NSE7 Advanced Threat Protection Practice Test 16 — 15 Questions

Question 1

A network security administrator notices that FortiGate is not blocking outbound traffic to domains that FortiGuard classifies as malicious. The administrator confirms that the license is valid and FortiGuard category-based blocking is enabled. Which FortiGate feature should be verified to ensure that DNS queries for malicious domains are intercepted and sinkholed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS filter with botnet C&C domain blocking enabled. The DNS filter with botnet C&C domain blocking is designed to intercept DNS responses for known malicious domains and redirect them to a sinkhole, effectively preventing communication. This is the correct mechanism when the goal is to block DNS resolution of malicious domains. Other features operate at different layers and do not provide DNS-level sinkholing, so they would not address the specific problem.

Answer

Web filter with FortiGuard category-based blocking

Answer

Application control with botnet signatures

Answer

Antivirus profile with botnet C&C IP blocking

Question 2

A FortiGate administrator wants to stop outbound DNS queries to a known malicious domain that is not present in any static blocklist. The administrator has already licensed FortiGuard DNS Filtering and enabled DNS filtering on the firewall policy. Which FortiGuard service must the FortiGate resolve the domain against so that the query is blocked based on the latest threat intelligence?

Accepted Answer

FortiGuard DNS Filtering service. FortiGuard DNS Filtering is the service that evaluates domain names during DNS resolution and blocks queries for malicious or risky domains. Enabling DNS filtering on the firewall policy causes the FortiGate to consult this service for each lookup, so the endpoint never receives the IP address. Web Filtering, Antispam, and IP Reputation operate at different layers and cannot stop the domain from resolving.

Answer

FortiGuard IP Reputation service

Answer

FortiGuard Antispam service

Answer

FortiGuard Web Filtering

Question 3

A security analyst is investigating a recent security incident and wants to use FortiGate's Security Fabric to gather threat intelligence. The analyst needs to view detailed information about a detected threat, including the source, destination, and the specific IPS signature that triggered. Which FortiGate feature provides a centralized view of threat events and allows drill-down into individual incidents?

Accepted Answer

FortiView. FortiView is a built-in FortiGate feature that aggregates and visualizes threat events from multiple security functions, including IPS, antivirus, and web filtering. It allows administrators to drill down into specific incidents to see source, destination, and signature details, making it a powerful tool for threat investigation within the Security Fabric.

Answer

FortiAnalyzer

Answer

FortiSandbox

Answer

FortiGuard Outbreak Prevention

Question 4

A network security administrator is deploying a FortiSandbox appliance in a FortiGate environment. The administrator wants to ensure that when a zero-day malware sample is detonated, the FortiGate immediately blocks the file hash and the C2 callback. Which FortiSandbox integration method should the administrator configure on the FortiGate to achieve this?

Accepted Answer

Configure the FortiGate to send files to FortiSandbox via the 'fortisandbox' fabric connector and enable 'block malicious files' in the antivirus profile.. The FortiSandbox fabric connector on FortiGate enables seamless submission of files and retrieval of verdicts. When a file is deemed malicious, the FortiGate can block the file hash and C2 traffic via the antivirus profile's block action. This integrated approach automates threat protection without manual intervention, ensuring immediate response to zero-day threats.

Answer

Configure an external threat feed on the FortiGate using the FortiSandbox API to pull malicious IPs every 5 minutes.

Answer

Configure a syslog server on the FortiSandbox to send logs to the FortiGate, and create a firewall policy that denies traffic from the sandbox subnet.

Answer

Enable 'Use FortiSandbox for unknown files' in the antivirus profile and set the action to 'monitor' for all protocols.

Question 5

An administrator is configuring a FortiGate to block outbound traffic to known malicious IP addresses. They want the block list to be updated automatically from a commercial threat intelligence service that provides a REST API. Which FortiGate feature should be used?

Accepted Answer

External Threat Feed connector. The External Threat Feed connector is designed to ingest IP or domain blocklists from external HTTP/HTTPS sources, including REST APIs. It automates updates and integrates with firewall policies. The other options are either manual, domain-focused, or tied to Fortinet's own reputation service, which cannot be customized to an arbitrary third-party feed.

Answer

FortiGuard IP Reputation service

Answer

DNS Filter with botnet C&C category

Answer

Static firewall address objects

Question 6

A network administrator is configuring a FortiGate to protect against unknown malware by using machine learning. The administrator wants to enable the feature that uses machine learning to detect and block malicious files based on their behavior and characteristics, without relying solely on signatures. Which antivirus setting should the administrator enable?

Accepted Answer

Machine Learning (ML) Malware Detection. The Machine Learning Malware Detection setting in the FortiGate antivirus profile uses machine learning algorithms to detect and block unknown malware based on file characteristics and behavior. This provides protection against zero-day threats without relying solely on signatures, meeting the administrator's requirement.

Answer

Sandbox Inspection

Answer

FortiGuard Outbreak Prevention

Answer

Content Disarm and Reconstruction

Question 7

A security administrator is deploying FortiDeceptor in a data center network. They want to detect an attacker who is performing internal reconnaissance by scanning the subnet for live hosts. Which FortiDeceptor component should the administrator deploy to generate a decoy IP address that responds to such scans and alerts on any interaction?

Accepted Answer

Deploy a FortiDeceptor decoy VM that uses a decoy IP address on the same subnet.. FortiDeceptor uses decoy VMs, network decoys, and token decoys to lure attackers. A decoy VM with a decoy IP on the same subnet is the correct component to detect internal reconnaissance scans because it appears as a live host and alerts on any interaction. Other options either provide passive monitoring, lack decoy functionality, or are analytics tools.

Answer

Use FortiAnalyzer to create a synthetic network device that logs scan attempts.

Answer

Configure a FortiGate interface as a honeypot by enabling the decoy option in the firewall policy.

Answer

Install a FortiDeceptor virtual appliance in promiscuous mode on a SPAN port.

Question 8

A FortiGate administrator is configuring a security profile to detect command-and-control traffic from internal hosts. The administrator wants to use a signature-based detection method that matches known botnet patterns. Which FortiGate feature should be enabled to accomplish this?

Accepted Answer

Intrusion Prevention System (IPS) with botnet signatures. The Intrusion Prevention System (IPS) on FortiGate uses a signature database that includes patterns for known botnet command-and-control traffic. Enabling IPS with botnet signatures allows the firewall to inspect packets and block or log C2 communications. Other features like web filtering, application control, or DNS filtering do not provide the same level of signature-based detection for C2 traffic.

Answer

Application Control with botnet category

Answer

DNS Filter with botnet domain database

Answer

FortiGuard Category Based Filter

Question 9

A security administrator is configuring a FortiGate to use an external threat intelligence feed to block malicious IP addresses. The administrator wants the FortiGate to automatically update the list of malicious IPs from a threat feed and use it in firewall policies. Which FortiGate feature should be used?

Accepted Answer

Threat feeds in Security Fabric > Fabric Connectors. Threat feeds in Fabric Connectors allow FortiGate to subscribe to external threat intelligence sources and automatically update dynamic firewall addresses. These addresses can be used in policies to block malicious IPs. Other options either provide static or geographic-based lists, not dynamic external feeds.

Answer

DNS filter with a threat feed category

Answer

Internet Service Database (ISDB) in firewall addresses

Answer

Geo IP database in firewall addresses

Question 10

A security analyst is reviewing FortiGate logs and notices that a web filter profile is blocking access to a known malicious domain, but the block page shows the category as 'Unrated'. The analyst confirms the domain is listed in a custom blocklist. Which FortiGate feature is responsible for overriding the category and enforcing the block?

Accepted Answer

Static URL filter with the action set to 'Block' and the type set to 'Simple'.. A static URL filter entry with the action set to Block and type Simple allows an administrator to block specific URLs or domains regardless of their FortiGuard category. This is why a domain categorized as Unrated can still be blocked and present a block page. The static URL filter is evaluated as part of the web filter profile and overrides category-based actions.

Answer

FortiGuard web filter category override using a local category definition.

Answer

DNS filter with a custom blocklist entry for the domain.

Answer

Application control signature that matches the domain's HTTP header.

Question 11

A FortiGate running FortiOS 7.4 is configured with a firewall policy that references an IPS sensor. The sensor uses a custom signature to detect a recently discovered exploit. Users report that the exploit traffic is not being blocked even though the signature is enabled. The administrator confirms the traffic matches the signature and that the policy is in flow-based inspection mode. Which action should the administrator take to ensure the IPS sensor can block the exploit?

Accepted Answer

Set the IPS sensor action for the signature to 'block'.. An IPS sensor in FortiOS can contain multiple signatures and filters, each with an action that determines whether matching traffic is allowed, monitored, or blocked. If the action is not set to block, the sensor will not drop packets even when a signature matches. The administrator must verify the action for the specific signature and set it to block to achieve the desired protection.

Answer

Enable 'Block malicious URLs' in the web filter profile.

Answer

Add the signature to a custom application control signature.

Answer

Change the firewall policy inspection mode to proxy-based.

Question 12

A security analyst is investigating an alert from FortiSandbox indicating that a file has a high-risk verdict. The analyst wants to automatically prevent the file from executing on other endpoints. Which FortiSandbox integration should be configured to achieve this?

Accepted Answer

FortiSandbox to FortiGate fabric connector. Configuring the fabric connector between FortiSandbox and FortiGate allows automatic sharing of malicious file verdicts. FortiGate can then block the file hash, preventing download and execution on endpoints. Other fabric connectors are limited to email security, endpoint management, or logging, and do not provide the same automatic network-wide blocking.

Answer

FortiSandbox to FortiAnalyzer fabric connector

Answer

FortiSandbox to FortiClient EMS fabric connector

Answer

FortiSandbox to FortiMail fabric connector

Question 13

A security administrator is configuring a FortiGate to use a threat feed connector to block traffic from known malicious IP addresses. The administrator wants to ensure that the threat feed is updated automatically and that the FortiGate can use the feed in firewall policies. Which two actions must the administrator perform? (Choose two.)

Accepted Answer

Configure the threat feed as an external connector of type 'IP Address'.. To use a custom threat feed for blocking, the administrator must configure an external connector of type 'IP Address' and then reference the resulting dynamic address object in a firewall policy with a deny action. The refresh interval should be set to a non-zero value for automatic updates. Other options such as antivirus block lists or SSL inspection profiles are not involved in this integration.

Answer

Enable 'Use External IP Block List' in the antivirus profile.

Answer

Set the threat feed refresh interval to 0 to disable automatic updates.

Answer

Apply the threat feed connector to the SSL inspection profile.

Question 14

A FortiGate administrator is configuring a firewall policy to inspect traffic for advanced threats. The administrator wants to ensure that the policy uses both antivirus and IPS inspection, and that the traffic is inspected in a way that minimizes latency while still detecting threats. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Apply an antivirus profile and an IPS sensor to the firewall policy.. To minimize latency while inspecting for advanced threats, flow-based inspection should be used because it processes packets without full buffering. Additionally, both an antivirus profile and an IPS sensor must be applied to the firewall policy to ensure that malware and network attacks are detected. These two actions together satisfy the performance and security requirements.

Answer

Enable 'Scan with FortiSandbox' in the antivirus profile.

Answer

Enable 'Block Oversized Files' in the antivirus profile.

Answer

Enable proxy-based inspection on the firewall policy.

Question 15

A FortiGate administrator wants to prevent users from accessing a list of known malicious domains. The list is updated daily by a third-party provider and available as a plain text file over HTTPS. Which FortiGate feature should be used to ingest and block these domains?

Accepted Answer

External Threat Feed connector. The External Threat Feed connector is designed to import IP or domain lists from external HTTP/HTTPS sources and keep them updated. It creates a dynamic object that can be referenced in policies, providing automated blocking. The other options are either static or tied to Fortinet's own categorization, and cannot ingest a custom third-party list automatically.

Answer

FortiGuard DNS Filter with custom categories

Answer

Static DNS zone with blackhole

Answer

FortiGate local domain blocklist