Configure Security Policies NSE6-FORTISIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When configuring a security policy in FortiEDR, what is the primary purpose of the policy?

   • ATo manage user access to the FortiEDR console
   • BTo collect and store endpoint logs for compliance
   • CTo configure network firewall rules for endpoints
   • DTo define and enforce endpoint protection rules
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is configuring FortiEDR and wants to ensure that security policies are applied to all endpoints, including those that are occasionally offline. What is the best way to ensure policies are applied when endpoints come back online?

   • AConfigure FortiEDR to automatically apply the latest policy when an endpoint reconnects.
   • BUse a script to apply the policy to offline endpoints periodically.
   • CDo not worry about offline endpoints because they are not a security risk.
   • DManually apply the policy to each endpoint when it comes back online.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A large enterprise is configuring FortiEDR and needs to ensure that security policies are applied to all endpoints, including those in remote locations with limited bandwidth. The security team wants to minimize the impact on network performance. What is the best way to achieve this?

   • AUse a cloud-based FortiEDR instance and rely on the cloud provider's network.
   • BDisable data collection for remote endpoints to reduce network traffic.
   • CStream all data to a central collector in the headquarters.
   • DDeploy FortiEDR collectors in each remote location to reduce the amount of data sent over the WAN.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A hospital's IT team is configuring FortiEDR for 200 medical workstations running a legacy EHR application. The EHR frequently writes temporary scripts to a local folder and executes them. Initial testing shows the default security policy blocks these scripts, causing the EHR to fail. The team must keep the EHR functional without broadly weakening endpoint protection. What should they do?

   • ADisable the security policy on the medical workstations until the EHR vendor provides a fix.
   • BCreate a policy exception for the specific folder and the EHR executable, then apply the policy to the workstation group.
   • CChange the policy action from block to log for all events on the medical workstations.
   • DMove the EHR temporary scripts to the system32 folder so they are considered trusted by default.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A manufacturing company has a mix of Windows and Linux servers. The security team is configuring FortiEDR policies and wants to ensure that a new ransomware protection rule applies to all file servers. What is the most important consideration when configuring the policy?

   • ASet the policy action to 'log only' to avoid any disruption to file server operations.
   • BEnsure the policy is assigned to the correct group of file servers and that the rule is compatible with both Windows and Linux.
   • CApply the policy to all endpoints, including workstations, to ensure consistent protection.
   • DCreate a separate policy for each operating system to avoid any compatibility issues.
   Reveal Solution Discussion Select an answer first