NSE7 Advanced Threat Protection Practice Test 10 — 15 Questions

Question 1

A network administrator wants to ensure that files downloaded from the internet are analyzed by FortiSandbox before being delivered to the client. The FortiGate is configured with a FortiSandbox connection and an antivirus profile. Which setting must be enabled in the antivirus profile to submit files to FortiSandbox?

Accepted Answer

Submit files to FortiSandbox

Answer

FortiSandbox inline scanning

Answer

Enable Content Disarm and Reconstruction (CDR)

Answer

Enable Outbreak Prevention

Question 2

What is the primary purpose of Content Disarm and Reconstruction (CDR) in advanced antivirus protection?

Accepted Answer

To reconstruct files by removing potentially malicious active content such as macros and scripts

Answer

To detect and block known malware using signature-based detection

Answer

To submit files to FortiSandbox for behavioral analysis

Answer

To encrypt files in transit to prevent interception

Question 3

An administrator configures a custom IPS signature to detect traffic to a specific malicious domain. Which syntax is correct for a custom IPS signature in FortiGate?

Accepted Answer

F-SBID( --name "malicious_domain"; --pattern "example.com"; --service HTTP; )

Answer

config ips custom signature edit "malicious_domain" set signature "alert tcp any any -> any any (msg:"malicious"; content:"example.com";)" end

Answer

config firewall policy edit 1 set ips-filter "malicious_domain" end

Answer

set ips-sensor custom-signature "malicious_domain" pattern "example.com"

Question 4

A company uses FortiMail for email security. They want to prevent email spoofing by verifying that incoming emails originate from authorized servers. Which email authentication method should be configured on FortiMail to check the sending server's IP against a published SPF record?

Accepted Answer

SPF verification

Answer

DKIM verification

Answer

DMARC verification

Answer

Sender Policy Framework (SPF) is not supported on FortiMail

Question 5

A security analyst notices repeated failed login attempts from a specific IP address to the FortiGate management interface. The administrator wants to automatically blacklist the IP after 3 failed attempts within 60 seconds. Which feature should be configured?

Accepted Answer

Admin lockdown and intruder lockout settings

Answer

Intrusion Prevention System (IPS) with custom signature

Answer

FortiGate's built-in DoS policy and blacklist

Answer

Administrative access trusted hosts

Question 6

An administrator configures an automation stitch to respond to a high severity event. The trigger is 'event' and the action is 'CLI script'. What must be defined for the action to execute properly?

Accepted Answer

A valid CLI script that contains commands to be executed on the FortiGate

Answer

An API token for authentication

Answer

A FortiManager to execute the script

Answer

An email server to send the script output

Question 7

Which of the following best describes the function of FortiDeceptor in an enterprise network?

Accepted Answer

It deploys decoys and lures to detect attackers inside the network.

Answer

It provides endpoint detection and response (EDR) capabilities on workstations.

Answer

It acts as a web application firewall for protecting web servers.

Answer

It provides sandboxing for advanced malware analysis.

Question 8

A FortiGate is configured with an antivirus profile that has the machine learning engine enabled. An administrator notices that some files are being detected by the ML engine but the verdict is 'probably clean'. What does this verdict indicate?

Accepted Answer

The ML engine has low confidence that the file is malicious; it may be a false positive.

Answer

The file is clean and safe to pass.

Answer

The file is definitely malicious and should be blocked.

Answer

The ML engine has detected an outbreak but needs FortiGuard to confirm.

Question 9

What is the primary difference between using a Web Application Firewall (WAF) on FortiGate versus using FortiWeb?

Accepted Answer

FortiWeb provides dedicated, advanced WAF features and higher performance for web traffic, while FortiGate WAF is a basic protection feature.

Answer

There is no difference; they are the same.

Answer

FortiGate WAF is cloud-based, while FortiWeb is on-premises.

Answer

FortiGate WAF can protect multiple web servers simultaneously, while FortiWeb protects only one.

Question 10

An administrator wants to automatically block a file that FortiSandbox has determined to be malicious. The FortiGate is configured with an antivirus profile that includes FortiSandbox submission. Which verdict action should be set to 'block' in the antivirus profile to achieve this?

Accepted Answer

Malicious

Answer

Exempted

Answer

Unknown

Answer

Clean

Question 11

A FortiGate administrator runs 'diagnose ips anomaly list' and sees many entries with 'protocol anomaly - tcp_port_scan'. The administrator wants to reduce false positives. Which action should be taken in the IPS sensor configuration?

Accepted Answer

Increase the threshold for the port scan detection in the IPS sensor.

Answer

Add the trusted server IPs to an exemption list in the IPS sensor.

Answer

Disable the TCP port scan filter entirely.

Answer

Change the action from 'block' to 'monitor' for all IPS filters.

Question 12

A company wants to receive threat intelligence feeds from external sources to enhance their FortiGate's protection. Which method should be used to integrate external threat feeds into FortiGate?

Accepted Answer

Configure an external threat feed connector in FortiGate, such as using a URL to a STIX/TAXII feed.

Answer

Use FortiGuard Threat Intelligence Service which automatically pulls feeds.

Answer

Manually add IP addresses to local address objects.

Answer

Use FortiAnalyzer to push feeds to FortiGate.

Question 13

An administrator needs to configure advanced email security on FortiMail to protect against phishing and spoofing. Which THREE features should be enabled to achieve comprehensive email authentication?

Accepted Answer

DKIM signing and verification

Answer

Anti-spam Bayesian filtering

Answer

TLS encryption for inbound/outbound

Question 14

A FortiGate administrator wants to use automation stitches to respond to a detected threat. The trigger is 'event' and the action is to quarantine the source IP. Which TWO actions can be used in FortiGate automation stitches to achieve IP quarantine?

Accepted Answer

CLI script that runs 'diagnose user quarantine add'

Answer

Send an email to the administrator

Answer

Use the 'execute fortishield' command in a CLI script

Answer

Log the event to FortiAnalyzer

Question 15

A company has deployed FortiClient with advanced threat protection (ATP) features. Which TWO capabilities does FortiClient ATP provide beyond basic antivirus?

Accepted Answer

Exploit prevention and vulnerability scanning

Answer

Application control and inventory

Answer

VPN connectivity

Answer

Web filtering and URL rating