy NSE6-FORTISIEM-ANALYST Practice Questions (Page 3)

Questions 11–14

1. 11application · easy

   A company is implementing FortiEDR and wants to ensure that endpoints can only communicate with approved internal servers. They plan to use communication control policies. What is the primary benefit of using these policies?

   • AThey provide granular control over outbound network communications from endpoints.
   • BThey automatically block all inbound traffic to endpoints.
   • CThey provide real-time threat intelligence updates.
   • DThey replace the need for network firewalls.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In a FortiEDR communication rule, what does the 'action' field specify?

   • AThe priority of the rule among other rules
   • BWhether to allow, block, or log the communication
   • CThe encryption method used for the communication
   • DThe logging level for the communication
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In FortiEDR, to which of the following can a communication control policy be assigned?

   • AOnly to the entire organization
   • BOnly to servers, not workstations
   • COnly to endpoints with a specific operating system
   • DIndividual endpoints or groups of endpoints
   Reveal Solution Discussion Select an answer first
5. 14expert · medium

   A security operations center (SOC) is monitoring a communication control policy that blocks outbound traffic to known malicious domains. The policy is deployed in 'Block' mode. The SOC receives an alert about an endpoint attempting to connect to a domain that is not on the block list. The domain is later confirmed as malicious. What should the SOC do to prevent future attempts to this domain?

   • ACreate a new policy that blocks the domain and assign it to the affected endpoint.
   • BChange the enforcement mode of the policy to 'Log' to gather more information.
   • CAdd the domain to the block list in the existing policy and redeploy the policy.
   • DWait for the threat intelligence feed to automatically update the block list.
   Reveal Solution Discussion Select an answer first