NSE7 Advanced Threat Protection Practice Test 13 — 15 Questions

Question 1

A FortiGate is configured with an antivirus profile that has the machine learning engine enabled. An administrator notices that some files are being detected by the ML engine but the verdict is 'probably clean'. What does this verdict indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ML engine has low confidence that the file is malicious; it may be a false positive.. The ML engine in FortiGate's antivirus profile assigns a verdict of 'probably clean' when its confidence level is low that the file is malicious. This indicates a potential false positive, meaning the file is likely benign but the engine cannot be certain. The correct action is to allow the file to pass while logging the event for further analysis, not to block it outright.

Answer

The file is clean and safe to pass.

Answer

The file is definitely malicious and should be blocked.

Answer

The ML engine has detected an outbreak but needs FortiGuard to confirm.

Question 2

What is the primary difference between using a Web Application Firewall (WAF) on FortiGate versus using FortiWeb?

Accepted Answer

FortiWeb provides dedicated, advanced WAF features and higher performance for web traffic, while FortiGate WAF is a basic protection feature.. FortiWeb is a dedicated web application firewall appliance that provides advanced, specialized WAF features such as machine learning-based bot detection, API discovery, and granular signature tuning, along with higher throughput for web traffic. In contrast, the WAF feature on FortiGate is a basic, integrated protection module that offers essential HTTP/HTTPS inspection and signature-based filtering, but lacks the depth and performance optimization of FortiWeb.

Answer

There is no difference; they are the same.

Answer

FortiGate WAF is cloud-based, while FortiWeb is on-premises.

Answer

FortiGate WAF can protect multiple web servers simultaneously, while FortiWeb protects only one.

Question 3

An administrator wants to automatically block a file that FortiSandbox has determined to be malicious. The FortiGate is configured with an antivirus profile that includes FortiSandbox submission. Which verdict action should be set to 'block' in the antivirus profile to achieve this?

Accepted Answer

Malicious. The 'Malicious' verdict action in the antivirus profile is specifically designed to block files that FortiSandbox has determined to be malicious. When FortiSandbox submits a file and returns a 'malicious' verdict, the FortiGate uses this action to enforce blocking, ensuring the file is not delivered to the end user.

Answer

Exempted

Answer

Unknown

Answer

Clean

Question 4

A company wants to receive threat intelligence feeds from external sources to enhance their FortiGate's protection. Which method should be used to integrate external threat feeds into FortiGate?

Accepted Answer

Configure an external threat feed connector in FortiGate, such as using a URL to a STIX/TAXII feed.. FortiGate supports integration with external threat intelligence feeds via the External Threat Feed connector, which can consume STIX/TAXII feeds from a URL. This allows the FortiGate to dynamically update its threat database with indicators from third-party sources, enhancing its protection without relying solely on FortiGuard services.

Answer

Use FortiGuard Threat Intelligence Service which automatically pulls feeds.

Answer

Manually add IP addresses to local address objects.

Answer

Use FortiAnalyzer to push feeds to FortiGate.

Question 5

An administrator needs to configure advanced email security on FortiMail to protect against phishing and spoofing. Which THREE features should be enabled to achieve comprehensive email authentication?

Accepted Answer

DKIM signing and verification. DKIM (DomainKeys Identified Mail) signing and verification is correct because it allows the sending domain to cryptographically sign outgoing emails, and the receiving server to verify that the signature matches the domain’s public DNS record. This ensures the email was not tampered with and originates from an authorized server, directly addressing phishing and spoofing by validating message integrity and sender authenticity.

Answer

Anti-spam Bayesian filtering

Answer

TLS encryption for inbound/outbound

Question 6

A company has deployed FortiClient with advanced threat protection (ATP) features. Which TWO capabilities does FortiClient ATP provide beyond basic antivirus?

Accepted Answer

Exploit prevention and vulnerability scanning

Answer

Application control and inventory

Answer

VPN connectivity

Answer

Web filtering and URL rating

Question 7

A network administrator notices that FortiGate is not blocking a known malicious file that was submitted to FortiSandbox and received a 'malicious' verdict. The firewall policy includes a FortiSandbox inline scan profile. What is the MOST likely cause?

Accepted Answer

The FortiSandbox is not configured as an inline scanner in the antivirus profile. The FortiGate uses an antivirus profile to define how files are scanned, including whether to send files to FortiSandbox for inline analysis. Even if the firewall policy references a FortiSandbox inline scan profile, the antivirus profile must have the 'FortiSandbox inline scan' option enabled to actually forward files to the FortiSandbox appliance. Without this setting, the FortiGate will not submit files for sandboxing, so a malicious verdict from FortiSandbox is never applied to the traffic.

Answer

The antivirus signature database is outdated

Answer

The FortiSandbox license has expired

Answer

The file is larger than the maximum file size allowed for scanning

Question 8

A FortiGate administrator wants to ensure that files in email attachments are disarmed before delivery. Which security feature should be configured in the antivirus profile?

Accepted Answer

Content Disarm and Reconstruction (CDR). Content Disarm and Reconstruction (CDR) is the correct answer because it is specifically designed to remove active content (e.g., macros, scripts, embedded objects) from email attachments and rebuild them into safe, sanitized versions before delivery. Unlike detection-based methods, CDR proactively disarms threats by stripping potentially malicious elements while preserving the file's usability, making it the ideal choice for disarming attachments in an antivirus profile.

Answer

FortiSandbox inline scanning

Answer

Machine Learning Engine

Answer

Outbreak Prevention

Question 9

An administrator wants to secure email traffic by ensuring that incoming emails are verified against the sender's domain SPF record. Which email authentication method provides this verification?

Accepted Answer

SPF. SPF (Sender Policy Framework) is the email authentication method that verifies incoming emails against the sender's domain SPF record. It works by checking whether the sending mail server's IP address is authorized by the domain owner's DNS TXT record. This directly matches the administrator's requirement to verify incoming emails against the sender's domain SPF record.

Answer

DKIM

Answer

DMARC

Answer

S/MIME

Question 10

An administrator configured FortiGate to forward suspected malicious files to FortiSandbox. They set the action to 'block' for malicious verdicts. Some files are being blocked, but others with a 'clean' verdict are allowed. However, they notice that some files that should have been sent to FortiSandbox are not being forwarded. Which reason is MOST likely?

Accepted Answer

The file size exceeds the maximum size configured for FortiSandbox scanning. The most likely reason is that the file size exceeds the maximum size configured for FortiSandbox scanning. FortiGate has a configurable limit (default 10 MB) for files sent to FortiSandbox; files larger than this threshold are not forwarded, even if the antivirus engine would otherwise trigger a submission. This explains why some files are blocked or allowed based on verdicts, while others are never submitted.

Answer

The FortiGate antivirus engine is set to proxy-based mode

Answer

The FortiGate has insufficient disk space for temporary files

Answer

The FortiSandbox device is overloaded and rejecting submissions

Question 11

Which feature in FortiMail provides an additional layer of protection by analyzing the behavior of email attachments in a sandbox environment?

Accepted Answer

FortiSandbox integration. FortiSandbox integration allows FortiMail to forward email attachments to an external or internal FortiSandbox appliance for dynamic behavioral analysis. Unlike static signature-based detection, this sandboxing executes the attachment in a controlled environment to identify zero-day malware, ransomware, or advanced persistent threats based on runtime behavior, providing an additional layer of protection beyond traditional filtering.

Answer

Outbreak Prevention

Answer

Anti-spam

Answer

Content Disarm and Reconstruction

Question 12

An administrator is configuring FortiDeceptor to detect threats within the network. Which TWO statements about FortiDeceptor are correct?

Accepted Answer

It sends alerts to FortiSIEM or FortiSOAR for automated response. FortiDeceptor integrates with FortiSIEM and FortiSOAR to automatically trigger incident response workflows when a threat is detected. This integration allows security teams to quickly contain and remediate attacks without manual intervention, leveraging the Fortinet Security Fabric's automation capabilities.

Answer

It requires a separate hardware appliance for each network segment

Answer

It uses signature-based detection to identify malware

Answer

It can replace firewall functionality

Question 13

An administrator wants to protect against zero-day malware that has not yet been discovered by signature-based detection. Which TWO technologies can help mitigate such threats?

Accepted Answer

Machine Learning Engine. The Machine Learning Engine (A) is correct because it uses behavioral analysis and static file analysis to detect previously unknown malware based on patterns and anomalies, without relying on signatures. This allows it to identify zero-day threats by analyzing file characteristics and runtime behavior in real time.

Answer

Signature-based antivirus

Answer

Web filtering

Answer

Application control

Question 14

An administrator is configuring FortiMail to be more secure against advanced email threats. Which THREE features should they enable to protect against email-based phishing attacks?

Accepted Answer

DKIM signing/verification. DKIM (DomainKeys Identified Mail) signing and verification allow the receiving mail server to cryptographically verify that an email was not tampered with during transit and that it originated from an authorized domain. This prevents attackers from spoofing the sender domain in phishing emails, as the DKIM signature will fail validation if the message body or headers are altered.

Answer

CDR (Content Disarm and Reconstruction)

Answer

FortiSandbox inline scanning

Question 15

A security administrator is configuring FortiSandbox integration to automatically block malicious files detected in email attachments. Which TWO actions are required to achieve this integration?

Accepted Answer

Configure FortiGate to submit files to FortiSandbox for analysis. FortiGate must be configured to submit files to FortiSandbox for analysis, which is the foundational step to enable detection of malicious content in email attachments. This submission is typically done via the FortiGate antivirus profile, where the 'FortiSandbox' inline scanning option is enabled, allowing files to be sent to FortiSandbox for verdict-based blocking.

Answer

Deploy FortiClient endpoints with full disk encryption

Answer

Configure FortiSandbox to send SNMP traps when a file is malicious

Answer

Enable FortiGate's machine learning engine on the antivirus profile