NSE7 Advanced Threat Protection Practice Test 7 — 15 Questions

Question 1

An organization wants to prevent users from downloading malicious files from the internet. Which FortiGate security profile should be applied to the outbound firewall policy to block files based on their hash if they have been identified as malicious by FortiSandbox?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Antivirus profile. The Antivirus profile is the correct choice because it integrates with FortiSandbox to block files based on their hash when identified as malicious. FortiGate's antivirus engine can submit files to FortiSandbox for analysis, and if the file's hash matches a known malicious signature, the antivirus profile will block the download. This is specifically designed for file-based threat detection at the application layer, unlike other profiles that focus on different security functions.

Answer

Application Control profile

Answer

IPS profile

Answer

Web Filter profile

Question 2

A FortiGate admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session has been active for 1 hour and will expire in about 1 hour. The output shows 'duration=3600' and 'expire=3599', meaning the session has been active for 3600 seconds (1 hour) and has approximately 3599 seconds remaining before it times out. The 'proto=6' indicates TCP (protocol 6), and 'proto_state=01' is the TCP state (typically ESTABLISHED). The session is healthy and will expire in about 1 hour, confirming C.

Answer

The session is a UDP session that has been idle for 1 hour

Answer

The session has a problem because duration and expire are not equal

Answer

The session is a short-lived connection that started 3600 seconds ago

Question 3

A security admin notices that FortiClient ATP is not blocking threats on a managed endpoint. The FortiClient is registered with FortiGate and the ATP feature is enabled in the FortiClient profile. What is the most likely cause?

Accepted Answer

The FortiGate antivirus profile applied to the FortiClient policy has 'Scan on Access' disabled. FortiClient ATP (AntiVirus/AntiMalware) relies on the FortiGate's antivirus profile to enforce real-time scanning. Even if the ATP feature is enabled in the FortiClient profile, the 'Scan on Access' setting in the FortiGate antivirus profile applied to the FortiClient policy must be enabled for the endpoint to block threats on access. If 'Scan on Access' is disabled, FortiClient will not perform real-time scanning, allowing threats to go undetected despite ATP being enabled.

Answer

The FortiGate's antivirus signatures are outdated

Answer

The FortiClient endpoint has a different antivirus product installed that conflicts

Answer

FortiClient is in standalone mode instead of managed mode

Question 4

An organization wants to protect against zero-day malware by using FortiGate's outbreak prevention feature. Which configuration is required to enable outbreak prevention in the antivirus profile?

Accepted Answer

Select 'Outbreak Prevention' under Antivirus profile settings. FortiGate's outbreak prevention feature is specifically enabled within the antivirus profile by selecting the 'Outbreak Prevention' option. This setting leverages FortiGuard's outbreak alert database to block files that match known outbreak signatures, providing protection against zero-day malware before traditional signatures are available.

Answer

Enable 'Machine Learning Engine' in the antivirus profile

Answer

Enable 'FortiSandbox Inline Scan'

Answer

Configure a web filter profile to block malicious URLs

Question 5

An admin configures Content Disarm and Reconstruction (CDR) on FortiGate to protect against malicious macros in Office documents. After applying the CDR profile to a firewall policy, users complain that documents are not being delivered. What is the most likely cause?

Accepted Answer

The firewall policy is configured for flow-based inspection. CDR requires proxy-based inspection to intercept, disarm, and reconstruct documents. Flow-based inspection bypasses the deep inspection engine, so CDR cannot process the files, causing delivery failures. FortiGate must use proxy-based inspection mode for CDR to function correctly.

Answer

The CDR profile has 'File Filter' enabled that blocks the file type

Answer

The FortiGate is running in transparent mode

Answer

The antivirus profile is not applied to the same policy

Question 6

Which FortiGate IPS feature allows administrators to create rules that detect network traffic patterns deviating from normal protocol behavior?

Accepted Answer

Protocol anomaly. Protocol anomaly detection in FortiGate IPS allows administrators to define rules that identify deviations from standard protocol behavior as defined by RFCs. Unlike signature-based detection, which matches known attack patterns, protocol anomaly detection flags traffic that violates expected protocol structures, such as malformed packets or illegal flag combinations. This enables the detection of zero-day exploits and protocol abuse without requiring a pre-existing signature.

Answer

Rate-based signatures

Answer

Custom signatures

Answer

Geo-IP blocking

Question 7

An admin wants to create a custom IPS signature to detect a specific exploit that sends a string 'EXPLOIT' in the HTTP Host header. Which signature syntax is correct?

Accepted Answer

F-SBID( --name "HTTP_EXPLOIT" --protocol http --header Host --content "EXPLOIT" ). The FortiGate custom IPS signature syntax requires the `--protocol http` flag to specify the application-layer protocol for HTTP inspection, and `--header Host` to target the HTTP Host header field. The `--content` parameter then defines the string 'EXPLOIT' to match within that header, enabling precise detection of the exploit.

Answer

F-SBID( --name "HTTP_EXPLOIT" --protocol http --header Host --content "EXPLOIT" )

Answer

F-SBID( --name "HTTP_EXPLOIT" --service HTTP --header Host --content "EXPLOIT" )

Answer

F-SBID( --name "HTTP_EXPLOIT" --protocol tcp --header Host --content "EXPLOIT" )

Question 8

A company uses FortiWeb to protect its web application. They want to block SQL injection attempts. Which FortiWeb feature should be configured to inspect HTTP requests for malicious SQL patterns?

Accepted Answer

Web Application Firewall (WAF) Signatures. FortiWeb's WAF Signatures (option B) are specifically designed to inspect HTTP request payloads for known attack patterns, including SQL injection signatures. This feature uses a regularly updated signature database to match malicious SQL syntax (e.g., UNION, OR 1=1) within GET/POST parameters, cookies, or headers, making it the correct choice for blocking SQL injection attempts.

Answer

URL Access Rule

Answer

HTTP Protocol Constraint

Answer

IP List

Question 9

An organization uses FortiGate's WAF feature (not FortiWeb) to protect a web server. The admin configures an inline WAF profile but notices that the WAF is not inspecting traffic. What is the most likely cause?

Accepted Answer

SSL Inspection is not enabled on the firewall policy. FortiGate's WAF feature operates at the application layer and requires SSL Inspection to decrypt HTTPS traffic before the WAF engine can analyze the payload. Without SSL Inspection enabled on the firewall policy, the WAF profile sees only encrypted traffic and cannot inspect HTTP/HTTPS content, effectively rendering the WAF non-functional for encrypted sessions.

Answer

The WAF profile is not applied to a firewall policy

Answer

The firewall policy uses flow-based inspection

Answer

The WAF profile is configured in monitor mode

Question 10

What does FortiGuard Outbreak Prevention use to protect against newly discovered malware outbreaks before traditional signatures are available?

Accepted Answer

Outbreak signatures and hash-based blocking. FortiGuard Outbreak Prevention uses outbreak signatures and hash-based blocking to provide rapid protection against newly discovered malware outbreaks before traditional signatures are available. Outbreak signatures are lightweight, pattern-based detections that can be deployed quickly, while hash-based blocking allows immediate blocking of known malicious file hashes, even when full signature analysis is not yet complete.

Answer

IP reputation and URL filtering

Answer

Heuristic analysis and emulation

Answer

Artificial intelligence and behavior analysis

Question 11

An admin receives an email from FortiMail regarding a message that was rejected due to SPF failure. What does this indicate about the email?

Accepted Answer

The email's From address domain does not match the sending server's IP per the domain's SPF record. SPF (Sender Policy Framework) validation checks whether the sending mail server's IP address is authorized to send mail for the domain in the envelope 'From' (RFC 5321.MailFrom) or the header 'From' address. When FortiMail rejects a message due to SPF failure, it means the IP of the connecting server does not match any of the authorized IPs listed in the domain's SPF TXT record (as defined in RFC 7208). This is a direct authentication failure, not a content-based or signature-based issue.

Answer

The email's DKIM signature is invalid

Answer

The email contains a virus

Answer

The email is missing a Message-ID header

Question 12

A security analyst wants to use automation stitches on FortiGate to automatically block IP addresses that trigger an IPS signature for 'SSH Brute Force'. Which two components are required to create this automation stitch? (Choose two.)

Accepted Answer

Action: 'Add to Block List'. The 'Add to Block List' action is the specific automation stitch action that dynamically adds the offending IP address to the FortiGate's local block list, effectively blocking further SSH brute-force attempts. This action directly enforces the security policy by preventing the source IP from accessing the firewall until the block expires or is manually removed.

Answer

FortiAnalyzer log query

Answer

Action: 'Email Notification'

Answer

FortiGuard category

Question 13

An organization wants to implement multiple layers of defense against advanced persistent threats. Which three Fortinet solutions would be most effective in an ATP strategy? (Choose three.)

Accepted Answer

FortiSandbox. FortiSandbox is correct because it provides dynamic analysis of suspicious files and URLs in a controlled, isolated environment, detecting zero-day and advanced malware that signature-based solutions miss. It integrates with other Fortinet security products to share threat intelligence and automate blocking, forming a critical layer in an ATP strategy by catching threats that evade initial defenses.

Answer

FortiMail

Answer

FortiWeb

Question 14

A network admin is troubleshooting why FortiGate's antivirus is not detecting a known malware sample. The sample is detected by other scanners. Which two checks should the admin perform? (Choose two.)

Accepted Answer

Verify that the FortiGuard Antivirus subscription is active. FortiGate's antivirus engine relies on a valid FortiGuard Antivirus subscription to download and update the virus signature database. If the subscription has expired, the engine cannot receive new signatures, causing it to miss recently discovered malware samples that other scanners with active subscriptions detect.

Answer

Check that the file is not excluded by a file filter

Answer

Ensure the firewall policy is configured for proxy-based inspection

Answer

Confirm that the antivirus profile has 'Scan on Delivery' enabled

Question 15

An administrator wants to block a zero-day malware outbreak detected by FortiGuard. Which feature should be configured to automatically block the threat across all enabled FortiGate devices?

Accepted Answer

FortiGuard Outbreak Prevention. FortiGuard Outbreak Prevention (option C) is the correct feature because it automatically pushes signatures to all FortiGate devices enrolled in the same FortiGuard network when a new zero-day malware outbreak is detected. This enables immediate, coordinated blocking without manual intervention, which is exactly what the administrator needs for a fast-spreading threat.

Answer

FortiSandbox Cloud

Answer

IPS Custom Signatures

Answer

Application Control