NSE7 Advanced Threat Protection Practice Test 4 — 15 Questions

Question 1

A company uses FortiMail and wants to ensure that incoming emails are authenticated using SPF, DKIM, and DMARC. Which profile should the administrator configure to enforce these checks?

Accepted Answer

Authentication Profile. The Authentication Profile in FortiMail is specifically designed to enforce email authentication checks such as SPF, DKIM, and DMARC. This profile defines the actions to take when an email fails these authentication checks, such as quarantining or rejecting the message, and is applied to incoming email flows to ensure compliance with authentication standards.

Answer

Session Profile

Answer

Antispam Profile

Answer

IP Policy

Question 2

A FortiGate administrator runs the following CLI command:
'diagnose ips anomaly log'
The output shows numerous 'tcp_syn_flood' events from a single source IP. To mitigate this, the administrator wants to block the source IP automatically. Which feature should be used?

Accepted Answer

Automation Stitch. The 'diagnose ips anomaly log' command displays anomalies detected by the FortiGate's DoS (Denial of Service) sensor, such as TCP SYN flood events. An Automation Stitch (Option D) is the correct feature to automatically block the source IP because it can trigger a 'Block IP' action based on a 'IPS Anomaly' event, creating an automated response without manual intervention.

Answer

IPS Custom Signature

Answer

Local-in Policy

Answer

IP Block List

Question 3

A FortiGate is configured to submit files to FortiSandbox. The administrator notices that files are being submitted but no verdicts are returned. Which two conditions could cause this?

Accepted Answer

The FortiSandbox server is not reachable from the FortiGate. When FortiSandbox is not reachable from the FortiGate, the file cannot be submitted for analysis, resulting in no verdict returned. Similarly, if the file size exceeds the FortiSandbox submission limit, the file may be rejected, preventing verdict generation. Unsupported file types (B) still get a verdict (e.g., skipped). An expired license (D) also prevents verdict return, but the explanation must match the new correct set: A and C are the only correct conditions among the list. The antivirus profile set to monitor mode (E) does not affect verdict return; it only controls action taken on verdict.

Answer

The file type is not supported by FortiSandbox

Answer

The FortiSandbox license has expired

Answer

The antivirus profile is set to monitor mode

Question 4

A network admin notices that files submitted to FortiSandbox are not being analyzed. The FortiGate is configured to send files to FortiSandbox. What is the MOST likely cause?

Accepted Answer

FortiSandbox license is expired. The most likely cause is an expired FortiSandbox license. When the license expires, FortiSandbox stops analyzing submitted files and may reject new submissions, even though the FortiGate is configured to send them. The FortiGate will still attempt to forward files, but FortiSandbox will not process them, resulting in no analysis results being returned.

Answer

FortiGate firewall policy is blocking the connection to FortiSandbox on port 443

Answer

FortiSandbox is in quarantine mode

Answer

File size exceeds the maximum submission size limit on FortiGate

Question 5

An organization wants to protect a public-facing web application against SQL injection and cross-site scripting (XSS) attacks. They have a FortiGate and a FortiWeb. What is the BEST deployment approach?

Accepted Answer

Deploy FortiWeb in reverse proxy mode in front of the web server. FortiWeb in reverse proxy mode is the best deployment because it terminates the client connection and inspects all HTTP/HTTPS traffic at the application layer (Layer 7) using specialized web application firewall (WAF) signatures and machine learning to detect and block SQL injection and XSS payloads before they reach the web server. Unlike a network firewall or IPS, FortiWeb is purpose-built for web application security and can decode, normalize, and analyze complex attack patterns that might evade simpler inspection methods.

Answer

Place the web server in a DMZ and rely on firewall policies

Answer

Use FortiGate WAF profile only

Answer

Use FortiGate IPS signatures for SQL injection and XSS

Question 6

A company uses FortiMail to protect email. They set up DMARC with a policy of 'quarantine' for emails failing SPF and DKIM checks. However, legitimate emails from a third-party service are being quarantined. What should the admin do?

Accepted Answer

Update the SPF record to include the third-party mail server IP. The root cause is that the third-party mail server's IP is not authorized in the sender domain's SPF record. DMARC uses SPF alignment: if the message fails SPF (because the sending IP is not listed) and also fails DKIM, DMARC enforces the 'quarantine' policy. Adding the third-party IP to the SPF record allows SPF to pass, achieving alignment and preventing quarantine.

Answer

Add the sender domain to a whitelist in FortiMail

Answer

Change the DMARC policy to 'none'

Answer

Disable DMARC checking for that specific sender

Question 7

A security analyst notices repeated failed login attempts from a specific IP address to the FortiGate management interface. The administrator wants to automatically blacklist the IP after 3 failed attempts within 60 seconds. Which feature should be configured?

Accepted Answer

Admin lockdown and intruder lockout settings. The 'Admin lockdown and intruder lockout' settings in FortiGate are specifically designed to detect repeated failed login attempts to the management interface and automatically blacklist the offending IP address after a configurable number of failures within a defined time window. This feature operates at the authentication layer, directly monitoring admin login attempts, and can enforce a lockout threshold (e.g., 3 failures in 60 seconds) to block the source IP, which matches the requirement exactly.

Answer

Intrusion Prevention System (IPS) with custom signature

Answer

FortiGate's built-in DoS policy and blacklist

Answer

Administrative access trusted hosts

Question 8

A FortiGate administrator runs 'diagnose ips anomaly list' and sees many entries with 'protocol anomaly - tcp_port_scan'. The administrator wants to reduce false positives. Which action should be taken in the IPS sensor configuration?

Accepted Answer

Increase the threshold for the port scan detection in the IPS sensor.. Increasing the threshold for port scan detection in the IPS sensor reduces false positives by requiring a higher number of scan attempts within the detection window before an alert is triggered. The 'diagnose ips anomaly list' output shows 'protocol anomaly - tcp_port_scan' entries, which are generated by the IPS engine's anomaly-based detection; raising the threshold makes the sensor less sensitive to benign network scanning activity, such as legitimate port sweeps by monitoring tools.

Answer

Add the trusted server IPs to an exemption list in the IPS sensor.

Answer

Disable the TCP port scan filter entirely.

Answer

Change the action from 'block' to 'monitor' for all IPS filters.

Question 9

A FortiGate administrator wants to use automation stitches to respond to a detected threat. The trigger is 'event' and the action is to quarantine the source IP. Which TWO actions can be used in FortiGate automation stitches to achieve IP quarantine?

Accepted Answer

CLI script that runs 'diagnose user quarantine add'. The 'diagnose user quarantine add' command is the native FortiGate CLI command to add an IP address to the quarantine list, which is a valid action in an automation stitch. Option C is also correct because executing a CLI script that creates a firewall address object and a corresponding policy to block the IP effectively achieves IP quarantine by preventing traffic from that source, which is a common alternative method.

Answer

Send an email to the administrator

Answer

Use the 'execute fortishield' command in a CLI script

Answer

Log the event to FortiAnalyzer

Question 10

An administrator runs 'diagnose ips anomaly list' and sees many 'data_leak' events from a specific internal IP address. The IPS sensor has the default pre-defined signatures enabled. What additional step should the administrator take to block this specific anomaly?

Accepted Answer

Create a custom IPS signature to match the anomaly pattern and apply it to the IPS sensor. The 'diagnose ips anomaly list' command shows protocol anomaly events, which are detected by the IPS engine's built-in anomaly detection logic, not by pre-defined signatures. To block a specific anomaly pattern like 'data_leak', the administrator must create a custom IPS signature that matches the exact anomaly characteristics and apply it to the IPS sensor. Pre-defined signatures cannot be modified to block anomalies; only custom signatures can target these events.

Answer

Enable protocol anomaly detection in the antivirus profile

Answer

Enable the 'data_leak' signature in the IPS sensor and set action to 'block'

Answer

Configure a firewall policy with application control to block the traffic

Question 11

An administrator is configuring a firewall policy for web traffic to a critical web application. They want to protect against SQL injection and cross-site scripting. Which security profile should they apply?

Accepted Answer

Web Application Firewall (WAF) profile. The Web Application Firewall (WAF) profile is specifically designed to inspect HTTP/HTTPS traffic at the application layer and block common web-based attacks such as SQL injection and cross-site scripting (XSS). It uses signature-based detection and behavioral analysis to identify malicious payloads in request parameters, headers, and body content, making it the correct choice for protecting a critical web application.

Answer

Antivirus profile with CDR

Answer

Application control profile

Answer

IPS sensor with pre-defined signatures

Question 12

You receive an alert from FortiSandbox that a file has been rated 'highly malicious'. The FortiGate has the FortiSandbox inline scanning enabled with the action 'block malicious'. However, the file is still being downloaded by users. What is the most likely reason?

Accepted Answer

The file type is not listed in the scanning profile for FortiSandbox. FortiSandbox inline scanning only inspects file types that are explicitly listed in the scanning profile. If the file type (e.g., .zip, .pdf, or a specific executable extension) is not included in the profile, FortiGate will allow the file to pass through without sending it to FortiSandbox for analysis, even if the action is set to 'block malicious'. This explains why a file rated 'highly malicious' can still be downloaded by users.

Answer

The FortiSandbox device is not reachable from FortiGate

Answer

The IPS sensor is blocking the connection before the antivirus inspection

Answer

The antivirus database is outdated

Question 13

An administrator is deploying FortiClient with ATP features. They want to ensure that if a process is detected as malicious by the FortiClient machine learning engine, the endpoint is isolated from the network. Which configuration should they use?

Accepted Answer

Configure an automation stitch with trigger 'FortiClient event' and action 'quarantine endpoint'. An automation stitch with the trigger 'FortiClient event' and action 'quarantine endpoint' allows FortiGate to automatically isolate an endpoint when the FortiClient machine learning engine detects a malicious process. This integration leverages FortiGate's Security Fabric to enforce network isolation based on endpoint telemetry, ensuring the compromised host is blocked from communicating with the rest of the network.

Answer

Create a firewall policy to block traffic from that endpoint

Answer

Enable 'auto-network-access' in the FortiClient profile

Answer

Enable 'FortiClient quarantine' in the antivirus profile

Question 14

A FortiGate administrator is troubleshooting an issue where a legitimate application is being blocked by the IPS. The administrator wants to ensure the application works while maintaining protection for other traffic. What is the best action?

Accepted Answer

Create a custom IPS signature to pass the specific application traffic. Creating a custom IPS signature that passes (allows) the specific application traffic is the surgical fix: it exempts only the legitimate application's traffic pattern from IPS inspection while leaving all other signatures active to protect the rest of the traffic. This preserves the security posture of the IPS sensor on the policy instead of weakening it globally. FortiGate supports custom signatures with the action set to 'pass' so the matching flow bypasses further IPS inspection.

Answer

Disable the IPS sensor on the firewall policy

Answer

Apply an application control profile to allow the application

Answer

Change the IPS signature action to 'monitor' for all signatures

Question 15

An administrator is configuring automation stitches to respond to a detected ransomware outbreak. Which THREE components are essential for an automation stitch?

Accepted Answer

Condition. In Fortinet's NSE7 context, an automation stitch requires three essential components: a Trigger (which initiates the stitch), a Condition (which filters or qualifies the trigger), and an Action (which executes the response). The Condition is correct because it allows the stitch to evaluate specific criteria—such as a ransomware detection event—before proceeding to the Action, ensuring precise and efficient automated responses.

Answer

Schedule

Answer

Log device