NSE7 Advanced Threat Protection Practice Test 6 — 15 Questions

Question 1

An administrator wants to prevent users from downloading known malicious files from the internet. The administrator has enabled FortiGuard Outbreak Prevention and applied an antivirus profile to the outbound policy. However, some malicious files are still reaching users. What configuration step is most likely missing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The antivirus profile does not have 'FortiGuard Outbreak Prevention' enabled. FortiGuard Outbreak Prevention is a separate toggle within the antivirus profile that must be explicitly enabled to leverage real-time outbreak intelligence. Even if the administrator believes they have enabled it, the profile may have the feature disabled by default or inadvertently left off, allowing known malicious files to bypass detection. Without this toggle, the antivirus engine relies only on static signatures and cannot block files flagged by FortiGuard's outbreak database.

Answer

The antivirus profile has 'FortiGuard Outbreak Prevention' enabled

Answer

The FortiGuard subscription has expired

Answer

The security policy is not configured for proxy-based inspection

Question 2

A security analyst is investigating a phishing email that bypassed email security. The email's headers show SPF=pass, DKIM=pass, but DMARC=quarantine. The email was delivered to the inbox. What is the most likely reason DMARC did not block or quarantine the email?

Accepted Answer

The SPF and DKIM alignment checks passed, so DMARC treated the email as authentic. DMARC uses SPF and DKIM alignment to determine authenticity. When both SPF and DKIM pass and are aligned (i.e., the domain in the From header matches the domain used in SPF/DKIM), DMARC considers the email authentic and applies the policy accordingly. In this case, the DMARC policy was set to 'quarantine', but because alignment checks passed, DMARC treated the email as legitimate and allowed delivery to the inbox, rather than quarantining it.

Answer

The email was sent from a subdomain not covered by DMARC

Answer

The DMARC record had a pct (percentage) of less than 100

Answer

The DMARC policy was set to 'none'

Question 3

What is the primary function of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus profile?

Accepted Answer

To remove active content and rebuild files to eliminate hidden threats. Content Disarm and Reconstruction (CDR) works by stripping active content (e.g., macros, scripts, OLE objects) from incoming files and rebuilding them into a safe, sanitized version. This eliminates hidden threats such as embedded exploits or malicious code that signature-based detection might miss, providing protection against zero-day and unknown attacks. Option D correctly identifies this core function of removing active content and rebuilding files to neutralize threats.

Answer

To detect and block zero-day malware using machine learning

Answer

To reconstruct files that were corrupted during transmission

Answer

To compress files for faster scanning

Question 4

An administrator wants to create an automation stitch that automatically blocks an IP address when a high-severity IPS alert is triggered. The administrator creates a trigger for 'IPS event' and an action of 'Add to Blocked IPs'. However, the action fails to execute. Which of the following is the most likely cause?

Accepted Answer

The admin account used to configure the stitch does not have permission to modify the blocked IP list. The admin account used to configure the automation stitch must have the necessary permissions to modify the blocked IP list. In FortiOS, the automation stitch action 'Add to Blocked IPs' requires write access to the firewall address object or the blocked IP list. If the admin account has read-only or restricted privileges, the action will fail silently, even if the trigger and action are correctly configured.

Answer

The automation stitch is set to execute every 5 minutes, not immediately

Answer

The blocked IP list has reached its maximum size

Answer

The IPS event trigger does not support IP address extraction

Question 5

A FortiGate administrator notices that traffic classified as 'unknown' by the antivirus is being allowed. The administrator wants to ensure that such files are submitted to FortiSandbox for analysis and blocked until a verdict is received. Which configuration is required?

Accepted Answer

Enable FortiSandbox in the antivirus profile and set 'Action for unknown files' to 'Block'. When FortiSandbox is enabled in the antivirus profile and 'Action for unknown files' is set to 'Block', the FortiGate will submit files that cannot be identified by the local antivirus engine to FortiSandbox for analysis. While the file is being analyzed, it is blocked from reaching the client, ensuring that no potentially malicious content is delivered until a verdict (clean or malicious) is received. This directly addresses the administrator's requirement to block unknown files pending sandbox analysis.

Answer

Create a custom IPS signature for unknown files

Answer

Enable outbreak prevention in the antivirus profile

Answer

Enable FortiSandbox in the antivirus profile and set 'Action for known files' to 'Block'

Question 6

A company uses FortiGate as a web application firewall (WAF) to protect a public web server. The security team wants to block SQL injection attacks. Which WAF signature category should the administrator enable?

Accepted Answer

SQL Injection. SQL injection attacks specifically target database queries by injecting malicious SQL statements through input fields. FortiGate's WAF signature category for SQL Injection is designed to detect and block these patterns, such as 'OR 1=1' or UNION-based injections, by matching against known attack signatures in the HTTP request payload.

Answer

Server-Side Request Forgery

Answer

Command Injection

Answer

Cross-Site Scripting

Question 7

What is the purpose of FortiDeceptor in an enterprise security architecture?

Accepted Answer

To simulate real assets and detect attackers attempting to interact with decoys. FortiDeceptor is a deception-based threat detection solution that deploys decoys (simulated real assets like servers, databases, or IoT devices) across the network. When an attacker probes or interacts with these decoys, FortiDeceptor generates high-fidelity alerts, enabling early detection of lateral movement or reconnaissance without relying on signatures. This aligns with the Advanced Threat Protection domain by shifting from reactive blocking to proactive deception.

Answer

To provide VPN access for remote users

Answer

To encrypt all data at rest on endpoints

Answer

To block all inbound traffic from suspicious IP addresses

Question 8

An administrator wants to use FortiGate to automatically block traffic if FortiEDR detects a threat on an endpoint. Which feature should the administrator configure?

Accepted Answer

Create an automation stitch with a trigger from FortiEDR and an action to block the source IP. FortiGate integrates with FortiEDR via automation stitches, which allow events from FortiEDR (such as a detected threat) to trigger automated actions on FortiGate, such as blocking the source IP of the compromised endpoint. This provides real-time, policy-driven threat response without manual intervention, leveraging the Fortinet Security Fabric. Option A is incorrect because a VPN tunnel is not required; FortiEDR and FortiGate communicate via APIs. Option B is incorrect because FortiGuard Outbreak Prevention is a separate service that provides threat intelligence, not direct endpoint detection integration. Option C is incorrect because a static route is unnecessary for the API-based communication.

Answer

Configure a VPN tunnel between FortiGate and FortiEDR

Answer

Enable FortiGuard Outbreak Prevention on the antivirus profile

Answer

Configure a static route to the FortiEDR management IP

Question 9

A FortiGate administrator receives a report that a user downloaded a malicious PDF file. The antivirus profile has machine learning engine enabled, CDR enabled, and FortiSandbox integration. However, the file was allowed. The log shows: 'file=malicious.pdf, action=allow, ml_score=85, cd_result=clean, sandbox=not_submitted'. What is the most likely reason the file was not submitted to FortiSandbox?

Accepted Answer

The file size exceeded the maximum file size for FortiSandbox submission. The log shows 'sandbox=not_submitted', which directly indicates the file was never sent to FortiSandbox. FortiGate has a configurable maximum file size limit for sandbox submission (default 10 MB). If the PDF exceeds this limit, the file is allowed without sandbox inspection, even if other engines like ML or CDR are enabled. The ml_score of 85 indicates a high malicious probability, but the sandbox submission was skipped due to size constraints.

Answer

CDR reconstructed the file, making it appear clean

Answer

The machine learning engine scored the file as clean (score below threshold)

Answer

The file was excluded by a file type filter in the antivirus profile

Question 10

What is the primary benefit of using FortiClient with ATP features in conjunction with FortiGate?

Accepted Answer

It enables endpoint detection and response with automated quarantine through FortiGate. FortiClient with ATP (Advanced Threat Protection) features, such as Antivirus, Web Filtering, and Vulnerability Scan, integrates with FortiGate via the FortiTelemetry protocol. This integration enables endpoint detection and response (EDR) capabilities, allowing FortiGate to automatically quarantine compromised endpoints based on telemetry and threat intelligence from FortiClient, thereby containing threats at the network edge.

Answer

It allows users to bypass security policies

Answer

It replaces the need for a firewall

Answer

It provides a single sign-on portal for all users

Question 11

An administrator needs to create a custom IPS signature to detect a specific exploit that sends a unique string 'EXPLOIT_2024' in the HTTP User-Agent header. Which IPS signature syntax should the administrator use?

Accepted Answer

F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "User-Agent: EXPLOIT_2024"; --service HTTP;). It uses the `--pattern` to match the exact string 'User-Agent: EXPLOIT_2024' within the HTTP header context, and `--service HTTP` ensures the signature only inspects HTTP traffic. This syntax precisely detects the exploit string in the User-Agent header as required.

Answer

F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "EXPLOIT_2024"; --context http-header;)

Answer

F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "User-Agent: EXPLOIT"; --service HTTP;)

Answer

F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "EXPLOIT_2024"; --service HTTP;)

Question 12

A company receives a threat intelligence feed that lists several IP addresses as malicious. The administrator wants to automatically block traffic from these IPs on FortiGate. Which TWO methods can achieve this? (Choose two.)

Accepted Answer

Configure an external connector to a threat intelligence feed and map it to an address object. FortiGate's external connector can ingest a threat intelligence feed (e.g., STIX/TAXII or CSV) and dynamically map it to an address object. This allows the firewall to automatically update its policy enforcement based on the feed without manual intervention. Option C is correct because an automation stitch can use a trigger (e.g., receiving a feed via webhook or script) and an action to update blocked IPs via the FortiOS API or CLI, providing real-time blocking.

Answer

Enable FortiGuard Outbreak Prevention

Answer

Configure a firewall policy to deny all traffic from unknown sources

Answer

Create an address group and add the IPs manually

Question 13

A security team is configuring FortiMail for email security. They want to ensure that incoming emails are authenticated using SPF, DKIM, and DMARC, and that emails failing authentication are quarantined. Which THREE settings must be configured in FortiMail? (Choose three.)

Accepted Answer

Enable DKIM verification in the anti-spam policy. DKIM verification must be explicitly enabled in the anti-spam policy to allow FortiMail to validate the DKIM signature on incoming emails. Without this setting, DKIM authentication is not performed, and the email's DKIM status will not be evaluated.

Answer

Enable TLS encryption for incoming SMTP

Answer

Configure a recipient verification policy

Question 14

An administrator is troubleshooting why a custom IPS signature for protocol anomaly detection is not triggering. The signature is designed to detect abnormal DNS query lengths. Which TWO steps should the administrator take to verify the signature is working? (Choose two.)

Accepted Answer

Verify that the IPS sensor containing the signature is applied to the correct firewall policy. An IPS sensor must be explicitly applied to a firewall policy for the signatures it contains to be evaluated against traffic passing through that policy. Without this binding, the custom signature for DNS protocol anomaly detection will never be inspected, regardless of its configuration or the traffic type.

Answer

Reboot the FortiGate to reset the IPS engine

Answer

Disable the firewall policy to see if the signature triggers

Answer

Increase the signature's severity to see it in logs

Question 15

A network admin notices that files submitted to FortiSandbox from FortiGate are not being analyzed. The FortiGate has a valid FortiSandbox license and the device is reachable. What configuration step is most likely missing?

Accepted Answer

The antivirus profile has 'FortiSandbox Inline Scan' disabled. FortiGate uses antivirus profiles to define scanning behavior for traffic. Even with a valid FortiSandbox license and reachability, the antivirus profile must have 'FortiSandbox Inline Scan' enabled to submit files to FortiSandbox for analysis. Without this setting, files are not forwarded for sandboxing, regardless of other configurations.

Answer

The FortiSandbox feature is not enabled in the VDOM settings

Answer

The FortiSandbox server IP is not configured under Security Fabric > Fabric Connectors

Answer

The FortiGate is not registered with FortiCloud