NSE7 Advanced Threat Protection Practice Test 8 — 15 Questions

Question 1

A FortiGate admin configures an automation stitch to send an email alert when a high-severity IPS event occurs. The trigger is 'IPS Event' and the action is 'Email'. After testing, no email is sent despite events being logged. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

No SMTP server is configured in the FortiGate. The automation stitch requires a functional SMTP server configuration to send emails. Without an SMTP server defined under System > Settings > Email Service, the FortiGate cannot relay the alert email, even if the trigger and action are correctly configured and events are logged. This is the most common reason for email delivery failure in automation stitches.

Answer

The IPS event severity threshold is set too low

Answer

The automation stitch is disabled

Answer

The IPS engine is in monitor mode

Question 2

When configuring FortiGate with FortiSandbox integration, an administrator wants to block files that are rated 'High Risk' by the sandbox. Which setting must be enabled in the antivirus profile to automatically quarantine these files?

Accepted Answer

Enable 'Submit Files to FortiSandbox' and set action to 'Block'. The 'Submit Files to FortiSandbox' setting in the antivirus profile, when set to 'Block', directly instructs FortiGate to quarantine files that receive a 'High Risk' verdict from FortiSandbox. This action is part of the antivirus profile's sandbox integration, not a separate automation or IPS feature, and it automatically handles the quarantine without requiring additional configuration.

Answer

Configure an automation stitch to quarantine files based on sandbox verdict

Answer

Enable 'File Filter' in the antivirus profile and add a rule for high-risk files

Answer

Enable 'FortiSandbox Quarantine' in the IPS profile

Question 3

An administrator sees the following log entry:
'id=13593 msg="CDR: File attachment sanitized"'
Which feature generated this log?

Accepted Answer

Content Disarm and Reconstruction. The log entry 'CDR: File attachment sanitized' is generated by Content Disarm and Reconstruction (CDR). CDR works by removing active content (e.g., macros, scripts, embedded objects) from files and rebuilding them into a safe, sanitized version. This is distinct from sandboxing or machine learning, as CDR does not rely on detection but instead proactively neutralizes threats by reconstructing the file.

Answer

FortiSandbox

Answer

Machine Learning Engine

Answer

Outbreak Prevention

Question 4

Which Fortinet product is specifically designed to deploy decoys and lures to detect lateral movement and early-stage attacks inside the network?

Accepted Answer

FortiDeceptor. FortiDeceptor is specifically designed to deploy decoys and lures that mimic real assets (e.g., servers, endpoints, IoT devices) to attract and detect lateral movement and early-stage attacks inside the network. It uses deception technology to create a realistic attack surface, triggering alerts when an attacker interacts with a decoy, without relying on signatures or behavioral analysis.

Answer

FortiSandbox

Answer

FortiEDR

Answer

FortiClient

Question 5

A company uses FortiMail and wants to ensure that incoming emails are authenticated using SPF, DKIM, and DMARC. Which profile should the administrator configure to enforce these checks?

Accepted Answer

Authentication Profile. The Authentication Profile in FortiMail is specifically designed to enforce email authentication checks such as SPF, DKIM, and DMARC. This profile defines the actions to take when an email fails these authentication checks, such as quarantining or rejecting the message, and is applied to incoming email flows to ensure compliance with authentication standards.

Answer

Session Profile

Answer

Antispam Profile

Answer

IP Policy

Question 6

A FortiGate administrator runs the following CLI command:
'diagnose ips anomaly log'
The output shows numerous 'tcp_syn_flood' events from a single source IP. To mitigate this, the administrator wants to block the source IP automatically. Which feature should be used?

Accepted Answer

Automation Stitch. The 'diagnose ips anomaly log' command displays anomalies detected by the FortiGate's DoS (Denial of Service) sensor, such as TCP SYN flood events. An Automation Stitch (Option D) is the correct feature to automatically block the source IP because it can trigger a 'Block IP' action based on a 'IPS Anomaly' event, creating an automated response without manual intervention.

Answer

IPS Custom Signature

Answer

Local-in Policy

Answer

IP Block List

Question 7

Which Fortinet solution collects and correlates security events from multiple sources to provide a unified view of threats across the network?

Accepted Answer

FortiSIEM. FortiSIEM is the correct answer because it is specifically designed as a Security Information and Event Management (SIEM) solution that aggregates, normalizes, and correlates logs and events from diverse sources—including firewalls, endpoints, servers, and cloud platforms—into a single pane of glass. It uses a patented event correlation engine and a unified event database to detect multi-stage attack patterns and provide actionable threat intelligence, fulfilling the requirement for a unified view of threats across the network.

Answer

FortiSandbox

Answer

FortiDeceptor

Answer

FortiEDR

Question 8

A network admin wants to use FortiClient's advanced threat protection features to detect ransomware behavior on endpoints. Which FortiClient feature should be enabled?

Accepted Answer

Advanced Threat Protection. FortiClient's Advanced Threat Protection (ATP) feature is specifically designed to detect and block ransomware behavior by using real-time behavioral analysis, machine learning, and exploit prevention. Unlike other features, ATP monitors process behavior for indicators of compromise (IoCs) such as mass file encryption or unauthorized file access patterns, making it the correct choice for ransomware detection.

Answer

Web Filtering

Answer

Application Firewall

Answer

Vulnerability Scan

Question 9

Which feature on FortiGate uses machine learning to detect never-before-seen malware based on file characteristics?

Accepted Answer

Machine Learning Engine. The Machine Learning Engine (option A) on FortiGate uses static file analysis and machine learning models to detect never-before-seen malware based on file characteristics such as entropy, structure, and opcode sequences, without requiring signatures or behavioral execution. This allows it to identify zero-day threats pre-execution, directly matching the question's description.

Answer

Outbreak Prevention

Answer

FortiSandbox

Answer

Content Disarm and Reconstruction

Question 10

An administrator configures a WAF profile on FortiGate to protect a web application. However, the administrator notices that SQL injection attacks are not being blocked. What should the administrator check first?

Accepted Answer

The SQL injection signatures are enabled in the WAF profile. SQL injection attacks are blocked by specific signatures within the WAF profile. If these signatures are not enabled, the WAF will not inspect HTTP requests for SQL injection patterns, allowing attacks to pass through. The administrator must verify that the SQL injection signatures are toggled on under the WAF profile's signature configuration.

Answer

The WAF profile is attached to the correct firewall policy

Answer

The FortiGate has a valid Advanced Web Protection subscription

Answer

The web application is using HTTPS and SSL inspection is configured

Question 11

An organization uses FortiWeb to protect its web applications. The security team wants to block requests that contain a specific custom pattern in the URL. Which feature should be used?

Accepted Answer

Custom Attack Signature. Custom Attack Signatures in FortiWeb allow administrators to define user-specific patterns to match against HTTP request elements, including the URL. This feature is designed to block requests containing custom patterns, such as a specific string in the URL, by inspecting the request and triggering an action (e.g., alert or block) when the pattern is matched. Unlike other features, Custom Attack Signatures provide the granularity needed to detect and block arbitrary, organization-defined patterns in the URL.

Answer

Inline Protection Profile

Answer

URL Access Rule

Answer

Web Application Firewall Policy

Question 12

Which FortiGate security feature removes potentially malicious active content from files (e.g., macros, scripts) before delivering them to end users?

Accepted Answer

Content Disarm and Reconstruction. Content Disarm and Reconstruction (CDR) is the correct answer because it specifically removes potentially malicious active content—such as macros, scripts, and embedded objects—from files (e.g., Office documents, PDFs) by stripping the active elements and reconstructing a safe, sanitized version before delivery. Unlike traditional scanning, CDR does not rely on signatures or heuristics; it assumes the file could be malicious and proactively neutralizes threats by rebuilding the file with only safe, static content.

Answer

Antivirus

Answer

Data Leak Prevention

Answer

File Filter

Question 13

An administrator wants to integrate FortiGate with an external threat intelligence feed to block known malicious IP addresses automatically. Which object should be used to consume the feed?

Accepted Answer

External Threat Intelligence Feed. The External Threat Intelligence Feed object in FortiGate is specifically designed to consume external threat intelligence feeds (e.g., STIX/TAXII, CSV, or plain text lists) and automatically update a dynamic address object with indicators of compromise (IoCs) such as malicious IP addresses. This enables automated blocking of known malicious sources without manual intervention, making it the correct choice for integrating an external feed.

Answer

IP Pool

Answer

Address Group

Answer

Security Profile Group

Question 14

A FortiGate administrator is troubleshooting why a custom IPS signature is not triggering on traffic matching the pattern. Which TWO checks should be performed?

Accepted Answer

Confirm the IPS sensor is applied to the correct firewall policy. An IPS sensor must be explicitly attached to a firewall policy via the 'inspection-mode' or 'ips-sensor' configuration to inspect traffic. Even if a custom signature is correctly defined and enabled, it will never trigger if the sensor containing it is not applied to the policy that matches the target traffic. This is a fundamental prerequisite for any IPS signature to process packets.

Answer

Check the signature's severity level in the IPS sensor

Answer

Ensure the FortiGate is in proxy-based inspection mode

Answer

Verify the signature uses correct protocol decoder

Question 15

A company wants to use FortiMail to implement email authentication to prevent spoofing. Which THREE mechanisms should be configured in FortiMail's Authentication Profile?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is correct because it builds on SPF and DKIM to provide a policy framework that tells receiving mail servers how to handle messages that fail authentication checks. In FortiMail's Authentication Profile, DMARC enables the enforcement of policies like quarantine or reject, which directly prevents spoofing by ensuring only authenticated emails are delivered.

Answer

S/MIME

Answer

TLS