NSE7 Advanced Threat Protection — Timed 10 Questions

Question 1

A company is deploying FortiGate with Advanced Threat Protection (ATP) and wants to block advanced malware that uses encrypted C2 communications. Which security profile should be configured to perform SSL inspection and detect malicious traffic?

Accepted Answer

Antivirus profile with SSL inspection. Option B is correct because an Antivirus profile with SSL inspection enabled is required to decrypt encrypted C2 (command-and-control) traffic so that FortiGate can inspect the payload for malware signatures, heuristics, and behavioral patterns. Without SSL inspection, the ATP engine cannot see inside the encrypted tunnel, rendering the antivirus and other security profiles ineffective against encrypted C2 communications.

Answer

Data Leak Prevention profile

Answer

Web Filtering profile

Answer

Intrusion Prevention profile

Question 2

A network administrator notices that several endpoints are infected with ransomware despite having FortiGate ATP enabled. The logs show that the files were downloaded over HTTPS, and the antivirus profile did not detect them. What is the most likely reason?

Accepted Answer

SSL inspection was not enabled on the antivirus profile. FortiGate ATP's antivirus engine cannot inspect encrypted HTTPS traffic unless SSL inspection is explicitly enabled on the antivirus profile. Without SSL inspection, the antivirus profile only sees encrypted payloads and cannot match file signatures or heuristics, allowing ransomware to pass undetected. The logs confirm files were downloaded over HTTPS, making this the most likely root cause.

Answer

Application control profile blocked the download

Answer

FortiSandbox was not configured to analyze the files

Answer

IPS signature database was outdated

Question 3

A security engineer is troubleshooting a scenario where FortiGate is not blocking a known malicious URL categorized as 'Malware'. The web filtering profile is configured with 'monitor all' for the Malware category. What change should be made to block the URL?

Accepted Answer

Change the action for Malware category from 'monitor' to 'block' in the web filter profile. The web filtering profile currently has the Malware category set to 'monitor all', which logs but does not block traffic. To block the URL, the action must be changed from 'monitor' to 'block' within the same web filter profile. This directly enforces the blocking action for all URLs categorized as Malware, including the known malicious URL.

Answer

Configure traffic shaping to rate limit the URL

Answer

Add a static URL filter with the exact URL and action 'block'

Answer

Enable DNS filter with botnet C2 domain blocking

Question 4

A company wants to detect and block phishing emails that contain malicious links. Which FortiGate security profile should be used?

Accepted Answer

Email Filtering profile. Option D is correct because FortiGate's Email Filtering profile is specifically designed to inspect SMTP, POP3, and IMAP traffic for phishing indicators, including malicious URLs in email bodies and attachments. It can block or quarantine emails based on URL reputation, sender authentication (SPF/DKIM/DMARC), and content analysis, directly addressing the requirement to detect and block phishing emails with malicious links.

Answer

Antivirus profile

Answer

Web Filtering profile

Answer

Data Leak Prevention profile

Question 5

A FortiGate administrator receives alerts about a device communicating with a known botnet C2 server. The traffic is encrypted with TLS. Which ATP feature is most effective to block this communication?

Accepted Answer

DNS Filter with botnet C2 domain blocking. DNS Filter with botnet C2 domain blocking is the most effective because it proactively prevents the initial DNS resolution of the botnet's command-and-control domain, stopping the TLS handshake before it even begins. Since the traffic is encrypted with TLS, other security mechanisms like application control or IPS would require decryption to inspect the payload, which may not be feasible or configured. DNS Filter operates at Layer 7 without needing to decrypt the traffic, directly blocking the domain lookup based on FortiGuard's real-time threat intelligence.

Answer

Application control to block the C2 application

Answer

Antivirus profile with SSL inspection

Answer

IPS signature for botnet activity

Question 6

Which TWO features are part of FortiGate's Advanced Threat Protection (ATP) suite?

Accepted Answer

FortiGuard Antivirus. FortiGate's Advanced Threat Protection (ATP) suite is designed to detect and block advanced, unknown, and zero-day threats. FortiGuard Antivirus (C) is a core ATP component that uses signature-based and heuristics-based scanning to detect known malware at the gateway. FortiSandbox (D) extends this by detonating suspicious files in a virtual environment to identify unknown threats, making both integral to the ATP suite.

Answer

Data Leak Prevention (DLP)

Answer

SSL Inspection

Answer

Intrusion Prevention System (IPS)

Question 7

Which THREE actions should be taken to optimize FortiGate ATP performance while maintaining security?

Accepted Answer

Implement allow lists for trusted IP addresses to bypass scanning. Implementing allow lists for trusted IP addresses to bypass scanning (Option A) reduces unnecessary processing of traffic that is known to be safe, thereby optimizing FortiGate ATP performance without compromising security. This approach leverages the FortiGate's ability to exempt trusted sources from deep inspection, which lowers CPU and memory load while maintaining protection for untrusted traffic.

Answer

Disable unnecessary security profiles to reduce CPU load

Answer

Enable proxy-based inspection for all traffic

Question 8

Refer to the exhibit. An administrator notices that some malware files are not being detected by FortiGate. The antivirus profile uses flow-based scanning with FortiSandbox disabled. What is the most likely reason for missed detections?

Accepted Answer

FortiSandbox inline-scan is disabled, so unknown malware is not analyzed. Flow-based scanning inspects files as they traverse the firewall, but it relies on signatures and heuristics for detection. Without FortiSandbox inline-scan enabled, unknown or zero-day malware that does not match existing signatures will not be sent to the sandbox for behavioral analysis, so it can pass undetected. Option B correctly identifies that disabling FortiSandbox removes the ability to analyze unknown threats, which is the most likely reason for missed detections.

Answer

Flow-based scanning is less thorough than proxy-based

Answer

Quarantine is enabled, which causes files to be dropped before scanning

Answer

The antivirus profile is not applied to the firewall policy

Question 9

Refer to the exhibit. A user reports that accessing a legitimate HTTPS website is blocked. The FortiGate logs show that the connection was denied by the antivirus profile. What is the most likely cause?

Accepted Answer

The antivirus profile detected a false positive in the encrypted traffic. Option A is correct because the antivirus (AV) profile on FortiGate performs deep inspection of HTTPS traffic by decrypting it, scanning the content, and re-encrypting it. If the AV signature database contains a false positive for a legitimate website's content (e.g., a benign JavaScript file matching a malware signature), the connection will be denied. The log explicitly states the denial was by the AV profile, not by any other security profile, making a false positive in encrypted traffic the most likely cause.

Answer

The application list blocked the HTTPS application

Answer

The IPS profile blocked a vulnerability in the website

Answer

The protocol options profile blocked the SSL handshake

Question 10

A large enterprise uses FortiGate as their perimeter firewall with ATP features enabled. They have a mix of internal users and remote VPN users. Recently, several remote users reported that their machines became infected with ransomware after connecting to the VPN. The IT team suspects that the ransomware entered through the VPN tunnel. The FortiGate has an antivirus profile applied to the VPN policy with SSL inspection enabled for all traffic. However, the logs show that no malware was detected. Upon investigation, the team finds that the remote users' machines are not managed by the company and do not have any endpoint protection. The ransomware was delivered via a spear-phishing email that the users opened on their remote machines. The email traffic passed through the VPN tunnel to the corporate mail server first, then back to the user. The FortiGate antivirus profile is configured to scan SMTP traffic but the email was sent from an external source to the corporate mail server, and the mail server uses STARTTLS to receive emails. The FortiGate does not perform SSL inspection on the SMTP traffic because the SMTP service is not included in the SSL inspection profile. What action should the administrator take to prevent this in the future?

Accepted Answer

Add SMTP to the SSL inspection profile to decrypt and scan email traffic. Option B is correct because the FortiGate's antivirus profile is configured to scan SMTP traffic, but the email was encrypted via STARTTLS, and SMTP is not included in the SSL inspection profile. By adding SMTP to the SSL inspection profile, the FortiGate can decrypt the SMTP traffic, allowing the antivirus engine to inspect the email content for malware, including ransomware delivered via spear-phishing.

Answer

Disable STARTTLS on the corporate mail server to force plaintext SMTP

Answer

Require remote users to install endpoint protection with FortiClient

Answer

Block all SMTP traffic from remote VPN users