NSE7 Advanced Threat Protection Practice Test 11 — 15 Questions

Question 1

A network administrator notices that FortiGate is not blocking a known malicious file that was submitted to FortiSandbox and received a 'malicious' verdict. The firewall policy includes a FortiSandbox inline scan profile. What is the MOST likely cause?

Accepted Answer

The FortiSandbox is not configured as an inline scanner in the antivirus profile. Option A is correct because inline scanning requires the FortiSandbox to be configured as the inline scanner in the antivirus profile. If only a scheduled scan or a separate FortiSandbox is used for analysis, the inline blocking will not occur.

Answer

The antivirus signature database is outdated

Answer

The FortiSandbox license has expired

Answer

The file is larger than the maximum file size allowed for scanning

Question 2

An administrator runs 'diagnose ips anomaly list' and sees many 'data_leak' events from a specific internal IP address. The IPS sensor has the default pre-defined signatures enabled. What additional step should the administrator take to block this specific anomaly?

Accepted Answer

Create a custom IPS signature to match the anomaly pattern and apply it to the IPS sensor. Option B is correct because protocol anomalies require custom signatures to define the precise pattern or threshold, as pre-defined signatures may not cover specific behavior.

Answer

Enable protocol anomaly detection in the antivirus profile

Answer

Enable the 'data_leak' signature in the IPS sensor and set action to 'block'

Answer

Configure a firewall policy with application control to block the traffic

Question 3

A FortiGate administrator wants to ensure that files in email attachments are disarmed before delivery. Which security feature should be configured in the antivirus profile?

Accepted Answer

Content Disarm and Reconstruction (CDR). Option C is correct. Content Disarm and Reconstruction (CDR) is specifically designed to remove active content and rebuild files, making them safe for delivery.

Answer

FortiSandbox inline scanning

Answer

Machine Learning Engine

Answer

Outbreak Prevention

Question 4

An administrator is configuring a firewall policy for web traffic to a critical web application. They want to protect against SQL injection and cross-site scripting. Which security profile should they apply?

Accepted Answer

Web Application Firewall (WAF) profile. Option B is correct. Web Application Firewall (WAF) on FortiGate provides signature-based and anomaly-based detection for web application attacks like SQL injection and XSS.

Answer

Antivirus profile with CDR

Answer

Application control profile

Answer

IPS sensor with pre-defined signatures

Question 5

You receive an alert from FortiSandbox that a file has been rated 'highly malicious'. The FortiGate has the FortiSandbox inline scanning enabled with the action 'block malicious'. However, the file is still being downloaded by users. What is the most likely reason?

Accepted Answer

The file type is not listed in the scanning profile for FortiSandbox. Option D is correct. Inline scanning requires the file to be forwarded to FortiSandbox; if the file type is not included in the scanning profile (e.g., by file extension, MIME type, or size), it will bypass scanning.

Answer

The FortiSandbox device is not reachable from FortiGate

Answer

The IPS sensor is blocking the connection before the antivirus inspection

Answer

The antivirus database is outdated

Question 6

An administrator is deploying FortiClient with ATP features. They want to ensure that if a process is detected as malicious by the FortiClient machine learning engine, the endpoint is isolated from the network. Which configuration should they use?

Accepted Answer

Configure an automation stitch with trigger 'FortiClient event' and action 'quarantine endpoint'. Option A is correct. Automation stitches allow triggering an action (like endpoint isolation) when a specific event (malicious process detected) occurs. The ML engine can generate a log event that triggers the stitch.

Answer

Create a firewall policy to block traffic from that endpoint

Answer

Enable 'auto-network-access' in the FortiClient profile

Answer

Enable 'FortiClient quarantine' in the antivirus profile

Question 7

An administrator wants to secure email traffic by ensuring that incoming emails are verified against the sender's domain SPF record. Which email authentication method provides this verification?

Accepted Answer

SPF. Option B is correct. SPF (Sender Policy Framework) checks if the sending IP is authorized by the domain's SPF record in DNS.

Answer

DKIM

Answer

DMARC

Answer

S/MIME

Question 8

A FortiGate administrator is troubleshooting an issue where a legitimate application is being blocked by the IPS. The administrator wants to ensure the application works while maintaining protection for other traffic. What is the best action?

Accepted Answer

Create a custom IPS signature to pass the specific application traffic. Option C is correct. Creating a custom IPS signature with a 'pass' action for the specific application traffic will allow it, while the default action (block) applies to others.

Answer

Disable the IPS sensor on the firewall policy

Answer

Apply an application control profile to allow the application

Answer

Change the IPS signature action to 'monitor' for all signatures

Question 9

An administrator configured FortiGate to forward suspected malicious files to FortiSandbox. They set the action to 'block' for malicious verdicts. Some files are being blocked, but others with a 'clean' verdict are allowed. However, they notice that some files that should have been sent to FortiSandbox are not being forwarded. Which reason is MOST likely?

Accepted Answer

The file size exceeds the maximum size configured for FortiSandbox scanning. Option C is correct. FortiGate uses a scanning profile that includes file size and type limits; if the file exceeds the maximum size configured for FortiSandbox submission, it will not be forwarded.

Answer

The FortiGate antivirus engine is set to proxy-based mode

Answer

The FortiGate has insufficient disk space for temporary files

Answer

The FortiSandbox device is overloaded and rejecting submissions

Question 10

Which feature in FortiMail provides an additional layer of protection by analyzing the behavior of email attachments in a sandbox environment?

Accepted Answer

FortiSandbox integration. Option C is correct. FortiMail integrates with FortiSandbox to analyze attachment behavior in a sandbox, providing advanced threat detection beyond signature-based methods.

Answer

Outbreak Prevention

Answer

Anti-spam

Answer

Content Disarm and Reconstruction

Question 11

An administrator is configuring FortiDeceptor to detect threats within the network. Which TWO statements about FortiDeceptor are correct?

Accepted Answer

It sends alerts to FortiSIEM or FortiSOAR for automated response. Options A and D are correct. FortiDeceptor uses decoys and lures to attract attackers, and it sends alerts to FortiSIEM or FortiSOAR for automated response.

Answer

It requires a separate hardware appliance for each network segment

Answer

It uses signature-based detection to identify malware

Answer

It can replace firewall functionality

Question 12

An administrator is configuring automation stitches to respond to a detected ransomware outbreak. Which THREE components are essential for an automation stitch?

Accepted Answer

Condition. Options A, C, and D are correct. An automation stitch requires a trigger (event), a condition (optional but often used), and an action (response).

Answer

Schedule

Answer

Log device

Question 13

An administrator wants to protect against zero-day malware that has not yet been discovered by signature-based detection. Which TWO technologies can help mitigate such threats?

Accepted Answer

Machine Learning Engine. Options B and D are correct. Machine learning engine and outbreak prevention use heuristics and behavioral analysis to detect unknown threats.

Answer

Signature-based antivirus

Answer

Web filtering

Answer

Application control

Question 14

An administrator is configuring FortiMail to be more secure against advanced email threats. Which THREE features should they enable to protect against email-based phishing attacks?

Accepted Answer

DKIM signing/verification. Options A, B, and E are correct. SPF, DKIM, and DMARC are email authentication standards that help verify sender identity and prevent spoofing/phishing.

Answer

CDR (Content Disarm and Reconstruction)

Answer

FortiSandbox inline scanning

Question 15

An administrator is investigating an alert from FortiEDR indicating a suspicious process on an endpoint. The administrator wants to gather more context. Which TWO sources can provide threat intelligence to enrich the investigation?

Accepted Answer

FortiGuard Outbreak Prevention. Options C and D are correct. FortiGuard Outbreak Prevention and third-party threat feeds provide external threat intelligence about indicators of compromise.

Answer

Local antivirus signature database

Answer

FortiGate traffic logs

Answer

FortiClient local cache