Free Fortinet NSE6_EDR_AD-7.0 Practice Test Questions and Answers (2026)

In FortiEDR Threat Hunting, events are recorded for visibility and forensic analysis. The details typically show the user context (e.g., user "fortinet") executing a specific process (e.g., "PING.EXE"). Because standard administrative commands often do not map to malicious tactics, the MITRE ATT&CK details are empty. Threat hunting logs activities but does not block them.

B: Executing a command like ping is classified as a process creation or execution event, not a file action (like read/write).

C: Threat Hunting is a visibility and logging feature; it records the execution but does not block processes.

- Fortinet NSE 6 - FortiEDR 7.0 Study Guide, Section: Threat Hunting and Forensics, pp. 134-137.

- FortiEDR 7.0 Administration Guide, Chapter: Threat Hunting, Document ID: FG-EDR-7.0-AG.

The collector-move API request is organization-scoped. To move the collector into the High Security Collector Group for isolation, the organization parameter must match the organization where that collector and target collector group exist. The exhibit shows the organization value is incorrect; setting it to Default allows the API to locate the collector group and complete the isolation move.

B. The error is caused by an incorrect request parameter, not failed authentication credentials.

C. The issue is not the HTTP method; the request method shown is not the parameter causing the failure.

D. Engineering is not the isolation group; the target must remain the High Security Collector Group.

- Fortinet, FortiEDR 7.0 REST API Reference, section “Collector group operations / Move collector to group” — documents organization-scoped collector-group parameters.

- Fortinet, FortiEDR 7.0 Administration Guide, section “Collector Groups” — explains collectors are managed within organizations and collector groups.

- Fortinet, FortiEDR 7.0 Administration Guide, section “Isolation / High Security Collector Group” — describes using the High Security group for isolation.

FortiEDR's IoT probing (Rogue Device Discovery) leverages existing endpoint collectors to scan their local subnets and identify unmanaged or IoT devices. This process retrieves identifying details such as hostnames, IP addresses, and MAC addresses to build a comprehensive device inventory. To prevent performance degradation and ensure reliable scanning, the FortiEDR Core only assigns this probing task to healthy collectors. It does not perform deep packet inspection on all neighboring traffic, nor does it mandate that server collectors be used for probing.

A. Collectors on servers are not always used; the system typically selects healthy workstation collectors to avoid impacting critical server performance.

D. IoT probing is designed for device discovery and inventory, not for capturing all neighboring traffic or performing deep packet inspection.

1. Fortinet, "FortiEDR 5.x Administration Guide," Chapter: Discovery, Section: IoT and Rogue Device Discovery, pp. 175-178.

2. Fortinet NSE 6 - FortiEDR Study Guide, Module: Architecture and Discovery.

FortiXDR extends the capabilities of FortiEDR by integrating telemetry from other Fortinet Security Fabric products, such as FortiGate and FortiProxy. It achieves this by using log forwarding syslog receivers (Collectors) to ingest raw logs and security events. Once collected, FortiXDR applies advanced machine learning models and artificial intelligence to correlate these cross-product events, identifying complex threat patterns that span across the network and endpoints.

B: FortiXDR correlates events across multiple Fortinet products, not just FortiEDR events, to provide extended detection and response.

C: FortiXDR does not require direct agent installation on network appliances like FortiGate or FortiProxy; it relies on log forwarding.

D: FortiXDR actively correlates events across different products centrally using AI/ML, rather than acting merely as a reporting aggregator for local correlations.

Fortinet, Inc. (2022). FortiXDR Integration Guide. Document ID: FXDR-10-IG. Section: "Architecture and Data Collection", pp. 10-14.

Fortinet Training Institute (2023). FortiEDR Administrator Courseware. Module 8: "FortiXDR Integration and Correlation".

FortiEDR's Threat Hunting module allows administrators to proactively search for indicators of compromise, such as specific registry modifications, file creations, or process executions. To automate this process, you must configure a scheduled query within a threat hunting profile. This feature enables the system to automatically execute predefined Lucene-based queries at specified intervals (e.g., every 15 minutes) across all endpoints. The results are continuously monitored, and alerts can be generated if the query returns matches for suspicious activities.

A. Communication control rules manage and restrict network traffic; they do not query endpoint telemetry or search for registry modifications.

B. Manual queries are executed on-demand by an analyst and cannot be automated or scheduled to run at regular intervals.

D. Playbooks are reactive mechanisms that respond to generated security events; they do not proactively query endpoints for raw telemetry.

1. Fortinet Inc., "FortiEDR 5.2 Administration Guide," Document ID: 09-520-735193-20210916, Section: Threat Hunting -> Scheduled Queries, pp. 302-305.

2. Fortinet Inc., "FortiEDR Security Architecture and Operations," NSE 6 Courseware, Module 6: Threat Hunting.

In FortiEDR, Communication Control policies govern which applications are allowed or blocked from communicating on the network. Since the collector (C8092231196) is a member of the Finance collector group, it inherits the policies assigned specifically to that group. To block the FileZilla application for this collector, an administrator must edit the Communication Control policy assigned to the Finance group (the Finance policy) and set the action for the FileZilla application to "Deny".

A. Assigning a policy to the DBA group will not affect a collector that resides in the Finance group.

C. Assigning the Finance policy to the DBA group changes the DBA group's rules, not the Finance group's rules.

D. Assigning the policy to a broader group does not specifically block the application for the Finance group and may cause unintended widespread impact.

Fortinet, "FortiEDR 5.0 Administration Guide," Communication Control Policies and Collector Groups, pp. 150-154.

Fortinet, "FortiEDR NSE 6 Study Guide," Application Control, p. 39.

FortiEDR playbooks are designed to provide resilient, automated incident response by executing a sequence of mitigation actions. If a specific action within a playbook fails—such as failing to terminate a process because it is a protected Windows system process—the playbook does not halt its execution. Instead, FortiEDR logs the failure of that specific step and automatically continues to execute the subsequent actions defined in the playbook, such as isolating the device from the network. This ensures that maximum possible containment is achieved even if granular actions are blocked by the OS.

A: Playbooks are fully automated response mechanisms and do not pause to wait for manual administrator intervention when a single action fails.

B: While email notifications can be configured as part of a playbook, the execution of mitigation actions does not halt upon a single failure.

C: Playbooks are designed for operational resilience; a failure in one mitigation step does not abort the entire automated response sequence.

1. Fortinet, "FortiEDR 7.0 Administration Guide," Section: Playbook Configuration and Execution, pp. 180-182.

2. Fortinet, "FortiEDR 7.0 NSE 6 Study Guide," Section: Automated Incident Response, pp. 112-115.

To effectively reduce false positives in threat hunting without compromising detection sensitivity, the scheduled query should be refined to exclude known legitimate activities. By adding profile conditions that filter out specific backup service accounts or processes, the query will ignore normal backup operations and only trigger alerts for anomalous or unauthorized file access behavior, thereby improving the accuracy of the threat hunting profile.

A: Disabling the scheduled query removes automated detection capabilities, significantly reducing the organization's overall security posture and visibility.

B: Increasing the threshold might hide actual malicious data exfiltration that occurs at a slower rate below the new limit.

D: Escalating unrefined alerts to a SIEM increases alert fatigue and does not address the root cause of the false positives within FortiEDR.

Fortinet, Inc. (2022). FortiEDR 5.0 Administration Guide. Document ID: FEDR-50-AG. Section: "Threat Hunting and Scheduled Queries", pp. 180-185.

Fortinet Training Institute (2023). FortiEDR Administrator Courseware. Module 6: "Threat Hunting and Forensics".

When a newly installed collector fails to appear in the Central Manager's Inventory tab, troubleshooting must follow the communication path. First, you must verify that the FortiEDR services are actively running on the local endpoint (e.g., using the FortiEDR status command). Second, you must verify end-to-end network connectivity. This requires ensuring that TCP port 555 is open for the Collector to reach the Aggregator, and TCP port 8081 is open for the Aggregator/Core to communicate with the Central Manager. If any port in this chain is blocked, the collector will not register in the inventory.

A. The FortiEDR architecture dictates that the collector initiates the outbound connection to the Aggregator; the Central Manager does not need to resolve the collector's hostname via DNS.

D. If the collector has never successfully connected to the infrastructure, its logs will not be transmitted to the Central Manager and must be reviewed locally on the endpoint.

1. Fortinet NSE 6 - FortiEDR 7.0 Administration Guide, Section: "Architecture and Communication Ports," pp. 24-28.

2. Fortinet NSE 6 - FortiEDR 7.0 Administration Guide, Section: "Troubleshooting Collector Connectivity," pp. 140-143.

In a FortiEDR deployment, when an on-premises reputation server (Local FCS) receives a hash query from a collector that is not found in its local database, it acts as a proxy. It forwards the request to the FortiGuard Cloud reputation service to retrieve the missing hash classification. Once the cloud service responds, the local reputation server updates its database and provides the classification back to the endpoint, ensuring up-to-date threat intelligence while minimizing direct internet access from endpoints.

A: The server actively queries the cloud service to resolve the unknown hash rather than ignoring it.

B: It does not wait for endpoint input; it automatically queries the cloud reputation service for classification.

D: Unknown hashes are not automatically blocked; they are queried for proper classification before any enforcement action is taken.

Fortinet FortiEDR 5.2 Administration Guide, Chapter 2: Architecture and Components, Section: Local FCS / Reputation Server, pp. 45-47.

Fortinet NSE 6 - FortiEDR 5.2 Courseware, Module 1: Introduction and Architecture, p. 22.