NSE7 Practice Test 16 — 15 Questions

Question 1

A network administrator wants to ensure that files downloaded from the internet are analyzed by FortiSandbox before being delivered to the client. The FortiGate is configured with a FortiSandbox connection and an antivirus profile. Which setting must be enabled in the antivirus profile to submit files to FortiSandbox?

Accepted Answer

Submit files to FortiSandbox

Answer

FortiSandbox inline scanning

Answer

Enable Content Disarm and Reconstruction (CDR)

Answer

Enable Outbreak Prevention

Question 2

An administrator configures an automation stitch to respond to a high severity event. The trigger is 'event' and the action is 'CLI script'. What must be defined for the action to execute properly?

Accepted Answer

A valid CLI script that contains commands to be executed on the FortiGate

Answer

An API token for authentication

Answer

A FortiManager to execute the script

Answer

An email server to send the script output

Question 3

An administrator wants to automatically block a file that FortiSandbox has determined to be malicious. The FortiGate is configured with an antivirus profile that includes FortiSandbox submission. Which verdict action should be set to 'block' in the antivirus profile to achieve this?

Accepted Answer

Malicious

Answer

Exempted

Answer

Unknown

Answer

Clean

Question 4

A company wants to receive threat intelligence feeds from external sources to enhance their FortiGate's protection. Which method should be used to integrate external threat feeds into FortiGate?

Accepted Answer

Configure an external threat feed connector in FortiGate, such as using a URL to a STIX/TAXII feed.

Answer

Use FortiGuard Threat Intelligence Service which automatically pulls feeds.

Answer

Manually add IP addresses to local address objects.

Answer

Use FortiAnalyzer to push feeds to FortiGate.

Question 5

An administrator runs 'diagnose ips anomaly list' and sees many 'data_leak' events from a specific internal IP address. The IPS sensor has the default pre-defined signatures enabled. What additional step should the administrator take to block this specific anomaly?

Accepted Answer

Create a custom IPS signature to match the anomaly pattern and apply it to the IPS sensor. Option B is correct because protocol anomalies require custom signatures to define the precise pattern or threshold, as pre-defined signatures may not cover specific behavior.

Answer

Enable protocol anomaly detection in the antivirus profile

Answer

Enable the 'data_leak' signature in the IPS sensor and set action to 'block'

Answer

Configure a firewall policy with application control to block the traffic

Question 6

An administrator wants to protect against zero-day malware that has not yet been discovered by signature-based detection. Which TWO technologies can help mitigate such threats?

Accepted Answer

Machine Learning Engine. Options B and D are correct. Machine learning engine and outbreak prevention use heuristics and behavioral analysis to detect unknown threats.

Answer

Signature-based antivirus

Answer

Web filtering

Answer

Application control

Question 7

A FortiGate admin configures an automation stitch to send an email alert when a high-severity IPS event occurs. The trigger is 'IPS Event' and the action is 'Email'. After testing, no email is sent despite events being logged. What is the most likely cause?

Accepted Answer

No SMTP server is configured in the FortiGate. Automation stitches require a valid mail server configuration in the FortiGate's email settings. Without it, the email action cannot be executed.

Answer

The IPS event severity threshold is set too low

Answer

The automation stitch is disabled

Answer

The IPS engine is in monitor mode

Question 8

A network admin wants to use FortiClient's advanced threat protection features to detect ransomware behavior on endpoints. Which FortiClient feature should be enabled?

Accepted Answer

Advanced Threat Protection. FortiClient's Advanced Threat Protection (ATP) includes endpoint detection and response capabilities such as ransomware behavior detection.

Answer

Web Filtering

Answer

Application Firewall

Answer

Vulnerability Scan

Question 9

A company wants to use FortiMail to implement email authentication to prevent spoofing. Which THREE mechanisms should be configured in FortiMail's Authentication Profile?

Accepted Answer

DMARC. SPF, DKIM, and DMARC are the three standard email authentication methods.

Answer

S/MIME

Answer

TLS

Question 10

A company uses an advanced antivirus profile with machine learning engine enabled. After a recent outbreak, several files that were previously undetected are now flagged. How does the outbreak prevention feature help in this situation?

Accepted Answer

It downloads the latest ML models from FortiGuard to detect new threats. Option A is correct because outbreak prevention uses FortiGuard to push real-time updates, including new ML models, to detect emerging threats quickly.

Answer

It sends all files to FortiSandbox for analysis

Answer

It quarantines all files for 24 hours until a signature is released

Answer

It blocks all executable files from being downloaded

Question 11

A FortiGate is configured with an antivirus profile that has the machine learning engine enabled. An administrator notices that some files are being detected by the ML engine but the verdict is 'probably clean'. What does this verdict indicate?

Accepted Answer

The ML engine has low confidence that the file is malicious; it may be a false positive.

Answer

The file is clean and safe to pass.

Answer

The file is definitely malicious and should be blocked.

Answer

The ML engine has detected an outbreak but needs FortiGuard to confirm.

Question 12

A network administrator notices that FortiGate is not blocking a known malicious file that was submitted to FortiSandbox and received a 'malicious' verdict. The firewall policy includes a FortiSandbox inline scan profile. What is the MOST likely cause?

Accepted Answer

The FortiSandbox is not configured as an inline scanner in the antivirus profile. Option A is correct because inline scanning requires the FortiSandbox to be configured as the inline scanner in the antivirus profile. If only a scheduled scan or a separate FortiSandbox is used for analysis, the inline blocking will not occur.

Answer

The antivirus signature database is outdated

Answer

The FortiSandbox license has expired

Answer

The file is larger than the maximum file size allowed for scanning

Question 13

An administrator is configuring automation stitches to respond to a detected ransomware outbreak. Which THREE components are essential for an automation stitch?

Accepted Answer

Condition. Options A, C, and D are correct. An automation stitch requires a trigger (event), a condition (optional but often used), and an action (response).

Answer

Schedule

Answer

Log device

Question 14

A company uses FortiMail and wants to ensure that incoming emails are authenticated using SPF, DKIM, and DMARC. Which profile should the administrator configure to enforce these checks?

Accepted Answer

Authentication Profile. FortiMail uses an 'Authentication Profile' to configure SPF, DKIM, and DMARC verification for incoming emails.

Answer

Session Profile

Answer

Antispam Profile

Answer

IP Policy

Question 15

A network admin notices that files submitted to FortiSandbox are not being analyzed. The FortiGate is configured to send files to FortiSandbox. What is the MOST likely cause?

Accepted Answer

FortiSandbox license is expired. Option A is correct because FortiSandbox requires a valid license to perform analysis. Without it, files are queued but not analyzed.

Answer

FortiGate firewall policy is blocking the connection to FortiSandbox on port 443

Answer

FortiSandbox is in quarantine mode

Answer

File size exceeds the maximum submission size limit on FortiGate