When implementing an application block policy in FortiEDR, which three actions, in order, reflect the correct operational sequence? (Choose three.) Select an action in the left column and hold and drag it to a blank position in the column on the right. Place the three correct actions in order, starting with the first action at the top of the column. After you place an action, you can move it again if you want to change your answer before proceeding to the next question. You must drop three actions in the work area.
Select and drag the screen divider to change the viewable area of the source and work areas.

Reveal Solution
Discussion
Correct Answer:

Explanation:
Add applications to the application control manager.
Assign collector groups to the policy.
Enable the blocklist rule on the application control policy.
"The applications must be added to the Application Control Manager under the user-defined group"
"Collector groups must be assigned to this policy"
"The blocklist rule must be enabled on the Application Control Policy." The correct sequence is to add applications to Application Control Manager, assign the relevant Collector Groups to the Application Control policy, and enable the blocklist rule. Application Control prevents designated executables from launching, whereas Communication Control regulates outbound application communication. FortiEDR automatically places manually added applications in its User-defined group, so creating a separate application group is unnecessary. Collector Groups receive policy assignments directly; application groups are not assigned to individual Collectors. Newly added applications are disabled by default and must also be enabled for blocking, unless the administrator has changed the default application state.
Reference: FortiEDR 7.0.0 Administration Guide, pages 216-224.