NSE7 Advanced Threat Protection Practice Question
A security analyst notices repeated failed login attempts from a specific IP address to the FortiGate management interface. The administrator wants to automatically blacklist the IP after 3 failed attempts within 60 seconds. Which feature should be configured?
⚠ Common exam trap
Many candidates confuse the 'intruder lockout' feature (which is an admin authentication control) with DoS policies or IPS, because all three can block IPs, but only the intruder lockout is triggered by failed login attempts to the management interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Admin lockdown and intruder lockout settings
The 'Admin lockdown and intruder lockout' settings in FortiGate are specifically designed to detect repeated failed login attempts to the management interface and automatically blacklist the offending IP address after a configurable number of failures within a defined time window. This feature operates at the authentication layer, directly monitoring admin login attempts, and can enforce a lockout threshold (e.g., 3 failures in 60 seconds) to block the source IP, which matches the requirement exactly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Intrusion Prevention System (IPS) with custom signature
Why it's wrong here
IPS is not designed for login failure blacklisting.
- ✗
FortiGate's built-in DoS policy and blacklist
Why it's wrong here
DoS policies mitigate floods, not brute force login.
- ✓
Admin lockdown and intruder lockout settings
Why this is correct
FortiGate can be configured to lock out IPs after failed admin login attempts via 'config system admin' settings or via 'config system global' set admin-lockout-threshold and admin-lockout-duration.
- ✗
Administrative access trusted hosts
Why it's wrong here
Trusted hosts limit access, but do not auto-blacklist based on attempts.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.