Configure Security Policies NSE6-FORTISIEM-ANALYST Practice Questions (Page 3)

Questions 11–13

1. 11application · medium

   A government agency is configuring FortiEDR and needs to ensure that all security policies are applied consistently across multiple geographic locations. The agency has a central security team that manages policies, but local IT staff sometimes need to make temporary exceptions. What is the recommended approach?

   • ACentralize policy management and require local IT to request exceptions through a formal change process.
   • BAllow each local IT team to manage their own policies independently to respond quickly to local threats.
   • CUse the default FortiEDR policy for all locations and do not customize it.
   • DCreate a single global policy and do not allow any exceptions.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A healthcare organization is configuring FortiEDR and must comply with HIPAA, which requires strict access controls and audit trails. The security team needs to ensure that only authorized personnel can modify security policies. What is the most effective way to enforce this requirement?

   • AConfigure role-based access control (RBAC) in FortiEDR to grant policy modification rights only to the security team leads.
   • BUse the default FortiEDR administrator account for all policy changes.
   • CAllow all security analysts to modify policies to ensure quick response to threats.
   • DDisable policy modification in FortiEDR and use the API to make changes.
   Reveal Solution Discussion Select an answer first
3. 13expert · hard

   A multinational corporation is deploying FortiEDR to 10,000 endpoints across 40 countries. The security team must comply with local data residency laws, which require that security event data for certain regions remain within those regions. The team is configuring policies and needs to decide how to handle policy distribution and data collection. What is the most important consideration?

   • ADeploy a single central collector in the company's headquarters and stream all data to it.
   • BUse a cloud-based FortiEDR instance and rely on the cloud provider's data residency guarantees.
   • CCreate a separate FortiEDR instance for each region to ensure complete data isolation.
   • DEnsure that FortiEDR collectors are deployed in each region to keep event data local, while policies are centrally managed.
   Reveal Solution Discussion Select an answer first