NSE7 Advanced Threat Protection Practice Question
An organization is deploying FortiEDR to enhance endpoint protection. Which THREE capabilities does FortiEDR provide? (Choose three.)
⚠ Common exam trap
Watch out — candidates often confuse FortiEDR's capabilities with those of other Fortinet products, such as assuming decoy deployment (FortiDeceptor) or email filtering (FortiMail) are part of FortiEDR's endpoint protection suite.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Forensic investigation and root cause analysis
FortiEDR provides forensic investigation and root cause analysis by recording detailed endpoint telemetry, including process creation, network connections, and file system changes. This allows security teams to reconstruct the full attack chain after an incident, identifying the initial infection vector and all subsequent malicious activities. The platform correlates these events across multiple endpoints to provide a comprehensive timeline for investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Forensic investigation and root cause analysis
Why this is correct
FortiEDR provides detailed forensic data for investigation.
- ✗
Decoy deployment to lure attackers
Why it's wrong here
Decoy deployment is a FortiDeceptor feature, not FortiEDR.
- ✓
Real-time threat detection using behavioral analysis
Why this is correct
FortiEDR uses behavioral analysis to detect threats in real-time.
- ✓
Automated response to isolate compromised endpoints
Why this is correct
FortiEDR can automatically isolate endpoints to prevent spread.
- ✗
Email security filtering
Why it's wrong here
Email filtering is a FortiMail feature.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.