NSE7 Advanced Threat Protection Practice Question
An administrator is configuring FortiGate automation stitches to respond to a detected brute-force attack against an internal web server. The trigger is set to 'Event' with a condition matching repeated failed login attempts. Which TWO actions are appropriate to mitigate the attack? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse 'quarantine' (a FortiClient/EMS endpoint concept) with network-level blocking, or assume that disabling a user account via CLI is a valid automation stitch action, when FortiGate stitches primarily handle network and security fabric actions, not OS-level account management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the source IP to a local address group that is used in a block policy
Adding the source IP to a local address group that is referenced in a block policy dynamically updates the firewall rule set to drop all traffic from that IP. This is a common automation stitch action in FortiGate that leverages the local address object and policy to enforce immediate blocking without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add the source IP to a local address group that is used in a block policy
Why this is correct
This blocks traffic from the attacker IP.
- ✓
Send an email notification to the SOC team
Why this is correct
Informing the SOC allows further investigation and response.
- ✗
Enable quarantine on the web server
Why it's wrong here
Quarantine is not a direct action in automation stitches; it applies to files in sandbox.
- ✗
Shut down the web server interface
Why it's wrong here
Shutting down the interface would affect all traffic, not just the attack.
- ✗
Run a CLI script to disable the user account
Why it's wrong here
Automation stitches cannot disable user accounts directly.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.