NSE7 Advanced Threat Protection Practice Test 3 — 15 Questions

Question 1

A FortiGate administrator wants to detect and block protocol anomalies as part of advanced IPS. Which three options are available in FortiGate's custom IPS signatures? (Choose three.)

Accepted Answer

Protocol-specific fields. Custom IPS signatures in FortiGate allow matching on protocol-specific fields such as TCP flags, ICMP type/code, or DNS query types. This enables detection of anomalies like invalid flag combinations or malformed protocol headers, which is a core part of advanced IPS.

Answer

Application signatures

Answer

URL filtering

Question 2

A network administrator has configured FortiGate to send files to FortiSandbox for analysis. However, files are not being submitted. The administrator checks the FortiGate configuration and sees that the FortiSandbox server IP is correctly entered. What is the most likely cause of the issue?

Accepted Answer

A firewall policy is blocking communication to FortiSandbox on port 514. The most likely cause is that a firewall policy is blocking communication to FortiSandbox on port 514. FortiGate uses port 514 (syslog) to submit files to FortiSandbox, and if this port is blocked by an intermediate firewall or an implicit deny policy, the submission will fail even if the server IP is correctly configured. The administrator should verify that traffic to the FortiSandbox IP on UDP/TCP 514 is permitted by all relevant policies.

Answer

The FortiSandbox is not licensed for file submission

Answer

The file type is not supported by FortiSandbox

Answer

The FortiGate antivirus profile is set to flow-based inspection

Question 3

An administrator wants to prevent users from downloading known malicious files from the internet. The administrator has enabled FortiGuard Outbreak Prevention and applied an antivirus profile to the outbound policy. However, some malicious files are still reaching users. What configuration step is most likely missing?

Accepted Answer

The antivirus profile does not have 'FortiGuard Outbreak Prevention' enabled. FortiGuard Outbreak Prevention is a separate toggle within the antivirus profile that must be explicitly enabled to leverage real-time outbreak intelligence. Even if the administrator believes they have enabled it, the profile may have the feature disabled by default or inadvertently left off, allowing known malicious files to bypass detection. Without this toggle, the antivirus engine relies only on static signatures and cannot block files flagged by FortiGuard's outbreak database.

Answer

The antivirus profile has 'FortiGuard Outbreak Prevention' enabled

Answer

The FortiGuard subscription has expired

Answer

The security policy is not configured for proxy-based inspection

Question 4

A security analyst is investigating a phishing email that bypassed email security. The email's headers show SPF=pass, DKIM=pass, but DMARC=quarantine. The email was delivered to the inbox. What is the most likely reason DMARC did not block or quarantine the email?

Accepted Answer

The SPF and DKIM alignment checks passed, so DMARC treated the email as authentic. DMARC uses SPF and DKIM alignment to determine authenticity. When both SPF and DKIM pass and are aligned (i.e., the domain in the From header matches the domain used in SPF/DKIM), DMARC considers the email authentic and applies the policy accordingly. In this case, the DMARC policy was set to 'quarantine', but because alignment checks passed, DMARC treated the email as legitimate and allowed delivery to the inbox, rather than quarantining it.

Answer

The email was sent from a subdomain not covered by DMARC

Answer

The DMARC record had a pct (percentage) of less than 100

Answer

The DMARC policy was set to 'none'

Question 5

An administrator wants to create an automation stitch that automatically blocks an IP address when a high-severity IPS alert is triggered. The administrator creates a trigger for 'IPS event' and an action of 'Add to Blocked IPs'. However, the action fails to execute. Which of the following is the most likely cause?

Accepted Answer

The admin account used to configure the stitch does not have permission to modify the blocked IP list. The admin account used to configure the automation stitch must have the necessary permissions to modify the blocked IP list. In FortiOS, the automation stitch action 'Add to Blocked IPs' requires write access to the firewall address object or the blocked IP list. If the admin account has read-only or restricted privileges, the action will fail silently, even if the trigger and action are correctly configured.

Answer

The automation stitch is set to execute every 5 minutes, not immediately

Answer

The blocked IP list has reached its maximum size

Answer

The IPS event trigger does not support IP address extraction

Question 6

A FortiGate administrator receives a report that a user downloaded a malicious PDF file. The antivirus profile has machine learning engine enabled, CDR enabled, and FortiSandbox integration. However, the file was allowed. The log shows: 'file=malicious.pdf, action=allow, ml_score=85, cd_result=clean, sandbox=not_submitted'. What is the most likely reason the file was not submitted to FortiSandbox?

Accepted Answer

The file size exceeded the maximum file size for FortiSandbox submission. The log shows 'sandbox=not_submitted', which directly indicates the file was never sent to FortiSandbox. FortiGate has a configurable maximum file size limit for sandbox submission (default 10 MB). If the PDF exceeds this limit, the file is allowed without sandbox inspection, even if other engines like ML or CDR are enabled. The ml_score of 85 indicates a high malicious probability, but the sandbox submission was skipped due to size constraints.

Answer

CDR reconstructed the file, making it appear clean

Answer

The machine learning engine scored the file as clean (score below threshold)

Answer

The file was excluded by a file type filter in the antivirus profile

Question 7

An administrator needs to create a custom IPS signature to detect a specific exploit that sends a unique string 'EXPLOIT_2024' in the HTTP User-Agent header. Which IPS signature syntax should the administrator use?

Accepted Answer

F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "User-Agent: EXPLOIT_2024"; --service HTTP;). It uses the `--pattern` to match the exact string 'User-Agent: EXPLOIT_2024' within the HTTP header context, and `--service HTTP` ensures the signature only inspects HTTP traffic. This syntax precisely detects the exploit string in the User-Agent header as required.

Answer

F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "EXPLOIT_2024"; --context http-header;)

Answer

F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "User-Agent: EXPLOIT"; --service HTTP;)

Answer

F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "EXPLOIT_2024"; --service HTTP;)

Question 8

A company receives a threat intelligence feed that lists several IP addresses as malicious. The administrator wants to automatically block traffic from these IPs on FortiGate. Which TWO methods can achieve this? (Choose two.)

Accepted Answer

Configure an external connector to a threat intelligence feed and map it to an address object. FortiGate's external connector can ingest a threat intelligence feed (e.g., STIX/TAXII or CSV) and dynamically map it to an address object. This allows the firewall to automatically update its policy enforcement based on the feed without manual intervention. Option C is correct because an automation stitch can use a trigger (e.g., receiving a feed via webhook or script) and an action to update blocked IPs via the FortiOS API or CLI, providing real-time blocking.

Answer

Enable FortiGuard Outbreak Prevention

Answer

Configure a firewall policy to deny all traffic from unknown sources

Answer

Create an address group and add the IPs manually

Question 9

An administrator is troubleshooting why a custom IPS signature for protocol anomaly detection is not triggering. The signature is designed to detect abnormal DNS query lengths. Which TWO steps should the administrator take to verify the signature is working? (Choose two.)

Accepted Answer

Verify that the IPS sensor containing the signature is applied to the correct firewall policy. An IPS sensor must be explicitly applied to a firewall policy for the signatures it contains to be evaluated against traffic passing through that policy. Without this binding, the custom signature for DNS protocol anomaly detection will never be inspected, regardless of its configuration or the traffic type.

Answer

Reboot the FortiGate to reset the IPS engine

Answer

Disable the firewall policy to see if the signature triggers

Answer

Increase the signature's severity to see it in logs

Question 10

A network admin notices that files submitted to FortiSandbox from FortiGate are not being analyzed. The FortiGate has a valid FortiSandbox license and the device is reachable. What configuration step is most likely missing?

Accepted Answer

The antivirus profile has 'FortiSandbox Inline Scan' disabled. FortiGate uses antivirus profiles to define scanning behavior for traffic. Even with a valid FortiSandbox license and reachability, the antivirus profile must have 'FortiSandbox Inline Scan' enabled to submit files to FortiSandbox for analysis. Without this setting, files are not forwarded for sandboxing, regardless of other configurations.

Answer

The FortiSandbox feature is not enabled in the VDOM settings

Answer

The FortiSandbox server IP is not configured under Security Fabric > Fabric Connectors

Answer

The FortiGate is not registered with FortiCloud

Question 11

A FortiGate admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session has been active for 1 hour and will expire in about 1 hour. The output shows 'duration=3600' and 'expire=3599', meaning the session has been active for 3600 seconds (1 hour) and has approximately 3599 seconds remaining before it times out. The 'proto=6' indicates TCP (protocol 6), and 'proto_state=01' is the TCP state (typically ESTABLISHED). The session is healthy and will expire in about 1 hour, confirming C.

Answer

The session is a UDP session that has been idle for 1 hour

Answer

The session has a problem because duration and expire are not equal

Answer

The session is a short-lived connection that started 3600 seconds ago

Question 12

A security admin notices that FortiClient ATP is not blocking threats on a managed endpoint. The FortiClient is registered with FortiGate and the ATP feature is enabled in the FortiClient profile. What is the most likely cause?

Accepted Answer

The FortiGate antivirus profile applied to the FortiClient policy has 'Scan on Access' disabled. FortiClient ATP (AntiVirus/AntiMalware) relies on the FortiGate's antivirus profile to enforce real-time scanning. Even if the ATP feature is enabled in the FortiClient profile, the 'Scan on Access' setting in the FortiGate antivirus profile applied to the FortiClient policy must be enabled for the endpoint to block threats on access. If 'Scan on Access' is disabled, FortiClient will not perform real-time scanning, allowing threats to go undetected despite ATP being enabled.

Answer

The FortiGate's antivirus signatures are outdated

Answer

The FortiClient endpoint has a different antivirus product installed that conflicts

Answer

FortiClient is in standalone mode instead of managed mode

Question 13

An organization wants to protect against zero-day malware by using FortiGate's outbreak prevention feature. Which configuration is required to enable outbreak prevention in the antivirus profile?

Accepted Answer

Select 'Outbreak Prevention' under Antivirus profile settings. FortiGate's outbreak prevention feature is specifically enabled within the antivirus profile by selecting the 'Outbreak Prevention' option. This setting leverages FortiGuard's outbreak alert database to block files that match known outbreak signatures, providing protection against zero-day malware before traditional signatures are available.

Answer

Enable 'Machine Learning Engine' in the antivirus profile

Answer

Enable 'FortiSandbox Inline Scan'

Answer

Configure a web filter profile to block malicious URLs

Question 14

An organization uses FortiGate's WAF feature (not FortiWeb) to protect a web server. The admin configures an inline WAF profile but notices that the WAF is not inspecting traffic. What is the most likely cause?

Accepted Answer

SSL Inspection is not enabled on the firewall policy. FortiGate's WAF feature operates at the application layer and requires SSL Inspection to decrypt HTTPS traffic before the WAF engine can analyze the payload. Without SSL Inspection enabled on the firewall policy, the WAF profile sees only encrypted traffic and cannot inspect HTTP/HTTPS content, effectively rendering the WAF non-functional for encrypted sessions.

Answer

The WAF profile is not applied to a firewall policy

Answer

The firewall policy uses flow-based inspection

Answer

The WAF profile is configured in monitor mode

Question 15

When configuring FortiGate with FortiSandbox integration, an administrator wants to block files that are rated 'High Risk' by the sandbox. Which setting must be enabled in the antivirus profile to automatically quarantine these files?

Accepted Answer

Enable 'Submit Files to FortiSandbox' and set action to 'Block'. The 'Submit Files to FortiSandbox' setting in the antivirus profile, when set to 'Block', directly instructs FortiGate to quarantine files that receive a 'High Risk' verdict from FortiSandbox. This action is part of the antivirus profile's sandbox integration, not a separate automation or IPS feature, and it automatically handles the quarantine without requiring additional configuration.

Answer

Configure an automation stitch to quarantine files based on sandbox verdict

Answer

Enable 'File Filter' in the antivirus profile and add a rule for high-risk files

Answer

Enable 'FortiSandbox Quarantine' in the IPS profile