The correct answer is the trigger set to 'Event Log' with a filter for the specific IPS signature, and the action set to 'Add IP to Blocklist'. This configuration is correct because an automation stitch on FortiGate requires a trigger that defines the initiating event and an action that executes the response; for automatic IP blocking, the Event Log trigger captures the IPS signature log entry, and the Add IP to Blocklist action extracts the source IP and adds it to the banned IP list, creating a direct, automated containment loop. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of how automation stitches bridge detection and response, often appearing as a scenario where a trap is to confuse the trigger with 'IPS Signature' itself or the action with 'Email Alert'—remember that the trigger must be a log event, not the signature object. A useful memory tip is "Log to Lock": the trigger must log the event, and the action must lock the IP into the blocklist.
NSE7 Advanced Threat Protection Practice Question
This NSE7 practice question tests your understanding of advanced threat protection. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An administrator configures an automation stitch on FortiGate to automatically block an IP address when a specific IPS signature triggers. What must be configured as the trigger and action?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Trigger: 'Event Log' with filter for the IPS signature; Action: 'Add IP to Blocklist'
Option A is correct because an automation stitch in FortiGate requires a trigger that defines the event that starts the automation, and an action that defines what happens when the trigger fires. For automatically blocking an IP when a specific IPS signature triggers, the trigger must be 'Event Log' with a filter for that IPS signature, and the action must be 'Add IP to Blocklist', which directly adds the source IP to the FortiGate's blocklist (banned IP list). This combination ensures that when the IPS signature is logged, the stitch extracts the source IP and applies a block.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Trigger: 'Event Log' with filter for the IPS signature; Action: 'Add IP to Blocklist'
Why this is correct
Event log triggers on specific log IDs; action adds IP to blocklist.
Related concept
Read the scenario before looking for a memorised answer.
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse 'Banned IP' (a status or list) with the actual action name 'Add IP to Blocklist', or they mistakenly think a CLI script or webhook can directly react to an IPS event without the proper log-based trigger.
Detailed technical explanation
How to think about this question
Under the hood, the 'Event Log' trigger in an automation stitch uses FortiGate's log system to match specific log messages via filters (e.g., 'subtype=ips' and 'signature_id=xxxxx'). When a match occurs, the stitch extracts the source IP from the log and passes it to the 'Add IP to Blocklist' action, which adds the IP to the FortiGate's dynamic blocklist (visible under 'Monitor > Banned IPs'). This block is temporary by default (e.g., 3600 seconds) and can be customized. In a real-world scenario, this is critical for automated threat response, such as blocking a host that triggers a critical IPS signature like 'Heartbleed' or 'EternalBlue'.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Advanced Threat Protection — This question tests Advanced Threat Protection — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Trigger: 'Event Log' with filter for the IPS signature; Action: 'Add IP to Blocklist' — Option A is correct because an automation stitch in FortiGate requires a trigger that defines the event that starts the automation, and an action that defines what happens when the trigger fires. For automatically blocking an IP when a specific IPS signature triggers, the trigger must be 'Event Log' with a filter for that IPS signature, and the action must be 'Add IP to Blocklist', which directly adds the source IP to the FortiGate's blocklist (banned IP list). This combination ensures that when the IPS signature is logged, the stitch extracts the source IP and applies a block.
What should I do if I get this NSE7 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which FortiGate feature can automatically block traffic from an IP address that is detected as malicious by FortiSandbox?
easy
A.Traffic Shaping
B.Intrusion Prevention System (IPS)
C.Application Control
✓ D.Automation Stitch
Why D: Option D is correct because Automation Stitch in FortiOS allows you to create a trigger-action pair that automatically blocks an IP address when FortiSandbox detects malicious activity. The trigger can be a FortiSandbox IOC (Indicator of Compromise) event, and the action can be an IP block via a local or external block list, enabling real-time, automated threat response without manual intervention.
Variation 2. A FortiGate admin configures an automation stitch to send an email alert when a high-severity IPS event occurs. The trigger is 'IPS Event' and the action is 'Email'. After testing, no email is sent despite events being logged. What is the most likely cause?
medium
A.The IPS event severity threshold is set too low
B.The automation stitch is disabled
✓ C.No SMTP server is configured in the FortiGate
D.The IPS engine is in monitor mode
Why C: Automation stitches require a valid mail server configuration in the FortiGate's email settings. Without it, the email action cannot be executed.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.