NSE5_EDR-5.0: Fortinet NSE 5 - FortiEDR 5.0 Hunting Practice Questions

What is the benefit of using file hash along with the file name in a threat hunting repository search?

• AA. It helps to make sure the hash is really a malware
• BB. It helps to check the malware even if the malware variant uses a different file name
• CC. It helps to find if some instances of the hash are actually associated with a different file
• DD. It helps locate a file as threat hunting only allows hash search

Refer to the exhibit. Based on the threat hunting query shown in the exhibit which of the following is true?

• AA. RDP connections will be blocked and classified as suspicious
• BB. A security event will be triggered when the device attempts a RDP connection
• CC. This query is included in other organizations
• DD. The query will only check for network category

Refer to the exhibit. Based on the threat hunting event details shown in the exhibit, which two statements about the event are true? (Choose two.)

Select 2 answers.

• AA. The PING EXE process was blocked
• BB. The user fortinet has executed a ping command
• CC. The activity event is associated with the file action
• DD. There are no MITRE details available for this event