Courseiva
Advanced Threat ProtectionmediumMultiple SelectObjective-mapped

NSE7 Advanced Threat Protection Practice Question

An administrator needs to configure advanced email security on FortiMail to protect against phishing and spoofing. Which THREE features should be enabled to achieve comprehensive email authentication?

⚠ Common exam trap

It's easy for candidates to confuse transport security (TLS) or content filtering (Bayesian) with sender authentication protocols, forgetting that only DKIM, SPF, and DMARC directly verify domain ownership and prevent spoofing, while TLS and Bayesian filtering address different security layers (confidentiality and spam classification).

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

DKIM signing and verification

DKIM (DomainKeys Identified Mail) signing and verification is correct because it allows the sending domain to cryptographically sign outgoing emails, and the receiving server to verify that the signature matches the domain’s public DNS record. This ensures the email was not tampered with and originates from an authorized server, directly addressing phishing and spoofing by validating message integrity and sender authenticity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • DKIM signing and verification

    Why this is correct

    DKIM provides digital signatures for email integrity.

  • SPF checking

    Why this is correct

    SPF verifies sender IP against authorized servers.

  • DMARC policy enforcement

    Why this is correct

    DMARC uses SPF and DKIM results to define policy.

  • Anti-spam Bayesian filtering

    Why it's wrong here

    Anti-spam is for spam, not authentication.

  • TLS encryption for inbound/outbound

    Why it's wrong here

    TLS encrypts transport, but does not authenticate sender.

Visual reference

Client Recursive Resolver Root DNS (13 root servers) TLD DNS (.com, .org, …) Authoritative example.com query IP addr answer

About these practice questions

One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.