NSE7 Advanced Threat Protection Practice Test 5 — 15 Questions

Question 1

An administrator configures FortiSandbox inline scanning for HTTP traffic. They notice that files uploaded via HTTP are being scanned but no verdict is being returned, causing delays. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file scan timeout is too short, causing FortiGate to pass the file before a verdict is received. When FortiGate sends a file to FortiSandbox for inline scanning, it waits for a verdict before allowing the traffic to proceed. If the file scan timeout is too short, FortiGate will stop waiting for the verdict and pass the file anyway, causing the observed delay without a final verdict. This is the most likely cause because the administrator sees scanning occurring but no verdict returned, which aligns with a premature timeout rather than a failure to scan.

Answer

The FortiSandbox has reached its maximum storage capacity

Answer

The FortiSandbox is not registered with the FortiGate

Answer

The file type is not supported by FortiSandbox

Question 2

A network administrator wants to block known malicious IP addresses using threat intelligence feeds on FortiGate. Which feature should they use?

Accepted Answer

External Threat Intelligence. FortiGate's External Threat Intelligence feature allows administrators to import and consume threat intelligence feeds (e.g., STIX/TAXII, CSV, or custom URLs) to block known malicious IP addresses. This is the correct feature because it is specifically designed to ingest external threat data and apply it to firewall policies for dynamic blocking, unlike the other options which serve different purposes.

Answer

FortiGuard Web Filtering

Answer

Application Control

Answer

IP Reputation

Question 3

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP connection that has been active for 3600 seconds and will expire in 3599 seconds. The output shows 'proto=6' which indicates TCP (protocol 6), 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds. The 'proto_state=01' is a TCP state code indicating an established connection. This is a standard FortiGate diagnostic session output.

Answer

The session is a UDP DNS request

Answer

The session is being blocked by a firewall policy

Answer

The session is an SSL VPN tunnel

Question 4

A company is deploying FortiClient ATP to protect endpoints. They want to block ransomware behavior in real time. Which FortiClient feature should be enabled?

Accepted Answer

Real-Time Protection. Real-Time Protection is the FortiClient feature that uses behavioral analysis and machine learning to detect and block ransomware-like activities, such as mass file encryption or unauthorized file modifications, as they occur. This feature monitors process behavior in real time, leveraging FortiSandbox threat intelligence and local heuristics to stop ransomware before it can cause damage.

Answer

Vulnerability Scan

Answer

Web Filtering

Answer

Application Firewall

Question 5

An administrator configures FortiSandbox to quarantine files that are rated 'malicious'. They notice that some files are being quarantined even though the verdict is 'clean'. What could explain this?

Accepted Answer

The quarantine action is set to apply to files with a risk level above a certain threshold, and clean files have been incorrectly rated. FortiSandbox's quarantine action can be configured based on a risk score threshold, not solely on the verdict. If the risk score for a file rated 'clean' exceeds the configured threshold, the file may still be quarantined. This occurs because the verdict and risk score are separate attributes; a 'clean' verdict indicates no known malware, but the file's behavior or heuristics may still generate a high risk score that triggers quarantine.

Answer

FortiSandbox uses a whitelist that includes those files

Answer

The files were submitted by a different FortiGate with different settings

Answer

The administrator has enabled 'aggressive mode' which quarantines all files

Question 6

Which FortiGate feature can automatically block traffic from an IP address that is detected as malicious by FortiSandbox?

Accepted Answer

Automation Stitch. Automation Stitch in FortiOS allows you to create a trigger-action pair that automatically blocks an IP address when FortiSandbox detects malicious activity. The trigger can be a FortiSandbox IOC (Indicator of Compromise) event, and the action can be an IP block via a local or external block list, enabling real-time, automated threat response without manual intervention.

Answer

Traffic Shaping

Answer

Intrusion Prevention System (IPS)

Answer

Application Control

Question 7

A FortiGate administrator configures an antivirus profile with Machine Learning (ML) engine enabled. The ML engine is not detecting any threats, even though new unknown malware is present. What is the MOST likely reason?

Accepted Answer

The FortiGuard antivirus subscription is expired, preventing ML model updates. The FortiGate ML engine relies on FortiGuard for model updates that enable it to detect new and unknown malware. If the FortiGuard antivirus subscription is expired, the ML engine cannot receive these updates, rendering it unable to identify novel threats. This is the most likely reason the ML engine is not detecting any threats despite the presence of new unknown malware.

Answer

The ML engine requires a separate subscription

Answer

The ML engine is only for outbreak prevention

Answer

The antivirus profile is set to flow-based inspection

Question 8

An organization wants to prevent zero-day attacks by using Content Disarm and Reconstruction (CDR) on email attachments. Which Fortinet product provides this capability?

Accepted Answer

FortiMail. FortiMail is the correct answer because it natively integrates Content Disarm and Reconstruction (CDR) to sanitize email attachments by removing active content (e.g., macros, scripts, embedded objects) and rebuilding the file in a safe format. This prevents zero-day exploits that bypass signature-based detection, as CDR does not rely on threat intelligence but instead strips potentially malicious elements before delivery.

Answer

FortiWeb

Answer

FortiGate

Answer

FortiSandbox

Question 9

An administrator configures a WAF profile on FortiGate to protect a web application. They notice that SQL injection attacks are not being blocked. What is the MOST likely reason?

Accepted Answer

The FortiGuard Web Filtering subscription is inactive. The FortiGuard Web Filtering subscription provides the signature database required to detect and block SQL injection attacks within a WAF profile. Without an active subscription, the WAF profile cannot update or use the latest attack signatures, rendering it unable to identify SQL injection patterns even if the profile is enabled and applied correctly.

Answer

The web application uses HTTPS without SSL inspection

Answer

The WAF profile is set to monitor mode

Answer

The WAF profile is applied to the wrong firewall policy

Question 10

An administrator wants to detect lateral movement and early stages of an attack using decoy systems that mimic production assets. Which Fortinet product should they deploy?

Accepted Answer

FortiDeceptor. FortiDeceptor is specifically designed to detect lateral movement and early-stage attacks by deploying decoy systems (honeypots) that mimic production assets. It uses deception technology to lure attackers away from real targets and trigger alerts when decoys are probed or compromised, enabling early threat detection without impacting production systems.

Answer

FortiSIEM

Answer

FortiEDR

Answer

FortiNDR

Question 11

Which Fortinet product provides endpoint detection and response (EDR) capabilities, including automated threat containment?

Accepted Answer

FortiEDR. FortiEDR is the correct answer because it is Fortinet's dedicated endpoint detection and response solution that provides real-time behavioral analysis, automated threat containment, and forensic investigation capabilities. Unlike traditional antivirus, FortiEDR uses machine learning and pre-execution analysis to detect and block advanced threats, and it can automatically isolate compromised endpoints from the network to prevent lateral movement.

Answer

FortiClient

Answer

FortiSandbox

Answer

FortiGuard

Question 12

An administrator configures email authentication (SPF, DKIM, DMARC) on FortiMail. They find that legitimate emails are being marked as spam by FortiMail. The SPF check passes but DKIM fails. What could be the issue?

Accepted Answer

The email was forwarded by an intermediary that strips the DKIM signature. When an email is forwarded by an intermediary (e.g., a mailing list or forwarding service), the intermediary often modifies the message headers or body, which invalidates the DKIM signature. Since DKIM relies on a cryptographic hash of the original message content and selected headers, any alteration—even by a legitimate forwarder—causes the signature verification to fail. The SPF check passes because the forwarding server may be authorized in the SPF record, but DKIM failure triggers spam classification if the DMARC policy is not aligned.

Answer

The SPF record is too strict

Answer

FortiMail has a bug in the DKIM verification module

Answer

The DMARC policy is set to reject

Question 13

An administrator needs to enable automation stitches to automatically block a malicious IP address detected by FortiSandbox. Which two components are required? (Choose two.)

Accepted Answer

A trigger that detects the FortiSandbox verdict. Automation stitches require a trigger to initiate the workflow. In this scenario, the trigger must detect the FortiSandbox verdict (e.g., malicious or clean) to start the automated response. Without a trigger, the stitch has no event to react to, making it non-functional.

Answer

A static route to the malicious IP

Answer

An SSL certificate for the FortiGate

Answer

A firewall policy that allows the traffic

Question 14

An administrator is configuring FortiMail to improve email security. Which three of the following features are part of FortiMail's advanced threat protection? (Choose three.)

Accepted Answer

Email Authentication (SPF, DKIM, DMARC). Email Authentication (SPF, DKIM, DMARC) is part of FortiMail's advanced threat protection because it verifies sender identity and prevents email spoofing and phishing. SPF checks the sending server's IP against authorized records, DKIM uses cryptographic signatures to ensure message integrity, and DMARC provides policy enforcement for alignment. These mechanisms collectively reduce the risk of domain impersonation and are integral to FortiMail's anti-phishing capabilities.

Answer

Web Filtering

Answer

Application Control

Question 15

A FortiGate administrator wants to detect and block protocol anomalies as part of advanced IPS. Which three options are available in FortiGate's custom IPS signatures? (Choose three.)

Accepted Answer

Protocol-specific fields. Custom IPS signatures in FortiGate allow matching on protocol-specific fields such as TCP flags, ICMP type/code, or DNS query types. This enables detection of anomalies like invalid flag combinations or malformed protocol headers, which is a core part of advanced IPS.

Answer

Application signatures

Answer

URL filtering