NSE7 Advanced Threat Protection Practice Question
A FortiGate administrator receives alerts about a device communicating with a known botnet C2 server. The traffic is encrypted with TLS. Which ATP feature is most effective to block this communication?
⚠ Common exam trap
Test-takers frequently assume encrypted traffic requires SSL inspection to block it, but DNS Filter blocks the domain resolution before encryption occurs, making it the most efficient and non-intrusive solution for C2 communication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS Filter with botnet C2 domain blocking
DNS Filter with botnet C2 domain blocking is the most effective because it proactively prevents the initial DNS resolution of the botnet's command-and-control domain, stopping the TLS handshake before it even begins. Since the traffic is encrypted with TLS, other security mechanisms like application control or IPS would require decryption to inspect the payload, which may not be feasible or configured. DNS Filter operates at Layer 7 without needing to decrypt the traffic, directly blocking the domain lookup based on FortiGuard's real-time threat intelligence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Application control to block the C2 application
Why it's wrong here
Application control may not identify the C2 traffic as a specific application.
- ✗
Antivirus profile with SSL inspection
Why it's wrong here
Antivirus can detect malware but not necessarily block C2 if the traffic is just a beacon.
- ✗
IPS signature for botnet activity
Why it's wrong here
IPS may detect but requires SSL inspection for encrypted traffic.
- ✓
DNS Filter with botnet C2 domain blocking
Why this is correct
DNS filter blocks resolution of known malicious domains, preventing communication.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.