NSE7 Advanced Threat Protection Practice Test 15 — 15 Questions

Question 1

A security team is deploying FortiEDR to protect endpoints. They want to ensure that when a threat is detected, the endpoint is automatically isolated from the network to prevent lateral movement. However, they also need to allow the endpoint to communicate with the FortiEDR management server for updates and remediation. Which FortiEDR feature should they configure to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Playbook with network isolation action. FortiEDR playbooks enable automated response actions, including network isolation. The isolation action blocks all network traffic except to the FortiEDR management server, allowing the endpoint to remain managed and receive remediation instructions. This satisfies the requirement of automatic isolation while preserving management connectivity. Other options like application control, device control, or FortiGate policies do not provide the same integrated, automated endpoint isolation capability.

Answer

Firewall policy on FortiGate

Answer

Device control policy

Answer

Application control policy

Question 2

A FortiGate administrator is configuring SSL inspection on a policy that handles outbound HTTPS traffic. Users report that after enabling deep inspection, some business-critical applications that use certificate pinning fail. The administrator needs to inspect as much traffic as possible while keeping those pinned applications working. What should the administrator do?

Accepted Answer

Create an exemption in the SSL inspection profile for the pinned applications and apply deep inspection to the remaining traffic.. Deep inspection is required to examine encrypted traffic for threats, but certificate-pinned applications will reject the FortiGate's re-signed certificate. The supported approach is to add those applications or destinations to an SSL exemption so they are not decrypted, while deep inspection continues for everything else. This balances security visibility with application availability and is the recommended operational practice for mixed traffic.

Answer

Configure the policy to use full SSL inspection and import the pinned applications' certificates as trusted CAs on the FortiGate.

Answer

Disable SSL inspection entirely on the policy and rely on the application control profile to identify the pinned applications.

Answer

Set the SSL inspection profile to certificate-inspection for the policy and leave the rest of the traffic uninspected.

Question 3

An administrator is configuring FortiGate to inspect SSL traffic for malware. They enable deep inspection in the SSL inspection profile and apply it to a firewall policy. Users report that some HTTPS websites are showing certificate errors. What is the most likely cause?

Accepted Answer

The websites are using certificate pinning, which prevents deep inspection.. Certificate pinning in applications or browsers causes certificate errors when deep inspection is used because the FortiGate presents a re-signed certificate that does not match the pinned certificate. Administrators should exempt such sites from deep inspection or use a different inspection method.

Answer

The SSL inspection profile is set to protect only the server, not the client.

Answer

The FortiGate is using a self-signed certificate for deep inspection.

Answer

The FortiGate is not configured to use SNI for SSL inspection.

Question 4

A security analyst is reviewing FortiGate logs and notices that a known malicious file hash is being downloaded repeatedly, but the antivirus profile is not blocking it. The file is detected by FortiSandbox, and the FortiGate has a valid FortiGuard license. Which action should the analyst take to ensure the hash is blocked on subsequent downloads?

Accepted Answer

Add the file hash to a custom antivirus signature list or threat feed and enable it in the antivirus profile.. When a specific malicious file hash is known, the most direct and reliable way to block it on FortiGate is to add that hash to a custom antivirus signature or external threat feed and enable it in the antivirus profile. This ensures detection regardless of the delivery URL or protocol, and it integrates with existing antivirus scanning. It also avoids overblocking legitimate executables and does not depend solely on sandbox verdict propagation.

Answer

Enable 'Treat Windows executable files as viruses' in the antivirus profile to block all executable downloads.

Answer

Configure FortiSandbox to send a verdict to FortiGate and set the action to 'Block' in the sandbox profile.

Answer

Enable the 'Block malicious URLs' option in the web filter profile so the download URL is blocked.

Question 5

A network administrator is deploying FortiGate to protect against unknown malware. They want to use machine learning to detect and block malicious files without relying on signatures. Which antivirus scanning technique should be enabled to achieve this?

Accepted Answer

Machine learning-based malware detection. Machine learning-based malware detection uses artificial intelligence models to analyze file features and identify malicious patterns, allowing FortiGate to block unknown malware without relying on signatures. This is the only option that directly matches the requirement for machine learning. Other techniques like signatures, heuristics, or sandboxing are different approaches and do not provide the same capability.

Answer

Heuristic scanning

Answer

Signature-based detection

Answer

Sandbox analysis

Question 6

An administrator wants to block outbound traffic from internal hosts to known malicious domains without relying on full URL inspection or certificate inspection. The requirement is to use a lightweight DNS-based security service on FortiGate that can block botnet C2 and phishing domains. Which FortiGuard feature should the administrator enable and configure in a DNS filter profile?

Accepted Answer

FortiGuard DNS Filter. FortiGuard DNS Filter is the correct choice because it provides DNS-layer security by categorizing and blocking malicious domains using FortiGuard's DNS rating service. It is lightweight and does not require full URL inspection or certificate inspection. Enabling it in a DNS filter profile and applying it to a firewall policy allows the FortiGate to block botnet C2 and phishing domains effectively.

Answer

FortiGuard Anti-Spam

Answer

FortiGuard IP Reputation

Answer

FortiGuard Web Filter

Question 7

A security team uses FortiSandbox in a FortiGate security fabric. They want files that receive a 'Malicious' verdict to be automatically quarantined and their source endpoints isolated without manual intervention. Which combination of Fortinet components and features must be configured to achieve this automated response?

Accepted Answer

FortiSandbox 'Automation stitches' with FortiGate and FortiClient EMS to trigger quarantine and endpoint isolation.. Automated response to a FortiSandbox malicious verdict requires an automation stitch that links the sandbox to enforcement points. FortiSandbox can trigger actions on FortiGate to block the file and quarantine the host, and on FortiClient EMS to isolate the endpoint. Other components such as FortiAnalyzer, FortiMail, or FortiGuard feeds do not provide the direct endpoint isolation needed here.

Answer

FortiGate 'Security Fabric' connectors with FortiAnalyzer playbooks to push blocklists to FortiMail.

Answer

FortiGate 'Threat Feed' with FortiGuard IOC service and manual firewall policy updates.

Answer

FortiSandbox 'Scan Profile' with 'Block Malicious Files' enabled and FortiGate AV quarantine.

Question 8

A FortiGate administrator has enabled FortiGuard Outbreak Prevention and selects the 'Use Outbreak Prevention Database' option. After a new outbreak is detected, the administrator verifies that the IPS signature is applied to all applicable policies. However, the administrator wants to ensure that the FortiGate dynamically updates its protection without requiring a full IPS engine update. Which FortiGuard service must be reachable for the FortiGate to receive outbreak prevention updates?

Accepted Answer

FortiGuard IPS service. Outbreak Prevention on FortiGate relies on the FortiGuard IPS service to receive dynamic threat intelligence, including outbreak prevention signatures and metadata. Without connectivity to the FortiGuard IPS service, the FortiGate cannot download the latest outbreak prevention database, and the feature will not function. Other FortiGuard services do not provide this specific data.

Answer

FortiGuard Anti-Spam service

Answer

FortiGuard Web Filtering service

Answer

FortiGuard SD-WAN service

Question 9

An administrator is configuring a FortiGate to detect and block command and control (C2) traffic using FortiGuard's Indicator of Compromise (IoC) service. The administrator wants to ensure that the firewall checks DNS queries and HTTP requests against the IoC database. Which feature should be enabled on the FortiGate to accomplish this?

Accepted Answer

FortiGuard IoC Service in the security fabric connector. The FortiGuard IoC Service is a security fabric connector that enables FortiGate to download indicators of compromise and inspect traffic, including DNS and HTTP, against that database. It provides comprehensive detection of C2 communications and other malicious activities. Other features like web filtering or DNS filtering may block some C2 traffic but do not utilize the IoC service as required.

Answer

Botnet C&C IP Blocklist in the firewall policy

Answer

DNS Filter profile with botnet C&C domain blocking

Answer

FortiGuard Category Based Filter in the web filter profile

Question 10

A network security administrator wants to use FortiGate to automatically quarantine an endpoint when FortiEDR detects malicious behavior on that endpoint. Which FortiGate feature should be used to integrate with FortiEDR for this purpose?

Accepted Answer

FortiGate Fabric Connector for FortiEDR with automated response actions.. The FortiGate Fabric Connector for FortiEDR enables integration between the endpoint detection and response platform and the FortiGate. When FortiEDR identifies malicious behavior, the connector can trigger automated actions such as quarantining the endpoint or blocking its network access. This is the correct feature for coordinating endpoint detection with network enforcement in the Security Fabric.

Answer

FortiGate IPsec VPN with dynamic routing to isolate the endpoint.

Answer

FortiGate antivirus profile with 'Block' action for all detected threats.

Answer

FortiGate DNS filter with a blocklist of the endpoint's IP address.

Question 11

An administrator is configuring a FortiGate to use the FortiGuard Web Filter to block access to newly registered domains that are often used in phishing campaigns. The administrator wants the block to occur with minimal impact on legitimate business traffic and without relying on manual URL submissions. Which FortiGuard Web Filter category should be used?

Accepted Answer

Newly Observed Domain. Newly Observed Domain is a FortiGuard category that identifies domains registered recently, which are disproportionately used in phishing and malware campaigns. Blocking it provides proactive protection against unknown malicious domains without manual URL submission. Other categories either target different threat types or are reactive, so they do not meet the requirement for minimal-impact, automated blocking of newly registered domains.

Answer

Potentially Unwanted Program

Answer

Malicious Websites

Answer

Dynamic DNS

Question 12

A security administrator is configuring FortiGate to detect and block command-and-control (C2) traffic using the botnet database and DNS filtering. The administrator wants to ensure that infected internal hosts are identified and their C2 communication is blocked. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Configure a DNS filter profile with FortiGuard category filtering and block malicious categories.. To detect and block C2 traffic, the administrator should enable the botnet database with a block action in the antivirus profile and configure DNS filtering to block malicious categories. These two actions provide both IP-based and domain-based blocking of C2 communication, and they leverage FortiGuard threat intelligence. Together they help identify infected hosts and prevent them from reaching C2 infrastructure.

Answer

Disable logging for botnet events to reduce log volume.

Answer

Create a firewall address for each known C2 server and manually add them to a deny policy.

Answer

Enable IPS signatures for known C2 protocols and set the action to monitor only.

Question 13

A security administrator is reviewing threat logs on a FortiGate running FortiOS 7.4. Multiple internal hosts have triggered IPS signatures for a known botnet C2 domain, but the administrator wants to ensure that DNS queries to this domain are blocked before a connection is attempted. The FortiGate is already using the default FortiGuard ISDB and IPS signatures. Which FortiGate feature should the administrator configure to block DNS resolution of the malicious domain?

Accepted Answer

DNS filter profile with a static domain filter entry set to block. The DNS filter profile is designed to inspect DNS queries and can block resolution of specific domains using static domain filters. When applied to a policy, it prevents internal hosts from resolving malicious domains, effectively stopping connections before they start. Other features like web filter or application control operate at later stages and do not block DNS resolution.

Answer

Web filter profile with a URL filter entry set to block

Answer

IPS sensor with a custom signature that matches the domain name in DNS queries

Answer

Application control profile with a signature to block the botnet application

Question 14

A security analyst is investigating alerts from FortiGate's IPS. They notice that an attack was detected but not blocked, even though the IPS profile is set to block. The log shows the action as 'detected'. What is the most likely reason for this behavior?

Accepted Answer

The IPS signature is set to 'Monitor' instead of 'Block' in the IPS sensor.. The most likely reason is that the specific IPS signature that detected the attack is configured to 'Monitor' rather than 'Block' in the IPS sensor. Even if the overall profile is set to block, individual signatures can override this. Checking the signature's action setting in the sensor will confirm and allow correction.

Answer

The FortiGate's IPS engine is in 'learn' mode.

Answer

The FortiGate is in transparent mode, which does not support IPS blocking.

Answer

The IPS profile is applied to the wrong firewall policy.

Question 15

A company uses FortiEDR and wants to ensure that when an endpoint is compromised, the threat is contained and the security team receives detailed forensics. The team also wants to prevent the malicious process from communicating with its command-and-control server. Which FortiEDR feature should be configured to achieve both containment and forensic data collection?

Accepted Answer

Use 'Playbooks' with a 'Block and Remediate' action triggered by a malicious verdict.. FortiEDR playbooks automate responses based on verdicts. A Block and Remediate playbook can terminate the malicious process, sever command-and-control communication, and initiate forensic collection. Logging, exclusions, or monitoring alone do not provide containment, so they cannot meet the combined requirement for automated containment and detailed forensics.

Answer

Enable 'Security Events' with 'Log' action for all process executions.

Answer

Set the 'Threat Hunting' module to 'Monitor' mode for all endpoints.

Answer

Configure 'Exclusions' to prevent FortiEDR from scanning critical applications.