NSE7 Advanced Threat Protection Practice Test 12 — 15 Questions

Question 1

An admin wants to ensure that office documents (e.g., Word, Excel) downloaded from the internet are safe before users open them. Which feature should be used to remove potentially malicious macros and active content?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Content Disarm and Reconstruction (CDR). Content Disarm and Reconstruction (CDR) is the correct feature because it proactively removes potentially malicious macros, scripts, and active content from office documents by stripping the original file's active elements and rebuilding a safe, sanitized version. Unlike detection-based methods, CDR eliminates threats before the file reaches the user, ensuring that even unknown or zero-day macro-based attacks are neutralized.

Answer

Machine learning engine

Answer

Antivirus pattern matching

Answer

FortiSandbox file submission

Question 2

An IPS administrator wants to detect a new custom attack that sends malformed HTTP headers. The attack pattern is a specific sequence of bytes that is not covered by existing signatures. What is the BEST way to detect this attack on FortiGate?

Accepted Answer

Create a custom IPS signature. Custom IPS signatures allow you to define a specific byte sequence or pattern (e.g., via a regular expression or hex pattern) that matches the malformed HTTP header. FortiGate's IPS engine can then inspect HTTP traffic at the application layer and trigger an alert or block when the custom pattern is found, even if no existing signature covers it.

Answer

Use an automation stitch to block traffic with unusual headers

Answer

Enable protocol anomaly detection in the IPS sensor

Answer

Deploy FortiWeb as a reverse proxy

Question 3

A FortiGate is configured with an IPS sensor that has protocol anomaly detection enabled. The admin notices that legitimate VoIP traffic (SIP) is being blocked. Which action should the admin take to reduce false positives?

Accepted Answer

Tune the protocol anomaly thresholds to be more lenient for SIP. Protocol anomaly detection in IPS sensors uses predefined thresholds to identify abnormal traffic patterns. When legitimate SIP traffic is being blocked, tuning the protocol anomaly thresholds to be more lenient for SIP allows the sensor to accommodate normal variations in SIP behavior without triggering false positives, while still maintaining protection against actual anomalies.

Answer

Change the IPS action from block to monitor

Answer

Add the VoIP servers to an IP exemption list in the IPS sensor

Answer

Disable protocol anomaly detection entirely

Question 4

An email security administrator wants to prevent attackers from spoofing the company's domain. Which email authentication mechanism should be configured to allow receiving servers to verify that emails claiming to be from the domain are sent from authorized mail servers?

Accepted Answer

SPF. SPF (Sender Policy Framework) is the correct answer because it allows domain owners to publish DNS records specifying which mail servers are authorized to send email on behalf of their domain. Receiving servers can then verify the envelope sender (Return-Path) against the SPF record to detect spoofed messages. This directly addresses the requirement to verify that emails claiming to be from the domain originate from authorized servers.

Answer

DMARC

Answer

TLS for SMTP

Answer

DKIM

Question 5

Which Fortinet product is designed to deploy decoy systems to lure attackers and detect lateral movement within the network?

Accepted Answer

FortiDeceptor. FortiDeceptor is specifically designed to deploy decoy systems (honeypots) that mimic real assets, such as servers or endpoints, to lure attackers. It detects lateral movement by monitoring decoy interactions and generating alerts when an attacker probes or compromises these fake targets, providing early warning of network intrusion.

Answer

FortiSandbox

Answer

FortiSOAR

Answer

FortiEDR

Question 6

An organization wants to implement a solution that can detect and automatically respond to threats across multiple Fortinet security products. Which product should they use?

Accepted Answer

FortiSOAR. FortiSOAR is the correct choice because it is a security orchestration, automation, and response (SOAR) platform designed to ingest alerts from multiple Fortinet products (e.g., FortiGate, FortiSIEM, FortiMail) and execute automated playbooks for threat detection and response. Unlike management or analytics tools, FortiSOAR provides the cross-product incident response and automation capabilities required to detect and automatically respond to threats across the Fortinet security fabric.

Answer

FortiManager

Answer

FortiSIEM

Answer

FortiAnalyzer

Question 7

A security analyst wants to use automation stitches on FortiGate to automatically block an IP address when a critical severity event is logged. Which TWO components are essential to create this automation stitch? (Choose two.)

Accepted Answer

An action that adds the source IP to a firewall address group. An automation stitch in FortiGate requires an action to execute a specific task, such as adding a source IP to a firewall address group, which effectively blocks the IP. This action is essential for enforcing the security response triggered by the stitch.

Answer

A FortiGuard subscription

Answer

A FortiAnalyzer to store logs

Answer

A static route to the internet

Question 8

An organization is deploying FortiEDR to enhance endpoint protection. Which THREE capabilities does FortiEDR provide? (Choose three.)

Accepted Answer

Forensic investigation and root cause analysis. FortiEDR provides forensic investigation and root cause analysis by recording detailed endpoint telemetry, including process creation, network connections, and file system changes. This allows security teams to reconstruct the full attack chain after an incident, identifying the initial infection vector and all subsequent malicious activities. The platform correlates these events across multiple endpoints to provide a comprehensive timeline for investigation.

Answer

Decoy deployment to lure attackers

Answer

Email security filtering

Question 9

A FortiGate administrator wants to use threat intelligence feeds to block known malicious IP addresses. Which TWO steps are required to accomplish this? (Choose two.)

Accepted Answer

Create an external threat feed connector pointing to the IoC source. An external threat feed connector must be created in FortiGate to import indicators of compromise (IoC) from a third-party source. This connector defines the URL, authentication, and update interval for the feed, allowing FortiGate to consume and store the malicious IP addresses as a local threat feed object.

Answer

Enable IPS on all policies

Answer

Configure FortiGuard to push feeds automatically

Answer

Subscribe to FortiSandbox

Question 10

A network administrator wants to ensure that files downloaded from the internet are analyzed by FortiSandbox before being delivered to the client. The FortiGate is configured with a FortiSandbox connection and an antivirus profile. Which setting must be enabled in the antivirus profile to submit files to FortiSandbox?

Accepted Answer

Submit files to FortiSandbox. The 'Submit files to FortiSandbox' setting in the antivirus profile is the specific toggle that instructs FortiGate to forward files to the configured FortiSandbox for analysis. Without this setting enabled, the FortiGate will not send any files to FortiSandbox, even if the FortiSandbox connection is configured and the antivirus profile is applied.

Answer

FortiSandbox inline scanning

Answer

Enable Content Disarm and Reconstruction (CDR)

Answer

Enable Outbreak Prevention

Question 11

What is the primary purpose of Content Disarm and Reconstruction (CDR) in advanced antivirus protection?

Accepted Answer

To reconstruct files by removing potentially malicious active content such as macros and scripts. Content Disarm and Reconstruction (CDR) is designed to proactively neutralize threats by stripping or disabling potentially dangerous active content—such as macros, scripts, and embedded objects—from files while preserving the file's usability. Unlike signature-based detection, CDR does not rely on known threat signatures; instead, it reconstructs the file in a safe state, removing any elements that could execute malicious code. This makes CDR a zero-day prevention technique that blocks threats before they can be analyzed or detected by traditional methods.

Answer

To detect and block known malware using signature-based detection

Answer

To submit files to FortiSandbox for behavioral analysis

Answer

To encrypt files in transit to prevent interception

Question 12

An administrator configures a custom IPS signature to detect traffic to a specific malicious domain. Which syntax is correct for a custom IPS signature in FortiGate?

Accepted Answer

F-SBID( --name "malicious_domain"; --pattern "example.com"; --service HTTP; ). FortiGate custom IPS signatures use the F-SBID (Fortinet Signature-Based IDentification) syntax, which requires the --name and --pattern keywords to define the signature name and the malicious pattern to match. This syntax is specific to FortiGate's IPS engine and is not based on Snort or Suricata rule syntax.

Answer

config ips custom signature edit "malicious_domain" set signature "alert tcp any any -> any any (msg:"malicious"; content:"example.com";)" end

Answer

config firewall policy edit 1 set ips-filter "malicious_domain" end

Answer

set ips-sensor custom-signature "malicious_domain" pattern "example.com"

Question 13

A company uses FortiMail for email security. They want to prevent email spoofing by verifying that incoming emails originate from authorized servers. Which email authentication method should be configured on FortiMail to check the sending server's IP against a published SPF record?

Accepted Answer

SPF verification. SPF (Sender Policy Framework) verification on FortiMail checks the sending server's IP address against the SPF record published in the domain's DNS. This directly matches the requirement to verify that incoming emails originate from authorized servers, as SPF is designed to prevent spoofing by validating the envelope sender's domain against a list of permitted IPs.

Answer

DKIM verification

Answer

DMARC verification

Answer

Sender Policy Framework (SPF) is not supported on FortiMail

Question 14

An administrator configures an automation stitch to respond to a high severity event. The trigger is 'event' and the action is 'CLI script'. What must be defined for the action to execute properly?

Accepted Answer

A valid CLI script that contains commands to be executed on the FortiGate. For an automation stitch action of type 'CLI script' to execute properly on a FortiGate, the action must reference a valid CLI script that contains the actual FortiGate CLI commands to be run. The script is defined locally on the FortiGate and does not require external authentication, a FortiManager, or an email server for execution.

Answer

An API token for authentication

Answer

A FortiManager to execute the script

Answer

An email server to send the script output

Question 15

Which of the following best describes the function of FortiDeceptor in an enterprise network?

Accepted Answer

It deploys decoys and lures to detect attackers inside the network.

Answer

It provides endpoint detection and response (EDR) capabilities on workstations.

Answer

It acts as a web application firewall for protecting web servers.

Answer

It provides sandboxing for advanced malware analysis.