Fortinet
FCP_FCT_AD-7.2 · Question #21
Which security fabric component sends a notification to quarantine an endpoint after IOC detection in the automation process?
The correct answer is D. FortiGate. FortiGate determines if the FortiClient is among its connected endpoints and if it has the login credentials for the EMS that the FortiClient is connected to. With this information, FortiGate sends a notification to EMS to quarantine the endpoint.
Alerting and Incident Response
Question
Which security fabric component sends a notification to quarantine an endpoint after IOC detection in the automation process?
Options
- AFortiAnalyzer
- BFortiClient
- CFortiClient EMS
- DFortiGate
How the community answered
(52 responses)- A6% (3)
- B2% (1)
- C12% (6)
- D81% (42)
Explanation
FortiGate determines if the FortiClient is among its connected endpoints and if it has the login credentials for the EMS that the FortiClient is connected to. With this information, FortiGate sends a notification to EMS to quarantine the endpoint.
Topics
#IOC detection#endpoint quarantine#Security Fabric#automation
Community Discussion
No community discussion yet for this question.