NSE7 Advanced Threat Protection Practice Question
A security analyst wants to use automation stitches on FortiGate to automatically block IP addresses that trigger an IPS signature for 'SSH Brute Force'. Which two components are required to create this automation stitch? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse optional actions like email notifications or external log queries as required components, when only the trigger and a blocking action are mandatory to create a functional automation stitch for IP blocking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Action: 'Add to Block List'
The 'Add to Block List' action is the specific automation stitch action that dynamically adds the offending IP address to the FortiGate's local block list, effectively blocking further SSH brute-force attempts. This action directly enforces the security policy by preventing the source IP from accessing the firewall until the block expires or is manually removed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Action: 'Add to Block List'
Why this is correct
The action should block the source IP.
- ✗
FortiAnalyzer log query
Why it's wrong here
Log queries can be triggers but not for real-time IPS events.
- ✗
Action: 'Email Notification'
Why it's wrong here
Email notification is an action but does not block the IP.
- ✓
Trigger: 'IPS Event'
Why this is correct
The trigger should be an IPS event matching the signature.
- ✗
FortiGuard category
Why it's wrong here
FortiGuard categories are not used in automation stitches.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.