The correct answers are A. %upload_file and B. %ipconfig_all .

The FortiEDR 7.0.0 Administration Guide states that FortiEDR Connect opens a console that provides direct access to a FortiEDR-protected device through a remote shell connection. This allows administrators to respond to incidents, run commands and scripts, collect and download forensic data, and remediate threats. The guide also states that the FortiEDR Connect terminal has a prompt where commands can be typed, and the Help button displays the supported commands and their parameters.

The guide further confirms that FortiEDR Connect supports FortiEDR-specific commands, Windows command-line access through %cmd , and Python commands.

For the exact command list, Fortinet’s official FortiEDR Connect technical tip lists the supported commands. In that list, %ipconfig_all is explicitly described as returning extended IP information, and %upload_file is explicitly described as uploading a file to the specified path. ( Fortinet Community )

Options C. %psexec and D. %timestamp are not listed as supported FortiEDR Connect commands in the official Fortinet command list. Therefore, they must not be selected.

=========

=========

The correct answers are B and C .

The exhibit shows:

FortiEDR Service: Up

FortiEDR Driver: Up

FortiEDR Status: Degraded (no configuration)

This means the local Collector service and driver are running, but the Collector has not received valid configuration. In FortiEDR, a Collector must register and communicate with the FortiEDR Aggregator to receive its configuration. The guide states that the Collector initially sends registration information to the FortiEDR Aggregator using SSL, sends ongoing health/status/security-event information, and receives its configuration from the Aggregator.

During installation, a non-customized Windows Collector requires the correct Aggregator address , Aggregator port 8081 , and registration password . The guide explicitly states that the Aggregator port should be specified as 8081 , and that the registration password must be entered during installation.

Therefore, an incorrect registration password or incorrect port number can prevent proper registration/configuration retrieval, resulting in a degraded/no-configuration state.

Option A is not the best answer because Windows Firewall being enabled by itself does not automatically cause this FortiEDR status; only if it blocks required FortiEDR communication would it matter, and the option is too generic. Option D is also not correct as written because the Collector receives configuration from the Aggregator , not directly from the Central Manager. The guide describes Collector-to-Aggregator communication for registration and configuration.

=========

The correct answers are A and B .

The exhibit shows the event classification as Malicious , classified by FortinetCloudServices , and the history states that device R2D2-kvm63 was moved from the Training Collector Group to the High Security Collector Group . This is a Playbook action. The FortiEDR guide explains that after classification changes, the Overview pane displays the history of automatic FortiEDR actions, including Playbook policy-related actions .

The guide specifically lists Move device to High Security Group under Investigation actions in Playbook policies. It states that a checkmark in a classification column means the device is automatically moved to the High Security Collector Group when a security event with that classification is triggered. So the exhibit proves that Playbooks are configured for this event.

The second correct answer is B because the triggered rule is under Training • Extended Detection . The FortiEDR guide states that the eXtended Detection Policy logs events and displays them in the Incidents tab, but no blocking options are provided for this policy.

Option C is wrong because moving a device to the High Security Collector Group is not the same as isolating the device. Isolation would block communication to/from the affected Collector. The exhibit shows a Collector Group move, not isolation.

Option D is wrong because Extended Detection does not block. The guide explicitly says Extended Detection events are logged and displayed, with no blocking options provided.

=========

Add applications to the application control manager.

Assign collector groups to the policy.

Enable the blocklist rule on the application control policy.

“The applications must be added to the Application Control Manager under the user-defined group”

“Collector groups must be assigned to this policy”

“The blocklist rule must be enabled on the Application Control Policy.”

The correct sequence is to add applications to Application Control Manager, assign the relevant Collector Groups to the Application Control policy, and enable the blocklist rule. Application Control prevents designated executables from launching, whereas Communication Control regulates outbound application communication. FortiEDR automatically places manually added applications in its User-defined group, so creating a separate application group is unnecessary. Collector Groups receive policy assignments directly; application groups are not assigned to individual Collectors. Newly added applications are disabled by default and must also be enabled for blocking, unless the administrator has changed the default application state.

The correct answers are A and C .

For Fortinet Security Fabric correlation through FortiAnalyzer or FortiAnalyzer Cloud, the FortiEDR guide states that FortiEDR can integrate with FortiAnalyzer/FortiAnalyzer Cloud “to correlate data between FortiEDR and the Fortinet Security Fabric and issue eXtended detection alerts.” To complete this, you must configure an eXtended Detection Source connector and enable eXtended Detection rules and FortiEDR Threat Hunting event collection.

The prerequisites include connectivity from the FortiEDR Central Manager to Fortinet Cloud Services (FCS) . The same prerequisite list also requires either a FortiAnalyzer administrator account with JSON API access enabled or, for FortiAnalyzer Cloud, a valid FortiCloud API user with read/write access to the FortiAnalyzer Cloud portal.

Option B is wrong because a Forensics add-on license is not listed as a requirement for this integration. Option D is badly worded and not correct. A Jumpbox with connectivity to FortiAnalyzer is required, and the guide points to FortiEDR Core setup for Jumpbox configuration, but the answer option says Core with core-only functionality , which is not the stated requirement.

=========

The correct answer is C .

The FortiEDR 7.0.0 Administration Guide states that for on-premises deployments, the on-premise reputation service requests missing hashes from the cloud reputation service . If a proxy is not enabled, it requests the missing hashes from the cloud reputation service through the manager nginx . If a proxy is enabled, the on-premises reputation service requests the missing hashes through the proxy.

So, when the local reputation database does not contain the requested hash, the on-premises reputation server does not ignore the request, wait for endpoint input, or automatically block the application. It queries the cloud reputation service for the missing hash reputation data.

=========

The correct answer is D .

The FortiEDR guide confirms that Playbook actions are automatic incident response actions configured under Security Settings > Playbooks and applied based on security event classification. It also confirms that actions such as Terminate Process and device isolation actions can be configured as playbook responses. For scheduled-query-triggered events, the guide states that FortiEDR can automatically apply the Playbook action assigned to the Collector Group that the triggering device belongs to.

For isolation, the guide shows that isolation actions such as Isolate device with NAC are configured under the Investigation section of Playbooks, and similar isolation actions are triggered automatically when selected for the relevant classification.

The uploaded guide does not provide a specific line saying “if terminate process fails, continue to the next action.” Based on FortiEDR playbook behavior, configured actions are executed independently. A failure to terminate a protected Windows process does not automatically cancel the remaining playbook actions. Therefore, the next configured action, isolate device , is still executed.

Options A , B , and C are wrong because the playbook does not pause for administrator intervention, does not stop merely because an email is generated, and does not cancel all remaining configured actions because one action failed.

=========

The correct answer is A. Investigation .

The FortiEDR 7.0.0 Administration Guide states that Investigation actions enable administrators to isolate a device or assign it to a high-security Collector Group for further investigation of the device’s activity. Under the Investigation section, the guide lists the available investigation action types, including “Isolate device with Collector,” “Isolate device with NAC,” and “Move device to High Security Group.”

For Isolate device with Collector , the guide explains that the action blocks communication to and from the affected Collector, and it applies only to endpoint Collectors. If the Playbook policy is configured to isolate a device for a malicious event, then when a malicious security event is triggered, the device is isolated from communicating with the outside world for both sending and receiving.

So, this is not a Remediation , Custom , or Notification action. In FortiEDR Playbook policy terminology, Isolate device with Collector belongs under Investigation .

=========

The correct answers are C and D .

The exhibit shows an exception created/updated by FortinetCloudServices after the file Update.exe was classified as Good . This aligns with the FortiEDR Cloud Service behavior described in the guide. The guide states that once FCS is connected, it can enable Tuning , which means automated security event exception/allowlisting. After a triggered security event is reclassified as Safe, an automated cross-environment exception can be pushed downstream and the event expires, preventing it from triggering again.

Option C is correct because the Event Exceptions window includes Triggered Rules , and the guide states that when editing an exception, the administrator can modify the Collector Groups , Destinations , Users , and the pairs of rules and processes that define the exception in the Triggered Rules area.

Option D is the Fortinet/FCS-related statement supported by the guide’s FCS behavior. The guide says FCS can enable follow-up actions, including Tuning through automated exceptions and Playbook Actions , and that playbook policy remediation actions are based on the final FCS determination.

Option A is wrong because the exhibit explicitly states “All the Raw Data Items are covered.” A partial exception would mean not all raw data items are covered. The guide explains that if an exception does not cover all raw data items, FortiEDR displays a different indicator and distinguishes covered from non-covered raw data items.

Option B is wrong because the exception scope in the exhibit is set to All groups , All destinations , and All users . The comment references device C8092231196, but that is not the same as saying the exception applies only to that device.

=========

The correct answer is C .

The exhibit shows a Threat Hunting saved query named CLI Command with the query:

Target.Process.Filename ( " net.exe " )

It is configured as a Scheduled Query , classified as Suspicious , and set to repeat every 15 minutes . The FortiEDR guide states that saving a Threat Hunting query allows it to be defined as a scheduled query to automate threat detection. When the scheduled query runs and detects matching activity, a security event is automatically created in the Incidents tab .

The guide also states that scheduled queries run automatically according to the configured schedule, and each time a match is detected, FortiEDR generates a security event in the Incidents tab and sends notifications according to the security event configuration.

So, when the endpoint runs:

net user edruser password! /ADD

FortiEDR records the relevant process activity, and when the scheduled query runs, it matches the target process net.exe and creates an incident/security event. It is not immediate by default because the query is scheduled every 15 minutes. It also does not block CLI commands by default unless playbook actions or policy controls are configured. The activity is treated according to the saved query classification, which in the exhibit is Suspicious .

=========