NSE7 Advanced Threat Protection Practice Question
An administrator wants to integrate FortiGate with an external threat intelligence feed to block known malicious IP addresses automatically. Which object should be used to consume the feed?
⚠ Common exam trap
Many exam-takers confuse the External Threat Intelligence Feed with an Address Group, thinking they can manually add IPs from a feed into a group, but FortiGate requires the dedicated feed object to automate the ingestion and dynamic updates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
External Threat Intelligence Feed
The External Threat Intelligence Feed object in FortiGate is specifically designed to consume external threat intelligence feeds (e.g., STIX/TAXII, CSV, or plain text lists) and automatically update a dynamic address object with indicators of compromise (IoCs) such as malicious IP addresses. This enables automated blocking of known malicious sources without manual intervention, making it the correct choice for integrating an external feed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
External Threat Intelligence Feed
Why this is correct
This object dynamically updates with threat indicators.
- ✗
IP Pool
Why it's wrong here
IP Pool is used for NAT, not threat feeds.
- ✗
Address Group
Why it's wrong here
Address groups are static, not dynamic feeds.
- ✗
Security Profile Group
Why it's wrong here
Security profile groups contain profiles, not IP addresses.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.