NSE7 Advanced Threat Protection — 20 Questions

Question 1

A FortiGate administrator receives alerts about a device communicating with a known botnet C2 server. The traffic is encrypted with TLS. Which ATP feature is most effective to block this communication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS Filter with botnet C2 domain blocking. DNS Filter with botnet C2 domain blocking is the most effective because it proactively prevents the initial DNS resolution of the botnet's command-and-control domain, stopping the TLS handshake before it even begins. Since the traffic is encrypted with TLS, other security mechanisms like application control or IPS would require decryption to inspect the payload, which may not be feasible or configured. DNS Filter operates at Layer 7 without needing to decrypt the traffic, directly blocking the domain lookup based on FortiGuard's real-time threat intelligence.

Answer

Application control to block the C2 application

Answer

Antivirus profile with SSL inspection

Answer

IPS signature for botnet activity

Question 2

Which TWO features are part of FortiGate's Advanced Threat Protection (ATP) suite?

Accepted Answer

FortiGuard Antivirus. FortiGate's Advanced Threat Protection (ATP) suite is designed to detect and block advanced, unknown, and zero-day threats. FortiGuard Antivirus (C) is a core ATP component that uses signature-based and heuristics-based scanning to detect known malware at the gateway. FortiSandbox (D) extends this by detonating suspicious files in a virtual environment to identify unknown threats, making both integral to the ATP suite.

Answer

Data Leak Prevention (DLP)

Answer

SSL Inspection

Answer

Intrusion Prevention System (IPS)

Question 3

Which THREE actions should be taken to optimize FortiGate ATP performance while maintaining security?

Accepted Answer

Implement allow lists for trusted IP addresses to bypass scanning. Implementing allow lists for trusted IP addresses to bypass scanning (Option A) reduces unnecessary processing of traffic that is known to be safe, thereby optimizing FortiGate ATP performance without compromising security. This approach leverages the FortiGate's ability to exempt trusted sources from deep inspection, which lowers CPU and memory load while maintaining protection for untrusted traffic.

Answer

Disable unnecessary security profiles to reduce CPU load

Answer

Enable proxy-based inspection for all traffic

Question 4

Refer to the exhibit. An administrator notices that some malware files are not being detected by FortiGate. The antivirus profile uses flow-based scanning with FortiSandbox disabled. What is the most likely reason for missed detections?

Accepted Answer

FortiSandbox inline-scan is disabled, so unknown malware is not analyzed. Flow-based scanning inspects files as they traverse the firewall, but it relies on signatures and heuristics for detection. Without FortiSandbox inline-scan enabled, unknown or zero-day malware that does not match existing signatures will not be sent to the sandbox for behavioral analysis, so it can pass undetected. Option B correctly identifies that disabling FortiSandbox removes the ability to analyze unknown threats, which is the most likely reason for missed detections.

Answer

Flow-based scanning is less thorough than proxy-based

Answer

Quarantine is enabled, which causes files to be dropped before scanning

Answer

The antivirus profile is not applied to the firewall policy

Question 5

A large enterprise uses FortiGate as their perimeter firewall with ATP features enabled. They have a mix of internal users and remote VPN users. Recently, several remote users reported that their machines became infected with ransomware after connecting to the VPN. The IT team suspects that the ransomware entered through the VPN tunnel. The FortiGate has an antivirus profile applied to the VPN policy with SSL inspection enabled for all traffic. However, the logs show that no malware was detected. Upon investigation, the team finds that the remote users' machines are not managed by the company and do not have any endpoint protection. The ransomware was delivered via a spear-phishing email that the users opened on their remote machines. The email traffic passed through the VPN tunnel to the corporate mail server first, then back to the user. The FortiGate antivirus profile is configured to scan SMTP traffic but the email was sent from an external source to the corporate mail server, and the mail server uses STARTTLS to receive emails. The FortiGate does not perform SSL inspection on the SMTP traffic because the SMTP service is not included in the SSL inspection profile. What action should the administrator take to prevent this in the future?

Accepted Answer

Add SMTP to the SSL inspection profile to decrypt and scan email traffic. The FortiGate's antivirus profile is configured to scan SMTP traffic, but the email was encrypted via STARTTLS, and SMTP is not included in the SSL inspection profile. By adding SMTP to the SSL inspection profile, the FortiGate can decrypt the SMTP traffic, allowing the antivirus engine to inspect the email content for malware, including ransomware delivered via spear-phishing.

Answer

Disable STARTTLS on the corporate mail server to force plaintext SMTP

Answer

Require remote users to install endpoint protection with FortiClient

Answer

Block all SMTP traffic from remote VPN users

Question 6

Drag and drop the steps to configure OSPF on a FortiGate firewall into the correct order.

Accepted Answer

Step 1: Create virtual router, Step 2: Define areas and networks, Step 3: Set router ID, Step 4: Enable on interfaces, Step 5: Verify. Create virtual router, define areas and networks, set router ID, enable on interfaces, then verify.

Answer

Step 1: Set router ID, Step 2: Create virtual router, Step 3: Define areas and networks, Step 4: Enable on interfaces, Step 5: Verify

Answer

Step 1: Create virtual router, Step 2: Set router ID, Step 3: Enable on interfaces, Step 4: Define areas and networks, Step 5: Verify

Answer

Step 1: Define areas and networks, Step 2: Create virtual router, Step 3: Set router ID, Step 4: Enable on interfaces, Step 5: Verify

Question 7

Match each FortiGate security profile to its category.

Accepted Answer

Antivirus Profile: Protects against malware by scanning files and email attachments.. The correct matches are: Antivirus for malware scanning, Web Filter for URL categorization, and Application Control for app identification. Common confusions arise between Antivirus and Web Filter roles.

Answer

Antivirus Profile: Controls web content based on categories.

Answer

Web Filter Profile: Scans for viruses in traffic.

Question 8

A network admin configures FortiGate to submit files to FortiSandbox for analysis. After submission, the FortiGate logs show that files are being sent but no verdict is returned. The FortiSandbox is reachable and licensed. What is the most likely cause?

Accepted Answer

The FortiGate does not have a FortiGuard Security Rating subscription. FortiGate requires a valid FortiGuard Security Rating subscription to receive verdicts from FortiSandbox. Without this subscription, the FortiGate can submit files and see them as sent in logs, but it cannot process the returned verdicts, resulting in no action taken on the files. The Security Rating subscription enables the communication channel for verdict retrieval, distinct from the basic FortiSandbox license.

Answer

The FortiGate is using proxy-based inspection instead of flow-based

Answer

The FortiSandbox server's IP is not added to the FortiGate's trusted hosts

Answer

The antivirus profile is set to block without scanning

Question 9

An organization wants to protect against unknown malware by using machine learning on FortiGate. Which antivirus setting should be enabled to achieve this?

Accepted Answer

Enable 'Machine Learning Engine' in the antivirus profile. The 'Machine Learning Engine' in the antivirus profile uses on-device machine learning models to detect unknown malware based on file characteristics, without requiring signature updates. This provides proactive protection against zero-day threats directly on the FortiGate, aligning with the requirement to protect against unknown malware using machine learning.

Answer

Enable 'Outbreak Prevention' under FortiGuard settings

Answer

Set 'av-engine' to 'flow' under system settings

Answer

Enable 'FortiSandbox inline scanning' in the antivirus profile

Question 10

A FortiGate administrator wants to block a custom protocol anomaly where a client sends an HTTP request with a malformed header containing a null byte. Which advanced IPS feature should be used?

Accepted Answer

Enable Protocol Anomaly Detection in the IPS sensor. Protocol Anomaly Detection in the IPS sensor is designed to identify deviations from standard protocol behavior, such as malformed headers or null bytes in HTTP requests. This feature inspects traffic for known protocol violations without requiring custom signatures, making it the correct choice for blocking a null byte anomaly in HTTP headers.

Answer

Create a custom IPS signature to match the null byte pattern

Answer

Enable 'Outbreak Prevention' in the IPS sensor

Answer

Use the 'http-policy' setting in the WAF profile

Question 11

An organization uses FortiMail and wants to validate that incoming emails are from legitimate senders by checking the sender's domain against a published policy. Which two email authentication mechanisms can FortiMail use? (Choose two.)

Accepted Answer

SPF and DKIM. FortiMail can use SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to validate that incoming emails originate from legitimate senders by checking the sender's domain against a published policy. SPF verifies that the sending IP address is authorized by the domain's DNS TXT record, while DKIM uses a digital signature in the email header that can be validated against a public key published in the sender's DNS. Both mechanisms allow FortiMail to authenticate the sender's domain before accepting the message.

Answer

DKIM and DMARC

Answer

STARTTLS and SPF

Answer

DMARC and SPF

Question 12

A FortiGate admin runs 'diagnose ips anomaly list' and sees many 'tcp_src_session' events from a single internal IP. The admin suspects a scanning attack. What action should be taken to block this traffic without affecting legitimate traffic?

Accepted Answer

Create a custom IPS signature to detect and block the scanning pattern. Creating a custom IPS signature allows you to define specific patterns (e.g., multiple TCP SYN packets to different ports from the same source) that match scanning behavior, and then set the action to 'block'. This granular approach blocks only the malicious scanning traffic while permitting legitimate traffic from the same IP, unlike a blanket IP block or a global anomaly action that could impact normal sessions.

Answer

Create a firewall rule to block the IP address entirely

Answer

Enable 'tcp_src_session' anomaly action to 'block' in the IPS sensor

Answer

Use a WAF profile to block the IP based on rate

Question 13

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in SYN_SENT state, waiting for SYN-ACK. The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In Fortinet's session table, `proto_state=01` for TCP indicates the session is in the SYN_SENT state, meaning the firewall has forwarded a SYN packet and is waiting for a SYN-ACK from the remote host. The session is not yet established, as the three-way handshake has not completed.

Answer

The session is timed out

Answer

The session is closing (FIN_WAIT)

Answer

The session is fully established (proto_state=01 means established)

Question 14

A company uses FortiWeb as a reverse proxy for their web application. They want to protect against SQL injection attacks. Which FortiWeb feature should be configured?

Accepted Answer

Enable 'SQL Injection Prevention' in the Web Protection Profile. FortiWeb's Web Protection Profile includes a dedicated 'SQL Injection Prevention' module that uses signature-based and behavioral analysis to detect and block SQL injection attempts at the application layer. This is the correct feature because FortiWeb is a web application firewall (WAF) designed specifically for HTTP/HTTPS traffic, and SQL injection protection is a core WAF function, not a general IPS or network-layer feature.

Answer

Enable 'IPS Sensor' with SQL injection signatures

Answer

Use the FortiGate WAF profile instead

Answer

Configure a custom HTTP header validation rule

Question 15

Which TWO of the following are required for FortiGate to successfully obtain file verdicts from FortiSandbox? (Choose two.)

Accepted Answer

Valid FortiSandbox license on FortiGate. Option B is correct because FortiGate must have a valid FortiSandbox license (or a valid FortiGuard subscription that includes FortiSandbox Cloud service) to submit files and receive verdicts from FortiSandbox; without it, the sandbox integration is disabled. Option E is correct because FortiGate and FortiSandbox must have IP reachability over the network (typically TCP port 514 or the configured sandbox port) for FortiGate to send files and receive verdicts; without connectivity, no verdicts can be obtained. Option A is not required because FortiSandbox file submission and verdict retrieval work with both flow-based and proxy-based inspection modes. Option C is not required because inline scanning is a separate FortiSandbox deployment mode, not a prerequisite for FortiGate to receive verdicts. Option D is not required because FortiGuard Security Rating is an assessment service unrelated to sandbox verdict retrieval.

Answer

Proxy-based inspection mode enabled on the policy

Answer

FortiSandbox inline scanning enabled in antivirus profile

Answer

FortiGuard Security Rating subscription

Question 16

A security administrator wants to implement automated threat response using FortiGate automation stitches. Which THREE components are mandatory when creating an automation stitch? (Choose three.)

Accepted Answer

Action (e.g., 'CLI Script', 'Add IP to Blocklist'). In FortiGate automation stitches, the mandatory building blocks are the stitch name, at least one trigger, and at least one action, with an optional condition to filter when the stitch fires. Option B (stitch name) is required because every automation stitch must be uniquely identified and referenced by its name in the GUI or CLI. Option C (action, such as 'CLI Script' or 'Add IP to Blocklist') is mandatory because a stitch must define what FortiGate does in response, and a stitch cannot be saved without at least one action. Option D (trigger, such as 'Event Log' or 'FortiOS CLI') is mandatory because it defines the event that initiates the stitch; without a trigger the automation has nothing to react to. Option E (condition, e.g., a filter on event type) is also required in the sense that the trigger must be scoped by a condition/filter to specify which events match, and FortiOS requires this matching criterion when configuring the trigger. Option A (schedule, e.g., daily at midnight) is not mandatory because automation stitches are event-driven rather than time-driven; scheduling is not a required component of a stitch.

Answer

Schedule (e.g., daily at midnight)

Answer

Stitch name

Question 17

Which TWO email authentication mechanisms does FortiMail support to verify sender identity and reduce spoofing? (Choose two.)

Accepted Answer

SPF (Sender Policy Framework). FortiMail supports SPF (Sender Policy Framework) (B), which verifies the sending MTA's IP address against the domain's published SPF record in DNS to detect envelope-sender spoofing, and DKIM (DomainKeys Identified Mail) (E), which validates a cryptographic signature added to message headers to confirm the message was authorized by the signing domain and wasn't altered in transit. Both are core email authentication mechanisms FortiMail uses in its antispam and anti-spoofing profiles to verify sender identity. DMARC (A) is not the mechanism itself but a policy layer built on top of SPF and DKIM alignment, so it is not one of the two authentication mechanisms asked for here. STARTTLS (C) only encrypts the SMTP session in transit and provides no sender-identity verification, and S/MIME (D) provides message encryption and signing at the client level rather than authenticating the sending domain against DNS records.

Answer

DMARC (Domain-based Message Authentication, Reporting & Conformance)

Answer

STARTTLS

Answer

S/MIME

Question 18

A FortiGate administrator configures an antivirus profile with the machine learning engine enabled and applies it to a policy inspecting HTTP traffic. After deployment, the admin notices that some files are being allowed that should have been detected. What is the MOST likely cause?

Accepted Answer

The ML engine is in monitor-only mode. The most likely cause is that the machine learning engine is configured in monitor-only mode. In this mode, the ML engine will log detections and generate alerts but will not take any action to block the file, allowing it to pass through the policy. This is a common initial deployment strategy to assess the ML engine's impact before enabling active blocking.

Answer

FortiGuard outbreak prevention is disabled

Answer

The antivirus profile is using flow-based inspection instead of proxy-based

Answer

The file size exceeds the maximum scanning limit

Question 19

An administrator configures a FortiGate to integrate with FortiSandbox for inline scanning. The policy has an antivirus profile with FortiSandbox enabled. What condition must be met for files to be submitted to FortiSandbox?

Accepted Answer

The antivirus profile must use proxy-based inspection mode. For files to be submitted to FortiSandbox during inline scanning, the antivirus profile must use proxy-based inspection mode. This is because proxy-based inspection allows the FortiGate to buffer the entire file, perform deep analysis, and then forward it to FortiSandbox for verdict-based blocking. Flow-based inspection, in contrast, streams packets and cannot hold files for submission, making proxy mode a prerequisite for inline FortiSandbox integration.

Answer

The FortiSandbox must be on the same subnet as the FortiGate

Answer

The FortiGate must be in NAT mode

Answer

SSL inspection must be disabled

Question 20

A FortiGate administrator is troubleshooting why files are not being submitted to FortiSandbox for analysis. Which THREE conditions must be met for file submission to work? (Choose three.)

Accepted Answer

The file type must be in FortiSandbox's supported list. Option B is correct because FortiSandbox only accepts file types it can actually analyze, so the submitted file's type must appear in FortiSandbox's supported file-type list or the FortiGate will not forward it for sandboxing. Option C is correct because sandbox file submission requires a proxy-based antivirus profile; flow-based inspection does not support sending files to FortiSandbox, so the AV profile must operate in proxy mode. Option E is correct because the FortiGate must be licensed/authorized for FortiSandbox (via a valid FortiSandbox license or FortiCloud sandbox entitlement) for the sandbox inspection feature to function. Option A is wrong because SSL inspection is not a prerequisite for sandbox submission and is often needed to inspect encrypted traffic, not disabled. Option D is wrong because FortiSandbox inline scanning mode is not a requirement for FortiGate file submission; the FortiGate submits files to FortiSandbox for analysis regardless of inline versus other deployment modes.

Answer

SSL inspection must be disabled for the policy

Answer

The FortiSandbox must be in inline scanning mode