NSE7 Advanced Threat Protection Practice Test 2 — 15 Questions

Question 1

A security administrator wants to implement automated threat response using FortiGate automation stitches. Which THREE components are mandatory when creating an automation stitch? (Choose three.)

Accepted Answer

Action (e.g., 'CLI Script', 'Add IP to Blocklist'). In FortiGate automation stitches, the mandatory building blocks are the stitch name, at least one trigger, and at least one action, with an optional condition to filter when the stitch fires. Option B (stitch name) is required because every automation stitch must be uniquely identified and referenced by its name in the GUI or CLI. Option C (action, such as 'CLI Script' or 'Add IP to Blocklist') is mandatory because a stitch must define what FortiGate does in response, and a stitch cannot be saved without at least one action. Option D (trigger, such as 'Event Log' or 'FortiOS CLI') is mandatory because it defines the event that initiates the stitch; without a trigger the automation has nothing to react to. Option E (condition, e.g., a filter on event type) is also required in the sense that the trigger must be scoped by a condition/filter to specify which events match, and FortiOS requires this matching criterion when configuring the trigger. Option A (schedule, e.g., daily at midnight) is not mandatory because automation stitches are event-driven rather than time-driven; scheduling is not a required component of a stitch.

Answer

Schedule (e.g., daily at midnight)

Answer

Stitch name

Question 2

Which TWO email authentication mechanisms does FortiMail support to verify sender identity and reduce spoofing? (Choose two.)

Accepted Answer

SPF (Sender Policy Framework). FortiMail supports SPF (Sender Policy Framework) (B), which verifies the sending MTA's IP address against the domain's published SPF record in DNS to detect envelope-sender spoofing, and DKIM (DomainKeys Identified Mail) (E), which validates a cryptographic signature added to message headers to confirm the message was authorized by the signing domain and wasn't altered in transit. Both are core email authentication mechanisms FortiMail uses in its antispam and anti-spoofing profiles to verify sender identity. DMARC (A) is not the mechanism itself but a policy layer built on top of SPF and DKIM alignment, so it is not one of the two authentication mechanisms asked for here. STARTTLS (C) only encrypts the SMTP session in transit and provides no sender-identity verification, and S/MIME (D) provides message encryption and signing at the client level rather than authenticating the sending domain against DNS records.

Answer

DMARC (Domain-based Message Authentication, Reporting & Conformance)

Answer

STARTTLS

Answer

S/MIME

Question 3

A FortiGate administrator configures an antivirus profile with the machine learning engine enabled and applies it to a policy inspecting HTTP traffic. After deployment, the admin notices that some files are being allowed that should have been detected. What is the MOST likely cause?

Accepted Answer

The ML engine is in monitor-only mode. The most likely cause is that the machine learning engine is configured in monitor-only mode. In this mode, the ML engine will log detections and generate alerts but will not take any action to block the file, allowing it to pass through the policy. This is a common initial deployment strategy to assess the ML engine's impact before enabling active blocking.

Answer

FortiGuard outbreak prevention is disabled

Answer

The antivirus profile is using flow-based inspection instead of proxy-based

Answer

The file size exceeds the maximum scanning limit

Question 4

An administrator configures a FortiGate to integrate with FortiSandbox for inline scanning. The policy has an antivirus profile with FortiSandbox enabled. What condition must be met for files to be submitted to FortiSandbox?

Accepted Answer

The antivirus profile must use proxy-based inspection mode. For files to be submitted to FortiSandbox during inline scanning, the antivirus profile must use proxy-based inspection mode. This is because proxy-based inspection allows the FortiGate to buffer the entire file, perform deep analysis, and then forward it to FortiSandbox for verdict-based blocking. Flow-based inspection, in contrast, streams packets and cannot hold files for submission, making proxy mode a prerequisite for inline FortiSandbox integration.

Answer

The FortiSandbox must be on the same subnet as the FortiGate

Answer

The FortiGate must be in NAT mode

Answer

SSL inspection must be disabled

Question 5

A FortiGate administrator is troubleshooting why files are not being submitted to FortiSandbox for analysis. Which THREE conditions must be met for file submission to work? (Choose three.)

Accepted Answer

The file type must be in FortiSandbox's supported list. Option B is correct because FortiSandbox only accepts file types it can actually analyze, so the submitted file's type must appear in FortiSandbox's supported file-type list or the FortiGate will not forward it for sandboxing. Option C is correct because sandbox file submission requires a proxy-based antivirus profile; flow-based inspection does not support sending files to FortiSandbox, so the AV profile must operate in proxy mode. Option E is correct because the FortiGate must be licensed/authorized for FortiSandbox (via a valid FortiSandbox license or FortiCloud sandbox entitlement) for the sandbox inspection feature to function. Option A is wrong because SSL inspection is not a prerequisite for sandbox submission and is often needed to inspect encrypted traffic, not disabled. Option D is wrong because FortiSandbox inline scanning mode is not a requirement for FortiGate file submission; the FortiGate submits files to FortiSandbox for analysis regardless of inline versus other deployment modes.

Answer

SSL inspection must be disabled for the policy

Answer

The FortiSandbox must be in inline scanning mode

Question 6

An organization wants to implement email authentication to prevent spoofing. Which TWO standards should they configure? (Choose two.)

Accepted Answer

SPF. SPF (Sender Policy Framework) is correct because it lets a domain publish a DNS TXT record listing the authorized sending hosts/IPs, so receivers can verify the envelope sender and reject or flag spoofed mail. DKIM (DomainKeys Identified Mail) is correct because it adds a cryptographic signature to outgoing messages using a private key, with the public key published in DNS, allowing receivers to verify the message was sent by the domain and wasn't altered in transit. Together, SPF and DKIM are the two core authentication standards that DMARC builds upon to prevent spoofing. DMARC is not marked correct here because, while it is an authentication policy framework, the question asks for the two underlying standards to configure. TLS and STARTTLS are transport encryption mechanisms that protect mail in transit but do not authenticate the sending domain or prevent spoofing.

Answer

DMARC

Answer

TLS

Answer

STARTTLS

Question 7

A FortiGate administrator notices that files submitted to FortiSandbox are receiving verdicts but the firewall is not automatically blocking the detected malware. The FortiSandbox integration is configured under Security Fabric > External Connectors. What additional configuration is required to enforce blocking based on FortiSandbox verdicts?

Accepted Answer

Enable the 'fortisandbox' option in the antivirus profile applied to the firewall policy. The FortiSandbox verdict integration requires the antivirus profile applied to the firewall policy to have the 'fortisandbox' option enabled. This option allows the FortiGate to query FortiSandbox for verdicts and automatically block files that are determined to be malicious. Without this setting in the antivirus profile, the FortiGate will receive verdicts but will not enforce blocking actions on the traffic.

Answer

Enable 'Inline Scan' on the FortiSandbox connector

Answer

Configure an automation stitch to quarantine files based on verdict

Answer

Enable 'Block malicious files' in the FortiSandbox connector settings

Question 8

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is an established TCP session with about one hour remaining before timeout. The output shows a TCP session (proto=6) with state 01, which in Fortinet's session table indicates an established TCP connection. The duration of 3600 seconds and expire value of 3599 seconds mean the session has been active for about one hour and has approximately one hour remaining before the idle timeout expires. This matches option B.

Answer

The session is in SYN_SENT state and cannot be established

Answer

The session is a UDP session using port 443

Answer

The session has a duration of 3600 seconds and will expire immediately

Question 9

An administrator wants to configure FortiGate to use the machine learning engine for advanced antivirus detection. Which setting must be enabled in the antivirus profile?

Accepted Answer

Enable 'Machine Learning Engine' in the antivirus profile. The machine learning engine for advanced antivirus detection is a dedicated feature within the antivirus profile that must be explicitly enabled. This engine uses behavioral analysis and heuristics to detect unknown or zero-day malware without relying solely on signature-based detection. Enabling this setting allows FortiGate to leverage on-device ML models to identify malicious files based on patterns and anomalies.

Answer

Enable 'Detect All' in the antivirus profile

Answer

Set 'Scan Mode' to 'Quick' in the antivirus profile

Answer

Enable 'Use FortiSandbox' in the antivirus profile

Question 10

A network administrator is troubleshooting a FortiGate IPS sensor that is not generating alerts for a custom signature they created. The custom signature uses the pattern 'malicious. The signature is enabled and applied to a firewall policy. What is the MOST likely cause of the issue?

Accepted Answer

The custom signature is missing the 'protocol' parameter. The custom signature is missing the 'protocol' parameter, which is mandatory for FortiGate custom IPS signatures. Without specifying the protocol (e.g., TCP, UDP, HTTP), the IPS engine cannot match the pattern against any traffic flow, so no alerts are generated even if the signature is enabled and applied to a policy.

Answer

The signature severity is set to 'Low' and logging is disabled for low severity

Answer

The IPS sensor is configured in 'Passive' mode

Answer

The firewall policy is using 'Flow-based' inspection

Question 11

An administrator is configuring FortiGate automation stitches to respond to a detected brute-force attack against an internal web server. The trigger is set to 'Event' with a condition matching repeated failed login attempts. Which TWO actions are appropriate to mitigate the attack? (Choose two.)

Accepted Answer

Add the source IP to a local address group that is used in a block policy. Adding the source IP to a local address group that is referenced in a block policy dynamically updates the firewall rule set to drop all traffic from that IP. This is a common automation stitch action in FortiGate that leverages the local address object and policy to enforce immediate blocking without manual intervention.

Answer

Enable quarantine on the web server

Answer

Shut down the web server interface

Answer

Run a CLI script to disable the user account

Question 12

An administrator configures FortiSandbox to quarantine files that are rated 'malicious'. They notice that some files are being quarantined even though the verdict is 'clean'. What could explain this?

Accepted Answer

The quarantine action is set to apply to files with a risk level above a certain threshold, and clean files have been incorrectly rated. FortiSandbox's quarantine action can be configured based on a risk score threshold, not solely on the verdict. If the risk score for a file rated 'clean' exceeds the configured threshold, the file may still be quarantined. This occurs because the verdict and risk score are separate attributes; a 'clean' verdict indicates no known malware, but the file's behavior or heuristics may still generate a high risk score that triggers quarantine.

Answer

FortiSandbox uses a whitelist that includes those files

Answer

The files were submitted by a different FortiGate with different settings

Answer

The administrator has enabled 'aggressive mode' which quarantines all files

Question 13

Which FortiGate feature can automatically block traffic from an IP address that is detected as malicious by FortiSandbox?

Accepted Answer

Automation Stitch. Automation Stitch in FortiOS allows you to create a trigger-action pair that automatically blocks an IP address when FortiSandbox detects malicious activity. The trigger can be a FortiSandbox IOC (Indicator of Compromise) event, and the action can be an IP block via a local or external block list, enabling real-time, automated threat response without manual intervention.

Answer

Traffic Shaping

Answer

Intrusion Prevention System (IPS)

Answer

Application Control

Question 14

A FortiGate administrator configures an antivirus profile with Machine Learning (ML) engine enabled. The ML engine is not detecting any threats, even though new unknown malware is present. What is the MOST likely reason?

Accepted Answer

The FortiGuard antivirus subscription is expired, preventing ML model updates. The FortiGate ML engine relies on FortiGuard for model updates that enable it to detect new and unknown malware. If the FortiGuard antivirus subscription is expired, the ML engine cannot receive these updates, rendering it unable to identify novel threats. This is the most likely reason the ML engine is not detecting any threats despite the presence of new unknown malware.

Answer

The ML engine requires a separate subscription

Answer

The ML engine is only for outbreak prevention

Answer

The antivirus profile is set to flow-based inspection

Question 15

An administrator configures a WAF profile on FortiGate to protect a web application. They notice that SQL injection attacks are not being blocked. What is the MOST likely reason?

Accepted Answer

The FortiGuard Web Filtering subscription is inactive. The FortiGuard Web Filtering subscription provides the signature database required to detect and block SQL injection attacks within a WAF profile. Without an active subscription, the WAF profile cannot update or use the latest attack signatures, rendering it unable to identify SQL injection patterns even if the profile is enabled and applied correctly.

Answer

The web application uses HTTPS without SSL inspection

Answer

The WAF profile is set to monitor mode

Answer

The WAF profile is applied to the wrong firewall policy