NSE7 Advanced Threat Protection Practice Question
A company wants to receive threat intelligence feeds from external sources to enhance their FortiGate's protection. Which method should be used to integrate external threat feeds into FortiGate?
⚠ Common exam trap
Many candidates confuse FortiGuard's built-in threat intelligence service with the ability to integrate external feeds, assuming FortiGuard can be customized to pull from third-party sources, when in fact the External Threat Feed connector is the dedicated feature for that purpose.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an external threat feed connector in FortiGate, such as using a URL to a STIX/TAXII feed.
FortiGate supports integration with external threat intelligence feeds via the External Threat Feed connector, which can consume STIX/TAXII feeds from a URL. This allows the FortiGate to dynamically update its threat database with indicators from third-party sources, enhancing its protection without relying solely on FortiGuard services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use FortiGuard Threat Intelligence Service which automatically pulls feeds.
Why it's wrong here
FortiGuard is internal; external feeds need another method.
- ✗
Manually add IP addresses to local address objects.
Why it's wrong here
This is not scalable for dynamic feeds.
- ✓
Configure an external threat feed connector in FortiGate, such as using a URL to a STIX/TAXII feed.
Why this is correct
FortiGate supports external threat feeds via indicators of compromise (IOC) using STIX/TAXII or via the 'config system external-resource' command.
- ✗
Use FortiAnalyzer to push feeds to FortiGate.
Why it's wrong here
FortiAnalyzer can aggregate logs but is not designed to push external threat feeds.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.