NSE7 Advanced Threat Protection Practice Test 9 — 15 Questions

Question 1

An administrator is investigating a security incident where a workstation is communicating with a known command and control (C2) server. The FortiGate has IPS enabled but did not block the traffic. Which TWO configuration issues could explain why the IPS did not detect the C2 communication? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall policy does not have SSL deep inspection enabled. Without SSL deep inspection, the FortiGate cannot decrypt HTTPS traffic to inspect the payload for C2 signatures. IPS operates on decrypted content; if the C2 communication uses TLS, the IPS engine only sees encrypted packets and cannot match application-layer signatures. Enabling SSL deep inspection with a valid CA certificate is required to decrypt and inspect the traffic.

Answer

The IPS sensor is configured in 'Inline' mode

Answer

The IPS sensor has 'Logging' disabled

Answer

The FortiGate is operating in 'Transparent' mode

Question 2

An administrator configures FortiSandbox inline scanning for HTTP traffic. They notice that files uploaded via HTTP are being scanned but no verdict is being returned, causing delays. What is the MOST likely cause?

Accepted Answer

The file scan timeout is too short, causing FortiGate to pass the file before a verdict is received. When FortiGate sends a file to FortiSandbox for inline scanning, it waits for a verdict before allowing the traffic to proceed. If the file scan timeout is too short, FortiGate will stop waiting for the verdict and pass the file anyway, causing the observed delay without a final verdict. This is the most likely cause because the administrator sees scanning occurring but no verdict returned, which aligns with a premature timeout rather than a failure to scan.

Answer

The FortiSandbox has reached its maximum storage capacity

Answer

The FortiSandbox is not registered with the FortiGate

Answer

The file type is not supported by FortiSandbox

Question 3

A network administrator wants to block known malicious IP addresses using threat intelligence feeds on FortiGate. Which feature should they use?

Accepted Answer

External Threat Intelligence. FortiGate's External Threat Intelligence feature allows administrators to import and consume threat intelligence feeds (e.g., STIX/TAXII, CSV, or custom URLs) to block known malicious IP addresses. This is the correct feature because it is specifically designed to ingest external threat data and apply it to firewall policies for dynamic blocking, unlike the other options which serve different purposes.

Answer

FortiGuard Web Filtering

Answer

Application Control

Answer

IP Reputation

Question 4

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP connection that has been active for 3600 seconds and will expire in 3599 seconds. The output shows 'proto=6' which indicates TCP (protocol 6), 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds. The 'proto_state=01' is a TCP state code indicating an established connection. This is a standard FortiGate diagnostic session output.

Answer

The session is a UDP DNS request

Answer

The session is being blocked by a firewall policy

Answer

The session is an SSL VPN tunnel

Question 5

A company is deploying FortiClient ATP to protect endpoints. They want to block ransomware behavior in real time. Which FortiClient feature should be enabled?

Accepted Answer

Real-Time Protection. Real-Time Protection is the FortiClient feature that uses behavioral analysis and machine learning to detect and block ransomware-like activities, such as mass file encryption or unauthorized file modifications, as they occur. This feature monitors process behavior in real time, leveraging FortiSandbox threat intelligence and local heuristics to stop ransomware before it can cause damage.

Answer

Vulnerability Scan

Answer

Web Filtering

Answer

Application Firewall

Question 6

An organization wants to prevent zero-day attacks by using Content Disarm and Reconstruction (CDR) on email attachments. Which Fortinet product provides this capability?

Accepted Answer

FortiMail. FortiMail is the correct answer because it natively integrates Content Disarm and Reconstruction (CDR) to sanitize email attachments by removing active content (e.g., macros, scripts, embedded objects) and rebuilding the file in a safe format. This prevents zero-day exploits that bypass signature-based detection, as CDR does not rely on threat intelligence but instead strips potentially malicious elements before delivery.

Answer

FortiWeb

Answer

FortiGate

Answer

FortiSandbox

Question 7

An administrator wants to detect lateral movement and early stages of an attack using decoy systems that mimic production assets. Which Fortinet product should they deploy?

Accepted Answer

FortiDeceptor. FortiDeceptor is specifically designed to detect lateral movement and early-stage attacks by deploying decoy systems (honeypots) that mimic production assets. It uses deception technology to lure attackers away from real targets and trigger alerts when decoys are probed or compromised, enabling early threat detection without impacting production systems.

Answer

FortiSIEM

Answer

FortiEDR

Answer

FortiNDR

Question 8

Which Fortinet product provides endpoint detection and response (EDR) capabilities, including automated threat containment?

Accepted Answer

FortiEDR. FortiEDR is the correct answer because it is Fortinet's dedicated endpoint detection and response solution that provides real-time behavioral analysis, automated threat containment, and forensic investigation capabilities. Unlike traditional antivirus, FortiEDR uses machine learning and pre-execution analysis to detect and block advanced threats, and it can automatically isolate compromised endpoints from the network to prevent lateral movement.

Answer

FortiClient

Answer

FortiSandbox

Answer

FortiGuard

Question 9

An administrator configures email authentication (SPF, DKIM, DMARC) on FortiMail. They find that legitimate emails are being marked as spam by FortiMail. The SPF check passes but DKIM fails. What could be the issue?

Accepted Answer

The email was forwarded by an intermediary that strips the DKIM signature. When an email is forwarded by an intermediary (e.g., a mailing list or forwarding service), the intermediary often modifies the message headers or body, which invalidates the DKIM signature. Since DKIM relies on a cryptographic hash of the original message content and selected headers, any alteration—even by a legitimate forwarder—causes the signature verification to fail. The SPF check passes because the forwarding server may be authorized in the SPF record, but DKIM failure triggers spam classification if the DMARC policy is not aligned.

Answer

The SPF record is too strict

Answer

FortiMail has a bug in the DKIM verification module

Answer

The DMARC policy is set to reject

Question 10

An administrator needs to enable automation stitches to automatically block a malicious IP address detected by FortiSandbox. Which two components are required? (Choose two.)

Accepted Answer

A trigger that detects the FortiSandbox verdict. Automation stitches require a trigger to initiate the workflow. In this scenario, the trigger must detect the FortiSandbox verdict (e.g., malicious or clean) to start the automated response. Without a trigger, the stitch has no event to react to, making it non-functional.

Answer

A static route to the malicious IP

Answer

An SSL certificate for the FortiGate

Answer

A firewall policy that allows the traffic

Question 11

An administrator is configuring FortiMail to improve email security. Which three of the following features are part of FortiMail's advanced threat protection? (Choose three.)

Accepted Answer

Email Authentication (SPF, DKIM, DMARC). Email Authentication (SPF, DKIM, DMARC) (C) is correct because FortiMail validates sender identity by checking SPF records, verifying DKIM signatures, and enforcing DMARC policy to block spoofed and phishing messages. Content Disarm and Reconstruction (CDR) (D) is correct because FortiMail can sanitize attachments by stripping active content and rebuilding files into safe, usable versions, neutralizing embedded threats. Sandboxing (E) is correct because FortiMail integrates with FortiSandbox to detonate suspicious attachments and URLs in an isolated environment and quarantine zero-day malware. Web Filtering (A) and Application Control (B) are not part of FortiMail's advanced email threat protection; those are FortiGate/NGFW security profiles that inspect web traffic and applications rather than email-borne threats.

Answer

Web Filtering

Answer

Application Control

Question 12

What is the primary function of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus profile?

Accepted Answer

To remove active content and rebuild files to eliminate hidden threats. Content Disarm and Reconstruction (CDR) works by stripping active content (e.g., macros, scripts, OLE objects) from incoming files and rebuilding them into a safe, sanitized version. This eliminates hidden threats such as embedded exploits or malicious code that signature-based detection might miss, providing protection against zero-day and unknown attacks. Option D correctly identifies this core function of removing active content and rebuilding files to neutralize threats.

Answer

To detect and block zero-day malware using machine learning

Answer

To reconstruct files that were corrupted during transmission

Answer

To compress files for faster scanning

Question 13

A FortiGate administrator notices that traffic classified as 'unknown' by the antivirus is being allowed. The administrator wants to ensure that such files are submitted to FortiSandbox for analysis and blocked until a verdict is received. Which configuration is required?

Accepted Answer

Enable FortiSandbox in the antivirus profile and set 'Action for unknown files' to 'Block'. When FortiSandbox is enabled in the antivirus profile and 'Action for unknown files' is set to 'Block', the FortiGate will submit files that cannot be identified by the local antivirus engine to FortiSandbox for analysis. While the file is being analyzed, it is blocked from reaching the client, ensuring that no potentially malicious content is delivered until a verdict (clean or malicious) is received. This directly addresses the administrator's requirement to block unknown files pending sandbox analysis.

Answer

Create a custom IPS signature for unknown files

Answer

Enable outbreak prevention in the antivirus profile

Answer

Enable FortiSandbox in the antivirus profile and set 'Action for known files' to 'Block'

Question 14

A company uses FortiGate as a web application firewall (WAF) to protect a public web server. The security team wants to block SQL injection attacks. Which WAF signature category should the administrator enable?

Accepted Answer

SQL Injection. SQL injection attacks specifically target database queries by injecting malicious SQL statements through input fields. FortiGate's WAF signature category for SQL Injection is designed to detect and block these patterns, such as 'OR 1=1' or UNION-based injections, by matching against known attack signatures in the HTTP request payload.

Answer

Server-Side Request Forgery

Answer

Command Injection

Answer

Cross-Site Scripting

Question 15

What is the purpose of FortiDeceptor in an enterprise security architecture?

Accepted Answer

To simulate real assets and detect attackers attempting to interact with decoys. FortiDeceptor is a deception-based threat detection solution that deploys decoys (simulated real assets like servers, databases, or IoT devices) across the network. When an attacker probes or interacts with these decoys, FortiDeceptor generates high-fidelity alerts, enabling early detection of lateral movement or reconnaissance without relying on signatures. This aligns with the Advanced Threat Protection domain by shifting from reactive blocking to proactive deception.

Answer

To provide VPN access for remote users

Answer

To encrypt all data at rest on endpoints

Answer

To block all inbound traffic from suspicious IP addresses