NSE7 Advanced Threat Protection Practice Test 9 — 15 Questions

Question 1

An administrator wants to create an automation stitch that responds to a high-severity IPS event by blocking the attacker IP. Which THREE components are required to build this automation stitch?

Accepted Answer

Trigger (e.g., IPS Event). An automation stitch in FortiOS requires a trigger to initiate the workflow. In this scenario, the IPS event trigger is specifically designed to fire when a high-severity IPS signature match occurs, providing the necessary event data (e.g., attacker IP) to pass to subsequent actions. Without a trigger, the stitch would have no starting point.

Answer

Schedule (e.g., run every hour)

Answer

Condition (e.g., severity threshold)

Question 2

A network admin notices that files submitted to FortiSandbox are not being analyzed. The FortiGate is configured to send files to FortiSandbox. What is the MOST likely cause?

Accepted Answer

FortiSandbox license is expired. The most likely cause is an expired FortiSandbox license. When the license expires, FortiSandbox stops analyzing submitted files and may reject new submissions, even though the FortiGate is configured to send them. The FortiGate will still attempt to forward files, but FortiSandbox will not process them, resulting in no analysis results being returned.

Answer

FortiGate firewall policy is blocking the connection to FortiSandbox on port 443

Answer

FortiSandbox is in quarantine mode

Answer

File size exceeds the maximum submission size limit on FortiGate

Question 3

An admin wants to block malicious files detected by FortiSandbox at the FortiGate level. Which configuration is required on the FortiGate to automatically block files based on FortiSandbox verdict?

Accepted Answer

Enable 'FortiSandbox inline prevention' in the antivirus profile. Enabling 'FortiSandbox inline prevention' in the antivirus profile allows FortiGate to automatically block files based on the verdict received from FortiSandbox. When this option is enabled, the FortiGate will hold the file until the sandbox analysis completes, then either allow or block the file based on the verdict (e.g., malware detected). This is the direct configuration for automatic file blocking at the gateway level.

Answer

Enable Threat Feeds on FortiGate and subscribe to FortiSandbox feeds

Answer

Configure an Automation Stitch that triggers on malware detected events and blocks the source IP

Answer

Configure a security policy with a Web Filter profile that blocks malware categories

Question 4

A company uses an advanced antivirus profile with machine learning engine enabled. After a recent outbreak, several files that were previously undetected are now flagged. How does the outbreak prevention feature help in this situation?

Accepted Answer

It downloads the latest ML models from FortiGuard to detect new threats. The outbreak prevention feature in FortiGate's advanced antivirus profile automatically downloads the latest machine learning (ML) models from FortiGuard when a new outbreak is detected. This allows the ML engine to identify and flag previously undetected files without requiring a traditional signature update, enabling proactive detection of zero-day threats.

Answer

It sends all files to FortiSandbox for analysis

Answer

It quarantines all files for 24 hours until a signature is released

Answer

It blocks all executable files from being downloaded

Question 5

An admin wants to ensure that office documents (e.g., Word, Excel) downloaded from the internet are safe before users open them. Which feature should be used to remove potentially malicious macros and active content?

Accepted Answer

Content Disarm and Reconstruction (CDR). Content Disarm and Reconstruction (CDR) is the correct feature because it proactively removes potentially malicious macros, scripts, and active content from office documents by stripping the original file's active elements and rebuilding a safe, sanitized version. Unlike detection-based methods, CDR eliminates threats before the file reaches the user, ensuring that even unknown or zero-day macro-based attacks are neutralized.

Answer

Machine learning engine

Answer

Antivirus pattern matching

Answer

FortiSandbox file submission

Question 6

An IPS administrator wants to detect a new custom attack that sends malformed HTTP headers. The attack pattern is a specific sequence of bytes that is not covered by existing signatures. What is the BEST way to detect this attack on FortiGate?

Accepted Answer

Create a custom IPS signature. Custom IPS signatures allow you to define a specific byte sequence or pattern (e.g., via a regular expression or hex pattern) that matches the malformed HTTP header. FortiGate's IPS engine can then inspect HTTP traffic at the application layer and trigger an alert or block when the custom pattern is found, even if no existing signature covers it.

Answer

Use an automation stitch to block traffic with unusual headers

Answer

Enable protocol anomaly detection in the IPS sensor

Answer

Deploy FortiWeb as a reverse proxy

Question 7

A FortiGate is configured with an IPS sensor that has protocol anomaly detection enabled. The admin notices that legitimate VoIP traffic (SIP) is being blocked. Which action should the admin take to reduce false positives?

Accepted Answer

Tune the protocol anomaly thresholds to be more lenient for SIP. Protocol anomaly detection in IPS sensors uses predefined thresholds to identify abnormal traffic patterns. When legitimate SIP traffic is being blocked, tuning the protocol anomaly thresholds to be more lenient for SIP allows the sensor to accommodate normal variations in SIP behavior without triggering false positives, while still maintaining protection against actual anomalies.

Answer

Change the IPS action from block to monitor

Answer

Add the VoIP servers to an IP exemption list in the IPS sensor

Answer

Disable protocol anomaly detection entirely

Question 8

An organization wants to protect a public-facing web application against SQL injection and cross-site scripting (XSS) attacks. They have a FortiGate and a FortiWeb. What is the BEST deployment approach?

Accepted Answer

Deploy FortiWeb in reverse proxy mode in front of the web server. FortiWeb in reverse proxy mode is the best deployment because it terminates the client connection and inspects all HTTP/HTTPS traffic at the application layer (Layer 7) using specialized web application firewall (WAF) signatures and machine learning to detect and block SQL injection and XSS payloads before they reach the web server. Unlike a network firewall or IPS, FortiWeb is purpose-built for web application security and can decode, normalize, and analyze complex attack patterns that might evade simpler inspection methods.

Answer

Place the web server in a DMZ and rely on firewall policies

Answer

Use FortiGate WAF profile only

Answer

Use FortiGate IPS signatures for SQL injection and XSS

Question 9

An email security administrator wants to prevent attackers from spoofing the company's domain. Which email authentication mechanism should be configured to allow receiving servers to verify that emails claiming to be from the domain are sent from authorized mail servers?

Accepted Answer

SPF. SPF (Sender Policy Framework) is the correct answer because it allows domain owners to publish DNS records specifying which mail servers are authorized to send email on behalf of their domain. Receiving servers can then verify the envelope sender (Return-Path) against the SPF record to detect spoofed messages. This directly addresses the requirement to verify that emails claiming to be from the domain originate from authorized servers.

Answer

DMARC

Answer

TLS for SMTP

Answer

DKIM

Question 10

A company uses FortiMail to protect email. They set up DMARC with a policy of 'quarantine' for emails failing SPF and DKIM checks. However, legitimate emails from a third-party service are being quarantined. What should the admin do?

Accepted Answer

Update the SPF record to include the third-party mail server IP. The root cause is that the third-party mail server's IP is not authorized in the sender domain's SPF record. DMARC uses SPF alignment: if the message fails SPF (because the sending IP is not listed) and also fails DKIM, DMARC enforces the 'quarantine' policy. Adding the third-party IP to the SPF record allows SPF to pass, achieving alignment and preventing quarantine.

Answer

Add the sender domain to a whitelist in FortiMail

Answer

Change the DMARC policy to 'none'

Answer

Disable DMARC checking for that specific sender

Question 11

Which Fortinet product is designed to deploy decoy systems to lure attackers and detect lateral movement within the network?

Accepted Answer

FortiDeceptor. FortiDeceptor is specifically designed to deploy decoy systems (honeypots) that mimic real assets, such as servers or endpoints, to lure attackers. It detects lateral movement by monitoring decoy interactions and generating alerts when an attacker probes or compromises these fake targets, providing early warning of network intrusion.

Answer

FortiSandbox

Answer

FortiSOAR

Answer

FortiEDR

Question 12

An organization wants to implement a solution that can detect and automatically respond to threats across multiple Fortinet security products. Which product should they use?

Accepted Answer

FortiSOAR. FortiSOAR is the correct choice because it is a security orchestration, automation, and response (SOAR) platform designed to ingest alerts from multiple Fortinet products (e.g., FortiGate, FortiSIEM, FortiMail) and execute automated playbooks for threat detection and response. Unlike management or analytics tools, FortiSOAR provides the cross-product incident response and automation capabilities required to detect and automatically respond to threats across the Fortinet security fabric.

Answer

FortiManager

Answer

FortiSIEM

Answer

FortiAnalyzer

Question 13

A security analyst wants to use automation stitches on FortiGate to automatically block an IP address when a critical severity event is logged. Which TWO components are essential to create this automation stitch? (Choose two.)

Accepted Answer

An action that adds the source IP to a firewall address group. An automation stitch in FortiGate requires an action to execute a specific task, such as adding a source IP to a firewall address group, which effectively blocks the IP. This action is essential for enforcing the security response triggered by the stitch.

Answer

A FortiGuard subscription

Answer

A FortiAnalyzer to store logs

Answer

A static route to the internet

Question 14

An organization is deploying FortiEDR to enhance endpoint protection. Which THREE capabilities does FortiEDR provide? (Choose three.)

Accepted Answer

Forensic investigation and root cause analysis. FortiEDR provides forensic investigation and root cause analysis by recording detailed endpoint telemetry, including process creation, network connections, and file system changes. This allows security teams to reconstruct the full attack chain after an incident, identifying the initial infection vector and all subsequent malicious activities. The platform correlates these events across multiple endpoints to provide a comprehensive timeline for investigation.

Answer

Decoy deployment to lure attackers

Answer

Email security filtering

Question 15

A FortiGate administrator wants to use threat intelligence feeds to block known malicious IP addresses. Which TWO steps are required to accomplish this? (Choose two.)

Accepted Answer

Create an external threat feed connector pointing to the IoC source. An external threat feed connector must be created in FortiGate to import indicators of compromise (IoC) from a third-party source. This connector defines the URL, authentication, and update interval for the feed, allowing FortiGate to consume and store the malicious IP addresses as a local threat feed object.

Answer

Enable IPS on all policies

Answer

Configure FortiGuard to push feeds automatically

Answer

Subscribe to FortiSandbox