NSE7 Advanced Threat Protection — Timed 10 Questions

Question 1

A FortiGate administrator receives alerts about a device communicating with a known botnet C2 server. The traffic is encrypted with TLS. Which ATP feature is most effective to block this communication?

10 minute time limit — choose an answer to begin.

Accepted Answer

DNS Filter with botnet C2 domain blocking. DNS Filter with botnet C2 domain blocking is the most effective because it proactively prevents the initial DNS resolution of the botnet's command-and-control domain, stopping the TLS handshake before it even begins. Since the traffic is encrypted with TLS, other security mechanisms like application control or IPS would require decryption to inspect the payload, which may not be feasible or configured. DNS Filter operates at Layer 7 without needing to decrypt the traffic, directly blocking the domain lookup based on FortiGuard's real-time threat intelligence.

Answer

Application control to block the C2 application

Answer

Antivirus profile with SSL inspection

Answer

IPS signature for botnet activity

Question 2

Which TWO features are part of FortiGate's Advanced Threat Protection (ATP) suite?

Accepted Answer

FortiGuard Antivirus. FortiGate's Advanced Threat Protection (ATP) suite is designed to detect and block advanced, unknown, and zero-day threats. FortiGuard Antivirus (C) is a core ATP component that uses signature-based and heuristics-based scanning to detect known malware at the gateway. FortiSandbox (D) extends this by detonating suspicious files in a virtual environment to identify unknown threats, making both integral to the ATP suite.

Answer

Data Leak Prevention (DLP)

Answer

SSL Inspection

Answer

Intrusion Prevention System (IPS)

Question 3

Which THREE actions should be taken to optimize FortiGate ATP performance while maintaining security?

Accepted Answer

Implement allow lists for trusted IP addresses to bypass scanning. Implementing allow lists for trusted IP addresses to bypass scanning (Option A) reduces unnecessary processing of traffic that is known to be safe, thereby optimizing FortiGate ATP performance without compromising security. This approach leverages the FortiGate's ability to exempt trusted sources from deep inspection, which lowers CPU and memory load while maintaining protection for untrusted traffic.

Answer

Disable unnecessary security profiles to reduce CPU load

Answer

Enable proxy-based inspection for all traffic

Question 4

Refer to the exhibit. An administrator notices that some malware files are not being detected by FortiGate. The antivirus profile uses flow-based scanning with FortiSandbox disabled. What is the most likely reason for missed detections?

Accepted Answer

FortiSandbox inline-scan is disabled, so unknown malware is not analyzed. Flow-based scanning inspects files as they traverse the firewall, but it relies on signatures and heuristics for detection. Without FortiSandbox inline-scan enabled, unknown or zero-day malware that does not match existing signatures will not be sent to the sandbox for behavioral analysis, so it can pass undetected. Option B correctly identifies that disabling FortiSandbox removes the ability to analyze unknown threats, which is the most likely reason for missed detections.

Answer

Flow-based scanning is less thorough than proxy-based

Answer

Quarantine is enabled, which causes files to be dropped before scanning

Answer

The antivirus profile is not applied to the firewall policy

Question 5

A large enterprise uses FortiGate as their perimeter firewall with ATP features enabled. They have a mix of internal users and remote VPN users. Recently, several remote users reported that their machines became infected with ransomware after connecting to the VPN. The IT team suspects that the ransomware entered through the VPN tunnel. The FortiGate has an antivirus profile applied to the VPN policy with SSL inspection enabled for all traffic. However, the logs show that no malware was detected. Upon investigation, the team finds that the remote users' machines are not managed by the company and do not have any endpoint protection. The ransomware was delivered via a spear-phishing email that the users opened on their remote machines. The email traffic passed through the VPN tunnel to the corporate mail server first, then back to the user. The FortiGate antivirus profile is configured to scan SMTP traffic but the email was sent from an external source to the corporate mail server, and the mail server uses STARTTLS to receive emails. The FortiGate does not perform SSL inspection on the SMTP traffic because the SMTP service is not included in the SSL inspection profile. What action should the administrator take to prevent this in the future?

Accepted Answer

Add SMTP to the SSL inspection profile to decrypt and scan email traffic. The FortiGate's antivirus profile is configured to scan SMTP traffic, but the email was encrypted via STARTTLS, and SMTP is not included in the SSL inspection profile. By adding SMTP to the SSL inspection profile, the FortiGate can decrypt the SMTP traffic, allowing the antivirus engine to inspect the email content for malware, including ransomware delivered via spear-phishing.

Answer

Disable STARTTLS on the corporate mail server to force plaintext SMTP

Answer

Require remote users to install endpoint protection with FortiClient

Answer

Block all SMTP traffic from remote VPN users

Question 6

Drag and drop the steps to configure OSPF on a FortiGate firewall into the correct order.

Accepted Answer

Step 1: Create virtual router, Step 2: Define areas and networks, Step 3: Set router ID, Step 4: Enable on interfaces, Step 5: Verify. Create virtual router, define areas and networks, set router ID, enable on interfaces, then verify.

Answer

Step 1: Set router ID, Step 2: Create virtual router, Step 3: Define areas and networks, Step 4: Enable on interfaces, Step 5: Verify

Answer

Step 1: Create virtual router, Step 2: Set router ID, Step 3: Enable on interfaces, Step 4: Define areas and networks, Step 5: Verify

Answer

Step 1: Define areas and networks, Step 2: Create virtual router, Step 3: Set router ID, Step 4: Enable on interfaces, Step 5: Verify

Question 7

Match each FortiGate security profile to its category.

Accepted Answer

Antivirus Profile: Protects against malware by scanning files and email attachments.. The correct matches are: Antivirus for malware scanning, Web Filter for URL categorization, and Application Control for app identification. Common confusions arise between Antivirus and Web Filter roles.

Answer

Antivirus Profile: Controls web content based on categories.

Answer

Web Filter Profile: Scans for viruses in traffic.

Question 8

A network admin configures FortiGate to submit files to FortiSandbox for analysis. After submission, the FortiGate logs show that files are being sent but no verdict is returned. The FortiSandbox is reachable and licensed. What is the most likely cause?

Accepted Answer

The FortiGate does not have a FortiGuard Security Rating subscription. FortiGate requires a valid FortiGuard Security Rating subscription to receive verdicts from FortiSandbox. Without this subscription, the FortiGate can submit files and see them as sent in logs, but it cannot process the returned verdicts, resulting in no action taken on the files. The Security Rating subscription enables the communication channel for verdict retrieval, distinct from the basic FortiSandbox license.

Answer

The FortiGate is using proxy-based inspection instead of flow-based

Answer

The FortiSandbox server's IP is not added to the FortiGate's trusted hosts

Answer

The antivirus profile is set to block without scanning

Question 9

An organization wants to protect against unknown malware by using machine learning on FortiGate. Which antivirus setting should be enabled to achieve this?

Accepted Answer

Enable 'Machine Learning Engine' in the antivirus profile. The 'Machine Learning Engine' in the antivirus profile uses on-device machine learning models to detect unknown malware based on file characteristics, without requiring signature updates. This provides proactive protection against zero-day threats directly on the FortiGate, aligning with the requirement to protect against unknown malware using machine learning.

Answer

Enable 'Outbreak Prevention' under FortiGuard settings

Answer

Set 'av-engine' to 'flow' under system settings

Answer

Enable 'FortiSandbox inline scanning' in the antivirus profile

Question 10

A FortiGate administrator wants to block a custom protocol anomaly where a client sends an HTTP request with a malformed header containing a null byte. Which advanced IPS feature should be used?

Accepted Answer

Enable Protocol Anomaly Detection in the IPS sensor. Protocol Anomaly Detection in the IPS sensor is designed to identify deviations from standard protocol behavior, such as malformed headers or null bytes in HTTP requests. This feature inspects traffic for known protocol violations without requiring custom signatures, making it the correct choice for blocking a null byte anomaly in HTTP headers.

Answer

Create a custom IPS signature to match the null byte pattern

Answer

Enable 'Outbreak Prevention' in the IPS sensor

Answer

Use the 'http-policy' setting in the WAF profile