Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. Fortinet
  5. NSE5_EDR-5.0

Fortinet NSE5_EDR-5.0 Exam
Fortinet NSE 5 - FortiEDR 5.0 (Page 4 )

Updated On: 12-Feb-2026
Page 2 of 10
PDF with 44 Questions

What is the purpose of the Threat Hunting feature?

  1. Delete any file from any collector in the organization
  2. Find and delete all instances of a known malicious file or hash in the organization
  3. Identify all instances of a known malicious file or hash and notify affected users
  4. Execute playbooks to isolate affected collectors in the organization

Answer(s): C



How does FortiEDR implement post-infection protection?

  1. By preventing data exfiltration or encryption even after a breach occurs
  2. By using methods used by traditional EDR
  3. By insurance against ransomware
  4. By real-time filtering to prevent malware from executing

Answer(s): A


Reference:

https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/fortiedr.pdf



Refer to the exhibit.



Based on the forensics data shown in the exhibit which two statements are true? (Choose two.)

  1. The device cannot be remediated
  2. The event was blocked because the certificate is unsigned
  3. Device C8092231196 has been isolated
  4. The execution prevention policy has blocked this event.

Answer(s): B,C



What is the benefit of using file hash along with the file name in a threat hunting repository search?

  1. It helps to make sure the hash is really a malware
  2. It helps to check the malware even if the malware variant uses a different file name
  3. It helps to find if some instances of the hash are actually associated with a different file
  4. It helps locate a file as threat hunting only allows hash search

Answer(s): B



Refer to the exhibit.



Based on the event shown in the exhibit which two statements about the event are true? (Choose two.)

  1. The device is moved to isolation.
  2. Playbooks is configured for this event.
  3. The event has been blocked
  4. The policy is in simulation mode

Answer(s): B,D






Post your Comments and Discuss Fortinet NSE5_EDR-5.0 exam prep with other Community members:

Join the NSE5_EDR-5.0 Discussion