NSE7 Advanced Threat Protection — 15 Questions

Question 1

A network administrator has configured FortiGate to send files to FortiSandbox for analysis. However, files are not being submitted. The administrator checks the FortiGate configuration and sees that the FortiSandbox server IP is correctly entered. What is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A firewall policy is blocking communication to FortiSandbox on port 514. The most likely cause is that a firewall policy is blocking communication to FortiSandbox on port 514. FortiGate uses port 514 (syslog) to submit files to FortiSandbox, and if this port is blocked by an intermediate firewall or an implicit deny policy, the submission will fail even if the server IP is correctly configured. The administrator should verify that traffic to the FortiSandbox IP on UDP/TCP 514 is permitted by all relevant policies.

Answer

The FortiSandbox is not licensed for file submission

Answer

The file type is not supported by FortiSandbox

Answer

The FortiGate antivirus profile is set to flow-based inspection

Question 2

A FortiGate is configured to submit files to FortiSandbox. The administrator notices that files are being submitted but no verdicts are returned. Which two conditions could cause this?

Accepted Answer

The FortiSandbox server is not reachable from the FortiGate. When FortiSandbox is not reachable from the FortiGate, the file cannot be submitted for analysis, resulting in no verdict returned. Similarly, if the file size exceeds the FortiSandbox submission limit, the file may be rejected, preventing verdict generation. Unsupported file types (B) still get a verdict (e.g., skipped). An expired license (D) also prevents verdict return, but the explanation must match the new correct set: A and C are the only correct conditions among the list. The antivirus profile set to monitor mode (E) does not affect verdict return; it only controls action taken on verdict.

Answer

The file type is not supported by FortiSandbox

Answer

The FortiSandbox license has expired

Answer

The antivirus profile is set to monitor mode

Question 3

Which FortiClient feature is specifically designed to prevent the execution of unknown malware by analyzing behavior in real-time?

Accepted Answer

FortiClient AI Engine. FortiClient AI Engine uses machine learning and behavioral analysis to detect and prevent unknown malware in real-time, without relying on signatures. Options A, B, and C address vulnerability scanning, application control, and web filtering respectively, none of which focus on real-time behavior analysis for unknown threats.

Answer

FortiClient Vulnerability Scan

Answer

FortiClient Application Firewall

Answer

FortiClient Web Filter

Question 4

A company is deploying FortiGate with Advanced Threat Protection (ATP) and wants to block advanced malware that uses encrypted C2 communications. Which security profile should be configured to perform SSL inspection and detect malicious traffic?

Accepted Answer

Antivirus profile with SSL inspection. An Antivirus profile with SSL inspection enabled is required to decrypt encrypted C2 (command-and-control) traffic so that FortiGate can inspect the payload for malware signatures, heuristics, and behavioral patterns. Without SSL inspection, the ATP engine cannot see inside the encrypted tunnel, rendering the antivirus and other security profiles ineffective against encrypted C2 communications.

Answer

Data Leak Prevention profile

Answer

Web Filtering profile

Answer

Intrusion Prevention profile

Question 5

A network administrator notices that several endpoints are infected with ransomware despite having FortiGate ATP enabled. The logs show that the files were downloaded over HTTPS, and the antivirus profile did not detect them. What is the most likely reason?

Accepted Answer

SSL inspection was not enabled on the antivirus profile. FortiGate ATP's antivirus engine cannot inspect encrypted HTTPS traffic unless SSL inspection is explicitly enabled on the antivirus profile. Without SSL inspection, the antivirus profile only sees encrypted payloads and cannot match file signatures or heuristics, allowing ransomware to pass undetected. The logs confirm files were downloaded over HTTPS, making this the most likely root cause.

Answer

Application control profile blocked the download

Answer

FortiSandbox was not configured to analyze the files

Answer

IPS signature database was outdated

Question 6

A security engineer is troubleshooting a scenario where FortiGate is not blocking a known malicious URL categorized as 'Malware'. The web filtering profile is configured with 'monitor all' for the Malware category. What change should be made to block the URL?

Accepted Answer

Change the action for Malware category from 'monitor' to 'block' in the web filter profile. The web filtering profile currently has the Malware category set to 'monitor all', which logs but does not block traffic. To block the URL, the action must be changed from 'monitor' to 'block' within the same web filter profile. This directly enforces the blocking action for all URLs categorized as Malware, including the known malicious URL.

Answer

Configure traffic shaping to rate limit the URL

Answer

Add a static URL filter with the exact URL and action 'block'

Answer

Enable DNS filter with botnet C2 domain blocking

Question 7

A company wants to detect and block phishing emails that contain malicious links. Which FortiGate security profile should be used?

Accepted Answer

Email Filtering profile. FortiGate's Email Filtering profile is specifically designed to inspect SMTP, POP3, and IMAP traffic for phishing indicators, including malicious URLs in email bodies and attachments. It can block or quarantine emails based on URL reputation, sender authentication (SPF/DKIM/DMARC), and content analysis, directly addressing the requirement to detect and block phishing emails with malicious links.

Answer

Antivirus profile

Answer

Web Filtering profile

Answer

Data Leak Prevention profile

Question 8

A FortiGate administrator receives alerts about a device communicating with a known botnet C2 server. The traffic is encrypted with TLS. Which ATP feature is most effective to block this communication?

Accepted Answer

DNS Filter with botnet C2 domain blocking. DNS Filter with botnet C2 domain blocking is the most effective because it proactively prevents the initial DNS resolution of the botnet's command-and-control domain, stopping the TLS handshake before it even begins. Since the traffic is encrypted with TLS, other security mechanisms like application control or IPS would require decryption to inspect the payload, which may not be feasible or configured. DNS Filter operates at Layer 7 without needing to decrypt the traffic, directly blocking the domain lookup based on FortiGuard's real-time threat intelligence.

Answer

Application control to block the C2 application

Answer

Antivirus profile with SSL inspection

Answer

IPS signature for botnet activity

Question 9

Which TWO features are part of FortiGate's Advanced Threat Protection (ATP) suite?

Accepted Answer

FortiGuard Antivirus. FortiGate's Advanced Threat Protection (ATP) suite is designed to detect and block advanced, unknown, and zero-day threats. FortiGuard Antivirus (C) is a core ATP component that uses signature-based and heuristics-based scanning to detect known malware at the gateway. FortiSandbox (D) extends this by detonating suspicious files in a virtual environment to identify unknown threats, making both integral to the ATP suite.

Answer

Data Leak Prevention (DLP)

Answer

SSL Inspection

Answer

Intrusion Prevention System (IPS)

Question 10

Which THREE actions should be taken to optimize FortiGate ATP performance while maintaining security?

Accepted Answer

Implement allow lists for trusted IP addresses to bypass scanning. Implementing allow lists for trusted IP addresses to bypass scanning (Option A) reduces unnecessary processing of traffic that is known to be safe, thereby optimizing FortiGate ATP performance without compromising security. This approach leverages the FortiGate's ability to exempt trusted sources from deep inspection, which lowers CPU and memory load while maintaining protection for untrusted traffic.

Answer

Disable unnecessary security profiles to reduce CPU load

Answer

Enable proxy-based inspection for all traffic

Question 11

Refer to the exhibit. An administrator notices that some malware files are not being detected by FortiGate. The antivirus profile uses flow-based scanning with FortiSandbox disabled. What is the most likely reason for missed detections?

Accepted Answer

FortiSandbox inline-scan is disabled, so unknown malware is not analyzed. Flow-based scanning inspects files as they traverse the firewall, but it relies on signatures and heuristics for detection. Without FortiSandbox inline-scan enabled, unknown or zero-day malware that does not match existing signatures will not be sent to the sandbox for behavioral analysis, so it can pass undetected. Option B correctly identifies that disabling FortiSandbox removes the ability to analyze unknown threats, which is the most likely reason for missed detections.

Answer

Flow-based scanning is less thorough than proxy-based

Answer

Quarantine is enabled, which causes files to be dropped before scanning

Answer

The antivirus profile is not applied to the firewall policy

Question 12

Refer to the exhibit. A user reports that accessing a legitimate HTTPS website is blocked. The FortiGate logs show that the connection was denied by the antivirus profile. What is the most likely cause?

Accepted Answer

The antivirus profile detected a false positive in the encrypted traffic. The antivirus (AV) profile on FortiGate performs deep inspection of HTTPS traffic by decrypting it, scanning the content, and re-encrypting it. If the AV signature database contains a false positive for a legitimate website's content (e.g., a benign JavaScript file matching a malware signature), the connection will be denied. The log explicitly states the denial was by the AV profile, not by any other security profile, making a false positive in encrypted traffic the most likely cause.

Answer

The application list blocked the HTTPS application

Answer

The IPS profile blocked a vulnerability in the website

Answer

The protocol options profile blocked the SSL handshake

Question 13

A large enterprise uses FortiGate as their perimeter firewall with ATP features enabled. They have a mix of internal users and remote VPN users. Recently, several remote users reported that their machines became infected with ransomware after connecting to the VPN. The IT team suspects that the ransomware entered through the VPN tunnel. The FortiGate has an antivirus profile applied to the VPN policy with SSL inspection enabled for all traffic. However, the logs show that no malware was detected. Upon investigation, the team finds that the remote users' machines are not managed by the company and do not have any endpoint protection. The ransomware was delivered via a spear-phishing email that the users opened on their remote machines. The email traffic passed through the VPN tunnel to the corporate mail server first, then back to the user. The FortiGate antivirus profile is configured to scan SMTP traffic but the email was sent from an external source to the corporate mail server, and the mail server uses STARTTLS to receive emails. The FortiGate does not perform SSL inspection on the SMTP traffic because the SMTP service is not included in the SSL inspection profile. What action should the administrator take to prevent this in the future?

Accepted Answer

Add SMTP to the SSL inspection profile to decrypt and scan email traffic. The FortiGate's antivirus profile is configured to scan SMTP traffic, but the email was encrypted via STARTTLS, and SMTP is not included in the SSL inspection profile. By adding SMTP to the SSL inspection profile, the FortiGate can decrypt the SMTP traffic, allowing the antivirus engine to inspect the email content for malware, including ransomware delivered via spear-phishing.

Answer

Disable STARTTLS on the corporate mail server to force plaintext SMTP

Answer

Require remote users to install endpoint protection with FortiClient

Answer

Block all SMTP traffic from remote VPN users

Question 14

Drag and drop the steps to configure OSPF on a FortiGate firewall into the correct order.

Accepted Answer

Step 1: Create virtual router, Step 2: Define areas and networks, Step 3: Set router ID, Step 4: Enable on interfaces, Step 5: Verify. Create virtual router, define areas and networks, set router ID, enable on interfaces, then verify.

Answer

Step 1: Set router ID, Step 2: Create virtual router, Step 3: Define areas and networks, Step 4: Enable on interfaces, Step 5: Verify

Answer

Step 1: Create virtual router, Step 2: Set router ID, Step 3: Enable on interfaces, Step 4: Define areas and networks, Step 5: Verify

Answer

Step 1: Define areas and networks, Step 2: Create virtual router, Step 3: Set router ID, Step 4: Enable on interfaces, Step 5: Verify

Question 15

Match each FortiGate security profile to its category.

Accepted Answer

Antivirus Profile: Protects against malware by scanning files and email attachments.. The correct matches are: Antivirus for malware scanning, Web Filter for URL categorization, and Application Control for app identification. Common confusions arise between Antivirus and Web Filter roles.

Answer

Antivirus Profile: Controls web content based on categories.

Answer

Web Filter Profile: Scans for viruses in traffic.