Fortinet NSE 5 - FortiEDR 5.0 - NSE5_EDR-5.0 Exam Questions [2026]

QUESTION NO: 1
Exhibit.

Based on the forensics data shown in the exhibit which two statements are true? (Choose two.)

A. Device C8092231196 has been isolated B. The execution prevention policy has blocked this event. C. The device cannot be remediated D. The event was blocked because the certificate is unsigned

Correct Answer: A,D

QUESTION NO: 2
What is the purpose of the Threat Hunting feature?

A. Delete any file from any collector in the organization B. Identify all instances of a known malicious file or hash and notify affected users C. Find and delete all instances ofa known malicious file or hash inthe organization D. Execute playbooks to isolate affected collectors in the organization

Correct Answer: B

QUESTION NO: 3
The FortiEDR axe classified an event as inconclusive, out a few seconds later FCS revised the classification to malicious. What playbook actions ate applied to the event?

A. Playbook actions applied to suspicious events B. Playbook actions applied to inconclusive events C. Playbook actions applied to malicious events D. Playbook actions applied to handled events

Correct Answer: C