Within the FortiEDR architecture, which component needs JumpBox capabilities to enable authenticated and controlled communication with FortiAnalyzer? (Choose one answer)
Correct Answer: A
The correct answer is A. Core.
For FortiAnalyzer / FortiAnalyzer Cloud integration, the FortiEDR 7.0.0 Administration Guide states that one prerequisite is ”A Jumpbox with connectivity to FortiAnalyzer.” The same section says to refer to Setting up the FortiEDR Core for details about installing a FortiEDR Core and configuring it as a Jumpbox. In the connector configuration, the guide also states that the Jumpbox field is used to select the FortiEDR Jumpbox that will communicate with FortiAnalyzer or FortiAnalyzer Cloud.
So, the FortiEDR component associated with JumpBox capability is the Core. The Central Manager must have connectivity to Fortinet Cloud Services, but it is not the component configured as the JumpBox. The Aggregator handles registration, configuration, and monitoring between Collectors/Cores and Central Manager, and the Reputation Server is unrelated to FortiAnalyzer JumpBox communication in this context.
What action does an on-premises reputation server take when it receives a hash request that is not found in its local database? (Choose one answer)
Correct Answer: C
The correct answer is C.
The FortiEDR 7.0.0 Administration Guide states that for on-premises deployments, the on-premise reputation service requests missing hashes from the cloud reputation service. If a proxy is not enabled, it requests the missing hashes from the cloud reputation service through the manager nginx. If a proxy is enabled, the on-premises reputation service requests the missing hashes through the proxy.
So, when the local reputation database does not contain the requested hash, the on-premises reputation server does not ignore the request, wait for endpoint input, or automatically block the application. It queries the cloud reputation service for the missing hash reputation data.
After integrating FortiEDR with external SIEM tools, an administrator notices that some events are missing from the SIEM dashboard. What is the most likely cause?
Answer: d
Which two types of data are essential for reconstructing an attack timeline in FortiEDR?
(Choose two.)
Answer: a, e
Which two benefits result from integrating FortiEDR with the broader Fortinet ecosystem?
(Choose two.)
Answer: a, b
Prep2Certsis a premium service offering a comprehensive collection of exam questions and answers for over 1400 certification exams. It is regularly updated and designed to help users pass their certification exams confidently.
Please contact info@Prep2Certs.com and we will provide you with alternative payment options.
You can by Contacting our sales team.