NSE7 Advanced Threat Protection Practice Test 8 — 15 Questions

Question 1

A FortiGate administrator configures a custom IPS signature with the pattern 'attack' in the HTTP request URI. After applying the signature, no alerts are generated even though the traffic matches. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The signature's protocol decoder is not set to 'HTTP'. The custom IPS signature pattern 'attack' will only be inspected against the HTTP request URI if the signature's protocol decoder is explicitly set to 'HTTP'. Without this decoder assignment, the IPS engine does not know which protocol layer to parse, and the pattern is never matched against the URI, resulting in no alerts despite matching traffic.

Answer

The signature's protocol decoder is set to 'HTTP'

Answer

The signature action is set to 'pass'

Answer

The signature severity is too low

Question 2

Which technology uses DMARC reports to help administrators identify unauthorized use of their email domain?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the correct answer because it specifically uses aggregate and forensic reports (DMARC reports) to provide administrators with visibility into how their email domain is being used, including unauthorized or spoofed emails. These reports are generated by receiving mail servers and sent back to the domain owner, detailing authentication results from SPF and DKIM checks, which helps identify and mitigate domain abuse.

Answer

SPF

Answer

DKIM

Answer

FortiMail

Question 3

An administrator wants to create an automation stitch that sends a webhook notification when an IPS attack is detected. Which trigger and action should be used?

Accepted Answer

Trigger: 'IPS Event'; Action: 'Webhook'. An automation stitch requires a trigger that matches the event type and an action that performs the desired response. 'IPS Event' is the correct trigger for detecting an IPS attack, and 'Webhook' is the action that sends an HTTP POST request to a configured endpoint, which is the standard method for webhook notifications in FortiOS.

Answer

Trigger: 'FortiGuard'; Action: 'Quarantine'

Answer

Trigger: 'System Event'; Action: 'Email'

Answer

Trigger: 'Incoming Webhook'; Action: 'IPS Event'

Question 4

A FortiGate is configured with a WAF profile to protect a web server. The administrator notices that SQL injection attacks are still reaching the server despite the WAF being enabled. What is the MOST likely reason?

Accepted Answer

The SQL injection signature set is disabled in the WAF profile. The WAF profile contains signature sets that detect and block common attack patterns, including SQL injection. If the SQL injection signature set is disabled within the profile, the WAF will not inspect traffic for those patterns, allowing attacks to pass through. This is the most direct and likely reason why SQL injection attacks are reaching the server despite the WAF being enabled.

Answer

The attack is coming from a trusted IP

Answer

The web server is using HTTPS without SSL inspection

Answer

The WAF profile is not applied to the correct policy

Question 5

An administrator runs 'diagnose ips anomaly http' and sees many entries with 'type=SQLi' and 'score=0'. What does a score of 0 indicate?

Accepted Answer

The traffic showed suspicious patterns but did not meet the threshold. In Fortinet's IPS anomaly detection, a score of 0 indicates that the traffic exhibited suspicious patterns (e.g., SQLi signatures) but did not accumulate enough anomaly points to meet the configured threshold for triggering an action. This means the traffic was flagged as potentially malicious but was not deemed severe enough to warrant logging or blocking, so it remains in a 'monitoring' state without enforcement.

Answer

The anomaly detection is disabled

Answer

The IPS sensor is not applied to any policy

Answer

The traffic is definitely an SQL injection attack

Question 6

An administrator wants to configure FortiGate to automatically block a source IP when a high-severity IPS event is detected. Which TWO components must be configured? (Choose two.)

Accepted Answer

An automation stitch trigger set to 'IPS Event'. Option C is correct because an automation stitch must have a trigger that fires on the relevant log event, and setting the trigger to 'IPS Event' (specifically matching high-severity IPS logs) is what initiates the automated response when the IPS sensor detects the threat. Option E is correct because the stitch also needs an action that performs the blocking; the 'Quarantine' action adds the offending source IP to the quarantine list so FortiGate drops subsequent traffic from it. Together, the IPS Event trigger and the Quarantine action form the automation stitch that automatically blocks the source IP. Option A is not required by the question because, while IPS must be enabled somewhere for events to occur, the question asks specifically about the automation components needed to block the source, not the base policy configuration. Option B is incorrect because FortiGuard category subscription relates to web filtering/security rating services, not to triggering IPS-based quarantine. Option D is incorrect because a static route to the source IP is unrelated to dynamically blocking a detected attacker.

Answer

A firewall policy with IPS enabled

Answer

A FortiGuard category subscription

Answer

A static route to the source IP

Question 7

Which FortiClient ATP feature provides protection against zero-day malware by monitoring process behavior and blocking suspicious activities at the endpoint?

Accepted Answer

FortiClient Exploit Prevention. FortiClient Exploit Prevention is correct because it uses real-time behavioral monitoring of process activities—such as API calls, memory access patterns, and code injection attempts—to detect and block zero-day malware that has no known signature. Unlike signature-based detection, this feature identifies malicious behavior at runtime, making it effective against previously unseen threats.

Answer

FortiClient Web Filtering

Answer

FortiClient Cloud Sandbox

Answer

FortiClient Vulnerability Scan

Question 8

A security administrator wants to block email spoofing attacks against their organization's domain. They configure SPF, DKIM, and DMARC records. Which protocol authenticates the domain of the email sender by verifying the email's signature against a public key published in DNS?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) is the correct answer because it provides email authentication by allowing the sender to cryptographically sign an email with a private key. The receiving mail server then retrieves the sender's public key from a DNS TXT record and verifies the signature, confirming that the email was not tampered with and originates from a domain the sender is authorized to use.

Answer

SPF

Answer

ARC

Answer

DMARC

Question 9

An organization wants to deploy a web application firewall (WAF) to protect a public-facing web application. They are evaluating FortiGate versus FortiWeb. Which of the following is a key advantage of using FortiWeb over FortiGate for WAF functionality?

Accepted Answer

FortiWeb offers advanced bot detection and positive security model. FortiWeb is a dedicated web application firewall that provides advanced bot detection and a positive security model, which allows only explicitly allowed traffic based on a whitelist of known good patterns. This is a key advantage over FortiGate, which primarily uses a negative security model (signature-based) and lacks the same depth of bot mitigation and positive enforcement for web-specific threats.

Answer

FortiGate can perform SSL deep inspection without performance impact

Answer

FortiGate supports a larger number of web servers behind a single policy

Answer

FortiGate can automatically patch web application vulnerabilities

Question 10

A FortiGate administrator wants to implement Content Disarm and Reconstruction (CDR) for email attachments. Which security profile must be configured to enable CDR?

Accepted Answer

Antivirus profile. Content Disarm and Reconstruction (CDR) is a security feature that removes active content (e.g., macros, scripts, embedded objects) from files and reconstructs them into a safe version. In FortiOS, CDR is configured within the Antivirus profile because it operates as part of the antivirus scanning engine, specifically under the 'File Filter' or 'Content Disarm' tab, where you can enable CDR for supported file types like Office documents and PDFs.

Answer

Web Filter profile

Answer

IPS profile

Answer

Application Control profile

Question 11

During a security incident, the SOC team receives an alert from FortiSIEM about a user accessing a known malicious IP. The team wants to automatically block the IP on the FortiGate. Which FortiGate feature can be used to create an automated response based on a threat intelligence feed?

Accepted Answer

Automation Stitch. Automation Stitch in FortiOS allows you to create automated responses triggered by events such as threat intelligence feeds. By configuring an Automation Stitch with a trigger from FortiSIEM (e.g., via a webhook or syslog) and an action to add a block entry to the FortiGate's local address group or dynamic block list, the SOC team can automatically block the malicious IP without manual intervention.

Answer

Local-in Policy

Answer

FortiGuard Outbreak Prevention

Answer

FortiGate VPN

Question 12

Which Fortinet product is designed specifically to detect and deceive attackers by creating decoy systems and luring them away from real assets?

Accepted Answer

FortiDeceptor. FortiDeceptor is Fortinet's dedicated deception-based threat detection solution. It creates realistic decoy systems (honeypots) and lures attackers away from real assets, providing early detection and threat intelligence without relying on signatures. This aligns with the question's specific requirement for a product designed to detect and deceive attackers using decoys.

Answer

FortiSandbox

Answer

FortiEDR

Answer

FortiWeb

Question 13

Which FortiMail advanced feature allows the administrator to rewrite URLs in email bodies to redirect users to a safe scanning service when they click on a link?

Accepted Answer

URL Rewriting. URL Rewriting is the correct answer because it is a FortiMail advanced feature specifically designed to replace URLs in email bodies with rewritten links that redirect users through FortiMail's scanning service. When a user clicks the rewritten URL, FortiMail inspects the destination in real time for malicious content, such as phishing or malware sites, before allowing the redirect. This provides proactive protection against zero-hour threats by leveraging FortiGuard's web filtering and threat intelligence.

Answer

Attachment Filtering

Answer

Bounce Verification

Answer

Anti-Spam

Question 14

What is the primary purpose of FortiGuard Outbreak Prevention service?

Accepted Answer

To provide proactive protection against zero-day and fast-spreading threats. FortiGuard Outbreak Prevention is designed to provide proactive protection against zero-day and fast-spreading threats by leveraging real-time threat intelligence from FortiGuard Labs. It automatically updates security policies and signatures to block emerging threats before they become widespread, reducing the window of vulnerability.

Answer

To provide real-time threat intelligence feeds to third-party SIEM systems

Answer

To automatically patch vulnerabilities in FortiGate firmware

Answer

To block all traffic from IP addresses listed in a community-based blocklist

Question 15

A security engineer wants to implement advanced threat protection for email using FortiMail. Which THREE features should be enabled to provide comprehensive protection against sophisticated email threats? (Choose three.)

Accepted Answer

URL rewriting and click-time protection. URL rewriting and click-time protection (A) is correct because FortiMail rewrites embedded URLs and re-evaluates them when the user clicks, blocking advanced phishing and malicious links that were benign at delivery time. FortiSandbox integration for email attachments (B) is correct because it detonates suspicious attachments in an isolated sandbox to detect zero-day malware and advanced persistent threats that signature-based scanning misses. DMARC verification (D) is correct because it validates the alignment of SPF and DKIM with the From: domain, preventing domain spoofing and business email compromise. Anti-Spam filter (C) is not among the marked answers because it addresses bulk unsolicited mail rather than sophisticated targeted threats. Attachment size limits (E) are not among the marked answers because they only enforce message size policy and provide no threat detection capability.

Answer

Anti-Spam filter

Answer

Attachment size limits