Free NSE5_EDR-5.0: Fortinet NSE 5 - FortiEDR 5.0 Exam Questions and Answers

Last updated: September 19, 2026

Provider

Fortinet

Questions in our bank

1000+

Free to read

First 10, with answers

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Practice format

Multiple choice

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   An administrator needs to restrict access to the ADMINISTRATION tab in the central manager for a specific account. What role should the administrator assign to this account?

   • A. Admin
   • B. User
   • C. Local Admin
   • D. REST API
   Reveal Answer

2. Question #2

   Refer to the exhibit. Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

   

   Select 2 answers.

   • A. The NGAV policy has blocked TestApplication exe
   • B. TestApplication exe is sophisticated malware
   • C. The user was able to launch TestApplication exe
   • D. FCS classified the event as malicious
   Reveal Answer

3. Question #3

   Exhibit. Based on the event shown in the exhibit which two statements about the event are true? (Choose two.)

   

   Select 2 answers.

   • A. The device is moved to isolation.
   • B. Playbooks is configured for this event.
   • C. The event has been blocked
   • D. The policy is in simulation mode
   Reveal Answer

4. Question #4

   A company requires a global communication policy for a FortiEDR multi-tenant environment. How can the administrator achieve this?

   • A. An administrator creates a new communication control policy and shares it with other organizations
   • B. A local administrator creates new a communication control policy and shares it with other organizations
   • C. A local administrator creates a new communication control policy and assigns it globally to all organizations
   • D. An administrator creates a new communication control policy for each organization
   Reveal Answer

5. Question #5

   What is the benefit of using file hash along with the file name in a threat hunting repository search?

   • A. It helps to make sure the hash is really a malware
   • B. It helps to check the malware even if the malware variant uses a different file name
   • C. It helps to find if some instances of the hash are actually associated with a different file
   • D. It helps locate a file as threat hunting only allows hash search
   Reveal Answer

6. Question #6

   Refer to the exhibit. Based on the threat hunting query shown in the exhibit which of the following is true?

   
   • A. RDP connections will be blocked and classified as suspicious
   • B. A security event will be triggered when the device attempts a RDP connection
   • C. This query is included in other organizations
   • D. The query will only check for network category
   Reveal Answer

7. Question #7

   Refer to the exhibits. The exhibits show application policy logs and application details Collector C8092231196 is a member of the Finance group What must an administrator do to block the FileZilia application?

   
   • A. Deny application in Finance policy
   • B. Assign Finance policy to DBA group
   • C. Assign Finance policy to Default Collector Group
   • D. Assign Simulation Communication Control Policy to DBA group
   Reveal Answer

8. Question #8

   Which FortiEDR component is required to find malicious files on the entire network of an organization?

   • A. FortiEDR Aggregator
   • B. FortiEDR Central Manager
   • C. FortiEDR Threat Hunting Repository
   • D. FortiEDR Core
   Reveal Answer

9. Question #9

   The FortiEDR axe classified an event as inconclusive, out a few seconds later FCS revised the classification to malicious. What playbook actions ate applied to the event?

   • A. Playbook actions applied to inconclusive events
   • B. Playbook actions applied to handled events
   • C. Playbook actions applied to suspicious events
   • D. Playbook actions applied to malicious events
   Reveal Answer

10. Question #10

    Refer to the exhibit. Based on the threat hunting event details shown in the exhibit, which two statements about the event are true? (Choose two.)

    

    Select 2 answers.

    • A. The PING EXE process was blocked
    • B. The user fortinet has executed a ping command
    • C. The activity event is associated with the file action
    • D. There are no MITRE details available for this event
    Reveal Answer