NSE7 Advanced Threat Protection Practice Test 3 — 15 Questions

Question 1

An administrator configures a FortiGate to integrate with FortiSandbox for inline scanning. The policy has an antivirus profile with FortiSandbox enabled. What condition must be met for files to be submitted to FortiSandbox?

Accepted Answer

The antivirus profile must use proxy-based inspection mode. For files to be submitted to FortiSandbox during inline scanning, the antivirus profile must use proxy-based inspection mode. This is because proxy-based inspection allows the FortiGate to buffer the entire file, perform deep analysis, and then forward it to FortiSandbox for verdict-based blocking. Flow-based inspection, in contrast, streams packets and cannot hold files for submission, making proxy mode a prerequisite for inline FortiSandbox integration.

Answer

The FortiSandbox must be on the same subnet as the FortiGate

Answer

The FortiGate must be in NAT mode

Answer

SSL inspection must be disabled

Question 2

A FortiGate admin sees the following log: 'Action=blocked, Service=HTTP, Application=Outbreak, File=invoice.doc, ThreatScore=95'. What is the MOST likely explanation for this block?

Accepted Answer

The file was blocked by FortiGuard outbreak prevention. The log entry shows 'Application=Outbreak' and 'ThreatScore=95', which are specific indicators of FortiGuard outbreak prevention. FortiGuard outbreak prevention uses real-time threat intelligence to block files associated with widespread malware campaigns before traditional signatures are updated. The 'Outbreak' application tag and high threat score directly correspond to this feature, not to machine learning, sandbox verdicts, or custom IPS signatures.

Answer

The file was blocked by the machine learning engine

Answer

The file was blocked by FortiSandbox verdict

Answer

The file was blocked by a custom IPS signature

Question 3

Which FortiGate security feature can reconstruct files to remove potentially malicious content while preserving the file's usability?

Accepted Answer

Content Disarm and Reconstruction. Content Disarm and Reconstruction (CDR) is the correct answer because it actively removes potentially malicious content—such as macros, scripts, or embedded objects—from files (e.g., Office documents, PDFs) and then reconstructs a clean, usable version. Unlike detection-based approaches, CDR eliminates threats by sanitizing the file structure itself, ensuring the file remains functional for the end user while blocking exploits.

Answer

Antivirus outbreak prevention

Answer

FortiSandbox

Answer

IPS application control

Question 4

An administrator needs to deploy a honeypot solution to detect and deceive attackers inside the network. Which Fortinet product is BEST suited for this purpose?

Accepted Answer

FortiDeceptor. FortiDeceptor is a dedicated deception-based security solution that deploys decoys (honeypots) and lures across the network to detect and misdirect attackers. It integrates with FortiGate and FortiSIEM to provide automated threat isolation and forensic data collection, making it the best choice for a honeypot deployment.

Answer

FortiSandbox

Answer

FortiEDR

Answer

FortiNAC

Question 5

A FortiGate administrator configures a custom IPS signature with the pattern 'attack' in the HTTP request URI. After applying the signature, no alerts are generated even though the traffic matches. What is the MOST likely cause?

Accepted Answer

The signature's protocol decoder is not set to 'HTTP'. The custom IPS signature pattern 'attack' will only be inspected against the HTTP request URI if the signature's protocol decoder is explicitly set to 'HTTP'. Without this decoder assignment, the IPS engine does not know which protocol layer to parse, and the pattern is never matched against the URI, resulting in no alerts despite matching traffic.

Answer

The signature's protocol decoder is set to 'HTTP'

Answer

The signature action is set to 'pass'

Answer

The signature severity is too low

Question 6

Which technology uses DMARC reports to help administrators identify unauthorized use of their email domain?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the correct answer because it specifically uses aggregate and forensic reports (DMARC reports) to provide administrators with visibility into how their email domain is being used, including unauthorized or spoofed emails. These reports are generated by receiving mail servers and sent back to the domain owner, detailing authentication results from SPF and DKIM checks, which helps identify and mitigate domain abuse.

Answer

SPF

Answer

DKIM

Answer

FortiMail

Question 7

An administrator wants to create an automation stitch that sends a webhook notification when an IPS attack is detected. Which trigger and action should be used?

Accepted Answer

Trigger: 'IPS Event'; Action: 'Webhook'. The correct answer is A because an automation stitch requires a trigger that matches the event type and an action that performs the desired response. 'IPS Event' is the correct trigger for detecting an IPS attack, and 'Webhook' is the action that sends an HTTP POST request to a configured endpoint, which is the standard method for webhook notifications in FortiOS.

Answer

Trigger: 'FortiGuard'; Action: 'Quarantine'

Answer

Trigger: 'System Event'; Action: 'Email'

Answer

Trigger: 'Incoming Webhook'; Action: 'IPS Event'

Question 8

A FortiGate is configured with a WAF profile to protect a web server. The administrator notices that SQL injection attacks are still reaching the server despite the WAF being enabled. What is the MOST likely reason?

Accepted Answer

The SQL injection signature set is disabled in the WAF profile. The WAF profile contains signature sets that detect and block common attack patterns, including SQL injection. If the SQL injection signature set is disabled within the profile, the WAF will not inspect traffic for those patterns, allowing attacks to pass through. This is the most direct and likely reason why SQL injection attacks are reaching the server despite the WAF being enabled.

Answer

The attack is coming from a trusted IP

Answer

The web server is using HTTPS without SSL inspection

Answer

The WAF profile is not applied to the correct policy

Question 9

An administrator runs 'diagnose ips anomaly http' and sees many entries with 'type=SQLi' and 'score=0'. What does a score of 0 indicate?

Accepted Answer

The traffic showed suspicious patterns but did not meet the threshold. In Fortinet's IPS anomaly detection, a score of 0 indicates that the traffic exhibited suspicious patterns (e.g., SQLi signatures) but did not accumulate enough anomaly points to meet the configured threshold for triggering an action. This means the traffic was flagged as potentially malicious but was not deemed severe enough to warrant logging or blocking, so it remains in a 'monitoring' state without enforcement.

Answer

The anomaly detection is disabled

Answer

The IPS sensor is not applied to any policy

Answer

The traffic is definitely an SQL injection attack

Question 10

An administrator wants to configure FortiGate to automatically block a source IP when a high-severity IPS event is detected. Which TWO components must be configured? (Choose two.)

Accepted Answer

An automation stitch trigger set to 'IPS Event'. Option C is correct because an automation stitch trigger set to 'IPS Event' is required to detect the high-severity IPS event and initiate the automated response. Option E is correct because the 'Quarantine' action within the automation stitch is the component that actually blocks the source IP by adding a dynamic block entry to the firewall policy.

Answer

A firewall policy with IPS enabled

Answer

A FortiGuard category subscription

Answer

A static route to the source IP

Question 11

A FortiGate administrator is troubleshooting why files are not being submitted to FortiSandbox for analysis. Which THREE conditions must be met for file submission to work? (Choose three.)

Accepted Answer

The file type must be in FortiSandbox's supported list. Option B is correct because FortiSandbox only supports analysis for specific file types (e.g., PE, PDF, Office documents). If the file type is not in the supported list, the FortiGate will not submit it, even if all other conditions are met. This is a fundamental filtering step in the FortiGate-FortiSandbox integration.

Answer

SSL inspection must be disabled for the policy

Answer

The FortiSandbox must be in inline scanning mode

Question 12

An organization wants to implement email authentication to prevent spoofing. Which TWO standards should they configure? (Choose two.)

Accepted Answer

SPF. SPF (Sender Policy Framework) is correct because it allows the domain owner to publish a list of authorized sending IP addresses in a DNS TXT record, enabling receiving mail servers to verify that the email originated from an approved source. DKIM (DomainKeys Identified Mail) is correct because it adds a digital signature to email headers, which the receiving server validates against a public key published in DNS, ensuring the message was not tampered with and truly came from the claimed domain. Together, SPF and DKIM form the foundational layers of email authentication that DMARC builds upon.

Answer

DMARC

Answer

TLS

Answer

STARTTLS

Question 13

A FortiGate administrator notices that files submitted to FortiSandbox are receiving verdicts but the firewall is not automatically blocking the detected malware. The FortiSandbox integration is configured under Security Fabric > External Connectors. What additional configuration is required to enforce blocking based on FortiSandbox verdicts?

Accepted Answer

Enable the 'fortisandbox' option in the antivirus profile applied to the firewall policy. Option A is correct because the FortiSandbox verdict integration requires the antivirus profile applied to the firewall policy to have the 'fortisandbox' option enabled. This option allows the FortiGate to query FortiSandbox for verdicts and automatically block files that are determined to be malicious. Without this setting in the antivirus profile, the FortiGate will receive verdicts but will not enforce blocking actions on the traffic.

Answer

Enable 'Inline Scan' on the FortiSandbox connector

Answer

Configure an automation stitch to quarantine files based on verdict

Answer

Enable 'Block malicious files' in the FortiSandbox connector settings

Question 14

Which FortiClient ATP feature provides protection against zero-day malware by monitoring process behavior and blocking suspicious activities at the endpoint?

Accepted Answer

FortiClient Exploit Prevention. FortiClient Exploit Prevention is correct because it uses real-time behavioral monitoring of process activities—such as API calls, memory access patterns, and code injection attempts—to detect and block zero-day malware that has no known signature. Unlike signature-based detection, this feature identifies malicious behavior at runtime, making it effective against previously unseen threats.

Answer

FortiClient Web Filtering

Answer

FortiClient Cloud Sandbox

Answer

FortiClient Vulnerability Scan

Question 15

A security administrator wants to block email spoofing attacks against their organization's domain. They configure SPF, DKIM, and DMARC records. Which protocol authenticates the domain of the email sender by verifying the email's signature against a public key published in DNS?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) is the correct answer because it provides email authentication by allowing the sender to cryptographically sign an email with a private key. The receiving mail server then retrieves the sender's public key from a DNS TXT record and verifies the signature, confirming that the email was not tampered with and originates from a domain the sender is authorized to use.

Answer

SPF

Answer

ARC

Answer

DMARC