NSE7 Advanced Threat Protection Practice Test 5 — 15 Questions

Question 1

An administrator is investigating an alert from FortiEDR indicating a suspicious process on an endpoint. The administrator wants to gather more context. Which TWO sources can provide threat intelligence to enrich the investigation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FortiGuard Outbreak Prevention. Options C and D are correct. FortiGuard Outbreak Prevention and third-party threat feeds provide external threat intelligence about indicators of compromise.

Answer

Local antivirus signature database

Answer

FortiGate traffic logs

Answer

FortiClient local cache

Question 2

A FortiGate administrator has enabled inline blocking for the antivirus profile and configured FortiSandbox as the analysis service. Users report that when they download an unknown executable, the download stalls for several seconds before completing, but the file is eventually allowed. The administrator wants to ensure that potentially malicious files are held until a verdict is received, and if the verdict is malicious, the download is blocked. Which FortiSandbox mode should be configured on the FortiGate to achieve this?

Accepted Answer

Inline mode. Inline mode is the only FortiSandbox submission mode that holds the file transfer until a verdict is returned, enabling real-time blocking of malicious files. The stall observed by users is consistent with inline mode, as FortiGate waits for FortiSandbox to analyze the file. Analytical and monitor modes do not block; quarantine mode is not a valid integration option. Therefore, inline mode is required to meet the administrator's goal.

Answer

Analytical mode

Answer

Monitor mode

Answer

Quarantine mode

Question 3

A FortiGate administrator configures a DNS filter profile with a botnet C&C category set to block. Users report that some known malicious domains still resolve, but only when the DNS server is not the FortiGate. Which FortiGate feature must be enabled to intercept and block those DNS queries?

Accepted Answer

Enable DNS filter on the FortiGate interface and force clients to use the FortiGate as their DNS server.. DNS filtering on FortiGate inspects DNS queries that traverse the FortiGate. If clients use an external DNS server, the FortiGate does not see the queries. Forcing clients to use the FortiGate as their DNS server ensures that all DNS queries are inspected and malicious domains in the botnet C&C category are blocked.

Answer

Enable DNS sinkhole on the FortiGate and configure a DNS translation rule.

Answer

Configure a static route for the DNS server IP address to redirect queries to the FortiGate.

Answer

Enable DNS over TLS inspection on the FortiGate to decrypt DNS queries.

Question 4

A security analyst is reviewing logs from FortiSandbox and notices that a suspicious file was rated as 'Malicious' by the sandbox, but the FortiGate did not block the file download. The analyst confirms that the file was submitted to FortiSandbox and that the verdict was received. Which action should the analyst take to ensure that future malicious files are blocked based on FortiSandbox verdicts?

Accepted Answer

Configure the FortiGate to use the 'Block' action for FortiSandbox verdicts in the antivirus profile.. The correct answer is to configure the FortiGate to use the 'Block' action for FortiSandbox verdicts in the antivirus profile. Even if FortiSandbox returns a malicious verdict, the FortiGate must be explicitly configured to block the file based on that verdict. By default, it may only log. Setting the action to block ensures enforcement. Other options either do not directly enforce blocking or are not scalable.

Answer

Ensure that the FortiGate is licensed for FortiSandbox Cloud and that the service is enabled.

Answer

Enable 'Block Malicious Files' in the antivirus profile used by the firewall policy.

Answer

Add the file's hash to a custom block list in the FortiGate's web filter.

Question 5

An administrator has deployed FortiSandbox and configured a FortiGate to submit suspicious files for analysis. The administrator notices that verdicts are returned only for files that FortiSandbox has already seen before, while brand-new malware samples remain unblocked for hours. Which FortiSandbox configuration should be adjusted to reduce the time before a verdict is available for new samples?

Accepted Answer

Increase the number of 'Clone VMs' and enable 'Adaptive Scanning' in FortiSandbox.. FortiSandbox verdict latency for new samples is primarily a capacity and prioritisation issue. Expanding the clone VM pool increases concurrent analysis slots, while Adaptive Scanning focuses resources on files that have not been seen before. Adjusting FortiGate-side profile options or timeouts does not change the sandbox's internal queue behaviour, so those settings cannot resolve the delay.

Answer

Configure a 'Real-time' file submission priority for unknown files in the FortiSandbox profile.

Answer

Lower the 'File Analysis Timeout' in the FortiSandbox system settings.

Answer

Enable the 'Inline Block' option in the FortiSandbox profile on FortiGate.

Question 6

A security analyst is reviewing logs from a FortiGate that has a firewall policy with an antivirus profile applied. The profile is configured to send files to FortiSandbox for analysis and to block files with a malicious verdict. The analyst notices that some files are being blocked immediately, while others are allowed initially and then blocked after a few minutes. Which mechanism explains this behavior?

Accepted Answer

FortiGate applies a default action to allow the file while waiting for the FortiSandbox verdict, then blocks if malicious.. The observed behavior occurs because FortiGate allows the file to pass initially while it is being analyzed by FortiSandbox. Once the sandbox returns a malicious verdict, FortiGate updates its local cache and blocks subsequent attempts to download or execute the file. The immediate blocks are from known signatures, while the delayed blocks are from sandbox verdicts. This hybrid approach balances user experience with security.

Answer

FortiGate applies a timeout and then blocks all files that have not received a verdict.

Answer

FortiGate uses FortiGuard AI-based inline prevention to block files after a delay.

Answer

FortiGate uses a local cache of previously scanned files to block known malware instantly.

Question 7

A FortiGate administrator wants to stop users from downloading executables that are less than 24 hours old, because such files are frequently used in drive-by attacks. Which FortiGuard service and configuration should be enabled to enforce this?

Accepted Answer

Enable the FortiGuard File Filter profile and create a rule for 'Executable' files with an age threshold of '1 day'.. The requirement is to block recent executables based on file age. FortiGuard File Filter provides reputation and metadata checks, including an age threshold, and can be applied to executable file types. Web filtering categories, antivirus signatures, and anti-spam do not evaluate file age, so they cannot enforce the 24-hour rule.

Answer

Enable FortiGuard Anti-Spam and configure a banned word list for '.exe' attachments.

Answer

Enable FortiGuard Web Filtering and set the category 'Malicious Websites' to block.

Answer

Enable the FortiGuard AntiVirus signature database and set the 'Scan' action to block.

Question 8

A security team is using FortiEDR to protect endpoints. They want to automatically isolate an endpoint from the network when a high-severity threat is detected, but still allow the endpoint to communicate with the FortiEDR management server for remediation. Which FortiEDR feature should they configure?

Accepted Answer

Configure a playbook that triggers network isolation with exceptions for the management server.. FortiEDR playbooks allow automated response actions based on threat severity. Configuring a playbook to isolate the endpoint while allowing communication with the management server achieves automatic isolation with the necessary exception for remediation. Other options either block all traffic, including management, or are not automated FortiEDR features.

Answer

Set the endpoint's network access control to 'Quarantine' in the FortiEDR console.

Answer

Configure a firewall rule on the endpoint to block all traffic except to the management server.

Answer

Enable 'Block all network traffic' in the security policy for the endpoint group.

Question 9

A network administrator is deploying a FortiGate in a small office and wants to protect users from accessing known malicious websites. The administrator wants to use a FortiGuard category-based web filter but also wants to ensure that any URL categorized as 'Malware' is blocked immediately, even if the category is not explicitly listed in the web filter profile. Which configuration should the administrator implement?

Accepted Answer

Enable 'Block malicious websites' in the web filter profile's FortiGuard category settings.. The correct answer is to enable 'Block malicious websites' in the web filter profile's FortiGuard category settings. This ensures that any URL categorized as Malware by FortiGuard is blocked. The FortiGuard service continuously updates categories, so new malicious sites are automatically blocked. Other options are either manual, ineffective, or operate at a different layer.

Answer

Configure a static URL filter to block all URLs containing the string 'malware'.

Answer

Enable DNS filtering and set the action to block for the 'Malware' category.

Answer

Create a web filter profile with a custom category that includes all known malware URLs.

Question 10

A security administrator is configuring FortiGate to submit suspicious files to FortiSandbox. They want to ensure that only files that are not already known to be malicious are submitted, to reduce sandbox load. Which FortiGuard antivirus setting should they enable to achieve this?

Accepted Answer

Enable 'Scan with FortiSandbox' and set 'FortiSandbox Inspection Mode' to 'Unknown Files Only'.. The correct configuration is to enable FortiSandbox scanning and set the inspection mode to 'Unknown Files Only'. This ensures that only files that are not already known to be malicious are submitted to FortiSandbox, reducing load. The other options either submit all files or do not exist as valid settings.

Answer

Enable 'Submit files to FortiSandbox' in the antivirus profile.

Answer

Enable 'Use FortiSandbox for Unknown Files' in the antivirus profile.

Answer

Enable 'Submit files to FortiSandbox' and set 'FortiSandbox Inspection Mode' to 'All Files'.

Question 11

A security analyst is configuring FortiSandbox integration with FortiGate to detect and block zero-day malware. The analyst wants to ensure that files are submitted to FortiSandbox and that verdicts are used to block malicious files. Which two actions are required on the FortiGate to achieve this? (Choose two.)

Accepted Answer

Configure a firewall policy that allows the FortiGate to communicate with the FortiSandbox appliance on the required ports.. To integrate FortiSandbox with FortiGate for file submission and verdict-based blocking, two actions are necessary: enabling FortiSandbox inspection in the antivirus profile and ensuring network connectivity between the FortiGate and the FortiSandbox appliance. These steps allow files to be sent for analysis and verdicts to be received, enabling the FortiGate to block malicious files based on sandbox results.

Answer

Enable SSL inspection on the firewall policy to decrypt files before submitting them to FortiSandbox.

Answer

Configure FortiGate to use FortiSandbox as its DNS server for malicious domain resolution.

Answer

Set the antivirus profile to block files with a FortiSandbox verdict of 'Malicious'.

Question 12

A security administrator is configuring FortiGate to use the external threat feed feature to block malicious IP addresses. The administrator adds a threat feed with the type 'IP Address' and configures it to update every 5 minutes. After applying the configuration, the administrator notices that the threat feed is not blocking any traffic. Which two actions should the administrator take to troubleshoot this issue? (Choose two.)

Accepted Answer

Ensure that a firewall policy references the threat feed as a source or destination object.. For an external threat feed to block traffic, the FortiGate must successfully retrieve the feed from the specified URL and the feed must be referenced in a firewall policy. The most common causes of failure are an unreachable or malformed feed URL and the absence of a policy that uses the threat feed object with a deny action. Verifying both ensures the feed is operational and enforced.

Answer

Configure a DNS server on the FortiGate to resolve the threat feed's domain name.

Answer

Enable FortiGuard Outbreak Prevention and set the action to block.

Answer

Set the threat feed refresh interval to 1 minute to force immediate updates.

Question 13

A security administrator is configuring a FortiGate to use FortiSandbox for advanced malware analysis. The administrator wants to ensure that files are submitted to FortiSandbox and that the results are used to block malicious files. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Enable 'Send Files to FortiSandbox' in the antivirus profile.. The two required actions are to enable 'Send Files to FortiSandbox' in the antivirus profile and to configure the antivirus profile to block files based on FortiSandbox verdicts. These ensure that files are submitted for analysis and that malicious files are blocked upon verdict. Other options, such as SSL inspection and communication policies, are supporting measures but not the core configuration steps for sandbox integration and enforcement.

Answer

Enable 'Use FortiSandbox Cloud' in the antivirus profile.

Answer

Configure a firewall policy to allow the FortiGate to communicate with FortiSandbox.

Answer

Enable SSL inspection on the firewall policy to inspect HTTPS traffic.

Question 14

A security analyst is reviewing FortiGate logs and sees that a user's workstation frequently connects to random-looking domain names that resolve to IP addresses in a known bulletproof hosting range. The analyst suspects DNS tunneling. Which FortiGate feature should be configured to detect and block this activity?

Accepted Answer

FortiGate DNS tunneling detection in the DNS filter profile. DNS tunneling detection within the DNS filter profile inspects DNS query patterns and payload characteristics to identify tunneling attempts. It goes beyond static categorization by using heuristics. The other options either rely on static reputation or do not analyze DNS payload behavior, making them insufficient for detecting the described anomaly.

Answer

FortiGuard DNS Filter

Answer

DNS over TLS inspection

Answer

FortiGate DNS Filter with botnet C&C category

Question 15

A security operations team is using FortiSandbox to analyze suspicious files. They want to reduce the number of files submitted to the sandbox by pre-filtering files that are unlikely to be malicious, while still submitting high-risk files. Which FortiGate setting should they configure to achieve this?

Accepted Answer

Configure the antivirus profile to use 'Monitor' for low-risk files and 'Block' for high-risk files, and enable sandbox submission only for files that are not already detected by antivirus.. To reduce sandbox submissions while still analyzing high-risk files, the administrator should leverage antivirus pre-filtering. Files already detected as malicious or clean by antivirus are not submitted, and only unknown or suspicious files are sent to the sandbox. Combining monitor for low-risk and block for high-risk ensures that high-risk files are still handled appropriately, while the sandbox focuses on the most uncertain files.

Answer

Set the sandbox profile action to 'Monitor' so files are submitted but not blocked.

Answer

Enable 'Scan with FortiSandbox' in the antivirus profile and set the file size threshold to a very low value.

Answer

Enable 'Treat Windows executable files as viruses' to block all executables and avoid sandbox submission.