NSE7 Advanced Threat Protection Practice Test 11 — 15 Questions

Question 1

An administrator sees the following log entry:
'id=13593 msg="CDR: File attachment sanitized"'
Which feature generated this log?

Accepted Answer

Content Disarm and Reconstruction. The log entry 'CDR: File attachment sanitized' is generated by Content Disarm and Reconstruction (CDR). CDR works by removing active content (e.g., macros, scripts, embedded objects) from files and rebuilding them into a safe, sanitized version. This is distinct from sandboxing or machine learning, as CDR does not rely on detection but instead proactively neutralizes threats by reconstructing the file.

Answer

FortiSandbox

Answer

Machine Learning Engine

Answer

Outbreak Prevention

Question 2

Which Fortinet product is specifically designed to deploy decoys and lures to detect lateral movement and early-stage attacks inside the network?

Accepted Answer

FortiDeceptor. FortiDeceptor is specifically designed to deploy decoys and lures that mimic real assets (e.g., servers, endpoints, IoT devices) to attract and detect lateral movement and early-stage attacks inside the network. It uses deception technology to create a realistic attack surface, triggering alerts when an attacker interacts with a decoy, without relying on signatures or behavioral analysis.

Answer

FortiSandbox

Answer

FortiEDR

Answer

FortiClient

Question 3

Which Fortinet solution collects and correlates security events from multiple sources to provide a unified view of threats across the network?

Accepted Answer

FortiSIEM. FortiSIEM is the correct answer because it is specifically designed as a Security Information and Event Management (SIEM) solution that aggregates, normalizes, and correlates logs and events from diverse sources—including firewalls, endpoints, servers, and cloud platforms—into a single pane of glass. It uses a patented event correlation engine and a unified event database to detect multi-stage attack patterns and provide actionable threat intelligence, fulfilling the requirement for a unified view of threats across the network.

Answer

FortiSandbox

Answer

FortiDeceptor

Answer

FortiEDR

Question 4

A network admin wants to use FortiClient's advanced threat protection features to detect ransomware behavior on endpoints. Which FortiClient feature should be enabled?

Accepted Answer

Advanced Threat Protection. FortiClient's Advanced Threat Protection (ATP) feature is specifically designed to detect and block ransomware behavior by using real-time behavioral analysis, machine learning, and exploit prevention. Unlike other features, ATP monitors process behavior for indicators of compromise (IoCs) such as mass file encryption or unauthorized file access patterns, making it the correct choice for ransomware detection.

Answer

Web Filtering

Answer

Application Firewall

Answer

Vulnerability Scan

Question 5

Which feature on FortiGate uses machine learning to detect never-before-seen malware based on file characteristics?

Accepted Answer

Machine Learning Engine. The Machine Learning Engine (option A) on FortiGate uses static file analysis and machine learning models to detect never-before-seen malware based on file characteristics such as entropy, structure, and opcode sequences, without requiring signatures or behavioral execution. This allows it to identify zero-day threats pre-execution, directly matching the question's description.

Answer

Outbreak Prevention

Answer

FortiSandbox

Answer

Content Disarm and Reconstruction

Question 6

An administrator configures a WAF profile on FortiGate to protect a web application. However, the administrator notices that SQL injection attacks are not being blocked. What should the administrator check first?

Accepted Answer

The SQL injection signatures are enabled in the WAF profile. SQL injection attacks are blocked by specific signatures within the WAF profile. If these signatures are not enabled, the WAF will not inspect HTTP requests for SQL injection patterns, allowing attacks to pass through. The administrator must verify that the SQL injection signatures are toggled on under the WAF profile's signature configuration.

Answer

The WAF profile is attached to the correct firewall policy

Answer

The FortiGate has a valid Advanced Web Protection subscription

Answer

The web application is using HTTPS and SSL inspection is configured

Question 7

An organization uses FortiWeb to protect its web applications. The security team wants to block requests that contain a specific custom pattern in the URL. Which feature should be used?

Accepted Answer

Custom Attack Signature. Custom Attack Signatures in FortiWeb allow administrators to define user-specific patterns to match against HTTP request elements, including the URL. This feature is designed to block requests containing custom patterns, such as a specific string in the URL, by inspecting the request and triggering an action (e.g., alert or block) when the pattern is matched. Unlike other features, Custom Attack Signatures provide the granularity needed to detect and block arbitrary, organization-defined patterns in the URL.

Answer

Inline Protection Profile

Answer

URL Access Rule

Answer

Web Application Firewall Policy

Question 8

Which FortiGate security feature removes potentially malicious active content from files (e.g., macros, scripts) before delivering them to end users?

Accepted Answer

Content Disarm and Reconstruction. Content Disarm and Reconstruction (CDR) is the correct answer because it specifically removes potentially malicious active content—such as macros, scripts, and embedded objects—from files (e.g., Office documents, PDFs) by stripping the active elements and reconstructing a safe, sanitized version before delivery. Unlike traditional scanning, CDR does not rely on signatures or heuristics; it assumes the file could be malicious and proactively neutralizes threats by rebuilding the file with only safe, static content.

Answer

Antivirus

Answer

Data Leak Prevention

Answer

File Filter

Question 9

An administrator wants to integrate FortiGate with an external threat intelligence feed to block known malicious IP addresses automatically. Which object should be used to consume the feed?

Accepted Answer

External Threat Intelligence Feed. The External Threat Intelligence Feed object in FortiGate is specifically designed to consume external threat intelligence feeds (e.g., STIX/TAXII, CSV, or plain text lists) and automatically update a dynamic address object with indicators of compromise (IoCs) such as malicious IP addresses. This enables automated blocking of known malicious sources without manual intervention, making it the correct choice for integrating an external feed.

Answer

IP Pool

Answer

Address Group

Answer

Security Profile Group

Question 10

A FortiGate administrator is troubleshooting why a custom IPS signature is not triggering on traffic matching the pattern. Which TWO checks should be performed?

Accepted Answer

Confirm the IPS sensor is applied to the correct firewall policy. An IPS sensor must be explicitly attached to a firewall policy via the 'inspection-mode' or 'ips-sensor' configuration to inspect traffic. Even if a custom signature is correctly defined and enabled, it will never trigger if the sensor containing it is not applied to the policy that matches the target traffic. This is a fundamental prerequisite for any IPS signature to process packets.

Answer

Check the signature's severity level in the IPS sensor

Answer

Ensure the FortiGate is in proxy-based inspection mode

Answer

Verify the signature uses correct protocol decoder

Question 11

A company wants to use FortiMail to implement email authentication to prevent spoofing. Which THREE mechanisms should be configured in FortiMail's Authentication Profile?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is correct because it builds on SPF and DKIM to provide a policy framework that tells receiving mail servers how to handle messages that fail authentication checks. In FortiMail's Authentication Profile, DMARC enables the enforcement of policies like quarantine or reject, which directly prevents spoofing by ensuring only authenticated emails are delivered.

Answer

S/MIME

Answer

TLS

Question 12

An administrator wants to create an automation stitch that responds to a high-severity IPS event by blocking the attacker IP. Which THREE components are required to build this automation stitch?

Accepted Answer

Trigger (e.g., IPS Event). An automation stitch in FortiOS requires a trigger to initiate the workflow. In this scenario, the IPS event trigger is specifically designed to fire when a high-severity IPS signature match occurs, providing the necessary event data (e.g., attacker IP) to pass to subsequent actions. Without a trigger, the stitch would have no starting point.

Answer

Schedule (e.g., run every hour)

Answer

Condition (e.g., severity threshold)

Question 13

An admin wants to block malicious files detected by FortiSandbox at the FortiGate level. Which configuration is required on the FortiGate to automatically block files based on FortiSandbox verdict?

Accepted Answer

Enable 'FortiSandbox inline prevention' in the antivirus profile. Enabling 'FortiSandbox inline prevention' in the antivirus profile allows FortiGate to automatically block files based on the verdict received from FortiSandbox. When this option is enabled, the FortiGate will hold the file until the sandbox analysis completes, then either allow or block the file based on the verdict (e.g., malware detected). This is the direct configuration for automatic file blocking at the gateway level.

Answer

Enable Threat Feeds on FortiGate and subscribe to FortiSandbox feeds

Answer

Configure an Automation Stitch that triggers on malware detected events and blocks the source IP

Answer

Configure a security policy with a Web Filter profile that blocks malware categories

Question 14

Which FortiClient feature is specifically designed to prevent the execution of unknown malware by analyzing behavior in real-time?

Accepted Answer

FortiClient AI Engine. FortiClient AI Engine uses machine learning and behavioral analysis to detect and prevent unknown malware in real-time, without relying on signatures. Options A, B, and C address vulnerability scanning, application control, and web filtering respectively, none of which focus on real-time behavior analysis for unknown threats.

Answer

FortiClient Vulnerability Scan

Answer

FortiClient Application Firewall

Answer

FortiClient Web Filter

Question 15

A company uses an advanced antivirus profile with machine learning engine enabled. After a recent outbreak, several files that were previously undetected are now flagged. How does the outbreak prevention feature help in this situation?

Accepted Answer

It downloads the latest ML models from FortiGuard to detect new threats. The outbreak prevention feature in FortiGate's advanced antivirus profile automatically downloads the latest machine learning (ML) models from FortiGuard when a new outbreak is detected. This allows the ML engine to identify and flag previously undetected files without requiring a traditional signature update, enabling proactive detection of zero-day threats.

Answer

It sends all files to FortiSandbox for analysis

Answer

It quarantines all files for 24 hours until a signature is released

Answer

It blocks all executable files from being downloaded