NSE7 Advanced Threat Protection Practice Test 3 — 15 Questions

Question 1

A FortiGate administrator configures an antivirus profile with the machine learning engine enabled and applies it to a policy inspecting HTTP traffic. After deployment, the admin notices that some files are being allowed that should have been detected. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ML engine is in monitor-only mode. The most likely cause is that the machine learning engine is configured in monitor-only mode. In this mode, the ML engine will log detections and generate alerts but will not take any action to block the file, allowing it to pass through the policy. This is a common initial deployment strategy to assess the ML engine's impact before enabling active blocking.

Answer

FortiGuard outbreak prevention is disabled

Answer

The antivirus profile is using flow-based inspection instead of proxy-based

Answer

The file size exceeds the maximum scanning limit

Question 2

An administrator runs the following CLI output: 'diagnose sys session filter dport 443' and sees 'proto=6 proto_state=01 duration=3600 expire=3599'. Which statement BEST describes the session?

Accepted Answer

The session is established and has been active for one hour. The session shows 'proto=6' (TCP), 'proto_state=01' (TCP_ESTABLISHED), and 'duration=3600' seconds, which equals one hour. The 'expire=3599' indicates the session has 3599 seconds left before timeout, confirming it is active and established. Option B correctly identifies this as an established session that has been active for one hour.

Answer

The session is in the process of being torn down

Answer

The session is a UDP session incorrectly classified as TCP

Answer

The TCP session is still in the SYN-SENT state

Question 3

A company wants to protect its internal users from malicious files attached to emails. Which FortiGate feature should be configured to inspect SMTP traffic for malware?

Accepted Answer

Antivirus. FortiGate's Antivirus feature is designed to scan SMTP traffic for malware by inspecting email attachments and body content against virus signatures. When configured in a security policy, it intercepts SMTP sessions, buffers the email data, and performs real-time scanning to block or quarantine malicious files before delivery to internal users.

Answer

Email Filter

Answer

Web Filter

Answer

IPS

Question 4

An administrator configures a FortiGate to integrate with FortiSandbox for inline scanning. The policy has an antivirus profile with FortiSandbox enabled. What condition must be met for files to be submitted to FortiSandbox?

Accepted Answer

The antivirus profile must use proxy-based inspection mode. For files to be submitted to FortiSandbox during inline scanning, the antivirus profile must use proxy-based inspection mode. This is because proxy-based inspection allows the FortiGate to buffer the entire file, perform deep analysis, and then forward it to FortiSandbox for verdict-based blocking. Flow-based inspection, in contrast, streams packets and cannot hold files for submission, making proxy mode a prerequisite for inline FortiSandbox integration.

Answer

The FortiSandbox must be on the same subnet as the FortiGate

Answer

The FortiGate must be in NAT mode

Answer

SSL inspection must be disabled

Question 5

A FortiGate admin sees the following log: 'Action=blocked, Service=HTTP, Application=Outbreak, File=invoice.doc, ThreatScore=95'. What is the MOST likely explanation for this block?

Accepted Answer

The file was blocked by FortiGuard outbreak prevention. The log entry shows 'Application=Outbreak' and 'ThreatScore=95', which are specific indicators of FortiGuard outbreak prevention. FortiGuard outbreak prevention uses real-time threat intelligence to block files associated with widespread malware campaigns before traditional signatures are updated. The 'Outbreak' application tag and high threat score directly correspond to this feature, not to machine learning, sandbox verdicts, or custom IPS signatures.

Answer

The file was blocked by the machine learning engine

Answer

The file was blocked by FortiSandbox verdict

Answer

The file was blocked by a custom IPS signature

Question 6

Which FortiGate security feature can reconstruct files to remove potentially malicious content while preserving the file's usability?

Accepted Answer

Content Disarm and Reconstruction. Content Disarm and Reconstruction (CDR) is the correct answer because it actively removes potentially malicious content—such as macros, scripts, or embedded objects—from files (e.g., Office documents, PDFs) and then reconstructs a clean, usable version. Unlike detection-based approaches, CDR eliminates threats by sanitizing the file structure itself, ensuring the file remains functional for the end user while blocking exploits.

Answer

Antivirus outbreak prevention

Answer

FortiSandbox

Answer

IPS application control

Question 7

An administrator needs to deploy a honeypot solution to detect and deceive attackers inside the network. Which Fortinet product is BEST suited for this purpose?

Accepted Answer

FortiDeceptor. FortiDeceptor is a dedicated deception-based security solution that deploys decoys (honeypots) and lures across the network to detect and misdirect attackers. It integrates with FortiGate and FortiSIEM to provide automated threat isolation and forensic data collection, making it the best choice for a honeypot deployment.

Answer

FortiSandbox

Answer

FortiEDR

Answer

FortiNAC

Question 8

A FortiGate administrator configures a custom IPS signature with the pattern 'attack' in the HTTP request URI. After applying the signature, no alerts are generated even though the traffic matches. What is the MOST likely cause?

Accepted Answer

The signature's protocol decoder is not set to 'HTTP'. The custom IPS signature pattern 'attack' will only be inspected against the HTTP request URI if the signature's protocol decoder is explicitly set to 'HTTP'. Without this decoder assignment, the IPS engine does not know which protocol layer to parse, and the pattern is never matched against the URI, resulting in no alerts despite matching traffic.

Answer

The signature's protocol decoder is set to 'HTTP'

Answer

The signature action is set to 'pass'

Answer

The signature severity is too low

Question 9

Which technology uses DMARC reports to help administrators identify unauthorized use of their email domain?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the correct answer because it specifically uses aggregate and forensic reports (DMARC reports) to provide administrators with visibility into how their email domain is being used, including unauthorized or spoofed emails. These reports are generated by receiving mail servers and sent back to the domain owner, detailing authentication results from SPF and DKIM checks, which helps identify and mitigate domain abuse.

Answer

SPF

Answer

DKIM

Answer

FortiMail

Question 10

An administrator wants to create an automation stitch that sends a webhook notification when an IPS attack is detected. Which trigger and action should be used?

Accepted Answer

Trigger: 'IPS Event'; Action: 'Webhook'. An automation stitch requires a trigger that matches the event type and an action that performs the desired response. 'IPS Event' is the correct trigger for detecting an IPS attack, and 'Webhook' is the action that sends an HTTP POST request to a configured endpoint, which is the standard method for webhook notifications in FortiOS.

Answer

Trigger: 'FortiGuard'; Action: 'Quarantine'

Answer

Trigger: 'System Event'; Action: 'Email'

Answer

Trigger: 'Incoming Webhook'; Action: 'IPS Event'

Question 11

A FortiGate is configured with a WAF profile to protect a web server. The administrator notices that SQL injection attacks are still reaching the server despite the WAF being enabled. What is the MOST likely reason?

Accepted Answer

The SQL injection signature set is disabled in the WAF profile. The WAF profile contains signature sets that detect and block common attack patterns, including SQL injection. If the SQL injection signature set is disabled within the profile, the WAF will not inspect traffic for those patterns, allowing attacks to pass through. This is the most direct and likely reason why SQL injection attacks are reaching the server despite the WAF being enabled.

Answer

The attack is coming from a trusted IP

Answer

The web server is using HTTPS without SSL inspection

Answer

The WAF profile is not applied to the correct policy

Question 12

An administrator runs 'diagnose ips anomaly http' and sees many entries with 'type=SQLi' and 'score=0'. What does a score of 0 indicate?

Accepted Answer

The traffic showed suspicious patterns but did not meet the threshold. In Fortinet's IPS anomaly detection, a score of 0 indicates that the traffic exhibited suspicious patterns (e.g., SQLi signatures) but did not accumulate enough anomaly points to meet the configured threshold for triggering an action. This means the traffic was flagged as potentially malicious but was not deemed severe enough to warrant logging or blocking, so it remains in a 'monitoring' state without enforcement.

Answer

The anomaly detection is disabled

Answer

The IPS sensor is not applied to any policy

Answer

The traffic is definitely an SQL injection attack

Question 13

An administrator wants to configure FortiGate to automatically block a source IP when a high-severity IPS event is detected. Which TWO components must be configured? (Choose two.)

Accepted Answer

An automation stitch trigger set to 'IPS Event'. An automation stitch trigger set to 'IPS Event' is required to detect the high-severity IPS event and initiate the automated response. Option E is correct because the 'Quarantine' action within the automation stitch is the component that actually blocks the source IP by adding a dynamic block entry to the firewall policy.

Answer

A firewall policy with IPS enabled

Answer

A FortiGuard category subscription

Answer

A static route to the source IP

Question 14

A FortiGate administrator is troubleshooting why files are not being submitted to FortiSandbox for analysis. Which THREE conditions must be met for file submission to work? (Choose three.)

Accepted Answer

The file type must be in FortiSandbox's supported list. FortiSandbox only supports analysis for specific file types (e.g., PE, PDF, Office documents). If the file type is not in the supported list, the FortiGate will not submit it, even if all other conditions are met. This is a fundamental filtering step in the FortiGate-FortiSandbox integration.

Answer

SSL inspection must be disabled for the policy

Answer

The FortiSandbox must be in inline scanning mode

Question 15

An organization wants to implement email authentication to prevent spoofing. Which TWO standards should they configure? (Choose two.)

Accepted Answer

SPF. SPF (Sender Policy Framework) is correct because it allows the domain owner to publish a list of authorized sending IP addresses in a DNS TXT record, enabling receiving mail servers to verify that the email originated from an approved source. DKIM (DomainKeys Identified Mail) is correct because it adds a digital signature to email headers, which the receiving server validates against a public key published in DNS, ensuring the message was not tampered with and truly came from the claimed domain. Together, SPF and DKIM form the foundational layers of email authentication that DMARC builds upon.

Answer

DMARC

Answer

TLS

Answer

STARTTLS