NSE5-EDR-5-0 Sample Questions & Answers

To construct this threat hunting query, the analyst needs to specify the type of event to look for and the specific attributes of that event. The core event is the creation of a process. Therefore, 'Event Type: Process Creation' is the correct starting point. Then, to find the specific utility and its arguments, two filters are needed: one to specify the process name (wmic.exe) and another to search within its command line for the specific malicious arguments (process call create). While both filters are correct, the question asks for two required components, and the event type is fundamental. The combination of Process Creation event type and filters on Process Name and Process Command Line is necessary.

The 'Block address with FortiGate' action in a FortiEDR playbook requires a specific parameter: the name of an existing address group on the target FortiGate. FortiEDR adds the offending IP address to this pre-defined group, which must then be used in a firewall policy on the FortiGate to deny traffic. If this address group name is missing or misspelled in the playbook action configuration, FortiEDR cannot tell the FortiGate where to place the IP, and the block will fail even if the Fabric connection is healthy.

Secure communications, especially those involving certificates and authentication, are highly dependent on synchronized system time. If the server's clock has drifted significantly from the Central Manager's clock, the TLS/SSL handshake required to establish a secure connection can fail. This leads to a cycle where the collector attempts to connect, fails the security check, disconnects, and then retries, causing the observed 'flapping'. This should be one of the first things to check when network connectivity is confirmed to be stable.

FortiEDR's multi-tenancy model enforces strict data isolation between Organizations (tenants). Resources such as threat hunting profiles, security policies, and events created within one Organization are not visible or accessible to another. A Global Administrator manages the system and Organizations but does not create content that is automatically shared across these isolated tenant environments. Each tenant administrator must create and manage their own threat hunting profiles.

This configuration correctly specifies all the necessary parameters. 'Action: Block' defines the desired outcome. 'Direction: Outgoing' targets traffic originating from the endpoint. 'Protocol: Any' (or TCP specifically) covers the connection type. 'Remote Address' is where the list of malicious domains or IPs would be entered. 'Application: Any' ensures the rule applies regardless of which process (e.g., browser, email client) initiates the connection, providing comprehensive protection.

The best practice for tuning false positives is to create a specific, narrow exception. By creating an exception for the 'Suspicious Packer' rule that is scoped to the deployment tool's unique code-signing certificate, the system will ignore this specific detection for that legitimate, trusted application only. This resolves the false positive issue without disabling the rule for all other potentially malicious software, thereby maintaining the organization's security posture.

The diagram illustrates a classic fileless malware attack chain. It begins with social engineering (phishing email), uses a legitimate application (Word) to execute a malicious script (macro), and then leverages another legitimate tool (PowerShell) for in-memory execution and communication with a command-and-control (C2) server. This avoids writing traditional malware executables to disk, which is the hallmark of a fileless attack.

This is the optimal solution. Deploying Aggregators in regional hubs reduces direct WAN traffic from each store to the central manager, addressing the bandwidth issue. Enabling the specific Ransomware and Exfiltration Prevention rules meets the CISO's primary security goals. Crucially, setting the collector to a low forensics collection level for the less-critical POS devices minimizes the performance impact by reducing the amount of data the agent processes and sends, which directly addresses the sluggishness and further reduces network traffic.

The primary function of FortiSandbox, whether on-premises or in the cloud, is to perform dynamic analysis (detonation) of files that are not definitively known to be good or bad. It executes the file in a safe, isolated virtual environment and observes its behavior to identify malicious characteristics. This process is crucial for detecting novel, zero-day malware that would not be caught by signature-based detection methods.

When the classification source for an event is shown as 'Fortinet', it means the verdict was provided by the Fortinet Cloud Service (FCS). The FortiEDR core sends telemetry and file hashes to FCS, which uses its vast repository of global threat intelligence, machine learning models, and sandbox analysis results to provide a definitive classification. This contrasts with classifications made by the local core or manually by an administrator.