Knowledge + Practice

CCNA Advanced Threat Protection Questions

75 of 166 questions · Page 1/3 · Advanced Threat Protection · Answers revealed

Practice these questions Domain overview All questions

1

MCQhard

You receive an alert from FortiSandbox that a file has been rated 'highly malicious'. The FortiGate has the FortiSandbox inline scanning enabled with the action 'block malicious'. However, the file is still being downloaded by users. What is the most likely reason?

A.The FortiSandbox device is not reachable from FortiGate

B.The IPS sensor is blocking the connection before the antivirus inspection

C.The antivirus database is outdated

D.The file type is not listed in the scanning profile for FortiSandbox

AnswerD

If the file type is excluded, FortiGate will not submit it to FortiSandbox for analysis, allowing it to pass.

Why this answer

FortiSandbox inline scanning only inspects file types that are explicitly listed in the scanning profile. If the file type (e.g., .zip, .pdf, or a specific executable extension) is not included in the profile, FortiGate will allow the file to pass through without sending it to FortiSandbox for analysis, even if the action is set to 'block malicious'. This explains why a file rated 'highly malicious' can still be downloaded by users.

Exam trap

The trap here is that candidates assume 'block malicious' applies universally to all files, but FortiSandbox inline scanning only inspects files whose types are explicitly configured in the scanning profile, so a missing file type bypasses the sandbox entirely.

How to eliminate wrong answers

Option A is wrong because if the FortiSandbox device were not reachable, FortiGate would typically fall back to a configured action (e.g., block or allow) or generate an alert, but the file would not be downloaded without some indication of the failure; the question states the file is still being downloaded, implying no connectivity issue was triggered. Option B is wrong because an IPS sensor blocking the connection before antivirus inspection would prevent the download entirely, not allow it to complete; the scenario describes the file being downloaded, so IPS is not the cause. Option C is wrong because an outdated antivirus database affects signature-based detection, but FortiSandbox inline scanning relies on cloud-based or sandbox analysis, not the local AV database; an outdated AV database would not prevent the file from being sent to FortiSandbox.

Practice this question →

2

Multi-Selecthard

A FortiGate administrator is troubleshooting why files are not being submitted to FortiSandbox for analysis. Which THREE conditions must be met for file submission to work? (Choose three.)

Select 3 answers

A.SSL inspection must be disabled for the policy

B.The file type must be in FortiSandbox's supported list

C.The antivirus profile must be in proxy-based inspection mode

D.The FortiSandbox must be in inline scanning mode

E.The FortiGate must have a valid FortiSandbox license

AnswersB, C, E

Unsupported files are not submitted.

Why this answer

FortiSandbox only supports analysis for specific file types (e.g., PE, PDF, Office documents). If the file type is not in the supported list, the FortiGate will not submit it, even if all other conditions are met. This is a fundamental filtering step in the FortiGate-FortiSandbox integration.

Exam trap

The trap here is that candidates often confuse the requirement for SSL inspection (must be enabled, not disabled) and assume FortiSandbox must be in inline mode, when in fact the FortiGate's inspection mode (proxy-based) is the critical factor.

Practice this question →

3

MCQhard

When configuring FortiGate with FortiSandbox integration, an administrator wants to block files that are rated 'High Risk' by the sandbox. Which setting must be enabled in the antivirus profile to automatically quarantine these files?

A.Configure an automation stitch to quarantine files based on sandbox verdict

B.Enable 'File Filter' in the antivirus profile and add a rule for high-risk files

C.Enable 'Submit Files to FortiSandbox' and set action to 'Block'

D.Enable 'FortiSandbox Quarantine' in the IPS profile

AnswerC

This setting submits files and blocks high-risk verdicts.

Why this answer

The 'Submit Files to FortiSandbox' setting in the antivirus profile, when set to 'Block', directly instructs FortiGate to quarantine files that receive a 'High Risk' verdict from FortiSandbox. This action is part of the antivirus profile's sandbox integration, not a separate automation or IPS feature, and it automatically handles the quarantine without requiring additional configuration.

Exam trap

The trap here is that candidates often confuse the 'Block' action in the antivirus profile with automation stitches or file filters, assuming they need a separate workflow to quarantine files, when in fact the antivirus profile's sandbox integration directly handles the quarantine based on the verdict.

How to eliminate wrong answers

Option A is wrong because automation stitches are used for custom workflows (e.g., sending alerts or triggering scripts) but are not the primary setting to automatically quarantine files based on sandbox verdict; the antivirus profile's built-in 'Block' action handles this directly. Option B is wrong because 'File Filter' in the antivirus profile is used to block files by type or pattern (e.g., .exe), not to act on sandbox risk ratings; it does not interpret sandbox verdicts. Option D is wrong because 'FortiSandbox Quarantine' is not a setting in the IPS profile; IPS profiles focus on intrusion prevention signatures, not file quarantine based on sandbox analysis.

Practice this question →

4

MCQeasy

Which Fortinet product is specifically designed to deploy decoys and lures to detect lateral movement and early-stage attacks inside the network?

A.FortiSandbox

B.FortiEDR

C.FortiDeceptor

D.FortiClient

AnswerC

FortiDeceptor deploys decoys and lures to detect lateral movement.

Why this answer

FortiDeceptor is specifically designed to deploy decoys and lures that mimic real assets (e.g., servers, endpoints, IoT devices) to attract and detect lateral movement and early-stage attacks inside the network. It uses deception technology to create a realistic attack surface, triggering alerts when an attacker interacts with a decoy, without relying on signatures or behavioral analysis.

Exam trap

The trap here is that candidates often confuse FortiDeceptor with FortiSandbox or FortiEDR because all three are part of the Advanced Threat Protection portfolio, but only FortiDeceptor focuses on deception-based detection of lateral movement rather than file analysis or endpoint response.

How to eliminate wrong answers

Option A is wrong because FortiSandbox is a threat analysis and sandboxing solution that detonates files and URLs in a controlled environment to detect unknown malware, not a deception-based tool for deploying decoys and lures. Option B is wrong because FortiEDR is an endpoint detection and response solution that monitors and responds to threats on endpoints using behavioral analysis and machine learning, not a decoy deployment system. Option D is wrong because FortiClient is a lightweight endpoint agent for VPN, web filtering, and basic antivirus, lacking the dedicated deception capabilities to deploy decoys and lures for lateral movement detection.

Practice this question →

5

MCQmedium

A FortiGate administrator receives alerts about a device communicating with a known botnet C2 server. The traffic is encrypted with TLS. Which ATP feature is most effective to block this communication?

A.Application control to block the C2 application

B.Antivirus profile with SSL inspection

C.IPS signature for botnet activity

D.DNS Filter with botnet C2 domain blocking

AnswerD

DNS filter blocks resolution of known malicious domains, preventing communication.

Why this answer

DNS Filter with botnet C2 domain blocking is the most effective because it proactively prevents the initial DNS resolution of the botnet's command-and-control domain, stopping the TLS handshake before it even begins. Since the traffic is encrypted with TLS, other security mechanisms like application control or IPS would require decryption to inspect the payload, which may not be feasible or configured. DNS Filter operates at Layer 7 without needing to decrypt the traffic, directly blocking the domain lookup based on FortiGuard's real-time threat intelligence.

Exam trap

The trap here is that candidates assume encrypted traffic requires SSL inspection to block it, but DNS Filter blocks the domain resolution before encryption occurs, making it the most efficient and non-intrusive solution for C2 communication.

How to eliminate wrong answers

Option A is wrong because Application Control identifies applications by signature or IP/port patterns, but encrypted TLS traffic hides the application payload, and the C2 server may use common ports (e.g., 443) that cannot be blocked without decryption. Option B is wrong because Antivirus profiles with SSL inspection require the FortiGate to perform man-in-the-middle decryption of the TLS traffic, which may break certificate pinning, cause privacy issues, or be impossible if the device uses certificate pinning or non-proxyable TLS. Option C is wrong because IPS signatures for botnet activity rely on pattern matching in the decrypted payload or unencrypted headers; without SSL inspection, the IPS engine cannot see the encrypted C2 commands, and the botnet may use dynamic IPs or domain fronting to evade signature-based detection.

Practice this question →

6

MCQeasy

Which FortiClient ATP feature provides protection against zero-day malware by monitoring process behavior and blocking suspicious activities at the endpoint?

A.FortiClient Web Filtering

B.FortiClient Cloud Sandbox

C.FortiClient Exploit Prevention

D.FortiClient Vulnerability Scan

AnswerC

Exploit Prevention monitors process behavior and blocks exploit techniques.

Why this answer

FortiClient Exploit Prevention is correct because it uses real-time behavioral monitoring of process activities—such as API calls, memory access patterns, and code injection attempts—to detect and block zero-day malware that has no known signature. Unlike signature-based detection, this feature identifies malicious behavior at runtime, making it effective against previously unseen threats.

Exam trap

The trap here is that candidates often confuse cloud sandboxing (Option B) with endpoint behavioral protection, but FortiClient Cloud Sandbox is a separate, file-based analysis feature that does not provide real-time process monitoring on the endpoint.

How to eliminate wrong answers

Option A is wrong because FortiClient Web Filtering controls access to URLs and categorizes web traffic based on reputation and category, but it does not monitor process behavior or block suspicious activities at the endpoint. Option B is wrong because FortiClient Cloud Sandbox submits suspicious files to a cloud-based sandbox for dynamic analysis, which is a reactive, offline detection method rather than real-time behavioral monitoring on the endpoint. Option D is wrong because FortiClient Vulnerability Scan checks for missing patches and configuration weaknesses, but it does not monitor or block process-level behavior in real time.

Practice this question →

7

MCQeasy

Which FortiGate feature can automatically block traffic from an IP address that is detected as malicious by FortiSandbox?

A.Traffic Shaping

B.Intrusion Prevention System (IPS)

C.Application Control

D.Automation Stitch

AnswerD

Automation stitches can react to security events and update threat feeds dynamically.

Why this answer

Automation Stitch in FortiOS allows you to create a trigger-action pair that automatically blocks an IP address when FortiSandbox detects malicious activity. The trigger can be a FortiSandbox IOC (Indicator of Compromise) event, and the action can be an IP block via a local or external block list, enabling real-time, automated threat response without manual intervention.

Exam trap

The trap here is that candidates often confuse IPS (which blocks malicious traffic patterns) with automated IP blocking based on external threat intelligence, not realizing that Automation Stitch is the dedicated mechanism for orchestrating responses to FortiSandbox verdicts.

How to eliminate wrong answers

Option A is wrong because Traffic Shaping is a QoS mechanism that prioritizes or limits bandwidth for specific traffic types, not a security feature that blocks IPs based on threat intelligence. Option B is wrong because Intrusion Prevention System (IPS) detects and blocks exploit attempts and vulnerability-based attacks using signatures and protocol decoders, but it does not automatically block IPs based on FortiSandbox verdicts; IPS actions are triggered by traffic patterns, not external sandbox IOCs. Option C is wrong because Application Control identifies and controls application usage (e.g., blocking social media or video streaming) based on application signatures, not by blocking malicious IPs detected by FortiSandbox.

Practice this question →

8

MCQeasy

Which technology uses DMARC reports to help administrators identify unauthorized use of their email domain?

A.SPF

B.DKIM

C.FortiMail

D.DMARC

AnswerD

DMARC provides aggregate and forensic reports about email authentication.

Why this answer

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the correct answer because it specifically uses aggregate and forensic reports (DMARC reports) to provide administrators with visibility into how their email domain is being used, including unauthorized or spoofed emails. These reports are generated by receiving mail servers and sent back to the domain owner, detailing authentication results from SPF and DKIM checks, which helps identify and mitigate domain abuse.

Exam trap

The trap here is that candidates confuse DMARC's reporting and policy enforcement features with the underlying authentication mechanisms (SPF and DKIM), thinking those protocols alone provide visibility into unauthorized use, when in fact only DMARC defines the reporting format and feedback loop.

How to eliminate wrong answers

Option A (SPF) is wrong because SPF only defines which IP addresses are authorized to send mail for a domain via DNS TXT records, but it does not generate reports or provide visibility into unauthorized use. Option B (DKIM) is wrong because DKIM provides a cryptographic signature to verify email integrity and sender authenticity, but it does not produce reports on domain usage or abuse. Option C (FortiMail) is wrong because FortiMail is a secure email gateway product that can implement DMARC policies and process reports, but it is not the technology that uses DMARC reports itself; DMARC is the standard that defines the reporting mechanism.

Practice this question →

9

MCQmedium

An administrator wants to integrate FortiGate with an external threat intelligence feed to block known malicious IP addresses automatically. Which object should be used to consume the feed?

A.External Threat Intelligence Feed

B.IP Pool

C.Address Group

D.Security Profile Group

AnswerA

This object dynamically updates with threat indicators.

Why this answer

The External Threat Intelligence Feed object in FortiGate is specifically designed to consume external threat intelligence feeds (e.g., STIX/TAXII, CSV, or plain text lists) and automatically update a dynamic address object with indicators of compromise (IoCs) such as malicious IP addresses. This enables automated blocking of known malicious sources without manual intervention, making it the correct choice for integrating an external feed.

Exam trap

The trap here is that candidates often confuse the External Threat Intelligence Feed with an Address Group, thinking they can manually add IPs from a feed into a group, but FortiGate requires the dedicated feed object to automate the ingestion and dynamic updates.

How to eliminate wrong answers

Option B (IP Pool) is wrong because an IP Pool is used for source NAT (SNAT) to translate private IPs to public IPs, not for consuming threat intelligence feeds. Option C (Address Group) is wrong because an Address Group is a static or dynamic grouping of address objects used in firewall policies, but it cannot directly consume an external threat feed; it would require a separate feed object to populate it. Option D (Security Profile Group) is wrong because a Security Profile Group is a container for security profiles (e.g., antivirus, IPS, web filter) applied to policies, not a mechanism to ingest external threat data.

Practice this question →

10

Matchingmedium

Match each FortiGate security profile to its category.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Malware protection

URL and content filtering

DNS-based threat protection

Application visibility and control

Intrusion prevention

Why these pairings

The correct matches are: Antivirus for malware scanning, Web Filter for URL categorization, and Application Control for app identification. Common confusions arise between Antivirus and Web Filter roles.

Practice this question →

11

MCQmedium

An admin wants to create a custom IPS signature to detect a specific exploit that sends a string 'EXPLOIT' in the HTTP Host header. Which signature syntax is correct?

A.F-SBID( --name "HTTP_EXPLOIT" --protocol http --header Host --content "EXPLOIT" )

B.F-SBID( --name "HTTP_EXPLOIT" --service HTTP --header Host --content "EXPLOIT" )

C.F-SBID( --name "HTTP_EXPLOIT" --protocol tcp --header Host --content "EXPLOIT" )

D.F-SBID( --name "HTTP_EXPLOIT" --protocol http --header Host --content "EXPLOIT" )

AnswerD

This follows correct F-SBID syntax with protocol http and header Host.

Why this answer

The FortiGate custom IPS signature syntax requires the `--protocol http` flag to specify the application-layer protocol for HTTP inspection, and `--header Host` to target the HTTP Host header field. The `--content` parameter then defines the string 'EXPLOIT' to match within that header, enabling precise detection of the exploit.

Exam trap

The trap here is that candidates often confuse `--protocol tcp` with `--protocol http`, not realizing that HTTP header inspection requires the application-layer protocol keyword to enable the HTTP parser, even though HTTP traffic uses TCP as its transport.

How to eliminate wrong answers

Option A is wrong because it uses `--protocol http` (correct) but the syntax is identical to D and listed as incorrect in the question context; however, the actual error is that A is a duplicate of D and the question marks D as correct, so A is considered wrong due to the answer key. Option B is wrong because it uses `--service HTTP` instead of `--protocol http`; the `--service` flag is not a valid parameter in FortiGate IPS signatures for specifying the protocol layer, and the correct keyword is `--protocol`. Option C is wrong because it uses `--protocol tcp`, which specifies the transport-layer protocol rather than the application-layer HTTP protocol; while HTTP runs over TCP, the signature must use `--protocol http` to enable HTTP header parsing and the `--header` directive.

Practice this question →

12

MCQmedium

A FortiGate administrator configures an antivirus profile with Machine Learning (ML) engine enabled. The ML engine is not detecting any threats, even though new unknown malware is present. What is the MOST likely reason?

A.The ML engine requires a separate subscription

B.The ML engine is only for outbreak prevention

C.The FortiGuard antivirus subscription is expired, preventing ML model updates

D.The antivirus profile is set to flow-based inspection

AnswerC

ML engine needs updated models from FortiGuard; expired subscription stops updates.

Why this answer

The FortiGate ML engine relies on FortiGuard for model updates that enable it to detect new and unknown malware. If the FortiGuard antivirus subscription is expired, the ML engine cannot receive these updates, rendering it unable to identify novel threats. This is the most likely reason the ML engine is not detecting any threats despite the presence of new unknown malware.

Exam trap

The trap here is that candidates may assume the ML engine works independently of subscriptions or that flow-based inspection disables it, when in fact the engine's effectiveness is entirely dependent on current FortiGuard updates.

How to eliminate wrong answers

Option A is wrong because the ML engine is included with the FortiGuard Antivirus subscription and does not require a separate subscription; it is an integrated feature. Option B is wrong because the ML engine is not limited to outbreak prevention; it provides continuous, real-time detection of unknown malware using behavioral analysis and static file analysis. Option D is wrong because flow-based inspection does not disable the ML engine; the ML engine works with both proxy-based and flow-based inspection modes, though flow-based may have reduced detection granularity.

Practice this question →

13

Multi-Selecthard

A security team is configuring FortiMail for email security. They want to ensure that incoming emails are authenticated using SPF, DKIM, and DMARC, and that emails failing authentication are quarantined. Which THREE settings must be configured in FortiMail? (Choose three.)

Select 3 answers

A.Enable DKIM verification in the anti-spam policy

B.Enable TLS encryption for incoming SMTP

C.Enable DMARC verification and set the action for DMARC failure to quarantine

D.Enable SPF verification in the anti-spam policy

E.Configure a recipient verification policy

AnswersA, C, D

DKIM verification must be enabled to verify DKIM signatures.

Why this answer

DKIM verification must be explicitly enabled in the anti-spam policy to allow FortiMail to validate the DKIM signature on incoming emails. Without this setting, DKIM authentication is not performed, and the email's DKIM status will not be evaluated.

Exam trap

The trap here is that candidates often confuse transport security (TLS) with email authentication protocols, mistakenly thinking TLS is required for SPF/DKIM/DMARC enforcement, when in fact TLS is optional and unrelated to the authentication chain.

Practice this question →

14

Multi-Selectmedium

An administrator is troubleshooting why a custom IPS signature for protocol anomaly detection is not triggering. The signature is designed to detect abnormal DNS query lengths. Which TWO steps should the administrator take to verify the signature is working? (Choose two.)

Select 2 answers

A.Reboot the FortiGate to reset the IPS engine

B.Disable the firewall policy to see if the signature triggers

C.Verify that the IPS sensor containing the signature is applied to the correct firewall policy

D.Generate traffic that matches the signature and check the IPS logs for alerts

E.Increase the signature's severity to see it in logs

AnswersC, D

If the sensor is not applied, the signature will not inspect traffic.

Why this answer

An IPS sensor must be explicitly applied to a firewall policy for the signatures it contains to be evaluated against traffic passing through that policy. Without this binding, the custom signature for DNS protocol anomaly detection will never be inspected, regardless of its configuration or the traffic type.

Exam trap

The trap here is that candidates assume a custom signature will automatically be evaluated once created, but FortiGate requires explicit policy attachment for any IPS sensor to process traffic, and rebooting or changing severity settings cannot compensate for a missing policy binding.

Practice this question →

15

MCQmedium

An administrator sees the following log entry: 'id=13593 msg="CDR: File attachment sanitized"' Which feature generated this log?

A.Content Disarm and Reconstruction

B.FortiSandbox

C.Machine Learning Engine

D.Outbreak Prevention

AnswerA

CDR sanitizes attachments and logs such events.

Why this answer

The log entry 'CDR: File attachment sanitized' is generated by Content Disarm and Reconstruction (CDR). CDR works by removing active content (e.g., macros, scripts, embedded objects) from files and rebuilding them into a safe, sanitized version. This is distinct from sandboxing or machine learning, as CDR does not rely on detection but instead proactively neutralizes threats by reconstructing the file.

Exam trap

The trap here is that candidates confuse the 'sanitized' action with sandboxing or ML-based detection, but CDR is a distinct proactive technology that does not rely on detection—it always sanitizes regardless of threat verdict.

How to eliminate wrong answers

Option B is wrong because FortiSandbox generates logs related to file submission, verdict (malicious/clean), and behavioral analysis, not 'CDR: File attachment sanitized' which is specific to the CDR engine. Option C is wrong because the Machine Learning Engine produces logs for ML-based detection events (e.g., 'ML: File detected as malicious'), not for file sanitization which is a static transformation process. Option D is wrong because Outbreak Prevention is a FortiGuard service that provides real-time threat intelligence and signatures, not a feature that performs file sanitization; its logs would reference outbreak alerts or signature updates, not CDR actions.

Practice this question →

16

MCQmedium

A FortiGate admin runs 'diagnose sys session filter dport 443' and sees the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is a UDP session that has been idle for 1 hour

B.The session has a problem because duration and expire are not equal

C.The session has been active for 1 hour and will expire in about 1 hour

D.The session is a short-lived connection that started 3600 seconds ago

AnswerC

duration is the time since creation, expire is remaining lifetime.

Why this answer

The output shows 'duration=3600' and 'expire=3599', meaning the session has been active for 3600 seconds (1 hour) and has approximately 3599 seconds remaining before it times out. The 'proto=6' indicates TCP (protocol 6), and 'proto_state=01' is the TCP state (typically ESTABLISHED). The session is healthy and will expire in about 1 hour, confirming C.

Exam trap

The trap here is that candidates misinterpret 'duration' and 'expire' as being equal or assume a discrepancy indicates a problem, when in fact they represent different time metrics (elapsed vs. remaining) and are expected to differ for active sessions.

How to eliminate wrong answers

Option A is wrong because 'proto=6' indicates TCP, not UDP (UDP is protocol 17). Option B is wrong because duration and expire are not required to be equal; duration is the elapsed time since the session started, and expire is the remaining time before timeout — they naturally differ unless the session just started. Option D is wrong because a duration of 3600 seconds (1 hour) indicates a long-lived session, not a short-lived one.

Practice this question →

17

MCQeasy

A network administrator wants to block known malicious IP addresses using threat intelligence feeds on FortiGate. Which feature should they use?

A.FortiGuard Web Filtering

B.External Threat Intelligence

C.Application Control

D.IP Reputation

AnswerB

This feature enables importing third-party threat feeds and using them in firewall policies.

Why this answer

FortiGate's External Threat Intelligence feature allows administrators to import and consume threat intelligence feeds (e.g., STIX/TAXII, CSV, or custom URLs) to block known malicious IP addresses. This is the correct feature because it is specifically designed to ingest external threat data and apply it to firewall policies for dynamic blocking, unlike the other options which serve different purposes.

Exam trap

The trap here is that candidates often confuse IP Reputation (a built-in FortiGuard service) with External Threat Intelligence (a feature for importing custom feeds), leading them to select IP Reputation when the question explicitly mentions 'threat intelligence feeds' from external sources.

How to eliminate wrong answers

Option A is wrong because FortiGuard Web Filtering is used to control access to web categories and URLs based on FortiGuard's cloud database, not to block specific IP addresses from external threat feeds. Option C is wrong because Application Control identifies and controls application traffic (e.g., Facebook, Skype) based on signatures, not IP-based threat intelligence. Option D is wrong because IP Reputation is a built-in FortiGuard service that rates IP addresses based on FortiGuard's own threat data, not a feature to import custom external threat intelligence feeds.

Practice this question →

18

MCQmedium

A FortiGate admin configures an automation stitch to send an email alert when a high-severity IPS event occurs. The trigger is 'IPS Event' and the action is 'Email'. After testing, no email is sent despite events being logged. What is the most likely cause?

A.The IPS event severity threshold is set too low

B.The automation stitch is disabled

C.No SMTP server is configured in the FortiGate

D.The IPS engine is in monitor mode

AnswerC

Email action requires an SMTP server to be configured under System > Settings.

Why this answer

The automation stitch requires a functional SMTP server configuration to send emails. Without an SMTP server defined under System > Settings > Email Service, the FortiGate cannot relay the alert email, even if the trigger and action are correctly configured and events are logged. This is the most common reason for email delivery failure in automation stitches.

Exam trap

The trap here is that candidates assume the automation stitch is misconfigured or the IPS engine is blocking the event, when the real issue is the underlying email infrastructure (SMTP) that the action depends on, which is a separate configuration from the stitch itself.

How to eliminate wrong answers

Option A is wrong because a low severity threshold would cause more events to match, not prevent email sending; the issue is delivery, not triggering. Option B is wrong because if the stitch were disabled, no events would be logged as triggered by the stitch, but the question states events are logged, implying the stitch is enabled and triggering. Option D is wrong because monitor mode affects IPS action (e.g., whether packets are blocked), not the generation of IPS events or the ability to send email alerts.

Practice this question →

19

MCQmedium

An administrator wants to configure FortiGate to use the machine learning engine for advanced antivirus detection. Which setting must be enabled in the antivirus profile?

A.Enable 'Machine Learning Engine' in the antivirus profile

B.Enable 'Detect All' in the antivirus profile

C.Set 'Scan Mode' to 'Quick' in the antivirus profile

D.Enable 'Use FortiSandbox' in the antivirus profile

AnswerA

The machine learning engine must be enabled in the antivirus profile to use AI-based detection.

Why this answer

The machine learning engine for advanced antivirus detection is a dedicated feature within the antivirus profile that must be explicitly enabled. This engine uses behavioral analysis and heuristics to detect unknown or zero-day malware without relying solely on signature-based detection. Enabling this setting allows FortiGate to leverage on-device ML models to identify malicious files based on patterns and anomalies.

Exam trap

The trap here is that candidates may confuse the machine learning engine with FortiSandbox integration, assuming that sandboxing is required for ML-based detection, when in fact the ML engine is a standalone on-device feature that must be enabled separately in the antivirus profile.

How to eliminate wrong answers

Option B is wrong because 'Detect All' is not a valid setting in the antivirus profile; it is a misconception that such a toggle exists for enabling ML-based detection. Option C is wrong because setting 'Scan Mode' to 'Quick' reduces scanning depth and may skip certain file types or archives, which would not enable the machine learning engine and could actually decrease detection accuracy. Option D is wrong because 'Use FortiSandbox' integrates with an external sandbox for file detonation and analysis, but it is a separate feature from the on-device machine learning engine and does not enable local ML-based detection.

Practice this question →

20

MCQhard

A security engineer is troubleshooting a scenario where FortiGate is not blocking a known malicious URL categorized as 'Malware'. The web filtering profile is configured with 'monitor all' for the Malware category. What change should be made to block the URL?

A.Configure traffic shaping to rate limit the URL

B.Add a static URL filter with the exact URL and action 'block'

C.Enable DNS filter with botnet C2 domain blocking

D.Change the action for Malware category from 'monitor' to 'block' in the web filter profile

AnswerD

Setting the category action to 'block' will block all URLs in that category.

Why this answer

The web filtering profile currently has the Malware category set to 'monitor all', which logs but does not block traffic. To block the URL, the action must be changed from 'monitor' to 'block' within the same web filter profile. This directly enforces the blocking action for all URLs categorized as Malware, including the known malicious URL.

Exam trap

The trap here is that candidates may think a static URL filter is required for blocking, overlooking that category-based actions in the web filter profile can directly block all URLs in a category without needing individual entries.

How to eliminate wrong answers

Option A is wrong because traffic shaping only rate-limits bandwidth and does not block URLs; it cannot enforce a block on malicious content. Option B is wrong because adding a static URL filter is unnecessary and less efficient when the category-based action can be changed; it also requires manual entry of every specific URL, which is not scalable. Option C is wrong because DNS filter with botnet C2 domain blocking targets command-and-control domains at the DNS level, not HTTP/HTTPS URL categories like Malware; it addresses a different threat vector.

Practice this question →

21

Multi-Selecthard

A security analyst wants to use automation stitches on FortiGate to automatically block IP addresses that trigger an IPS signature for 'SSH Brute Force'. Which two components are required to create this automation stitch? (Choose two.)

Select 2 answers

A.Action: 'Add to Block List'

B.FortiAnalyzer log query

C.Action: 'Email Notification'

D.Trigger: 'IPS Event'

E.FortiGuard category

AnswersA, D

The action should block the source IP.

Why this answer

The 'Add to Block List' action is the specific automation stitch action that dynamically adds the offending IP address to the FortiGate's local block list, effectively blocking further SSH brute-force attempts. This action directly enforces the security policy by preventing the source IP from accessing the firewall until the block expires or is manually removed.

Exam trap

The trap here is that candidates often confuse optional actions like email notifications or external log queries as required components, when only the trigger and a blocking action are mandatory to create a functional automation stitch for IP blocking.

Practice this question →

22

Multi-Selectmedium

An organization wants to implement multiple layers of defense against advanced persistent threats. Which three Fortinet solutions would be most effective in an ATP strategy? (Choose three.)

Select 3 answers

A.FortiMail

B.FortiSandbox

C.FortiWeb

D.FortiEDR

E.FortiDeceptor

AnswersB, D, E

FortiSandbox detects unknown malware via behavioral analysis.

Why this answer

FortiSandbox is correct because it provides dynamic analysis of suspicious files and URLs in a controlled, isolated environment, detecting zero-day and advanced malware that signature-based solutions miss. It integrates with other Fortinet security products to share threat intelligence and automate blocking, forming a critical layer in an ATP strategy by catching threats that evade initial defenses.

Exam trap

The trap here is that candidates often confuse 'security products that are part of a layered defense' with 'core ATP solutions,' leading them to select FortiMail or FortiWeb because they are common perimeter tools, while the exam specifically targets solutions that provide advanced threat detection, analysis, and response across multiple attack vectors.

Practice this question →

23

MCQhard

A FortiGate is configured with an antivirus profile that has the machine learning engine enabled. An administrator notices that some files are being detected by the ML engine but the verdict is 'probably clean'. What does this verdict indicate?

A.The file is clean and safe to pass.

B.The file is definitely malicious and should be blocked.

C.The ML engine has detected an outbreak but needs FortiGuard to confirm.

D.The ML engine has low confidence that the file is malicious; it may be a false positive.

AnswerD

'Probably clean' indicates low malicious confidence, often requiring further analysis.

Why this answer

The ML engine in FortiGate's antivirus profile assigns a verdict of 'probably clean' when its confidence level is low that the file is malicious. This indicates a potential false positive, meaning the file is likely benign but the engine cannot be certain. The correct action is to allow the file to pass while logging the event for further analysis, not to block it outright.

Exam trap

The trap here is that candidates confuse 'probably clean' with 'clean' or assume it requires external verification, when in fact it is a low-confidence verdict designed to avoid blocking potentially safe files.

How to eliminate wrong answers

Option A is wrong because 'probably clean' does not guarantee the file is clean; it indicates low confidence, so the file should not be unconditionally passed without scrutiny. Option B is wrong because the ML engine does not have high enough confidence to classify the file as definitely malicious; blocking it would be too aggressive and could cause false positives. Option C is wrong because the ML engine does not require FortiGuard confirmation for 'probably clean' verdicts; that mechanism is used for 'outbreak' verdicts where the engine suspects a new threat and queries FortiGuard for real-time reputation.

Practice this question →

24

MCQhard

A network administrator is troubleshooting a FortiGate IPS sensor that is not generating alerts for a custom signature they created. The custom signature uses the pattern 'malicious. The signature is enabled and applied to a firewall policy. What is the MOST likely cause of the issue?

A.The signature severity is set to 'Low' and logging is disabled for low severity

B.The custom signature is missing the 'protocol' parameter

C.The IPS sensor is configured in 'Passive' mode

D.The firewall policy is using 'Flow-based' inspection

AnswerB

Custom signatures must specify a protocol decoder (e.g., HTTP, FTP) to be evaluated; without it, the signature is ignored.

Why this answer

The custom signature is missing the 'protocol' parameter, which is mandatory for FortiGate custom IPS signatures. Without specifying the protocol (e.g., TCP, UDP, HTTP), the IPS engine cannot match the pattern against any traffic flow, so no alerts are generated even if the signature is enabled and applied to a policy.

Exam trap

The trap here is that candidates assume a missing protocol parameter would cause a syntax error or prevent the signature from being saved, but FortiGate allows saving incomplete custom signatures that simply never match traffic.

How to eliminate wrong answers

Option A is wrong because even if severity is 'Low' and logging is disabled for low severity, the IPS sensor would still generate alerts (just not log them); the question states no alerts are generated, not just no logs. Option C is wrong because 'Passive' mode only prevents the IPS from dropping traffic but still allows alert generation and logging; it does not suppress alerts entirely. Option D is wrong because 'Flow-based' inspection supports custom signatures and can generate alerts; the issue is not the inspection mode but the missing protocol parameter in the signature definition.

Practice this question →

25

MCQeasy

A company wants to detect and block phishing emails that contain malicious links. Which FortiGate security profile should be used?

A.Antivirus profile

B.Web Filtering profile

C.Data Leak Prevention profile

D.Email Filtering profile

AnswerD

Email filtering can block phishing emails based on content and reputation.

Why this answer

FortiGate's Email Filtering profile is specifically designed to inspect SMTP, POP3, and IMAP traffic for phishing indicators, including malicious URLs in email bodies and attachments. It can block or quarantine emails based on URL reputation, sender authentication (SPF/DKIM/DMARC), and content analysis, directly addressing the requirement to detect and block phishing emails with malicious links.

Exam trap

The trap here is that candidates often confuse Web Filtering (which handles web traffic) with Email Filtering (which handles email protocols), assuming URL reputation checks in web filtering can block phishing links in emails, but FortiGate requires the Email Filtering profile to inspect SMTP/IMAP/POP3 traffic and apply email-specific actions like quarantine.

How to eliminate wrong answers

Option A is wrong because the Antivirus profile scans for malware signatures in file attachments and does not analyze URLs or email-specific phishing patterns; it would miss malicious links that do not contain executable payloads. Option B is wrong because the Web Filtering profile controls HTTP/HTTPS traffic based on URL categories and reputation, but it operates on web proxy traffic, not on email protocols like SMTP, and cannot inspect or block emails before they reach the user's inbox. Option C is wrong because the Data Leak Prevention profile monitors and prevents unauthorized data exfiltration (e.g., credit card numbers, SSNs) and has no capability to detect phishing links or email-based threats.

Practice this question →

26

MCQmedium

A FortiGate administrator notices that traffic classified as 'unknown' by the antivirus is being allowed. The administrator wants to ensure that such files are submitted to FortiSandbox for analysis and blocked until a verdict is received. Which configuration is required?

A.Create a custom IPS signature for unknown files

B.Enable FortiSandbox in the antivirus profile and set 'Action for unknown files' to 'Block'

C.Enable outbreak prevention in the antivirus profile

D.Enable FortiSandbox in the antivirus profile and set 'Action for known files' to 'Block'

AnswerB

This configuration submits unknown files to FortiSandbox and blocks them until a verdict is returned.

Why this answer

When FortiSandbox is enabled in the antivirus profile and 'Action for unknown files' is set to 'Block', the FortiGate will submit files that cannot be identified by the local antivirus engine to FortiSandbox for analysis. While the file is being analyzed, it is blocked from reaching the client, ensuring that no potentially malicious content is delivered until a verdict (clean or malicious) is received. This directly addresses the administrator's requirement to block unknown files pending sandbox analysis.

Exam trap

The trap here is that candidates often confuse 'Action for unknown files' with 'Action for known files' or mistakenly think that outbreak prevention (which uses FortiGuard outbreak signatures) is sufficient to block unknown files, when in fact only the sandbox integration with the 'Block' action provides the required submission and blocking behavior.

How to eliminate wrong answers

Option A is wrong because custom IPS signatures are designed to detect and block network-level attacks based on traffic patterns, not to handle unknown files identified by the antivirus engine; IPS does not integrate with FortiSandbox for file submission. Option C is wrong because outbreak prevention in the antivirus profile uses FortiGuard outbreak alerts to block files based on known outbreak signatures, but it does not submit unknown files to FortiSandbox or block them pending analysis; it relies on pre-existing outbreak intelligence. Option D is wrong because setting 'Action for known files' to 'Block' would block files that are already identified by the antivirus engine, which is the opposite of the requirement; the administrator needs to block unknown files, not known ones.

Practice this question →

27

MCQeasy

What does FortiGuard Outbreak Prevention use to protect against newly discovered malware outbreaks before traditional signatures are available?

A.Outbreak signatures and hash-based blocking

B.IP reputation and URL filtering

C.Heuristic analysis and emulation

D.Artificial intelligence and behavior analysis

AnswerA

Outbreak prevention uses hashes of malicious files identified during outbreaks.

Why this answer

FortiGuard Outbreak Prevention uses outbreak signatures and hash-based blocking to provide rapid protection against newly discovered malware outbreaks before traditional signatures are available. Outbreak signatures are lightweight, pattern-based detections that can be deployed quickly, while hash-based blocking allows immediate blocking of known malicious file hashes, even when full signature analysis is not yet complete.

Exam trap

The trap here is that candidates often confuse outbreak prevention with sandboxing or heuristic analysis, but FortiGuard Outbreak Prevention specifically relies on rapidly deployable outbreak signatures and hash-based blocking, not on behavioral or AI-based analysis.

How to eliminate wrong answers

Option B is wrong because IP reputation and URL filtering are network-layer controls that block known malicious hosts or URLs, but they do not directly detect or block malware files themselves, making them insufficient for outbreak prevention. Option C is wrong because heuristic analysis and emulation are proactive detection methods used in sandboxing or advanced threat protection, but they are not the primary mechanism for FortiGuard Outbreak Prevention, which relies on rapidly deployable signatures and hashes. Option D is wrong because artificial intelligence and behavior analysis are advanced techniques used in FortiSandbox or FortiAI, but they are not the core technology behind FortiGuard Outbreak Prevention, which focuses on immediate, signature-based blocking.

Practice this question →

28

Multi-Selectmedium

A company receives a threat intelligence feed that lists several IP addresses as malicious. The administrator wants to automatically block traffic from these IPs on FortiGate. Which TWO methods can achieve this? (Choose two.)

Select 2 answers

A.Enable FortiGuard Outbreak Prevention

B.Configure an external connector to a threat intelligence feed and map it to an address object

C.Use an automation stitch with a trigger that receives the feed and an action to update blocked IPs

D.Configure a firewall policy to deny all traffic from unknown sources

E.Create an address group and add the IPs manually

AnswersB, C

External connectors can pull threat feeds and update address objects automatically.

Why this answer

FortiGate's external connector can ingest a threat intelligence feed (e.g., STIX/TAXII or CSV) and dynamically map it to an address object. This allows the firewall to automatically update its policy enforcement based on the feed without manual intervention. Option C is correct because an automation stitch can use a trigger (e.g., receiving a feed via webhook or script) and an action to update blocked IPs via the FortiOS API or CLI, providing real-time blocking.

Exam trap

The trap here is that candidates often confuse FortiGuard Outbreak Prevention (a signature-based service) with the ability to ingest external threat feeds, or they think manual address groups are sufficient for automated threat blocking, missing the requirement for dynamic, feed-driven automation.

Practice this question →

29

MCQeasy

What is the primary purpose of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus features?

A.To remove potentially malicious content from documents and rebuild them as safe files

B.To convert files into PDF format for safer viewing

C.To detect zero-day malware using sandboxing

D.To block all files containing macros

AnswerA

CDR strips active content and reconstructs files to eliminate threats.

Why this answer

Content Disarm and Reconstruction (CDR) is designed to remove active or potentially malicious content—such as macros, scripts, embedded objects, and OLE links—from documents (e.g., Office files, PDFs) and then reconstruct them as sanitized, safe versions. This approach prevents threats like macro-based malware or exploit-laden attachments from reaching users, even if the file contains previously unknown (zero-day) payloads, by stripping the dangerous components rather than relying solely on signature-based detection.

Exam trap

The trap here is that candidates often confuse CDR with sandboxing or macro blocking, but CDR is a static sanitization technique that removes active content from files without detonating them, whereas sandboxing involves dynamic analysis and macro blocking is a simpler, all-or-nothing approach that CDR avoids by allowing safe use of the document.

How to eliminate wrong answers

Option B is wrong because CDR does not convert files to PDF format; it sanitizes the original file format (e.g., DOCX, XLSX, PDF) and returns a cleaned version in the same format, not a different one. Option C is wrong because CDR is not a sandboxing or dynamic analysis feature; it statically disarms content by removing active elements, whereas sandboxing (e.g., FortiSandbox) detonates files in a virtual environment to detect zero-day malware. Option D is wrong because CDR does not block all files containing macros; it removes the macros and other active content from the file and then delivers the sanitized file, allowing the document to be used safely without the macro functionality.

Practice this question →

30

MCQmedium

A FortiGate is configured with a WAF profile to protect a web server. The administrator notices that SQL injection attacks are still reaching the server despite the WAF being enabled. What is the MOST likely reason?

A.The SQL injection signature set is disabled in the WAF profile

B.The attack is coming from a trusted IP

C.The web server is using HTTPS without SSL inspection

D.The WAF profile is not applied to the correct policy

AnswerA

WAF signatures are organized in groups; SQL injection must be enabled.

Why this answer

The WAF profile contains signature sets that detect and block common attack patterns, including SQL injection. If the SQL injection signature set is disabled within the profile, the WAF will not inspect traffic for those patterns, allowing attacks to pass through. This is the most direct and likely reason why SQL injection attacks are reaching the server despite the WAF being enabled.

Exam trap

The trap here is that candidates often assume a WAF profile is a monolithic block of protection, but FortiGate allows granular disabling of individual signature sets, and the exam tests whether you understand that a disabled signature set is the most direct cause of a specific attack type bypassing the WAF.

How to eliminate wrong answers

Option B is wrong because a trusted IP exception would only bypass WAF inspection for traffic from that specific source; it would not explain why SQL injection attacks from other sources are still reaching the server. Option C is wrong because HTTPS without SSL inspection means the WAF cannot decrypt the payload, but FortiGate can still inspect encrypted traffic using certificate-based inspection or flow-based inspection with SSL offloading; the lack of SSL inspection would block all inspection, not just SQL injection. Option D is wrong because if the WAF profile were not applied to the correct policy, no WAF inspection would occur at all, and the administrator would likely see no WAF-related logs or blocking; the question states the WAF is enabled, implying it is applied somewhere.

Practice this question →

31

MCQmedium

A security administrator wants to block email spoofing attacks against their organization's domain. They configure SPF, DKIM, and DMARC records. Which protocol authenticates the domain of the email sender by verifying the email's signature against a public key published in DNS?

A.SPF

B.ARC

C.DKIM

D.DMARC

AnswerC

DKIM signs emails with a private key; the public key in DNS verifies the signature.

Why this answer

DKIM (DomainKeys Identified Mail) is the correct answer because it provides email authentication by allowing the sender to cryptographically sign an email with a private key. The receiving mail server then retrieves the sender's public key from a DNS TXT record and verifies the signature, confirming that the email was not tampered with and originates from a domain the sender is authorized to use.

Exam trap

The trap here is that candidates often confuse SPF's IP-based verification with DKIM's cryptographic signature verification, or they assume DMARC performs the actual authentication, when in fact DMARC only enforces policies based on SPF and DKIM results.

How to eliminate wrong answers

Option A is wrong because SPF (Sender Policy Framework) authenticates the sending server's IP address against a list of authorized IPs published in DNS, not by verifying a cryptographic signature. Option B is wrong because ARC (Authenticated Received Chain) is a protocol that preserves email authentication results across intermediate hops (forwarders or mailing lists), but it does not itself authenticate the original sender's domain via a signature. Option D is wrong because DMARC (Domain-based Message Authentication, Reporting & Conformance) is a policy framework that uses SPF and DKIM results to instruct receivers on how to handle unauthenticated email (e.g., quarantine or reject), but it does not perform signature verification itself.

Practice this question →

32

MCQeasy

Which feature on FortiGate uses machine learning to detect never-before-seen malware based on file characteristics?

A.Machine Learning Engine

B.Outbreak Prevention

C.FortiSandbox

D.Content Disarm and Reconstruction

AnswerA

ML engine detects unknown malware based on file features.

Why this answer

The Machine Learning Engine (option A) on FortiGate uses static file analysis and machine learning models to detect never-before-seen malware based on file characteristics such as entropy, structure, and opcode sequences, without requiring signatures or behavioral execution. This allows it to identify zero-day threats pre-execution, directly matching the question's description.

Exam trap

The trap here is that candidates often confuse FortiSandbox's dynamic analysis (which also detects unknown malware) with the Machine Learning Engine's static analysis, but the question specifically asks for detection based on file characteristics, not behavioral execution.

How to eliminate wrong answers

Option B (Outbreak Prevention) is wrong because it is a subscription-based threat intelligence service that provides real-time updates on emerging threats, but it does not use machine learning to analyze file characteristics; instead, it relies on signature updates and IoCs from FortiGuard. Option C (FortiSandbox) is wrong because it detonates files in a virtual environment to observe runtime behavior, which is dynamic analysis, not static machine learning based on file characteristics. Option D (Content Disarm and Reconstruction) is wrong because it removes active content (e.g., macros, scripts) from files and rebuilds them into safe versions, but it does not use machine learning to detect malware; it is a prevention technique that strips potential threats regardless of detection.

Practice this question →

33

MCQmedium

An administrator configures FortiSandbox inline scanning for HTTP traffic. They notice that files uploaded via HTTP are being scanned but no verdict is being returned, causing delays. What is the MOST likely cause?

A.The FortiSandbox has reached its maximum storage capacity

B.The FortiSandbox is not registered with the FortiGate

C.The file scan timeout is too short, causing FortiGate to pass the file before a verdict is received

D.The file type is not supported by FortiSandbox

AnswerC

If FortiSandbox takes longer than the configured timeout, FortiGate allows the file to pass without a verdict.

Why this answer

When FortiGate sends a file to FortiSandbox for inline scanning, it waits for a verdict before allowing the traffic to proceed. If the file scan timeout is too short, FortiGate will stop waiting for the verdict and pass the file anyway, causing the observed delay without a final verdict. This is the most likely cause because the administrator sees scanning occurring but no verdict returned, which aligns with a premature timeout rather than a failure to scan.

Exam trap

The trap here is that candidates often assume a missing verdict is due to a registration or capacity issue, but the question specifically states scanning is occurring, which eliminates options A and B, and the delay points directly to a timeout configuration problem.

How to eliminate wrong answers

Option A is wrong because if the FortiSandbox had reached maximum storage capacity, it would typically reject new submissions or fail to store results, but the file would still be scanned or an error would be returned, not a delay without verdict. Option B is wrong because if the FortiSandbox were not registered with the FortiGate, the FortiGate would not be able to send files for scanning at all, so no scanning would occur. Option D is wrong because if the file type were not supported, FortiSandbox would either skip the file or return an unsupported verdict quickly, not cause a delay without a verdict.

Practice this question →

34

MCQmedium

An administrator is configuring a firewall policy for web traffic to a critical web application. They want to protect against SQL injection and cross-site scripting. Which security profile should they apply?

A.Antivirus profile with CDR

B.Application control profile

C.Web Application Firewall (WAF) profile

D.IPS sensor with pre-defined signatures

AnswerC

WAF is built for web application threats including SQL injection and XSS.

Why this answer

The Web Application Firewall (WAF) profile is specifically designed to inspect HTTP/HTTPS traffic at the application layer and block common web-based attacks such as SQL injection and cross-site scripting (XSS). It uses signature-based detection and behavioral analysis to identify malicious payloads in request parameters, headers, and body content, making it the correct choice for protecting a critical web application.

Exam trap

The trap here is that candidates often confuse the IPS sensor (Option D) with a WAF, assuming that IPS signatures for SQL injection and XSS are sufficient, but the NSE7 exam emphasizes that a WAF profile provides deeper, web-specific inspection that an IPS cannot match.

How to eliminate wrong answers

Option A is wrong because an Antivirus profile with Content Disarm and Reconstruction (CDR) focuses on detecting and sanitizing malicious files (e.g., PDFs, Office documents) in transit, not on inspecting HTTP request parameters for SQL injection or XSS payloads. Option B is wrong because an Application control profile is used to identify, allow, or block specific applications (e.g., Facebook, YouTube) based on traffic patterns, not to inspect application-layer content for injection attacks. Option D is wrong because an IPS sensor with pre-defined signatures can detect some web-based attacks, but it operates at the network layer and is not optimized for deep HTTP parsing; a WAF profile provides more granular, context-aware inspection of web traffic, including decoding of URL-encoded and base64-encoded payloads.

Practice this question →

35

Multi-Selectmedium

An administrator needs to configure advanced email security on FortiMail to protect against phishing and spoofing. Which THREE features should be enabled to achieve comprehensive email authentication?

Select 3 answers

A.DKIM signing and verification

B.SPF checking

C.DMARC policy enforcement

D.Anti-spam Bayesian filtering

E.TLS encryption for inbound/outbound

AnswersA, B, C

DKIM provides digital signatures for email integrity.

Why this answer

DKIM (DomainKeys Identified Mail) signing and verification is correct because it allows the sending domain to cryptographically sign outgoing emails, and the receiving server to verify that the signature matches the domain’s public DNS record. This ensures the email was not tampered with and originates from an authorized server, directly addressing phishing and spoofing by validating message integrity and sender authenticity.

Exam trap

The trap here is that candidates confuse transport security (TLS) or content filtering (Bayesian) with sender authentication protocols, forgetting that only DKIM, SPF, and DMARC directly verify domain ownership and prevent spoofing, while TLS and Bayesian filtering address different security layers (confidentiality and spam classification).

Practice this question →

36

MCQmedium

An administrator wants to use FortiGate to automatically block traffic if FortiEDR detects a threat on an endpoint. Which feature should the administrator configure?

A.Configure a VPN tunnel between FortiGate and FortiEDR

B.Enable FortiGuard Outbreak Prevention on the antivirus profile

C.Configure a static route to the FortiEDR management IP

D.Create an automation stitch with a trigger from FortiEDR and an action to block the source IP

AnswerD

Automation stitches allow FortiGate to respond to events from FortiEDR.

Why this answer

FortiGate integrates with FortiEDR via automation stitches, which allow events from FortiEDR (such as a detected threat) to trigger automated actions on FortiGate, such as blocking the source IP of the compromised endpoint. This provides real-time, policy-driven threat response without manual intervention, leveraging the Fortinet Security Fabric. Option A is incorrect because a VPN tunnel is not required; FortiEDR and FortiGate communicate via APIs.

Option B is incorrect because FortiGuard Outbreak Prevention is a separate service that provides threat intelligence, not direct endpoint detection integration. Option C is incorrect because a static route is unnecessary for the API-based communication.

Exam trap

The trap here is that candidates often confuse integration methods, assuming a VPN or routing change is needed for communication, when in fact FortiEDR and FortiGate communicate via the Security Fabric's REST API and automation stitches, not traditional network tunnels.

How to eliminate wrong answers

Option A is wrong because a VPN tunnel is used for secure site-to-site or remote access connectivity, not for receiving threat events from FortiEDR; FortiEDR communicates with FortiGate via REST API or Fabric connector, not VPN. Option B is wrong because FortiGuard Outbreak Prevention is a signature-based feature within antivirus profiles that blocks known outbreaks based on FortiGuard threat intelligence, not a mechanism to receive and act on FortiEDR-specific endpoint detections. Option C is wrong because a static route is used for IP routing and does not enable event-driven communication or automation between FortiEDR and FortiGate; the integration requires API-based triggers, not routing entries.

Practice this question →

37

MCQmedium

An organization wants to protect against unknown malware by using machine learning on FortiGate. Which antivirus setting should be enabled to achieve this?

A.Enable 'Outbreak Prevention' under FortiGuard settings

B.Set 'av-engine' to 'flow' under system settings

C.Enable 'Machine Learning Engine' in the antivirus profile

D.Enable 'FortiSandbox inline scanning' in the antivirus profile

AnswerC

This enables the ML engine to detect unknown malware based on behavioral analysis.

Why this answer

The 'Machine Learning Engine' in the antivirus profile uses on-device machine learning models to detect unknown malware based on file characteristics, without requiring signature updates. This provides proactive protection against zero-day threats directly on the FortiGate, aligning with the requirement to protect against unknown malware using machine learning.

Exam trap

The trap here is that candidates often confuse 'FortiSandbox inline scanning' with machine learning, but FortiSandbox uses behavioral analysis in a sandbox environment, not on-device ML, and requires additional licensing and infrastructure.

How to eliminate wrong answers

Option A is wrong because 'Outbreak Prevention' under FortiGuard settings is a cloud-based service that uses outbreak signatures and heuristics, not on-device machine learning, and requires internet connectivity to FortiGuard. Option B is wrong because setting 'av-engine' to 'flow' changes the antivirus scanning mode from proxy-based to flow-based, which affects performance and inspection depth but does not enable machine learning for unknown malware detection. Option D is wrong because 'FortiSandbox inline scanning' in the antivirus profile sends files to an external FortiSandbox appliance for dynamic analysis, which is not on-device machine learning and introduces latency; it is a separate feature from the Machine Learning Engine.

Practice this question →

38

MCQeasy

An administrator wants to block a zero-day malware outbreak detected by FortiGuard. Which feature should be configured to automatically block the threat across all enabled FortiGate devices?

A.FortiSandbox Cloud

B.IPS Custom Signatures

C.FortiGuard Outbreak Prevention

D.Application Control

AnswerC

This feature automatically blocks zero-day outbreaks using FortiGuard threat intelligence.

Why this answer

FortiGuard Outbreak Prevention (option C) is the correct feature because it automatically pushes signatures to all FortiGate devices enrolled in the same FortiGuard network when a new zero-day malware outbreak is detected. This enables immediate, coordinated blocking without manual intervention, which is exactly what the administrator needs for a fast-spreading threat.

Exam trap

The trap here is that candidates often confuse FortiSandbox Cloud with a real-time blocking mechanism, but FortiSandbox Cloud provides analysis and retrospective detection, not automatic, proactive blocking across all devices like Outbreak Prevention does.

How to eliminate wrong answers

Option A is wrong because FortiSandbox Cloud is a sandboxing service that analyzes suspicious files and behaviors, but it does not automatically push blocking signatures to all FortiGate devices; it provides detection results that require manual or policy-based action. Option B is wrong because IPS Custom Signatures are manually created by the administrator to block specific known patterns; they cannot be automatically generated or distributed by FortiGuard for a zero-day outbreak. Option D is wrong because Application Control is designed to manage and block specific applications based on signatures, not to respond to zero-day malware outbreaks with automatically distributed threat intelligence.

Practice this question →

39

MCQmedium

A company uses FortiMail and wants to ensure that incoming emails are authenticated using SPF, DKIM, and DMARC. Which profile should the administrator configure to enforce these checks?

A.Session Profile

B.Antispam Profile

C.IP Policy

D.Authentication Profile

AnswerD

This profile configures email authentication checks.

Why this answer

The Authentication Profile in FortiMail is specifically designed to enforce email authentication checks such as SPF, DKIM, and DMARC. This profile defines the actions to take when an email fails these authentication checks, such as quarantining or rejecting the message, and is applied to incoming email flows to ensure compliance with authentication standards.

Exam trap

The trap here is that candidates often confuse the Authentication Profile with the Antispam Profile, mistakenly thinking SPF/DKIM/DMARC are antispam techniques, when in fact they are authentication mechanisms enforced through a separate profile.

How to eliminate wrong answers

Option A is wrong because a Session Profile controls session-level parameters like timeouts and encryption (TLS), not email authentication checks. Option B is wrong because an Antispam Profile handles spam detection techniques (e.g., Bayesian filtering, greylisting, SURBL), not SPF/DKIM/DMARC enforcement. Option C is wrong because an IP Policy defines network-level access control (source/destination IPs, ports) and is not used for email authentication validation.

Practice this question →

40

Multi-Selectmedium

An administrator is configuring FortiGate automation stitches to respond to a detected ransomware outbreak. The trigger is a high severity event from FortiSandbox. Which TWO actions can be used in an automation stitch to contain the threat?

Select 2 answers

A.Create a new FortiGate administrator account

B.Send an SNMP trap to a monitoring system

C.Change the SSID of a wireless network

D.Execute a CLI script to block the infected host's IP address

E.Quarantine the endpoint using FortiClient EMS integration

AnswersD, E

CLI scripts can be used to block IPs via firewall policies or blacklist.

Why this answer

Executing a CLI script to block the infected host's IP address directly on the FortiGate allows immediate containment by applying a firewall policy or address-based block, which is a standard action in automation stitches for threat response. Option E is correct because quarantining the endpoint via FortiClient EMS integration leverages the FortiClient endpoint agent to isolate the infected device from the network, which is a supported action in automation stitches for ransomware containment.

Exam trap

The trap here is that candidates may confuse notification actions (like SNMP traps) or administrative changes (like creating accounts) with actual containment actions, failing to recognize that only actions that actively block or isolate the threat (CLI script or EMS quarantine) are valid in an automation stitch for ransomware response.

Practice this question →

41

MCQmedium

An organization wants to protect against zero-day malware by using FortiGate's outbreak prevention feature. Which configuration is required to enable outbreak prevention in the antivirus profile?

A.Enable 'Machine Learning Engine' in the antivirus profile

B.Enable 'FortiSandbox Inline Scan'

C.Select 'Outbreak Prevention' under Antivirus profile settings

D.Configure a web filter profile to block malicious URLs

AnswerC

This directly enables outbreak prevention, which uses outbreak signatures.

Why this answer

FortiGate's outbreak prevention feature is specifically enabled within the antivirus profile by selecting the 'Outbreak Prevention' option. This setting leverages FortiGuard's outbreak alert database to block files that match known outbreak signatures, providing protection against zero-day malware before traditional signatures are available.

Exam trap

The trap here is that candidates often confuse outbreak prevention with other advanced threat protection features like machine learning or sandboxing, but Fortinet specifically requires the 'Outbreak Prevention' toggle in the antivirus profile to activate this signature-based blocking mechanism.

How to eliminate wrong answers

Option A is wrong because the 'Machine Learning Engine' in the antivirus profile is used for detecting unknown malware through static analysis, not for outbreak prevention, which relies on FortiGuard's outbreak intelligence. Option B is wrong because 'FortiSandbox Inline Scan' is a separate feature that submits files to FortiSandbox for dynamic analysis, not the outbreak prevention mechanism that uses pre-emptive signatures. Option D is wrong because configuring a web filter profile to block malicious URLs addresses web-based threats but does not enable outbreak prevention for files scanned by the antivirus engine.

Practice this question →

42

MCQmedium

A company uses FortiGate as a web application firewall (WAF) to protect a public web server. The security team wants to block SQL injection attacks. Which WAF signature category should the administrator enable?

A.Server-Side Request Forgery

B.Command Injection

C.SQL Injection

D.Cross-Site Scripting

AnswerC

SQL injection signatures detect and block SQL injection attempts.

Why this answer

SQL injection attacks specifically target database queries by injecting malicious SQL statements through input fields. FortiGate's WAF signature category for SQL Injection is designed to detect and block these patterns, such as 'OR 1=1' or UNION-based injections, by matching against known attack signatures in the HTTP request payload.

Exam trap

The trap here is that candidates may confuse SQL Injection with Command Injection (Option B) because both involve injection attacks, but SQL Injection targets database layers via SQL syntax, while Command Injection targets the OS shell via system commands.

How to eliminate wrong answers

Option A is wrong because Server-Side Request Forgery (SSRF) is an attack that forces a server to make internal requests, not directly related to SQL injection; FortiGate's WAF has a separate signature category for SSRF. Option B is wrong because Command Injection involves executing system commands (e.g., via shell metacharacters) on the server, not database queries, and is covered by a different WAF signature category. Option D is wrong because Cross-Site Scripting (XSS) injects client-side scripts into web pages viewed by other users, targeting browsers rather than the database backend, and is handled by its own WAF signature category.

Practice this question →

43

MCQeasy

A FortiGate administrator wants to ensure that files in email attachments are disarmed before delivery. Which security feature should be configured in the antivirus profile?

A.Content Disarm and Reconstruction (CDR)

B.FortiSandbox inline scanning

C.Machine Learning Engine

D.Outbreak Prevention

AnswerA

CDR strips active content and rebuilds files to a safe state.

Why this answer

Content Disarm and Reconstruction (CDR) is the correct answer because it is specifically designed to remove active content (e.g., macros, scripts, embedded objects) from email attachments and rebuild them into safe, sanitized versions before delivery. Unlike detection-based methods, CDR proactively disarms threats by stripping potentially malicious elements while preserving the file's usability, making it the ideal choice for disarming attachments in an antivirus profile.

Exam trap

The trap here is that candidates often confuse detection-based features like FortiSandbox or Machine Learning with proactive disarming, assuming that any advanced threat protection feature can 'disarm' files, whereas CDR is the only option that actively reconstructs attachments to remove active content.

How to eliminate wrong answers

Option B is wrong because FortiSandbox inline scanning is a behavioral analysis feature that detonates files in a sandbox to detect threats, but it does not actively strip or reconstruct file content; it relies on detection and blocking, not proactive disarming. Option C is wrong because the Machine Learning Engine uses statistical models to classify files as malicious or benign based on patterns, but it does not modify or reconstruct attachments to remove active content. Option D is wrong because Outbreak Prevention is a FortiGuard service that provides real-time signatures and intelligence for emerging threats, but it is a detection and prevention mechanism, not a file sanitization or reconstruction technology.

Practice this question →

44

Multi-Selectmedium

An organization wants to implement email authentication to prevent spoofing and phishing attacks. They use FortiMail as their email security gateway. Which THREE mechanisms should they configure to achieve comprehensive email authentication?

Select 3 answers

A.Transport Layer Security (TLS) for SMTP

B.FortiGuard Antispam

C.Sender Policy Framework (SPF)

D.Domain-based Message Authentication, Reporting and Conformance (DMARC)

E.DomainKeys Identified Mail (DKIM)

AnswersC, D, E

SPF verifies that the sending server is authorized by the domain owner.

Why this answer

Sender Policy Framework (SPF) is correct because it allows the domain owner to publish a DNS TXT record listing authorized sending IP addresses, enabling receiving mail servers (like FortiMail) to verify that the email originated from an approved source. This directly prevents spoofing by rejecting messages from unauthorized IPs claiming to be from the domain.

Exam trap

The trap here is that candidates confuse encryption (TLS) or antispam filtering with authentication mechanisms, failing to recognize that SPF, DKIM, and DMARC are the three complementary protocols specifically designed for email authentication and spoofing prevention as defined in RFC 7208, RFC 6376, and RFC 7489.

Practice this question →

45

MCQhard

An administrator configures FortiSandbox to quarantine files that are rated 'malicious'. They notice that some files are being quarantined even though the verdict is 'clean'. What could explain this?

A.The quarantine action is set to apply to files with a risk level above a certain threshold, and clean files have been incorrectly rated

B.FortiSandbox uses a whitelist that includes those files

C.The files were submitted by a different FortiGate with different settings

D.The administrator has enabled 'aggressive mode' which quarantines all files

AnswerA

Risk level thresholds can cause false positives if set too aggressively.

Why this answer

FortiSandbox's quarantine action can be configured based on a risk score threshold, not solely on the verdict. If the risk score for a file rated 'clean' exceeds the configured threshold, the file may still be quarantined. This occurs because the verdict and risk score are separate attributes; a 'clean' verdict indicates no known malware, but the file's behavior or heuristics may still generate a high risk score that triggers quarantine.

Exam trap

The trap here is that candidates assume quarantine is strictly tied to the verdict, overlooking that FortiSandbox's quarantine action can be independently triggered by a risk score threshold, leading to quarantine of 'clean' files with high risk scores.

How to eliminate wrong answers

Option B is wrong because a whitelist would prevent quarantine, not cause it; whitelisted files are explicitly allowed and bypass scanning. Option C is wrong because files submitted by different FortiGate devices are evaluated independently by FortiSandbox based on its own analysis, not on the submitting device's settings; the quarantine decision is local to the FortiSandbox configuration. Option D is wrong because 'aggressive mode' in FortiSandbox does not exist; FortiSandbox uses configurable risk thresholds and verdicts, not an all-or-nothing aggressive mode.

Practice this question →

46

MCQeasy

A company wants to protect its internal users from malicious files attached to emails. Which FortiGate feature should be configured to inspect SMTP traffic for malware?

A.Antivirus

B.Email Filter

C.Web Filter

D.IPS

AnswerA

Antivirus profiles can scan SMTP, POP3, and IMAP traffic for malware.

Why this answer

FortiGate's Antivirus feature is designed to scan SMTP traffic for malware by inspecting email attachments and body content against virus signatures. When configured in a security policy, it intercepts SMTP sessions, buffers the email data, and performs real-time scanning to block or quarantine malicious files before delivery to internal users.

Exam trap

The trap here is that candidates confuse 'Email Filter' (which handles spam and content filtering) with antivirus scanning, assuming email security is solely about filtering, when in fact malware detection requires the dedicated Antivirus feature to inspect SMTP payloads at the file level.

How to eliminate wrong answers

Option B (Email Filter) is wrong because it focuses on spam filtering, content blocking, and email address/domain blacklisting, not on malware detection in attachments. Option C (Web Filter) is wrong because it controls HTTP/HTTPS traffic to block malicious URLs and web content, not SMTP email traffic. Option D (IPS) is wrong because it detects and prevents network-level attacks (e.g., exploits, buffer overflows) based on signatures, but it does not perform file-level malware scanning on email attachments.

Practice this question →

47

MCQmedium

An organization wants to deploy a web application firewall (WAF) to protect a public-facing web application. They are evaluating FortiGate versus FortiWeb. Which of the following is a key advantage of using FortiWeb over FortiGate for WAF functionality?

A.FortiWeb offers advanced bot detection and positive security model

B.FortiGate can perform SSL deep inspection without performance impact

C.FortiGate supports a larger number of web servers behind a single policy

D.FortiGate can automatically patch web application vulnerabilities

AnswerA

FortiWeb includes machine learning bot detection and positive security model (whitelisting), which FortiGate lacks.

Why this answer

FortiWeb is a dedicated web application firewall that provides advanced bot detection and a positive security model, which allows only explicitly allowed traffic based on a whitelist of known good patterns. This is a key advantage over FortiGate, which primarily uses a negative security model (signature-based) and lacks the same depth of bot mitigation and positive enforcement for web-specific threats.

Exam trap

The trap here is that candidates assume FortiGate's integrated WAF features are equivalent to a dedicated WAF, but FortiWeb's positive security model and advanced bot detection are unique differentiators that FortiGate lacks.

How to eliminate wrong answers

Option B is wrong because FortiGate, like any device performing SSL deep inspection, incurs performance overhead due to decryption/re-encryption, and FortiGate does not claim zero performance impact. Option C is wrong because FortiGate does not inherently support a larger number of web servers behind a single policy; both platforms can scale, but FortiWeb is specifically optimized for high-volume web server pools with granular per-server policies. Option D is wrong because neither FortiGate nor FortiWeb automatically patches web application vulnerabilities; they detect and block exploit attempts but do not modify application code.

Practice this question →

48

MCQmedium

A FortiGate administrator configures an antivirus profile with the machine learning engine enabled and applies it to a policy inspecting HTTP traffic. After deployment, the admin notices that some files are being allowed that should have been detected. What is the MOST likely cause?

A.The ML engine is in monitor-only mode

B.FortiGuard outbreak prevention is disabled

C.The antivirus profile is using flow-based inspection instead of proxy-based

D.The file size exceeds the maximum scanning limit

AnswerA

Monitor mode logs detections but does not block. To block, the engine must be in protect mode.

Why this answer

The most likely cause is that the machine learning engine is configured in monitor-only mode. In this mode, the ML engine will log detections and generate alerts but will not take any action to block the file, allowing it to pass through the policy. This is a common initial deployment strategy to assess the ML engine's impact before enabling active blocking.

Exam trap

The trap here is that candidates often assume the ML engine always blocks threats by default, overlooking the distinct monitor-only mode that logs detections without enforcement.

How to eliminate wrong answers

Option B is wrong because FortiGuard outbreak prevention is a separate feature that provides real-time updates for zero-day threats; disabling it would not cause the ML engine to allow files it should detect, as the ML engine operates independently of FortiGuard updates. Option C is wrong because flow-based inspection supports the ML engine and can perform detection; the issue is not the inspection mode but the action configured for the ML engine. Option D is wrong because if the file size exceeded the maximum scanning limit, the file would typically be skipped entirely or passed without any scanning, not allowed after being evaluated by the ML engine.

Practice this question →

49

MCQmedium

A company wants to receive threat intelligence feeds from external sources to enhance their FortiGate's protection. Which method should be used to integrate external threat feeds into FortiGate?

A.Use FortiGuard Threat Intelligence Service which automatically pulls feeds.

B.Manually add IP addresses to local address objects.

C.Configure an external threat feed connector in FortiGate, such as using a URL to a STIX/TAXII feed.

D.Use FortiAnalyzer to push feeds to FortiGate.

AnswerC

FortiGate supports external threat feeds via indicators of compromise (IOC) using STIX/TAXII or via the 'config system external-resource' command.

Why this answer

FortiGate supports integration with external threat intelligence feeds via the External Threat Feed connector, which can consume STIX/TAXII feeds from a URL. This allows the FortiGate to dynamically update its threat database with indicators from third-party sources, enhancing its protection without relying solely on FortiGuard services.

Exam trap

The trap here is that candidates may confuse FortiGuard's built-in threat intelligence service with the ability to integrate external feeds, assuming FortiGuard can be customized to pull from third-party sources, when in fact the External Threat Feed connector is the dedicated feature for that purpose.

How to eliminate wrong answers

Option A is wrong because FortiGuard Threat Intelligence Service is a built-in Fortinet service that provides curated feeds, not a method to integrate external third-party feeds; it cannot be configured to pull from arbitrary external sources. Option B is wrong because manually adding IP addresses to local address objects is a static, labor-intensive approach that does not support automated, dynamic updates from external threat feeds, defeating the purpose of real-time intelligence integration. Option D is wrong because FortiAnalyzer is a log management and analytics platform, not a mechanism to push threat feeds to FortiGate; it can forward logs or events but does not handle external feed ingestion for threat intelligence updates.

Practice this question →

50

MCQmedium

An organization deploys FortiEDR to protect endpoints. Which component is responsible for collecting and sending telemetry data to the FortiEDR management console?

A.FortiGate firewall

B.FortiEDR Sensor (Agent)

C.FortiAnalyzer

D.FortiClient EMS

AnswerB

The sensor is installed on endpoints to gather data.

Why this answer

The FortiEDR Sensor (Agent) is the endpoint-resident component that collects telemetry data—such as process creation, network connections, file system changes, and registry modifications—and securely transmits it to the FortiEDR management console (Controller) for analysis and threat detection. Without the sensor, the management console has no visibility into endpoint activity.

Exam trap

The trap here is that candidates often confuse FortiClient EMS (which manages endpoint policies) with the FortiEDR Sensor, assuming that EMS handles telemetry collection, when in fact the sensor is a separate, dedicated agent for endpoint detection and response.

How to eliminate wrong answers

Option A is wrong because FortiGate is a next-generation firewall that provides network security and can integrate with FortiEDR via API or syslog, but it does not collect or send endpoint telemetry data to the FortiEDR management console. Option C is wrong because FortiAnalyzer is a centralized logging and reporting appliance that aggregates logs from Fortinet devices (e.g., FortiGate, FortiMail) but does not act as the telemetry collection agent for FortiEDR endpoints. Option D is wrong because FortiClient EMS manages endpoint compliance, VPN, and web filtering policies, and while it can integrate with FortiEDR, it is not the component that collects and sends endpoint telemetry to the FortiEDR console.

Practice this question →

51

MCQhard

An administrator configures email authentication (SPF, DKIM, DMARC) on FortiMail. They find that legitimate emails are being marked as spam by FortiMail. The SPF check passes but DKIM fails. What could be the issue?

A.The SPF record is too strict

B.The email was forwarded by an intermediary that strips the DKIM signature

C.FortiMail has a bug in the DKIM verification module

D.The DMARC policy is set to reject

AnswerB

Forwarding often breaks DKIM, causing it to fail.

Why this answer

When an email is forwarded by an intermediary (e.g., a mailing list or forwarding service), the intermediary often modifies the message headers or body, which invalidates the DKIM signature. Since DKIM relies on a cryptographic hash of the original message content and selected headers, any alteration—even by a legitimate forwarder—causes the signature verification to fail. The SPF check passes because the forwarding server may be authorized in the SPF record, but DKIM failure triggers spam classification if the DMARC policy is not aligned.

Exam trap

The trap here is that candidates assume DKIM failure is always due to a misconfiguration on the sending side, rather than recognizing that forwarding or intermediary modification is a common and legitimate cause of DKIM breakage.

How to eliminate wrong answers

Option A is wrong because a strict SPF record (e.g., -all) would cause SPF to fail, not pass; the question states SPF passes, so this is irrelevant. Option C is wrong because FortiMail's DKIM verification module is RFC 6376 compliant and does not have a known bug that would cause legitimate DKIM signatures to fail; this is a red herring. Option D is wrong because DMARC policy (p=reject) only dictates how receivers handle messages that fail both SPF and DKIM alignment; it does not cause DKIM to fail—it is an action based on the result, not the cause of the failure.

Practice this question →

52

Multi-Selecthard

An organization is deploying FortiEDR to enhance endpoint protection. Which THREE capabilities does FortiEDR provide? (Choose three.)

Select 3 answers

A.Forensic investigation and root cause analysis

B.Decoy deployment to lure attackers

C.Real-time threat detection using behavioral analysis

D.Automated response to isolate compromised endpoints

E.Email security filtering

AnswersA, C, D

FortiEDR provides detailed forensic data for investigation.

Why this answer

FortiEDR provides forensic investigation and root cause analysis by recording detailed endpoint telemetry, including process creation, network connections, and file system changes. This allows security teams to reconstruct the full attack chain after an incident, identifying the initial infection vector and all subsequent malicious activities. The platform correlates these events across multiple endpoints to provide a comprehensive timeline for investigation.

Exam trap

The trap here is that candidates may confuse FortiEDR's capabilities with those of other Fortinet products, such as assuming decoy deployment (FortiDeceptor) or email filtering (FortiMail) are part of FortiEDR's endpoint protection suite.

Practice this question →

53

MCQmedium

An organization uses FortiGate's WAF feature (not FortiWeb) to protect a web server. The admin configures an inline WAF profile but notices that the WAF is not inspecting traffic. What is the most likely cause?

A.The WAF profile is not applied to a firewall policy

B.SSL Inspection is not enabled on the firewall policy

C.The firewall policy uses flow-based inspection

D.The WAF profile is configured in monitor mode

AnswerB

Without decryption, FortiGate cannot inspect encrypted traffic for WAF rules.

Why this answer

FortiGate's WAF feature operates at the application layer and requires SSL Inspection to decrypt HTTPS traffic before the WAF engine can analyze the payload. Without SSL Inspection enabled on the firewall policy, the WAF profile sees only encrypted traffic and cannot inspect HTTP/HTTPS content, effectively rendering the WAF non-functional for encrypted sessions.

Exam trap

The trap here is that candidates assume applying a WAF profile to a policy is enough, overlooking that FortiGate requires explicit SSL Inspection decryption to inspect HTTPS traffic, which is the most common oversight in WAF deployments.

How to eliminate wrong answers

Option A is wrong because applying a WAF profile to a firewall policy is necessary but not sufficient; the WAF will still fail to inspect traffic if SSL Inspection is missing. Option C is wrong because flow-based inspection does not inherently block WAF functionality; the WAF can work with both flow-based and proxy-based inspection modes, though proxy-based is recommended for deeper inspection. Option D is wrong because monitor mode only logs violations without blocking, but it still inspects traffic; the issue here is that no inspection occurs at all, which points to a missing decryption step, not a monitoring configuration.

Practice this question →

54

Drag & Dropmedium

Drag and drop the steps to configure OSPF on a FortiGate firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Create virtual router, define areas and networks, set router ID, enable on interfaces, then verify.

Practice this question →

55

MCQeasy

A company is deploying FortiGate with Advanced Threat Protection (ATP) and wants to block advanced malware that uses encrypted C2 communications. Which security profile should be configured to perform SSL inspection and detect malicious traffic?

A.Data Leak Prevention profile

B.Antivirus profile with SSL inspection

C.Web Filtering profile

D.Intrusion Prevention profile

AnswerB

Antivirus profiles can be configured with SSL inspection to detect malware in encrypted C2 traffic.

Why this answer

An Antivirus profile with SSL inspection enabled is required to decrypt encrypted C2 (command-and-control) traffic so that FortiGate can inspect the payload for malware signatures, heuristics, and behavioral patterns. Without SSL inspection, the ATP engine cannot see inside the encrypted tunnel, rendering the antivirus and other security profiles ineffective against encrypted C2 communications.

Exam trap

The trap here is that candidates often assume IPS or Web Filtering alone can block encrypted C2 traffic, but without SSL inspection, these profiles cannot see inside the encrypted tunnel, making the Antivirus profile with SSL inspection the only correct choice for detecting malware in encrypted communications.

How to eliminate wrong answers

Option A is wrong because a Data Leak Prevention (DLP) profile focuses on detecting and preventing unauthorized transmission of sensitive data (e.g., credit card numbers, PII) and does not perform SSL inspection or detect advanced malware C2 traffic. Option C is wrong because a Web Filtering profile controls access to URLs and categories (e.g., blocking malicious sites) but does not decrypt or inspect the content of encrypted sessions for malware payloads. Option D is wrong because an Intrusion Prevention profile (IPS) detects and blocks network-level exploits and vulnerabilities, but without SSL inspection, it cannot analyze encrypted C2 traffic; IPS relies on decrypted traffic to match signatures.

Practice this question →

56

MCQhard

An admin configures Content Disarm and Reconstruction (CDR) on FortiGate to protect against malicious macros in Office documents. After applying the CDR profile to a firewall policy, users complain that documents are not being delivered. What is the most likely cause?

A.The CDR profile has 'File Filter' enabled that blocks the file type

B.The FortiGate is running in transparent mode

C.The firewall policy is configured for flow-based inspection

D.The antivirus profile is not applied to the same policy

AnswerC

CDR requires proxy-based inspection mode. Flow mode does not support CDR, so documents may be dropped.

Why this answer

CDR requires proxy-based inspection to intercept, disarm, and reconstruct documents. Flow-based inspection bypasses the deep inspection engine, so CDR cannot process the files, causing delivery failures. FortiGate must use proxy-based inspection mode for CDR to function correctly.

Exam trap

The trap here is that candidates assume CDR is a simple file-filtering feature that works regardless of inspection mode, but Fortinet explicitly restricts CDR to proxy-based inspection, making flow-based mode a common misconfiguration that causes silent delivery failures.

How to eliminate wrong answers

Option A is wrong because File Filter in a CDR profile controls which files are submitted for disarming, not whether they are blocked; if enabled, it would filter files before CDR, not prevent delivery after processing. Option B is wrong because transparent mode does not affect CDR functionality; CDR works in both transparent and NAT modes as long as proxy-based inspection is used. Option D is wrong because CDR operates independently of antivirus; while AV profiles can complement CDR, they are not required for CDR to deliver documents, and their absence would not cause delivery failure.

Practice this question →

57

Multi-Selectmedium

An administrator is configuring FortiGate automation stitches to respond to a detected brute-force attack against an internal web server. The trigger is set to 'Event' with a condition matching repeated failed login attempts. Which TWO actions are appropriate to mitigate the attack? (Choose two.)

Select 2 answers

A.Add the source IP to a local address group that is used in a block policy

B.Send an email notification to the SOC team

C.Enable quarantine on the web server

D.Shut down the web server interface

E.Run a CLI script to disable the user account

AnswersA, B

This blocks traffic from the attacker IP.

Why this answer

Adding the source IP to a local address group that is referenced in a block policy dynamically updates the firewall rule set to drop all traffic from that IP. This is a common automation stitch action in FortiGate that leverages the local address object and policy to enforce immediate blocking without manual intervention.

Exam trap

The trap here is that candidates may confuse 'quarantine' (a FortiClient/EMS endpoint concept) with network-level blocking, or assume that disabling a user account via CLI is a valid automation stitch action, when FortiGate stitches primarily handle network and security fabric actions, not OS-level account management.

Practice this question →

58

MCQmedium

A network admin wants to use FortiClient's advanced threat protection features to detect ransomware behavior on endpoints. Which FortiClient feature should be enabled?

A.Advanced Threat Protection

B.Web Filtering

C.Application Firewall

D.Vulnerability Scan

AnswerA

ATP includes behavior-based detection for ransomware.

Why this answer

FortiClient's Advanced Threat Protection (ATP) feature is specifically designed to detect and block ransomware behavior by using real-time behavioral analysis, machine learning, and exploit prevention. Unlike other features, ATP monitors process behavior for indicators of compromise (IoCs) such as mass file encryption or unauthorized file access patterns, making it the correct choice for ransomware detection.

Exam trap

The trap here is that candidates confuse 'Advanced Threat Protection' with general security features like web filtering or application control, not realizing that ATP is the only feature that performs behavioral analysis on endpoint processes to detect ransomware.

How to eliminate wrong answers

Option B (Web Filtering) is wrong because it controls access to URLs and categories but does not analyze endpoint process behavior for ransomware. Option C (Application Firewall) is wrong because it controls network traffic based on application signatures and policies, not local process behavior or file system anomalies. Option D (Vulnerability Scan) is wrong because it identifies missing patches and configuration weaknesses but does not provide real-time behavioral detection of ransomware execution.

Practice this question →

59

MCQmedium

Which Fortinet solution collects and correlates security events from multiple sources to provide a unified view of threats across the network?

A.FortiSIEM

B.FortiSandbox

C.FortiDeceptor

D.FortiEDR

AnswerA

FortiSIEM collects and correlates events from various sources.

Why this answer

FortiSIEM is the correct answer because it is specifically designed as a Security Information and Event Management (SIEM) solution that aggregates, normalizes, and correlates logs and events from diverse sources—including firewalls, endpoints, servers, and cloud platforms—into a single pane of glass. It uses a patented event correlation engine and a unified event database to detect multi-stage attack patterns and provide actionable threat intelligence, fulfilling the requirement for a unified view of threats across the network.

Exam trap

The trap here is that candidates often confuse FortiSandbox or FortiEDR as the central correlation tool because they are prominent in the Fortinet Advanced Threat Protection (ATP) framework, but they lack the multi-source event aggregation and correlation that is the defining function of a SIEM like FortiSIEM.

How to eliminate wrong answers

Option B (FortiSandbox) is wrong because it is a threat detection and analysis appliance that focuses on executing suspicious files in a virtualized environment to identify zero-day malware, not on collecting and correlating security events from multiple sources. Option C (FortiDeceptor) is wrong because it is a deception-based threat detection platform that deploys decoys and lures to trap attackers, but it does not aggregate or correlate events from external sources; it only generates alerts from its own decoys. Option D (FortiEDR) is wrong because it is an endpoint detection and response solution that monitors and responds to threats on individual endpoints, but it lacks the centralized event correlation and multi-source aggregation capabilities of a SIEM.

Practice this question →

60

Multi-Selectmedium

A network admin is troubleshooting why FortiGate's antivirus is not detecting a known malware sample. The sample is detected by other scanners. Which two checks should the admin perform? (Choose two.)

Select 2 answers

A.Verify that the FortiGuard Antivirus subscription is active

B.Check that the file is not excluded by a file filter

C.Ensure the firewall policy is configured for proxy-based inspection

D.Check the antivirus database version against the latest available

E.Confirm that the antivirus profile has 'Scan on Delivery' enabled

AnswersA, D

Without a valid subscription, signatures are not updated.

Why this answer

FortiGate's antivirus engine relies on a valid FortiGuard Antivirus subscription to download and update the virus signature database. If the subscription has expired, the engine cannot receive new signatures, causing it to miss recently discovered malware samples that other scanners with active subscriptions detect.

Exam trap

The trap here is that candidates often confuse 'file filter' exclusions with antivirus signature exclusions, or assume proxy-based inspection is mandatory for antivirus, when in fact flow-based inspection also supports antivirus scanning.

Practice this question →

61

Multi-Selectmedium

A security administrator is configuring FortiSandbox integration to automatically block malicious files detected in email attachments. Which TWO actions are required to achieve this integration?

Select 2 answers

A.Configure FortiGate to submit files to FortiSandbox for analysis

B.Deploy FortiClient endpoints with full disk encryption

C.Configure FortiSandbox to send SNMP traps when a file is malicious

D.Enable FortiGate's machine learning engine on the antivirus profile

E.Enable 'Block malicious files detected by FortiSandbox' in the antivirus profile

AnswersA, E

File submission is required so FortiSandbox can analyze files.

Why this answer

FortiGate must be configured to submit files to FortiSandbox for analysis, which is the foundational step to enable detection of malicious content in email attachments. This submission is typically done via the FortiGate antivirus profile, where the 'FortiSandbox' inline scanning option is enabled, allowing files to be sent to FortiSandbox for verdict-based blocking.

Exam trap

The trap here is that candidates often confuse the requirement for FortiSandbox to send SNMP traps (which is only for alerting) with the actual blocking action, or they mistakenly think that enabling the machine learning engine alone provides sandbox integration, when in fact it is a separate local detection feature.

Practice this question →

62

Multi-Selectmedium

An administrator wants to create an automation stitch that responds to a high-severity IPS event by blocking the attacker IP. Which THREE components are required to build this automation stitch?

Select 3 answers

A.Trigger (e.g., IPS Event)

B.Schedule (e.g., run every hour)

C.Action (e.g., Block IP)

D.Target (e.g., FortiGate or FortiManager)

E.Condition (e.g., severity threshold)

AnswersA, C, D

Defines what event starts the stitch.

Why this answer

An automation stitch in FortiOS requires a trigger to initiate the workflow. In this scenario, the IPS event trigger is specifically designed to fire when a high-severity IPS signature match occurs, providing the necessary event data (e.g., attacker IP) to pass to subsequent actions. Without a trigger, the stitch would have no starting point.

Exam trap

The trap here is that candidates often confuse 'Condition' as a separate component because they think of it like a firewall policy's 'if-then' logic, but in FortiOS automation stitches, filtering logic is embedded within the trigger definition, not a standalone object.

Practice this question →

63

MCQmedium

An administrator wants to automatically block a file that FortiSandbox has determined to be malicious. The FortiGate is configured with an antivirus profile that includes FortiSandbox submission. Which verdict action should be set to 'block' in the antivirus profile to achieve this?

A.Exempted

B.Unknown

C.Malicious

D.Clean

AnswerC

The 'Malicious' verdict action will block files determined malicious by FortiSandbox.

Why this answer

The 'Malicious' verdict action in the antivirus profile is specifically designed to block files that FortiSandbox has determined to be malicious. When FortiSandbox submits a file and returns a 'malicious' verdict, the FortiGate uses this action to enforce blocking, ensuring the file is not delivered to the end user.

Exam trap

The trap here is that candidates often confuse 'Unknown' with 'Malicious' and think blocking unknown files is safer, but FortiSandbox's 'Unknown' verdict means the file could not be analyzed (e.g., due to size or timeout), and blocking it would disrupt legitimate traffic; the correct approach is to block only confirmed malicious files.

How to eliminate wrong answers

Option A is wrong because 'Exempted' is used to bypass scanning for specific files or patterns, not to block malicious files. Option B is wrong because 'Unknown' verdict action is used for files that FortiSandbox could not conclusively classify; blocking unknown files would cause excessive false positives and is not the intended behavior for confirmed malicious files. Option D is wrong because 'Clean' verdict action allows files that are determined to be safe, which is the opposite of blocking malicious content.

Practice this question →

64

MCQhard

An administrator wants to create an automation stitch that automatically blocks an IP address when a high-severity IPS alert is triggered. The administrator creates a trigger for 'IPS event' and an action of 'Add to Blocked IPs'. However, the action fails to execute. Which of the following is the most likely cause?

A.The automation stitch is set to execute every 5 minutes, not immediately

B.The blocked IP list has reached its maximum size

C.The IPS event trigger does not support IP address extraction

D.The admin account used to configure the stitch does not have permission to modify the blocked IP list

AnswerD

The stitch runs with the privileges of the admin who created it. If that admin lacks write access to address objects, the action fails.

Why this answer

The admin account used to configure the automation stitch must have the necessary permissions to modify the blocked IP list. In FortiOS, the automation stitch action 'Add to Blocked IPs' requires write access to the firewall address object or the blocked IP list. If the admin account has read-only or restricted privileges, the action will fail silently, even if the trigger and action are correctly configured.

Exam trap

The trap here is that candidates often assume the issue is with the trigger's capability (Option C) or a configuration timing problem (Option A), but FortiOS automation stitches are designed to extract IPs from IPS events, and the real bottleneck is almost always admin permissions, which is a subtle but critical detail in NSE7 exams.

How to eliminate wrong answers

Option A is wrong because the automation stitch execution interval (e.g., every 5 minutes) does not prevent the action from executing; it only delays it. The action would still execute at the next scheduled interval, not fail entirely. Option B is wrong because the blocked IP list has a default maximum size of 16,384 entries in FortiOS, and reaching this limit would cause the action to fail with a specific error, but the question states the action 'fails to execute' without any indication of a full list.

More importantly, the most common cause is permission-related, not capacity. Option C is wrong because the IPS event trigger in FortiOS does support IP address extraction; it captures the source IP from the IPS event log and passes it to the action. The trigger is designed to extract the IP address for use in automation stitches.

Practice this question →

65

MCQeasy

What is the primary difference between using a Web Application Firewall (WAF) on FortiGate versus using FortiWeb?

A.There is no difference; they are the same.

B.FortiGate WAF is cloud-based, while FortiWeb is on-premises.

C.FortiWeb provides dedicated, advanced WAF features and higher performance for web traffic, while FortiGate WAF is a basic protection feature.

D.FortiGate WAF can protect multiple web servers simultaneously, while FortiWeb protects only one.

AnswerC

FortiWeb is a dedicated WAF appliance with more advanced capabilities; FortiGate includes a basic WAF profile.

Why this answer

FortiWeb is a dedicated web application firewall appliance that provides advanced, specialized WAF features such as machine learning-based bot detection, API discovery, and granular signature tuning, along with higher throughput for web traffic. In contrast, the WAF feature on FortiGate is a basic, integrated protection module that offers essential HTTP/HTTPS inspection and signature-based filtering, but lacks the depth and performance optimization of FortiWeb.

Exam trap

The trap here is that candidates assume all WAF implementations are functionally identical, overlooking the architectural and performance differences between an integrated feature and a dedicated appliance.

How to eliminate wrong answers

Option A is wrong because FortiGate WAF and FortiWeb are fundamentally different products; FortiGate integrates a basic WAF as a feature within its NGFW, while FortiWeb is a dedicated appliance with advanced web security capabilities. Option B is wrong because FortiGate WAF is not cloud-based; it runs on-premises as part of the FortiGate hardware or VM, and FortiWeb can be deployed both on-premises and as a cloud service (e.g., FortiWeb Cloud). Option D is wrong because both FortiGate WAF and FortiWeb can protect multiple web servers simultaneously; FortiWeb supports multi-server load balancing and virtual server configurations, while FortiGate WAF can apply policies to multiple web servers behind the firewall.

Practice this question →

66

Multi-Selectmedium

Which TWO features are part of FortiGate's Advanced Threat Protection (ATP) suite?

Select 2 answers

A.Data Leak Prevention (DLP)

B.SSL Inspection

C.FortiGuard Antivirus

D.FortiSandbox

E.Intrusion Prevention System (IPS)

AnswersC, D

Part of ATP for malware detection.

Why this answer

FortiGate's Advanced Threat Protection (ATP) suite is designed to detect and block advanced, unknown, and zero-day threats. FortiGuard Antivirus (C) is a core ATP component that uses signature-based and heuristics-based scanning to detect known malware at the gateway. FortiSandbox (D) extends this by detonating suspicious files in a virtual environment to identify unknown threats, making both integral to the ATP suite.

Exam trap

The trap here is that candidates often confuse core security functions (like IPS or DLP) with the specific ATP suite components, which are explicitly defined by Fortinet as FortiGuard Antivirus and FortiSandbox for advanced threat detection.

Practice this question →

67

MCQhard

You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?

A.The session is in SYN_SENT state and cannot be established

B.The session is an established TCP session with about one hour remaining before timeout

C.The session is a UDP session using port 443

D.The session has a duration of 3600 seconds and will expire immediately

AnswerB

Established TCP session (state 01), duration 3600s, expire 3599s (about 1 hour).

Why this answer

The output shows a TCP session (proto=6) with state 01, which in Fortinet's session table indicates an established TCP connection. The duration of 3600 seconds and expire value of 3599 seconds mean the session has been active for about one hour and has approximately one hour remaining before the idle timeout expires. This matches option B.

Exam trap

The trap here is that candidates often confuse the proto_state value 01 with SYN_SENT (which is 02) or assume the expire field indicates total session lifetime rather than remaining idle timeout.

How to eliminate wrong answers

Option A is wrong because proto_state=01 indicates an established TCP session, not SYN_SENT; SYN_SENT would be state 02. Option C is wrong because proto=6 is TCP, not UDP (UDP uses proto=17). Option D is wrong because expire=3599 means the session will expire in about 3599 seconds, not immediately; immediate expiry would show expire=0 or a very small value.

Practice this question →

68

MCQmedium

An organization wants to prevent zero-day attacks by using Content Disarm and Reconstruction (CDR) on email attachments. Which Fortinet product provides this capability?

A.FortiWeb

B.FortiGate

C.FortiMail

D.FortiSandbox

AnswerC

FortiMail provides email security including CDR.

Why this answer

FortiMail is the correct answer because it natively integrates Content Disarm and Reconstruction (CDR) to sanitize email attachments by removing active content (e.g., macros, scripts, embedded objects) and rebuilding the file in a safe format. This prevents zero-day exploits that bypass signature-based detection, as CDR does not rely on threat intelligence but instead strips potentially malicious elements before delivery.

Exam trap

The trap here is that candidates often confuse FortiSandbox's dynamic analysis with CDR, assuming both provide proactive protection against zero-days, but FortiSandbox requires execution and detection, whereas CDR prevents exploitation by removing the attack surface entirely without relying on signatures or behavioral analysis.

How to eliminate wrong answers

Option A is wrong because FortiWeb is a web application firewall (WAF) that protects web servers from HTTP/HTTPS attacks (e.g., SQL injection, XSS) and does not process email attachments or provide CDR functionality. Option B is wrong because FortiGate is a next-generation firewall (NGFW) that can perform antivirus and sandboxing for traffic passing through it, but it does not include native CDR for email attachments; CDR is a feature specific to FortiMail's email security pipeline. Option D is wrong because FortiSandbox is a separate advanced threat detection appliance that uses dynamic analysis (e.g., detonating files in a sandbox) to identify unknown malware, but it does not perform CDR; CDR proactively disarms attachments without execution, whereas FortiSandbox relies on behavioral analysis after execution.

Practice this question →

69

MCQhard

A FortiGate is configured with an IPS sensor that has protocol anomaly detection enabled. The admin notices that legitimate VoIP traffic (SIP) is being blocked. Which action should the admin take to reduce false positives?

A.Change the IPS action from block to monitor

B.Add the VoIP servers to an IP exemption list in the IPS sensor

C.Disable protocol anomaly detection entirely

D.Tune the protocol anomaly thresholds to be more lenient for SIP

AnswerD

Tuning thresholds reduces false positives while maintaining security.

Why this answer

Protocol anomaly detection in IPS sensors uses predefined thresholds to identify abnormal traffic patterns. When legitimate SIP traffic is being blocked, tuning the protocol anomaly thresholds to be more lenient for SIP allows the sensor to accommodate normal variations in SIP behavior without triggering false positives, while still maintaining protection against actual anomalies.

Exam trap

The trap here is that candidates may think disabling or bypassing detection (options A, B, or C) is the simplest fix, but the exam tests the understanding that protocol anomaly detection should be tuned rather than disabled to preserve security while reducing false positives.

How to eliminate wrong answers

Option A is wrong because changing the IPS action from block to monitor would stop blocking but also disable protection, which is not a targeted fix for false positives and leaves the network vulnerable to real threats. Option B is wrong because adding VoIP servers to an IP exemption list would bypass all IPS inspection for those IPs, which is overly broad and could allow actual attacks to go undetected. Option C is wrong because disabling protocol anomaly detection entirely removes a valuable security layer and is an extreme measure that does not address the root cause of false positives.

Practice this question →

70

Multi-Selectmedium

A security analyst wants to use automation stitches on FortiGate to automatically block an IP address when a critical severity event is logged. Which TWO components are essential to create this automation stitch? (Choose two.)

Select 2 answers

A.A FortiGuard subscription

B.A FortiAnalyzer to store logs

C.An action that adds the source IP to a firewall address group

D.A static route to the internet

E.A trigger that matches critical severity logs

AnswersC, E

The action defines the response, such as blocking the IP.

Why this answer

An automation stitch in FortiGate requires an action to execute a specific task, such as adding a source IP to a firewall address group, which effectively blocks the IP. This action is essential for enforcing the security response triggered by the stitch.

Exam trap

The trap here is that candidates often confuse optional components (like FortiGuard or FortiAnalyzer) with essential ones, mistakenly thinking external services or connectivity are required for the stitch's core trigger and action logic.

Practice this question →

71

MCQmedium

An administrator needs to deploy a honeypot solution to detect and deceive attackers inside the network. Which Fortinet product is BEST suited for this purpose?

A.FortiDeceptor

B.FortiSandbox

C.FortiEDR

D.FortiNAC

AnswerA

FortiDeceptor provides honeypots and decoys to detect lateral movement.

Why this answer

FortiDeceptor is a dedicated deception-based security solution that deploys decoys (honeypots) and lures across the network to detect and misdirect attackers. It integrates with FortiGate and FortiSIEM to provide automated threat isolation and forensic data collection, making it the best choice for a honeypot deployment.

Exam trap

The trap here is that candidates may confuse FortiSandbox's file analysis with deception technology, but FortiSandbox does not deploy decoys or lures within the network for attacker interaction.

How to eliminate wrong answers

Option B (FortiSandbox) is wrong because it focuses on analyzing suspicious files and URLs in a sandboxed environment, not on deploying honeypots or decoys for attacker deception. Option C (FortiEDR) is wrong because it provides endpoint detection and response capabilities, including behavioral analysis and threat hunting, but does not include honeypot or deception technology. Option D (FortiNAC) is wrong because it is a network access control solution that manages device authentication and compliance, not a deception-based detection tool.

Practice this question →

72

Multi-Selecthard

A security administrator wants to implement automated threat response using FortiGate automation stitches. Which THREE components are mandatory when creating an automation stitch? (Choose three.)

Select 3 answers

A.Schedule (e.g., daily at midnight)

B.Stitch name

C.Action (e.g., 'CLI Script', 'Add IP to Blocklist')

D.Trigger (e.g., 'Event Log' or 'FortiOS CLI')

E.Condition (e.g., filter on event type)

AnswersC, D, E

What happens when the stitch fires.

Why this answer

An automation stitch requires at least one action to execute when triggered. Actions define the actual response, such as running a CLI script, adding an IP to a blocklist, or sending an email. Without an action, the stitch would have no effect on the network.

Exam trap

The trap here is that candidates often confuse 'mandatory components' with 'required fields in the GUI' — the stitch name is a required field in the GUI but is not a functional component of the automation logic, while the condition is often overlooked as optional but is considered mandatory in the NSE7 exam because it is essential for practical threat response filtering.

Practice this question →

73

MCQhard

An administrator configured FortiGate to forward suspected malicious files to FortiSandbox. They set the action to 'block' for malicious verdicts. Some files are being blocked, but others with a 'clean' verdict are allowed. However, they notice that some files that should have been sent to FortiSandbox are not being forwarded. Which reason is MOST likely?

A.The FortiGate antivirus engine is set to proxy-based mode

B.The FortiGate has insufficient disk space for temporary files

C.The file size exceeds the maximum size configured for FortiSandbox scanning

D.The FortiSandbox device is overloaded and rejecting submissions

AnswerC

File size limits in the scanning profile prevent oversized files from being submitted to FortiSandbox.

Why this answer

The most likely reason is that the file size exceeds the maximum size configured for FortiSandbox scanning. FortiGate has a configurable limit (default 10 MB) for files sent to FortiSandbox; files larger than this threshold are not forwarded, even if the antivirus engine would otherwise trigger a submission. This explains why some files are blocked or allowed based on verdicts, while others are never submitted.

Exam trap

The trap here is that candidates often assume network or resource issues (overloaded FortiSandbox or disk space) are the cause, but the question specifically describes files that 'should have been sent' but are not, pointing to a configuration-based filter like file size limits rather than transient failures.

How to eliminate wrong answers

Option A is wrong because proxy-based mode is a valid inspection mode for FortiGate antivirus and does not prevent file forwarding to FortiSandbox; it actually supports file submission. Option B is wrong because insufficient disk space for temporary files would cause local scanning or caching issues, but FortiSandbox submissions are streamed or queued, not dependent on local temporary storage for forwarding. Option D is wrong because an overloaded FortiSandbox may delay or queue submissions, but it does not cause files to be completely not forwarded; FortiGate will still attempt submission and handle timeouts gracefully.

Practice this question →

74

Multi-Selecthard

A security engineer wants to implement advanced threat protection for email using FortiMail. Which THREE features should be enabled to provide comprehensive protection against sophisticated email threats? (Choose three.)

Select 3 answers

A.URL rewriting and click-time protection

B.FortiSandbox integration for email attachments

C.Anti-Spam filter

D.DMARC verification

E.Attachment size limits

AnswersA, B, D

URL rewriting protects against phishing links.

Why this answer

URL rewriting and click-time protection (A) is correct because it proactively neutralizes malicious URLs in emails by rewriting them to route through FortiMail's proxy, enabling real-time inspection at the time of click. This defends against phishing and credential-harvesting attacks that use URLs to deliver payloads or steal credentials, even if the URL was benign at delivery time.

Exam trap

The trap here is that candidates often mistake basic anti-spam or administrative controls (like attachment size limits) for advanced threat protection features, overlooking that sophisticated threats require dynamic, behavior-based defenses such as URL rewriting, sandboxing, and email authentication protocols.

Practice this question →

75

MCQhard

You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is timed out

B.The session is closing (FIN_WAIT)

C.The session is in SYN_SENT state, waiting for SYN-ACK

D.The session is fully established (proto_state=01 means established)

AnswerC

proto_state=01 indicates SYN_SENT.

Why this answer

The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In Fortinet's session table, `proto_state=01` for TCP indicates the session is in the SYN_SENT state, meaning the firewall has forwarded a SYN packet and is waiting for a SYN-ACK from the remote host. The session is not yet established, as the three-way handshake has not completed.

Exam trap

The trap here is that candidates often misinterpret `proto_state=01` as an established session because they associate '01' with a binary 'on' or 'active' state, but in Fortinet's TCP state encoding, 01 specifically means SYN_SENT, not established.

How to eliminate wrong answers

Option A is wrong because the session has an expire value of 3599 seconds, meaning it is still active and not timed out. Option B is wrong because a FIN_WAIT state would be represented by a different proto_state value (e.g., 04 or 05), not 01; proto_state=01 specifically indicates SYN_SENT, not a closing state. Option D is wrong because proto_state=01 does not mean established; an established TCP session would show proto_state=02 (SYN_RCVD) or proto_state=03 (ESTABLISHED) in Fortinet's session table.

Practice this question →

Page 1 of 3 · 166 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Advanced Threat Protection questions.

Start 20-question session