Fortinet Updated NSE6_EDR_AD-7.0 Exam Questions and Answers by regan

The correct answer is C. The user account does not have the REST API role assigned .

The exhibit shows a Postman request to the FortiEDR Central Manager REST endpoint:

/management-rest/inventory/list-collectors

The response is 401 Unauthorized , which means the request reached the FortiEDR API endpoint but the supplied user credentials are not authorized for REST API access.

The FortiEDR 7.0.0 Administration Guide states that when adding or editing a user, the Rest API advanced option controls whether the user is allowed to access the FortiEDR Central Manager through API calls. The guide defines this option as: “Rest API — Specifies whether to allow the user to access the FortiEDR Central Manager through API calls.”

Therefore, the most accurate cause is that the account being used in Postman does not have the Rest API permission enabled.

Option A is incorrect because the request uses GET against a list endpoint, and an unsupported method would not normally be represented by this user-authentication failure. Option B is not supported by the exhibit or guide wording; the guide describes enabling REST API access per user. Option D is incorrect because first-login password reset is not the direct cause of this REST API authorization failure. The guide separately discusses password reset and password policy behavior, but that is not what the API error indicates.

The correct answer is A. Create a separate communication control policy for each organization .

The key point is that Communication Control is not available in Hoster view . In a FortiEDR multi-tenant environment, Hoster view is the view used to display information for all organizations together. However, the guide clearly states under the Hoster view section: “Communication Control — The Communication Control window is not available in Hoster view.”

That means you cannot create one global Communication Control policy from Hoster view and assign it across all organizations. Options B , C , and D all assume cross-organization/global Communication Control policy assignment, but the guide does not support that capability. The practical recommendation is to configure Communication Control policies separately inside each organization.

The guide contrasts this with Security Policies, where in Hoster view the Security Policies page displays all policies from all organizations and supports cloning a security policy from one organization to another. That statement is for Security Policies , not Communication Control policies.

=========

The correct answer is C.

The FortiEDR guide explains that Threat Hunting searches across endpoint activity events, including registry activity. It states that Threat Hunting can search based on attributes of files, registry keys and values, network, processes, event log, and activity event types. This fits the requirement to search for specific registry modifications across endpoints.

The guide also explains that after filtering activity events, the query can be saved and defined as a Scheduled Query. It says: “Scheduled Query: Mark this option to automate the process of detecting threats so that this query is run automatically according to the schedule that you define.” It also states that a security event is automatically created in the Incidents tab when matches are detected, and notifications can be sent through email, Syslog, and other configured methods.

The guide further states that the Repeat Every/On options define the frequency and schedule when the query runs. Therefore, a 15-minute recurring query is handled through the Scheduled Query capability in Threat Hunting, not Communication Control, policy override, or a manual Playbook trigger.

Strictly speaking, the guide calls this a scheduled query under Threat Hunting saved queries, not a “communication control rule” or “manual query.” Option C is the intended answer.

=========