Fortinet · NSE6_FEDR-6.0
Validates the ability to deploy, configure, and manage Fortinet's FortiEDR endpoint detection and response solution. Covers FortiEDR system architecture, security policies, threat hunting, forensics analysis, integration, and troubleshooting.
Practice Questions
600
≈ 10 practice exams
Duration
70 minutes
Passing Score
Pass/Fail
Difficulty
SpecialtyLast Updated
May 2026
Use this NSE6_FEDR-6.0 practice exam to prepare for Fortinet NSE 6 - FortiEDR Administrator (NSE6_FEDR-6.0) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 600 questions for Fortinet NSE6_FEDR-6.0, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as FortiEDR System Architecture, Security Settings and Policies, Events, Forensics, and Threat Hunting, FortiEDR Integration, and Troubleshooting. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
The Fortinet NSE 6 - FortiEDR Administrator (NSE6_FEDR-6.0) certification validates a candidate's applied knowledge of Fortinet's FortiEDR endpoint detection and response platform. The exam assesses the ability to deploy, configure, and operationally manage FortiEDR across enterprise environments, covering the full administrative lifecycle from system architecture and installation through security policy creation, forensic investigation, and active threat hunting. It is part of the broader NSE 6 Network Security Specialist certification track, which requires passing any four NSE 6 exams to earn the designation.
The certification is specifically grounded in real-world administrative tasks. Questions are presented as operational scenarios, configuration extracts, and troubleshooting captures rather than purely theoretical questions, ensuring that certified professionals can apply FortiEDR capabilities in practical enterprise security contexts. Topics span FortiEDR's core pillars: system architecture and inventory management, communication control and security policies, forensics and threat hunting workflows, integration with the Fortinet Security Fabric and FortiXDR, and systematic troubleshooting of endpoint events and alerts.
This certification is designed for network and security professionals who are responsible for the configuration, administration, and day-to-day operation of endpoint security solutions within enterprise network security infrastructures. Typical roles include security operations center (SOC) analysts, endpoint security administrators, and network security engineers who work directly with EDR platforms and need to demonstrate validated expertise with the FortiEDR product.
Candidates who manage or plan to manage FortiEDR deployments—including those handling multi-tenancy environments, playbook configuration, and integration with broader security ecosystems—are the primary audience. Professionals pursuing the NSE 6 Network Security Specialist designation or the NSE Certified Specialist - SASE pathway will also find this exam directly relevant to their certification goals.
Fortinet does not impose strict formal prerequisites for sitting the NSE6_FEDR-6.0 exam, but strongly recommends that candidates bring substantial hands-on experience before attempting it. Specifically, Fortinet advises at least three years of experience working with endpoint security solutions, one year of experience in network security, and one year of practical experience with next-generation antivirus (NGAV) solutions or an Endpoint Management Server (EMS).
In terms of recommended preparation, Fortinet advises completing the FortiEDR Administrator course and its associated hands-on labs. Reviewing the FortiEDR Installation and Administration Guide is also strongly encouraged. Candidates should be comfortable navigating the FortiEDR management console, including the Dashboard, Event Viewer, Forensics tab, Threat Hunting module, Communication Control, Security Policies, Playbooks, Inventory, and Administration sections before sitting for the exam.
The exam consists of 30–35 questions to be completed within a 70-minute time limit, delivered in English. Questions are presented in multiple-choice and multiple-select formats and are designed around applied scenarios including operational situations, configuration extracts, and troubleshooting captures. For multiple-select questions, all answers must be correct to receive credit—no partial credit is awarded.
The exam is scored on a pass/fail basis, and candidates receive a score report through their Pearson VUE account upon completion. Fortinet does not publicly disclose the exact numerical passing threshold. The exam is administered through Pearson VUE, available at authorized testing centers or via the OnVUE online proctoring service. The exam fee is approximately $200 USD. NSE 6 certifications, including this exam, are valid for two years from the date of completion.
Earning the Fortinet NSE 6 FortiEDR Administrator certification positions professionals as validated specialists in endpoint detection and response, a discipline that has become a core requirement in modern enterprise security operations. As organizations increasingly prioritize EDR and XDR capabilities to counter advanced threats, administrators who can demonstrate hands-on FortiEDR expertise are in demand for roles such as SOC analyst, endpoint security engineer, security operations administrator, and cybersecurity consultant. The NSE 6 designation also contributes toward the Fortinet NSE Certified Specialist - SASE pathway, adding further career differentiation.
Within the Fortinet ecosystem, NSE 6 specialists typically command higher compensation than non-certified peers, with security operations roles in enterprise environments commonly ranging from $85,000 to $130,000 USD annually depending on region and broader experience. The certification complements other Fortinet credentials such as the NSE 4 (FortiGate Administrator) and NSE 5 (FortiManager/FortiAnalyzer), and pairs naturally with vendor-neutral EDR and incident response certifications for professionals building a comprehensive security operations skill set.
5 sample questions with answers and explanations. The full bank has 600 questions, enough for 10 full-length practice exams.
Preview — answers shown1. Adatum Corporation operates as an MSSP managing FortiEDR for five separate customer organizations from a single Central Manager. The global administrator is documenting which resources are shared across all organizations versus which are completely isolated per organization. Which TWO resources are shared across organizations in a FortiEDR multi-tenant deployment? (Select two!)
Multiple correct answersExplanation
In a FortiEDR multi-tenant deployment, the Core and Aggregator backend infrastructure is shared across all organizations hosted on the same Central Manager. Individual organizations do not receive dedicated Core or Aggregator instances; the infrastructure is shared at the platform level while data remains isolated. Additionally, the FortiEDR Cloud Service threat intelligence is shared globally, meaning threat classifications, reputation data, and enrichment insights benefit from collective intelligence across all organizations. Security policies are fully isolated per organization with dedicated configurations for each customer. Security event data and forensic logs are completely isolated, ensuring that one organization's analysts cannot access another organization's event history. Collector Groups and endpoint assignments are also per-organization resources that are isolated so each customer manages their own endpoint groupings independently.
2. A DevOps engineer at Tailspin Toys is developing an automation script that queries the FortiEDR REST API every 15 minutes throughout the business day to retrieve new security events and push them to an external ticketing system. The script must run reliably for hours without manual intervention. Which approach should the engineer implement for API access to ensure uninterrupted operation while following security best practices? (Select one!)
Explanation
Creating a dedicated Read-Only service account with session token management and refresh logic is the correct approach combining security best practices with operational reliability. A dedicated service account applies the principle of least privilege; a Read-Only account can only perform GET operations, limiting the blast radius if the automation credentials are ever compromised. Token refresh logic handles the natural expiration of FortiEDR API session tokens, preventing authentication failures that would silently interrupt the event synchronization during long operational periods. Re-authenticating programmatically when a token expires, rather than embedding a static token, reduces credential exposure over time. Using the Super Admin account violates least privilege principles and creates significant security risk, as a compromised script would grant full administrative access to the FortiEDR platform. Basic Authentication is not a supported authentication method for the FortiEDR REST API; it uses token-based authentication obtained through a POST to the login endpoint with credentials. Hardcoding a manually obtained session token will fail when that token expires during normal operation and cannot be refreshed automatically, causing the integration to stop working silently.
3. A production FortiEDR deployment at Northwind Traders experiences a Central Manager failure during business hours. Security operations needs to understand the impact on endpoint protection. Which statement correctly describes what happens to endpoint protection during this Central Manager outage? (Select one!)
Explanation
When the Central Manager goes offline, Collectors continue enforcing the last received security policy using their locally cached configuration and kernel-level driver. The Collector agent is designed to operate autonomously, ensuring protection continues even without backend connectivity. Events detected during the outage are buffered locally and forwarded when connectivity is restored. No new policy changes, exceptions, or configuration updates can be pushed to endpoints during the outage. Collectors do not automatically switch to Detection-Only mode upon Central Manager failure; that is a deliberate policy configuration, not a failover behavior. The Core does not assume management functions; it continues its role as the real-time analysis engine but cannot distribute new configurations without the Central Manager.
4. A FortiEDR administrator at Litware Inc. has organized endpoints into a parent Collector Group named Corporate, with a child Collector Group named Finance Department. An exception was created at the Corporate group level to allow a specific financial analysis application. A Finance Department manager requests that this exception be removed from the Finance Department group because the application is not approved for use in that department. What is the correct statement about this scenario? (Select one!)
Explanation
FortiEDR implements a strict exception inheritance model where exceptions created at a parent Collector Group level are automatically inherited by all child groups and cannot be removed, overridden, or deleted at the child group level. The Finance Department group inherits all exceptions from the Corporate parent group, and no administrative action at the child level can remove an inherited parent exception. The only way to remove the exception from Finance Department endpoints is to either remove it from the Corporate parent group (which would affect all child groups) or restructure the Collector Group hierarchy so Finance Department is no longer a child of Corporate. Child groups can only add additional exceptions on top of what they inherit — they have no mechanism to block or neutralize exceptions inherited from a parent. This inheritance model ensures that exceptions set at higher organizational levels are consistently enforced across all sub-groups.
5. An administrator reviewing the FortiEDR Central Manager console notices that a Collector deployed last week shows a yellow status indicator labeled Degraded. The endpoint is online and reachable on the network. What does the Degraded status MOST LIKELY indicate about this Collector? (Select one!)
Explanation
A Degraded status (shown in yellow) in the FortiEDR console indicates that the Collector is connected and communicating with the backend, but there is a functional issue with the endpoint agent itself — most commonly that the kernel-level driver has not loaded correctly. This condition significantly reduces protection effectiveness because FortiEDR's real-time prevention capabilities depend on the kernel-mode driver for OS-level monitoring, process interception, and enforcement. If the Collector could not reach the Aggregator on TCP 8081, the status would be Disconnected (red). An unregistered Collector shows as Unmanaged (grey). A missed heartbeat timeout results in Disconnected, not Degraded. The Degraded state requires investigation into driver installation, kernel compatibility, or conflicting security products.
Fortinet NSE 5 - FortiWeb 8.0 Administrator
NSE5_FWB-8.0 · 596 questions
Fortinet NSE 6 - FortiAnalyzer 7.4 Administrator (FCP_FAZ_AD-7.4)
FCP_FAZ_AD-7.4 · 600 questions
Fortinet NSE 6 - FortiClient EMS 7.4 Administrator (FCP_FCT_AD-7.4)
FCP_FCT_AD-7.4 · 595 questions
Fortinet NSE 6 - FortiMail 7.4 Administrator
NSE6-FML · 600 questions
Fortinet NSE 6 - FortiSIEM 7.4 Analyst
NSE 6 · 600 questions
Fortinet NSE 6 - FortiSOAR 7.3 Administrator (NSE6_FSR-7.3)
NSE6_FSR-7.3 · 600 questions
$17.99
One-time access to this exam