NSE7 Advanced Threat Protection Practice Test 7 — 15 Questions

Question 1

A company is deploying FortiGate with Advanced Threat Protection (ATP) and wants to block advanced malware that uses encrypted C2 communications. Which security profile should be configured to perform SSL inspection and detect malicious traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Antivirus profile with SSL inspection. An Antivirus profile with SSL inspection enabled is required to decrypt encrypted C2 (command-and-control) traffic so that FortiGate can inspect the payload for malware signatures, heuristics, and behavioral patterns. Without SSL inspection, the ATP engine cannot see inside the encrypted tunnel, rendering the antivirus and other security profiles ineffective against encrypted C2 communications.

Answer

Data Leak Prevention profile

Answer

Web Filtering profile

Answer

Intrusion Prevention profile

Question 2

A network administrator notices that several endpoints are infected with ransomware despite having FortiGate ATP enabled. The logs show that the files were downloaded over HTTPS, and the antivirus profile did not detect them. What is the most likely reason?

Accepted Answer

SSL inspection was not enabled on the antivirus profile. FortiGate ATP's antivirus engine cannot inspect encrypted HTTPS traffic unless SSL inspection is explicitly enabled on the antivirus profile. Without SSL inspection, the antivirus profile only sees encrypted payloads and cannot match file signatures or heuristics, allowing ransomware to pass undetected. The logs confirm files were downloaded over HTTPS, making this the most likely root cause.

Answer

Application control profile blocked the download

Answer

FortiSandbox was not configured to analyze the files

Answer

IPS signature database was outdated

Question 3

A security engineer is troubleshooting a scenario where FortiGate is not blocking a known malicious URL categorized as 'Malware'. The web filtering profile is configured with 'monitor all' for the Malware category. What change should be made to block the URL?

Accepted Answer

Change the action for Malware category from 'monitor' to 'block' in the web filter profile. The web filtering profile currently has the Malware category set to 'monitor all', which logs but does not block traffic. To block the URL, the action must be changed from 'monitor' to 'block' within the same web filter profile. This directly enforces the blocking action for all URLs categorized as Malware, including the known malicious URL.

Answer

Configure traffic shaping to rate limit the URL

Answer

Add a static URL filter with the exact URL and action 'block'

Answer

Enable DNS filter with botnet C2 domain blocking

Question 4

A company wants to detect and block phishing emails that contain malicious links. Which FortiGate security profile should be used?

Accepted Answer

Email Filtering profile. FortiGate's Email Filtering profile is specifically designed to inspect SMTP, POP3, and IMAP traffic for phishing indicators, including malicious URLs in email bodies and attachments. It can block or quarantine emails based on URL reputation, sender authentication (SPF/DKIM/DMARC), and content analysis, directly addressing the requirement to detect and block phishing emails with malicious links.

Answer

Antivirus profile

Answer

Web Filtering profile

Answer

Data Leak Prevention profile

Question 5

Refer to the exhibit. A user reports that accessing a legitimate HTTPS website is blocked. The FortiGate logs show that the connection was denied by the antivirus profile. What is the most likely cause?

Accepted Answer

The antivirus profile detected a false positive in the encrypted traffic. The antivirus (AV) profile on FortiGate performs deep inspection of HTTPS traffic by decrypting it, scanning the content, and re-encrypting it. If the AV signature database contains a false positive for a legitimate website's content (e.g., a benign JavaScript file matching a malware signature), the connection will be denied. The log explicitly states the denial was by the AV profile, not by any other security profile, making a false positive in encrypted traffic the most likely cause.

Answer

The application list blocked the HTTPS application

Answer

The IPS profile blocked a vulnerability in the website

Answer

The protocol options profile blocked the SSL handshake

Question 6

What is the primary purpose of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus features?

Accepted Answer

To remove potentially malicious content from documents and rebuild them as safe files. Content Disarm and Reconstruction (CDR) is designed to remove active or potentially malicious content—such as macros, scripts, embedded objects, and OLE links—from documents (e.g., Office files, PDFs) and then reconstruct them as sanitized, safe versions. This approach prevents threats like macro-based malware or exploit-laden attachments from reaching users, even if the file contains previously unknown (zero-day) payloads, by stripping the dangerous components rather than relying solely on signature-based detection.

Answer

To convert files into PDF format for safer viewing

Answer

To detect zero-day malware using sandboxing

Answer

To block all files containing macros

Question 7

What is the primary function of FortiDeceptor in a network security architecture?

Accepted Answer

To lure attackers into interacting with decoys and generate alerts. FortiDeceptor is a deception-based threat detection solution that deploys decoys (fake assets) across the network to lure attackers. When an attacker interacts with a decoy, FortiDeceptor generates a high-fidelity alert, enabling early detection of lateral movement or reconnaissance without relying on signatures.

Answer

To provide network access control for endpoints

Answer

To aggregate logs from multiple security devices

Answer

To detect and block malware at the endpoint

Question 8

An administrator configures an automation stitch on FortiGate to automatically block an IP address when a specific IPS signature triggers. What must be configured as the trigger and action?

Accepted Answer

Trigger: 'Event Log' with filter for the IPS signature; Action: 'Add IP to Blocklist'. An automation stitch in FortiGate requires a trigger that defines the event that starts the automation, and an action that defines what happens when the trigger fires. For automatically blocking an IP when a specific IPS signature triggers, the trigger must be 'Event Log' with a filter for that IPS signature, and the action must be 'Add IP to Blocklist', which directly adds the source IP to the FortiGate's blocklist (banned IP list). This combination ensures that when the IPS signature is logged, the stitch extracts the source IP and applies a block.

Answer

Trigger: 'Incoming Webhook'; Action: 'CLI Script'

Answer

Trigger: 'FortiOS CLI'; Action: 'Alert Email'

Answer

Trigger: 'Schedule'; Action: 'Banned IP'

Question 9

What is the role of FortiGuard Outbreak Prevention in FortiGate's security suite?

Accepted Answer

To deliver real-time threat intelligence and block fast-spreading outbreaks. FortiGuard Outbreak Prevention is a real-time threat intelligence service that proactively blocks fast-spreading outbreaks by delivering immediate signature updates and threat data to FortiGate devices. Unlike scheduled updates, it uses a push mechanism to rapidly deploy protections against emerging threats, reducing the window of vulnerability during zero-day or widespread attacks.

Answer

To provide offline signature updates for antivirus

Answer

To perform sandbox analysis of files

Answer

To manage endpoint security policies

Question 10

An organization deploys FortiEDR to protect endpoints. Which component is responsible for collecting and sending telemetry data to the FortiEDR management console?

Accepted Answer

FortiEDR Sensor (Agent). The FortiEDR Sensor (Agent) is the endpoint-resident component that collects telemetry data—such as process creation, network connections, file system changes, and registry modifications—and securely transmits it to the FortiEDR management console (Controller) for analysis and threat detection. Without the sensor, the management console has no visibility into endpoint activity.

Answer

FortiGate firewall

Answer

FortiAnalyzer

Answer

FortiClient EMS

Question 11

An administrator runs the following CLI output: 'diagnose sys session filter dport 443' and sees 'proto=6 proto_state=01 duration=3600 expire=3599'. Which statement BEST describes the session?

Accepted Answer

The session is established and has been active for one hour. The session shows 'proto=6' (TCP), 'proto_state=01' (TCP_ESTABLISHED), and 'duration=3600' seconds, which equals one hour. The 'expire=3599' indicates the session has 3599 seconds left before timeout, confirming it is active and established. Option B correctly identifies this as an established session that has been active for one hour.

Answer

The session is in the process of being torn down

Answer

The session is a UDP session incorrectly classified as TCP

Answer

The TCP session is still in the SYN-SENT state

Question 12

A company wants to protect its internal users from malicious files attached to emails. Which FortiGate feature should be configured to inspect SMTP traffic for malware?

Accepted Answer

Antivirus. FortiGate's Antivirus feature is designed to scan SMTP traffic for malware by inspecting email attachments and body content against virus signatures. When configured in a security policy, it intercepts SMTP sessions, buffers the email data, and performs real-time scanning to block or quarantine malicious files before delivery to internal users.

Answer

Email Filter

Answer

Web Filter

Answer

IPS

Question 13

A FortiGate admin sees the following log: 'Action=blocked, Service=HTTP, Application=Outbreak, File=invoice.doc, ThreatScore=95'. What is the MOST likely explanation for this block?

Accepted Answer

The file was blocked by FortiGuard outbreak prevention. The log entry shows 'Application=Outbreak' and 'ThreatScore=95', which are specific indicators of FortiGuard outbreak prevention. FortiGuard outbreak prevention uses real-time threat intelligence to block files associated with widespread malware campaigns before traditional signatures are updated. The 'Outbreak' application tag and high threat score directly correspond to this feature, not to machine learning, sandbox verdicts, or custom IPS signatures.

Answer

The file was blocked by the machine learning engine

Answer

The file was blocked by FortiSandbox verdict

Answer

The file was blocked by a custom IPS signature

Question 14

Which FortiGate security feature can reconstruct files to remove potentially malicious content while preserving the file's usability?

Accepted Answer

Content Disarm and Reconstruction. Content Disarm and Reconstruction (CDR) is the correct answer because it actively removes potentially malicious content—such as macros, scripts, or embedded objects—from files (e.g., Office documents, PDFs) and then reconstructs a clean, usable version. Unlike detection-based approaches, CDR eliminates threats by sanitizing the file structure itself, ensuring the file remains functional for the end user while blocking exploits.

Answer

Antivirus outbreak prevention

Answer

FortiSandbox

Answer

IPS application control

Question 15

An administrator needs to deploy a honeypot solution to detect and deceive attackers inside the network. Which Fortinet product is BEST suited for this purpose?

Accepted Answer

FortiDeceptor. FortiDeceptor is a dedicated deception-based security solution that deploys decoys (honeypots) and lures across the network to detect and misdirect attackers. It integrates with FortiGate and FortiSIEM to provide automated threat isolation and forensic data collection, making it the best choice for a honeypot deployment.

Answer

FortiSandbox

Answer

FortiEDR

Answer

FortiNAC