NSE7 Advanced Threat Protection Practice Test 7 — 15 Questions

Question 1

A security admin notices that FortiClient ATP is not blocking threats on a managed endpoint. The FortiClient is registered with FortiGate and the ATP feature is enabled in the FortiClient profile. What is the most likely cause?

Accepted Answer

The FortiGate antivirus profile applied to the FortiClient policy has 'Scan on Access' disabled. FortiClient ATP uses the FortiGate's antivirus engine to scan files locally. If the endpoint's antivirus profile on FortiGate does not include 'Scan on Access', FortiClient ATP may not intercept file access events.

Answer

The FortiGate's antivirus signatures are outdated

Answer

The FortiClient endpoint has a different antivirus product installed that conflicts

Answer

FortiClient is in standalone mode instead of managed mode

Question 2

An organization wants to protect against zero-day malware by using FortiGate's outbreak prevention feature. Which configuration is required to enable outbreak prevention in the antivirus profile?

Accepted Answer

Select 'Outbreak Prevention' under Antivirus profile settings. Outbreak prevention uses FortiGuard's outbreak alert database to block files that match outbreak criteria. It must be enabled in the antivirus profile under 'Outbreak Prevention'.

Answer

Enable 'Machine Learning Engine' in the antivirus profile

Answer

Enable 'FortiSandbox Inline Scan'

Answer

Configure a web filter profile to block malicious URLs

Question 3

An admin configures Content Disarm and Reconstruction (CDR) on FortiGate to protect against malicious macros in Office documents. After applying the CDR profile to a firewall policy, users complain that documents are not being delivered. What is the most likely cause?

Accepted Answer

The firewall policy is configured for flow-based inspection. CDR requires proxy-based inspection to intercept, disarm, and reconstruct documents. Flow-based inspection bypasses the deep inspection engine, so CDR cannot process the files, causing delivery failures. FortiGate must use proxy-based inspection mode for CDR to function correctly.

Answer

The CDR profile has 'File Filter' enabled that blocks the file type

Answer

The FortiGate is running in transparent mode

Answer

The antivirus profile is not applied to the same policy

Question 4

Which FortiGate IPS feature allows administrators to create rules that detect network traffic patterns deviating from normal protocol behavior?

Accepted Answer

Protocol anomaly. Protocol anomaly detection in FortiGate IPS allows administrators to define rules that identify deviations from standard protocol behavior as defined by RFCs. Unlike signature-based detection, which matches known attack patterns, protocol anomaly detection flags traffic that violates expected protocol structures, such as malformed packets or illegal flag combinations. This enables the detection of zero-day exploits and protocol abuse without requiring a pre-existing signature.

Answer

Rate-based signatures

Answer

Custom signatures

Answer

Geo-IP blocking

Question 5

An admin wants to create a custom IPS signature to detect a specific exploit that sends a string 'EXPLOIT' in the HTTP Host header. Which signature syntax is correct?

Accepted Answer

F-SBID( --name "HTTP_EXPLOIT" --protocol http --header Host --content "EXPLOIT" ). Option D is correct because the FortiGate custom IPS signature syntax requires the `--protocol http` flag to specify the application-layer protocol for HTTP inspection, and `--header Host` to target the HTTP Host header field. The `--content` parameter then defines the string 'EXPLOIT' to match within that header, enabling precise detection of the exploit.

Answer

F-SBID( --name "HTTP_EXPLOIT" --protocol http --header Host --content "EXPLOIT" )

Answer

F-SBID( --name "HTTP_EXPLOIT" --service HTTP --header Host --content "EXPLOIT" )

Answer

F-SBID( --name "HTTP_EXPLOIT" --protocol tcp --header Host --content "EXPLOIT" )

Question 6

A company uses FortiWeb to protect its web application. They want to block SQL injection attempts. Which FortiWeb feature should be configured to inspect HTTP requests for malicious SQL patterns?

Accepted Answer

Web Application Firewall (WAF) Signatures. FortiWeb uses Web Application Firewall signatures to detect SQL injection. These are pre-configured signatures that match SQL patterns.

Answer

URL Access Rule

Answer

HTTP Protocol Constraint

Answer

IP List

Question 7

An organization uses FortiGate's WAF feature (not FortiWeb) to protect a web server. The admin configures an inline WAF profile but notices that the WAF is not inspecting traffic. What is the most likely cause?

Accepted Answer

SSL Inspection is not enabled on the firewall policy. FortiGate's WAF feature requires SSL inspection to decrypt HTTPS traffic. Without an SSL inspection profile applied to the policy, the WAF cannot see the plaintext HTTP content.

Answer

The WAF profile is not applied to a firewall policy

Answer

The firewall policy uses flow-based inspection

Answer

The WAF profile is configured in monitor mode

Question 8

What does FortiGuard Outbreak Prevention use to protect against newly discovered malware outbreaks before traditional signatures are available?

Accepted Answer

Outbreak signatures and hash-based blocking. FortiGuard Outbreak Prevention uses outbreak alerts and hashes from FortiSandbox and other sources to quickly block files.

Answer

IP reputation and URL filtering

Answer

Heuristic analysis and emulation

Answer

Artificial intelligence and behavior analysis

Question 9

An admin receives an email from FortiMail regarding a message that was rejected due to SPF failure. What does this indicate about the email?

Accepted Answer

The email's From address domain does not match the sending server's IP per the domain's SPF record. SPF (Sender Policy Framework) validates that the sending server IP is authorized to send mail for the domain in the envelope sender. A failure means the IP is not authorized.

Answer

The email's DKIM signature is invalid

Answer

The email contains a virus

Answer

The email is missing a Message-ID header

Question 10

A security analyst wants to use automation stitches on FortiGate to automatically block IP addresses that trigger an IPS signature for 'SSH Brute Force'. Which two components are required to create this automation stitch? (Choose two.)

Accepted Answer

Action: 'Add to Block List'. An automation stitch requires a trigger (e.g., IPS event) and an action (e.g., add to block list). The trigger defines when the stitch fires, and the action defines what to do.

Answer

FortiAnalyzer log query

Answer

Action: 'Email Notification'

Answer

FortiGuard category

Question 11

An organization wants to implement multiple layers of defense against advanced persistent threats. Which three Fortinet solutions would be most effective in an ATP strategy? (Choose three.)

Accepted Answer

FortiSandbox. FortiSandbox provides advanced threat detection, FortiEDR provides endpoint detection and response, and FortiDeceptor provides deception-based threat detection. Together they cover multiple attack stages.

Answer

FortiMail

Answer

FortiWeb

Question 12

A network admin is troubleshooting why FortiGate's antivirus is not detecting a known malware sample. The sample is detected by other scanners. Which two checks should the admin perform? (Choose two.)

Accepted Answer

Verify that the FortiGuard Antivirus subscription is active. The antivirus engine may be outdated (AV database) or the feature (FortiGuard AV) may not be enabled on the profile. Scanning mode (flow vs proxy) can affect detection but is less likely than these two.

Answer

Check that the file is not excluded by a file filter

Answer

Ensure the firewall policy is configured for proxy-based inspection

Answer

Confirm that the antivirus profile has 'Scan on Delivery' enabled

Question 13

An administrator wants to block a zero-day malware outbreak detected by FortiGuard. Which feature should be configured to automatically block the threat across all enabled FortiGate devices?

Accepted Answer

FortiGuard Outbreak Prevention. FortiGuard Outbreak Prevention automatically blocks new threats by pushing updated signatures or indicators. It requires an active FortiGuard subscription and can be enabled globally.

Answer

FortiSandbox Cloud

Answer

IPS Custom Signatures

Answer

Application Control

Question 14

A FortiGate admin configures an automation stitch to send an email alert when a high-severity IPS event occurs. The trigger is 'IPS Event' and the action is 'Email'. After testing, no email is sent despite events being logged. What is the most likely cause?

Accepted Answer

No SMTP server is configured in the FortiGate. Automation stitches require a valid mail server configuration in the FortiGate's email settings. Without it, the email action cannot be executed.

Answer

The IPS event severity threshold is set too low

Answer

The automation stitch is disabled

Answer

The IPS engine is in monitor mode

Question 15

When configuring FortiGate with FortiSandbox integration, an administrator wants to block files that are rated 'High Risk' by the sandbox. Which setting must be enabled in the antivirus profile to automatically quarantine these files?

Accepted Answer

Enable 'Submit Files to FortiSandbox' and set action to 'Block'. Option C is correct because the 'Submit Files to FortiSandbox' setting in the antivirus profile, when set to 'Block', directly instructs FortiGate to quarantine files that receive a 'High Risk' verdict from FortiSandbox. This action is part of the antivirus profile's sandbox integration, not a separate automation or IPS feature, and it automatically handles the quarantine without requiring additional configuration.

Answer

Configure an automation stitch to quarantine files based on sandbox verdict

Answer

Enable 'File Filter' in the antivirus profile and add a rule for high-risk files

Answer

Enable 'FortiSandbox Quarantine' in the IPS profile