NSE7 Advanced Threat Protection Practice Test 6 — 15 Questions

Question 1

A security team is deploying FortiSandbox in their network. They want to integrate it with FortiGate to detect and block zero-day malware. The FortiGate is running FortiOS 7.4 and FortiSandbox is configured with a static IP address. Which two actions must the administrator perform on the FortiGate to enable file submission to FortiSandbox? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the FortiSandbox appliance IP address under Security Fabric > Fabric Connectors. To integrate FortiGate with FortiSandbox, the administrator must add the FortiSandbox appliance as a Fabric Connector and enable file submission in the antivirus profile. These two steps establish connectivity and ensure files are sent for analysis. Other options either use incorrect ports or are not relevant to file submission.

Answer

Configure a firewall policy that allows traffic from FortiGate to FortiSandbox on TCP port 514

Answer

Enable 'Use FortiSandbox for Unknown Malware' in the IPS sensor

Answer

Set the FortiSandbox mode to 'Advanced' in the antivirus profile

Question 2

A security administrator is configuring a FortiGate to protect against zero-day attacks using behavior-based detection. They want to enable a feature that analyzes file behavior in a sandbox and automatically creates signatures to block similar future attacks. Which Fortinet feature should they use?

Accepted Answer

FortiSandbox inline blocking with feedback. FortiSandbox inline blocking with feedback allows FortiGate to receive verdicts and automatically generate local signatures to block similar attacks. This provides behavior-based, automated protection against zero-day threats. The other options are related but do not include the automatic signature creation on the FortiGate.

Answer

FortiSandbox Cloud

Answer

FortiGuard AntiVirus signatures

Answer

FortiGuard Advanced Threat Protection (ATP) service

Question 3

A FortiGate administrator has enabled antivirus inspection on the outbound firewall policy that allows internal users to browse the internet. The administrator wants to reduce the performance impact of inspection on a high-throughput link while still detecting large files that may carry malware. Which FortiGate antivirus profile setting should be configured to inspect only a portion of large files?

Accepted Answer

Set the 'Oversize Limit' to a value smaller than the default so that files larger than the limit are only partially scanned.. The Oversize Limit in a FortiGate antivirus profile controls the maximum size of a file that the antivirus engine will scan. When a file exceeds this limit, only the configured portion is inspected and the oversize action is applied. Lowering the limit reduces resource consumption on large files, which is the desired performance optimization while still inspecting part of the file for malware.

Answer

Change the inspection mode to flow-based and enable 'Block Oversized Files'.

Answer

Enable 'Scan with FortiSandbox' and set the inspection mode to proxy-based.

Answer

Enable 'Treat Windows Executables as Virus' in the antivirus profile.

Question 4

A security team is using FortiSandbox to analyze suspicious files. They notice that some files are not being submitted from FortiGate even though the antivirus profile is configured to submit files. The administrator checks the FortiGate and finds that the FortiSandbox appliance is reachable. Which FortiGate CLI command can be used to verify the FortiSandbox configuration and status?

Accepted Answer

diagnose debug application sandbox -1. The correct command to verify FortiSandbox configuration and status on FortiGate is 'diagnose debug application sandbox -1'. This debug command provides real-time logs of the sandbox daemon, including file submission attempts, verdicts, and any errors. It is the most effective tool for troubleshooting why files are not being submitted despite the appliance being reachable.

Answer

diagnose sys fortisandbox connection

Answer

diagnose test application sandbox 1

Answer

get system fortisandbox status

Question 5

An administrator is deploying FortiSandbox in a FortiGate security fabric to detect advanced malware. The administrator wants to ensure that files are submitted to FortiSandbox for analysis and that verdicts are used to block threats. Which two actions are required on FortiGate to enable file submission and verdict enforcement? (Choose two.)

Accepted Answer

Configure a FortiSandbox appliance entry under Security Fabric > Fabric Connectors.. To submit files and enforce verdicts, FortiGate must have the FortiSandbox registered as a fabric connector and the antivirus profile must be configured to send files to the sandbox and applied to a firewall policy. These two actions create the submission path and the enforcement context. Deny policies, inline block, or static routes are either harmful or not required for the core integration.

Answer

Enable 'Inline Block' in the web filter profile to hold files until a sandbox verdict is received.

Answer

Create a firewall address object for the FortiSandbox management IP and add it to a deny policy.

Answer

Configure a static route on FortiGate pointing to the FortiSandbox default gateway.

Question 6

An administrator is configuring a FortiGate to protect against unknown malware using machine learning. The administrator wants to enable the feature that uses a lightweight machine learning model to detect and block malicious files in real-time without sending them to a sandbox. Which antivirus setting should be enabled?

Accepted Answer

Enable 'Machine Learning' in the antivirus profile's advanced settings.. The correct answer is to enable 'Machine Learning' in the antivirus profile's advanced settings. This uses a local model to detect malicious files in real-time without sandboxing. Other options either refer to sandboxing, which is not real-time, or are not actual FortiGate settings. Machine learning provides an additional layer of protection against unknown threats.

Answer

Enable 'Cloud-Based Machine Learning' in the antivirus profile.

Answer

Enable 'AI-based Heuristics' in the antivirus profile.

Answer

Enable 'Sandbox Inspection' in the antivirus profile.

Question 7

A FortiGate is configured to send files to FortiSandbox for analysis. The administrator notices that files are being submitted and verdicts are returned, but the firewall is not blocking the malicious files in real time. The administrator has enabled the sandbox inspection profile and applied it to the firewall policy. Which additional configuration is required to ensure that FortiGate blocks files while waiting for the FortiSandbox verdict?

Accepted Answer

Configure the sandbox profile to use 'Inline' mode instead of 'Analyze' mode.. FortiGate sandbox profiles operate in either Analyze or Inline mode. Analyze mode submits a copy and lets the original file proceed, so blocking can only occur after a verdict is received and the session is still active. Inline mode holds the file until FortiSandbox returns a verdict, which allows real-time blocking of malicious files. The other options affect local antivirus behavior or administrative access, not the submission mode.

Answer

Enable 'Use FortiSandbox database' in the antivirus profile.

Answer

Enable the 'Block malicious files' option in the antivirus profile.

Answer

Add the FortiSandbox IP address to the trusted hosts list on the FortiGate.

Question 8

A security analyst is investigating a breach where an attacker used a previously unseen malware variant. The FortiGate is configured to submit files to FortiSandbox, but the malware evaded detection by sleeping for 10 minutes before executing malicious activities. Which FortiSandbox feature should the analyst enable to improve detection of such evasive malware?

Accepted Answer

Configure the FortiSandbox to use 'Advanced Threat Protection' mode with a longer analysis timeout and enable 'Detect evasive behavior'.. FortiSandbox's Advanced Threat Protection mode includes extended analysis time and behavioral heuristics to detect evasive techniques like long sleep periods. Enabling 'Detect evasive behavior' allows the sandbox to monitor for delayed execution and other stealth tactics. This is crucial for catching advanced malware that attempts to bypass sandbox analysis by remaining dormant.

Answer

Enable 'Scan with all engines' in the FortiSandbox profile to use multiple antivirus engines.

Answer

Use the FortiSandbox API to submit files to a third-party sandbox with longer analysis times.

Answer

Enable 'Real-time protection' on the FortiGate to block files while they are being analyzed.

Question 9

A network security team is deploying FortiSandbox integrated with FortiGate. They want to ensure that files are submitted for analysis and that verdicts are enforced. Which two configurations are required on the FortiGate? (Choose two.)

Accepted Answer

Configure the FortiSandbox appliance IP or cloud service in the Security Fabric settings.. To submit files to FortiSandbox and enforce verdicts, the FortiGate must have a configured FortiSandbox connector in Security Fabric, and the antivirus profile must have FortiSandbox inspection enabled. The connector provides the address and credentials, while the antivirus profile enables submission. Together they allow the FortiGate to send files and act on verdicts.

Answer

Set the action to 'Block' for FortiSandbox in the antivirus profile.

Answer

Enable SSL deep inspection on the firewall policy.

Answer

Enable 'Use FortiSandbox for unknown files' in the antivirus profile.

Question 10

An administrator has configured a FortiGate to submit files to FortiSandbox for analysis. They want to ensure that files are submitted only when they are not already known to be malicious by the FortiGuard antivirus service, to reduce unnecessary sandbox load. Which FortiGate setting should the administrator verify?

Accepted Answer

Configure the antivirus profile to use 'Block' action for known malware and enable 'Submit files to FortiSandbox' with the 'Use FortiGuard antivirus verdict' option.. The 'Use FortiGuard antivirus verdict' option ensures that FortiGate checks its local antivirus database first. If a file is already identified as malware, it is blocked and not sent to FortiSandbox. Only unknown or suspicious files are forwarded, which optimizes sandbox usage while maintaining security. This is the intended configuration for reducing unnecessary sandbox submissions.

Answer

Enable 'Scan with FortiSandbox' in the antivirus profile and set the action to 'monitor'.

Answer

Disable FortiGuard antivirus scanning entirely so that all files are sent to FortiSandbox.

Answer

Set the FortiSandbox submission mode to 'Always' in the antivirus profile.

Question 11

An administrator is configuring a FortiGate to block outbound traffic to known malicious domains using DNS filtering. They want to ensure that even if a user bypasses DNS by using an external DNS server, the FortiGate still blocks the malicious domain. Which FortiGate feature should they enable?

Accepted Answer

DNS filter with 'Block DNS requests for malicious domains' and 'Enforce FortiGuard DNS'. To block malicious domains even when users attempt to bypass DNS, the FortiGate must enforce the use of FortiGuard DNS. The DNS filter feature can redirect all DNS queries to FortiGuard, ensuring that malicious domains are blocked. This combination provides the required protection.

Answer

FortiGuard Category Based Filter with 'Block malicious websites'

Answer

DNS filter with 'Redirect to FortiGuard' enabled

Answer

DNS over TLS inspection

Question 12

A security engineer is configuring FortiSandbox to analyze suspicious files. The engineer wants to ensure that files are automatically submitted from FortiGate to FortiSandbox for analysis. Which FortiGate configuration is required to enable automatic file submission?

Accepted Answer

Enable 'Send Files to FortiSandbox' in the antivirus profile.. Automatic file submission to FortiSandbox is enabled within the antivirus profile by turning on 'Send Files to FortiSandbox'. This setting, combined with a properly configured FortiSandbox connector, ensures files are sent for analysis. Other options like file filter, web filter, or just the connector do not trigger submission on their own.

Answer

Enable 'FortiSandbox' in the web filter profile.

Answer

Configure a FortiSandbox connector in Security Fabric > Fabric Connectors.

Answer

Configure a firewall policy with a security profile that includes 'File Filter' with sandbox submission.

Question 13

A security team is deploying FortiSandbox in their network. They want to integrate it with FortiGate to detect and block zero-day malware. The FortiGate is running FortiOS 7.4 and FortiSandbox is configured with a static IP address. Which two actions must the administrator perform on the FortiGate to enable file submission to FortiSandbox? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Register each FortiGate as a client on FortiSandbox and configure the sandbox profile on each FortiGate with the FortiSandbox IP address.. To integrate FortiGate with FortiSandbox, each FortiGate must be registered as a client and configured with the FortiSandbox address in its sandbox profile. Additionally, FortiSandbox must be set to share verdicts with clients so that a file analyzed once is blocked across all integrated FortiGates. FortiSandbox Cloud, endpoint agents, and the antivirus database option do not fulfill these requirements.

Answer

Enable 'Use FortiSandbox database' in the antivirus profile on each FortiGate to receive verdicts.

Answer

Install a FortiSandbox agent on each endpoint to submit files directly to FortiSandbox.

Answer

Enable 'FortiSandbox Cloud' on each FortiGate to synchronize verdicts globally.

Question 14

A security operations team is using FortiGate with FortiSandbox to detect and block advanced malware. They want to ensure that files are submitted to FortiSandbox for analysis and that the results are used to block threats. Which two configuration steps are required on the FortiGate to achieve this? (Choose two.)

Accepted Answer

Configure the FortiSandbox fabric connector with the sandbox's IP address and enable 'Submit files to FortiSandbox' in the antivirus profile.. To integrate FortiGate with FortiSandbox for file submission and blocking, you must configure the FortiSandbox fabric connector and enable file submission in the antivirus profile. Additionally, enabling 'Block malicious files' ensures that verdicts are enforced. These steps together allow the FortiGate to send files, receive verdicts, and block malicious content automatically.

Answer

Set the action to 'Monitor' for all antivirus protocols to ensure files are not blocked prematurely.

Answer

Enable 'Use FortiSandbox for unknown files' in the web filter profile.

Answer

Configure a firewall policy to allow traffic from the FortiGate to the FortiSandbox on TCP port 514.

Question 15

A FortiGate administrator is configuring an antivirus profile to protect against unknown malware. The administrator wants to use machine learning to detect and block malicious files without relying on signatures. Which FortiGate antivirus scanning option should be enabled?

Accepted Answer

Enable 'Machine Learning' in the antivirus profile to use FortiGuard's AI-based detection.. FortiGate's antivirus profile includes a 'Machine Learning' option that leverages AI models to detect unknown malware. This feature analyzes file behavior and characteristics to identify threats without signatures, providing protection against zero-day attacks. Enabling it is the correct way to use ML-based detection on the FortiGate.

Answer

Enable 'Cloud Scan' to leverage FortiGuard's cloud-based signature database.

Answer

Enable 'Heuristic Scan' to detect malware based on code behavior.

Answer

Enable 'Scan with FortiSandbox' to submit files for dynamic analysis.