Fortinet NSE6_EDR_AD-7.0 Exam - Topic 4 Question 8 Discussion

The FortiEDR 7.0.0 Administration Guide states that when manually adding applications to be blocked, you can define the application using Hash or using any combination of File Name / Path / Signer attributes. This means hashes can be used independently and do not require filename, path, or signer attributes.

The guide also states that each hash is a unique identifier of an individual application, and the exhibit itself shows the hash field note: ''SHA-1 or SHA-2 or MD5.'' Therefore, the hash must use a supported hash format, making D correct.

For multiple hash entries, the uploaded guide text says they must be comma separated, while the exhibit note says ''You can enter multiple hashes comma separated.'' So the technically exact guide wording supports comma separation, not line separation. However, given your answer choices, A is clearly trying to test the requirement that multiple hashes must be separated correctly. The option wording says ''line-separated,'' which is not exact against the guide; the better wording would be comma-separated. Since no ''comma-separated'' option is provided, A is the intended separation-related answer, but the wording is flawed.

Option B is definitely wrong because hash mode is an alternative to attributes. Option C is also not the best answer because, although each hash uniquely identifies a file/application variant, the operational requirement is not that ''hashes must be unique to each application'' in the way the option implies. Hashes may represent different variants of the same application.