A playbook is configured to block a file hash on the network through the FortiGate...

Comprehensive and Detailed 100 to 150 words of Explanation From FortiEDR 7.0 Administrator topics:

“This action blocks the communication to/from the affected Collector.”

“A Firewall Connector must already be configured in order to perform this action.”

FortiEDR Playbooks support separate remediation and investigation actions. The firewall-blocking action depends on the configured FortiGate connector, while Collector-based device isolation operates through the protected endpoint. If FortiGate is unreachable, the firewall action cannot complete successfully, but the independent Collector isolation action can still execute. The intended outcome is therefore successful device isolation with a failure recorded for the unsuccessful response.

Verification qualification: The documented firewall action blocks malicious remote addresses, not file hashes directly. Additionally, the Administration Guide does not explicitly define the overall playbook status when one action fails. Consequently, D is the strongest intended answer, but its aggregate failure-status behavior is not conclusively verified by the cited documentation.