nerdexam
Fortinet

FCP_FCT_AD-7.2 · Question #25

Refer to the exhibits. Based on the FortiGate Security Fabric settings shown in the exhibits, what must an administrator do on the EMS server to successfully quarantine an endpoint. When it is…

The correct answer is A. The administrator must enable remote HTTPS access to EMS. Based on the FortiGate Security Fabric settings shown in the exhibits, to successfully quarantine an endpoint when it is detected as a compromised host (IoC), the following step is required: Enable Remote HTTPS Access to EMS: This setting allows FortiGate to communicate…

Alerting and Incident Response

Question

Refer to the exhibits. Based on the FortiGate Security Fabric settings shown in the exhibits, what must an administrator do on the EMS server to successfully quarantine an endpoint. When it is detected as a compromised host (IoC)?

Options

  • AThe administrator must enable remote HTTPS access to EMS.
  • BThe administrator must enable FQDN on EMS.
  • CThe administrator must authorize FortiGate on FortiAnalyzer.
  • DThe administrator must enable SSH access to EMS.

How the community answered

(33 responses)
  • A
    79% (26)
  • B
    3% (1)
  • C
    12% (4)
  • D
    6% (2)

Explanation

Based on the FortiGate Security Fabric settings shown in the exhibits, to successfully quarantine an endpoint when it is detected as a compromised host (IoC), the following step is required: Enable Remote HTTPS Access to EMS: This setting allows FortiGate to communicate securely with FortiClient EMS over HTTPS. Remote HTTPS access is essential for the quarantine functionality to operate correctly, enabling the EMS server to receive and act upon the quarantine commands from FortiGate. Therefore, the administrator must enable remote HTTPS access to EMS to allow the quarantine process to function properly.

Topics

#endpoint quarantine#EMS#IoC#remote HTTPS access

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full FCP_FCT_AD-7.2 Practice