CCNA Advanced Threat Protection Questions — Page 2 of 3

Multi-Selectmedium

An administrator is investigating a security incident where a workstation is communicating with a known command and control (C2) server. The FortiGate has IPS enabled but did not block the traffic. Which TWO configuration issues could explain why the IPS did not detect the C2 communication? (Choose two.)

Select 2 answers

A.The firewall policy does not have SSL deep inspection enabled

B.The IPS sensor is configured in 'Inline' mode

C.The IPS sensor has 'Logging' disabled

D.The IPS sensor does not include signatures for the C2 protocol or pattern

E.The FortiGate is operating in 'Transparent' mode

AnswersA, D

Without SSL inspection, encrypted C2 traffic is invisible to IPS.

Why this answer

Without SSL deep inspection, the FortiGate cannot decrypt HTTPS traffic to inspect the payload for C2 signatures. IPS operates on decrypted content; if the C2 communication uses TLS, the IPS engine only sees encrypted packets and cannot match application-layer signatures. Enabling SSL deep inspection with a valid CA certificate is required to decrypt and inspect the traffic.

Exam trap

The trap here is that candidates often assume 'Inline' mode or 'Transparent' mode inherently affect detection capability, when in fact they only affect traffic flow or logging, not the IPS engine's ability to inspect decrypted content.

Practice this question →

MCQmedium

An administrator configures an automation stitch on FortiGate to automatically block an IP address when a specific IPS signature triggers. What must be configured as the trigger and action?

A.Trigger: 'Event Log' with filter for the IPS signature; Action: 'Add IP to Blocklist'

B.Trigger: 'Incoming Webhook'; Action: 'CLI Script'

C.Trigger: 'FortiOS CLI'; Action: 'Alert Email'

D.Trigger: 'Schedule'; Action: 'Banned IP'

AnswerA

Event log triggers on specific log IDs; action adds IP to blocklist.

Why this answer

An automation stitch in FortiGate requires a trigger that defines the event that starts the automation, and an action that defines what happens when the trigger fires. For automatically blocking an IP when a specific IPS signature triggers, the trigger must be 'Event Log' with a filter for that IPS signature, and the action must be 'Add IP to Blocklist', which directly adds the source IP to the FortiGate's blocklist (banned IP list). This combination ensures that when the IPS signature is logged, the stitch extracts the source IP and applies a block.

Exam trap

The trap here is that candidates confuse 'Banned IP' (a status or list) with the actual action name 'Add IP to Blocklist', or they mistakenly think a CLI script or webhook can directly react to an IPS event without the proper log-based trigger.

How to eliminate wrong answers

Option B is wrong because 'Incoming Webhook' is a trigger that waits for an external HTTP request, not for an IPS signature event; it cannot directly react to local IPS logs. Option C is wrong because 'FortiOS CLI' is not a valid trigger type in automation stitches; triggers are events like 'Event Log', 'Incoming Webhook', or 'Schedule', not CLI commands. Option D is wrong because 'Schedule' is a time-based trigger (e.g., daily at 2 AM), not an event-driven trigger for an IPS signature; 'Banned IP' is not a valid action name—the correct action is 'Add IP to Blocklist'.

Practice this question →

Multi-Selectmedium

A company wants to use FortiMail to implement email authentication to prevent spoofing. Which THREE mechanisms should be configured in FortiMail's Authentication Profile?

Select 3 answers

A.DMARC

B.DKIM

C.S/MIME

D.TLS

E.SPF

AnswersA, B, E

Domain-based Message Authentication, Reporting & Conformance.

Why this answer

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is correct because it builds on SPF and DKIM to provide a policy framework that tells receiving mail servers how to handle messages that fail authentication checks. In FortiMail's Authentication Profile, DMARC enables the enforcement of policies like quarantine or reject, which directly prevents spoofing by ensuring only authenticated emails are delivered.

Exam trap

The trap here is that candidates often confuse transport security (TLS) or client-side encryption (S/MIME) with server-side domain authentication mechanisms, leading them to select options that protect confidentiality or integrity but do not prevent spoofing.

Practice this question →

MCQhard

An administrator configures a WAF profile on FortiGate to protect a web application. They notice that SQL injection attacks are not being blocked. What is the MOST likely reason?

A.The web application uses HTTPS without SSL inspection

B.The FortiGuard Web Filtering subscription is inactive

C.The WAF profile is set to monitor mode

D.The WAF profile is applied to the wrong firewall policy

AnswerB

WAF signatures are part of FortiGuard Web Filtering; without subscription, updates stop.

Why this answer

The FortiGuard Web Filtering subscription provides the signature database required to detect and block SQL injection attacks within a WAF profile. Without an active subscription, the WAF profile cannot update or use the latest attack signatures, rendering it unable to identify SQL injection patterns even if the profile is enabled and applied correctly.

Exam trap

The trap here is that candidates often assume a WAF profile in monitor mode is the most likely cause of attacks not being blocked, but the question emphasizes 'most likely' and the inactive subscription is a more fundamental prerequisite for signature-based detection to function at all.

How to eliminate wrong answers

Option A is wrong because HTTPS without SSL inspection does not prevent the WAF from inspecting HTTP traffic; FortiGate can still inspect the decrypted traffic if SSL inspection is configured, but the WAF operates on the application layer and can block SQL injection regardless of encryption as long as the traffic is decrypted. Option C is wrong because a WAF profile set to monitor mode would log attacks but not block them, which would be a plausible reason for SQL injection not being blocked, but the question asks for the 'most likely' reason, and an inactive FortiGuard subscription is a more fundamental issue that prevents signature-based detection entirely. Option D is wrong because applying the WAF profile to the wrong firewall policy would mean the profile is not applied to the traffic at all, but the administrator has already configured the profile and noticed it is not blocking attacks, implying the profile is applied; the issue is with the signature database, not policy application.

Practice this question →

MCQhard

During a security incident, the SOC team receives an alert from FortiSIEM about a user accessing a known malicious IP. The team wants to automatically block the IP on the FortiGate. Which FortiGate feature can be used to create an automated response based on a threat intelligence feed?

A.Automation Stitch

B.Local-in Policy

C.FortiGuard Outbreak Prevention

D.FortiGate VPN

AnswerA

Automation Stitches combine triggers (e.g., threat feed update) with actions (e.g., add address to block list) to automate responses.

Why this answer

Automation Stitch in FortiOS allows you to create automated responses triggered by events such as threat intelligence feeds. By configuring an Automation Stitch with a trigger from FortiSIEM (e.g., via a webhook or syslog) and an action to add a block entry to the FortiGate's local address group or dynamic block list, the SOC team can automatically block the malicious IP without manual intervention.

Exam trap

The trap here is that candidates often confuse Automation Stitch with FortiGuard Outbreak Prevention, thinking the latter can be directly triggered by a third-party alert, when in fact Outbreak Prevention is a passive, subscription-based feed that does not support custom automation from external sources like FortiSIEM.

How to eliminate wrong answers

Option B is wrong because Local-in Policy controls traffic destined to the FortiGate itself (e.g., management access), not traffic passing through the FortiGate, so it cannot block outbound traffic to a malicious IP. Option C is wrong because FortiGuard Outbreak Prevention is a subscription service that provides real-time threat intelligence and blocking for known outbreaks, but it does not allow custom automated responses based on a specific alert from FortiSIEM; it operates independently via FortiGuard updates. Option D is wrong because FortiGate VPN is a feature for secure remote access and site-to-site connectivity, not for automated threat response or IP blocking based on threat intelligence feeds.

Practice this question →

MCQmedium

Which FortiMail advanced feature allows the administrator to rewrite URLs in email bodies to redirect users to a safe scanning service when they click on a link?

A.URL Rewriting

B.Attachment Filtering

C.Bounce Verification

D.Anti-Spam

AnswerA

URL Rewriting replaces links with rewritten URLs that go through FortiMail's link scanning.

Why this answer

URL Rewriting is the correct answer because it is a FortiMail advanced feature specifically designed to replace URLs in email bodies with rewritten links that redirect users through FortiMail's scanning service. When a user clicks the rewritten URL, FortiMail inspects the destination in real time for malicious content, such as phishing or malware sites, before allowing the redirect. This provides proactive protection against zero-hour threats by leveraging FortiGuard's web filtering and threat intelligence.

Exam trap

The trap here is that candidates often confuse URL Rewriting with Attachment Filtering, assuming both deal with malicious content, but URL Rewriting specifically targets links in the email body, not file attachments.

How to eliminate wrong answers

Option B (Attachment Filtering) is wrong because it focuses on scanning email attachments for malware or prohibited file types, not on rewriting URLs in email bodies. Option C (Bounce Verification) is wrong because it validates the authenticity of bounce messages to prevent backscatter spam, not URL manipulation. Option D (Anti-Spam) is wrong because it uses techniques like RBLs, greylisting, and heuristic analysis to filter unwanted bulk email, not to rewrite or scan URLs for malicious content.

Practice this question →

MCQmedium

A network admin configures FortiGate to submit files to FortiSandbox for analysis. After submission, the FortiGate logs show that files are being sent but no verdict is returned. The FortiSandbox is reachable and licensed. What is the most likely cause?

A.The FortiGate is using proxy-based inspection instead of flow-based

B.The FortiSandbox server's IP is not added to the FortiGate's trusted hosts

C.The FortiGate does not have a FortiGuard Security Rating subscription

D.The antivirus profile is set to block without scanning

AnswerC

FortiSandbox verdicts are delivered via FortiGuard rating; without the subscription, verdicts are not returned.

Why this answer

FortiGate requires a valid FortiGuard Security Rating subscription to receive verdicts from FortiSandbox. Without this subscription, the FortiGate can submit files and see them as sent in logs, but it cannot process the returned verdicts, resulting in no action taken on the files. The Security Rating subscription enables the communication channel for verdict retrieval, distinct from the basic FortiSandbox license.

Exam trap

The trap here is that candidates assume a licensed FortiSandbox alone is sufficient for verdict delivery, overlooking that FortiGate requires an additional FortiGuard Security Rating subscription to consume those verdicts.

How to eliminate wrong answers

Option A is wrong because proxy-based inspection does not prevent verdict retrieval; FortiGate can receive and act on FortiSandbox verdicts regardless of inspection mode, as verdicts are handled at the FortiGate-FortiSandbox communication level, not the inspection engine. Option B is wrong because trusted hosts are used for administrative access control to the FortiGate GUI/CLI, not for FortiSandbox communication; FortiSandbox connectivity relies on IP reachability and API keys, not trusted host lists. Option D is wrong because setting an antivirus profile to block without scanning would prevent file submission entirely, not cause a scenario where files are sent but no verdict is returned; the logs confirm submission occurred, ruling out this option.

Practice this question →

MCQmedium

A FortiGate administrator is troubleshooting an issue where a legitimate application is being blocked by the IPS. The administrator wants to ensure the application works while maintaining protection for other traffic. What is the best action?

A.Disable the IPS sensor on the firewall policy

B.Apply an application control profile to allow the application

C.Create a custom IPS signature to pass the specific application traffic

D.Change the IPS signature action to 'monitor' for all signatures

AnswerC

Custom signature with 'pass' action allows the application while keeping other protections.

Why this answer

Creating a custom IPS signature with a 'pass' action for the specific application traffic will allow it, while the default action (block) applies to others.

Practice this question →

MCQmedium

An administrator needs to create a custom IPS signature to detect a specific exploit that sends a unique string 'EXPLOIT_2024' in the HTTP User-Agent header. Which IPS signature syntax should the administrator use?

A.F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "EXPLOIT_2024"; --context http-header;)

B.F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "User-Agent: EXPLOIT"; --service HTTP;)

C.F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "EXPLOIT_2024"; --service HTTP;)

D.F-SBID(--name "Custom_Exploit"; --protocol tcp; --pattern "User-Agent: EXPLOIT_2024"; --service HTTP;)

AnswerD

This pattern matches the exact User-Agent header content.

Why this answer

It uses the `--pattern` to match the exact string 'User-Agent: EXPLOIT_2024' within the HTTP header context, and `--service HTTP` ensures the signature only inspects HTTP traffic. This syntax precisely detects the exploit string in the User-Agent header as required.

Exam trap

The trap here is that candidates often assume `--context http-header` is a valid keyword (like in Snort), but FortiGate IPS uses `--service HTTP` to scope header inspection, and the pattern must include the full header field to match precisely.

How to eliminate wrong answers

Option A is wrong because `--context http-header` is not a valid keyword in FortiGate IPS signatures; the correct approach is to use `--service HTTP` to scope the signature to HTTP traffic. Option B is wrong because the pattern 'User-Agent: EXPLOIT' is incomplete—it does not include the full string 'EXPLOIT_2024', so it would fail to detect the specific exploit. Option C is wrong because the pattern 'EXPLOIT_2024' alone would match the string anywhere in the HTTP payload, not specifically in the User-Agent header, leading to false positives or missed detections.

Practice this question →

MCQmedium

A network admin notices that files submitted to FortiSandbox from FortiGate are not being analyzed. The FortiGate has a valid FortiSandbox license and the device is reachable. What configuration step is most likely missing?

A.The FortiSandbox feature is not enabled in the VDOM settings

B.The antivirus profile has 'FortiSandbox Inline Scan' disabled

C.The FortiSandbox server IP is not configured under Security Fabric > Fabric Connectors

D.The FortiGate is not registered with FortiCloud

AnswerB

Inline scan must be enabled in the antivirus profile to send files to FortiSandbox.

Why this answer

FortiGate uses antivirus profiles to define scanning behavior for traffic. Even with a valid FortiSandbox license and reachability, the antivirus profile must have 'FortiSandbox Inline Scan' enabled to submit files to FortiSandbox for analysis. Without this setting, files are not forwarded for sandboxing, regardless of other configurations.

Exam trap

The trap here is that candidates assume a valid license and reachability are sufficient, overlooking that the antivirus profile must explicitly enable the inline scan feature to trigger file submission to FortiSandbox.

How to eliminate wrong answers

Option A is wrong because the FortiSandbox feature is enabled globally under System > FortiSandbox, not per VDOM; VDOM settings do not control the submission of files to FortiSandbox. Option C is wrong because the FortiSandbox server IP is configured under System > FortiSandbox, not under Security Fabric > Fabric Connectors; Fabric Connectors are for integration with other Fortinet products like FortiAnalyzer or FortiSIEM. Option D is wrong because FortiCloud registration is required for cloud-based services like FortiGuard, but not for on-premises FortiSandbox communication; the FortiGate and FortiSandbox communicate directly via API over HTTPS.

Practice this question →

MCQeasy

What is the primary function of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus profile?

A.To detect and block zero-day malware using machine learning

B.To reconstruct files that were corrupted during transmission

C.To compress files for faster scanning

D.To remove active content and rebuild files to eliminate hidden threats

AnswerD

CDR strips potentially malicious elements and reconstructs a sanitized file.

Why this answer

Content Disarm and Reconstruction (CDR) works by stripping active content (e.g., macros, scripts, OLE objects) from incoming files and rebuilding them into a safe, sanitized version. This eliminates hidden threats such as embedded exploits or malicious code that signature-based detection might miss, providing protection against zero-day and unknown attacks. Option D correctly identifies this core function of removing active content and rebuilding files to neutralize threats.

Exam trap

The trap here is that candidates confuse CDR with traditional antivirus or sandboxing, assuming it detects threats via signatures or behavioral analysis, when in fact it proactively removes all active content regardless of whether a threat is known.

How to eliminate wrong answers

Option A is wrong because CDR does not use machine learning; it is a deterministic process that removes active content and reconstructs files, whereas FortiGate's machine learning-based detection is handled by FortiGuard AI/ML or other advanced threat protection features. Option B is wrong because CDR does not repair files corrupted during transmission; it sanitizes files by stripping potentially dangerous elements, and file corruption recovery is outside its scope. Option C is wrong because CDR does not compress files for faster scanning; it actually increases file size slightly due to reconstruction overhead, and compression is unrelated to its security purpose.

Practice this question →

MCQmedium

A network administrator wants to ensure that files downloaded from the internet are analyzed by FortiSandbox before being delivered to the client. The FortiGate is configured with a FortiSandbox connection and an antivirus profile. Which setting must be enabled in the antivirus profile to submit files to FortiSandbox?

A.FortiSandbox inline scanning

B.Enable Content Disarm and Reconstruction (CDR)

C.Enable Outbreak Prevention

D.Submit files to FortiSandbox

AnswerD

The antivirus profile includes a setting to submit files to FortiSandbox for analysis.

Why this answer

The 'Submit files to FortiSandbox' setting in the antivirus profile is the specific toggle that instructs FortiGate to forward files to the configured FortiSandbox for analysis. Without this setting enabled, the FortiGate will not send any files to FortiSandbox, even if the FortiSandbox connection is configured and the antivirus profile is applied.

Exam trap

The trap here is that candidates confuse the 'Submit files to FortiSandbox' setting in the antivirus profile with the 'FortiSandbox inline scanning' option in the security policy, thinking inline scanning alone enables submission, but inline scanning only controls traffic handling after submission is already enabled.

How to eliminate wrong answers

Option A is wrong because FortiSandbox inline scanning is not a setting in the antivirus profile; it is a mode of operation where traffic is held until sandbox verdict is received, but the actual submission is controlled by the 'Submit files to FortiSandbox' option. Option B is wrong because Content Disarm and Reconstruction (CDR) is a separate feature that sanitizes files by removing active content, not for submitting files to FortiSandbox. Option C is wrong because Outbreak Prevention is a FortiGuard service that provides real-time threat intelligence, not a mechanism to submit files to FortiSandbox.

Practice this question →

MCQhard

An administrator runs 'diagnose ips anomaly list' and sees many 'data_leak' events from a specific internal IP address. The IPS sensor has the default pre-defined signatures enabled. What additional step should the administrator take to block this specific anomaly?

A.Enable protocol anomaly detection in the antivirus profile

B.Create a custom IPS signature to match the anomaly pattern and apply it to the IPS sensor

C.Enable the 'data_leak' signature in the IPS sensor and set action to 'block'

D.Configure a firewall policy with application control to block the traffic

AnswerB

Custom signatures allow precise detection of protocol anomalies beyond pre-defined signatures.

Why this answer

The 'diagnose ips anomaly list' command shows protocol anomaly events, which are detected by the IPS engine's built-in anomaly detection logic, not by pre-defined signatures. To block a specific anomaly pattern like 'data_leak', the administrator must create a custom IPS signature that matches the exact anomaly characteristics and apply it to the IPS sensor. Pre-defined signatures cannot be modified to block anomalies; only custom signatures can target these events.

Exam trap

The trap here is that candidates confuse 'anomaly events' with 'pre-defined signatures', assuming they can simply enable or block a signature by name, when in fact anomalies require custom signature creation to be blocked.

How to eliminate wrong answers

Option A is wrong because protocol anomaly detection is a core IPS engine feature, not part of the antivirus profile, and enabling it in an antivirus profile would not affect IPS anomaly blocking. Option C is wrong because 'data_leak' is not a pre-defined signature in the IPS sensor; it is an anomaly event type, and pre-defined signatures cannot be enabled or set to 'block' for anomalies. Option D is wrong because application control operates at Layer 7 and cannot block low-level protocol anomalies detected by the IPS engine; it would only block application-specific traffic, not the anomaly itself.

Practice this question →

Multi-Selectmedium

An administrator needs to enable automation stitches to automatically block a malicious IP address detected by FortiSandbox. Which two components are required? (Choose two.)

Select 2 answers

A.A trigger that detects the FortiSandbox verdict

B.A static route to the malicious IP

C.An SSL certificate for the FortiGate

D.An action that adds the IP to a local threat feed

E.A firewall policy that allows the traffic

AnswersA, D

Trigger initiates the automation stitch.

Why this answer

Automation stitches require a trigger to initiate the workflow. In this scenario, the trigger must detect the FortiSandbox verdict (e.g., malicious or clean) to start the automated response. Without a trigger, the stitch has no event to react to, making it non-functional.

Exam trap

The trap here is that candidates often confuse the trigger requirement with other network components like routing or certificates, or mistakenly think a firewall policy allowing traffic is needed for the automation to work, when in fact the action modifies security policies to block the IP.

Practice this question →

MCQhard

An administrator runs 'diagnose sys session filter dport 443' and sees the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is a TCP connection that has been active for 3600 seconds and will expire in 3599 seconds

B.The session is a UDP DNS request

C.The session is being blocked by a firewall policy

D.The session is an SSL VPN tunnel

AnswerA

Correct interpretation of fields.

Why this answer

The output shows 'proto=6' which indicates TCP (protocol 6), 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds. The 'proto_state=01' is a TCP state code indicating an established connection. This is a standard FortiGate diagnostic session output.

Exam trap

The trap here is that candidates may misinterpret 'proto=6' as a generic protocol number without recalling that protocol 6 is specifically TCP, leading them to incorrectly associate the output with UDP-based services like DNS or SSL VPN tunnels.

How to eliminate wrong answers

Option B is wrong because UDP uses protocol 17, not protocol 6, and DNS requests typically use UDP port 53, not TCP port 443. Option C is wrong because the output shows an active session with a duration and expiry, indicating the session is allowed and tracked, not blocked; a blocked session would not have a duration or expire value. Option D is wrong because an SSL VPN tunnel is typically encapsulated in UDP (port 443) or uses a different session type, and the output shows a raw TCP session (proto=6) with no indication of VPN encapsulation or tunnel ID.

Practice this question →

MCQeasy

Which FortiGate IPS feature allows administrators to create rules that detect network traffic patterns deviating from normal protocol behavior?

A.Rate-based signatures

B.Custom signatures

C.Protocol anomaly

D.Geo-IP blocking

AnswerC

Protocol anomaly detection is specifically for detecting deviations from protocol standards.

Why this answer

Protocol anomaly detection in FortiGate IPS allows administrators to define rules that identify deviations from standard protocol behavior as defined by RFCs. Unlike signature-based detection, which matches known attack patterns, protocol anomaly detection flags traffic that violates expected protocol structures, such as malformed packets or illegal flag combinations. This enables the detection of zero-day exploits and protocol abuse without requiring a pre-existing signature.

Exam trap

The trap here is that candidates confuse 'protocol anomaly' with 'custom signatures' or 'rate-based signatures,' assuming any custom rule or threshold-based detection can identify protocol deviations, but FortiGate specifically reserves protocol anomaly for RFC-based behavioral analysis, not pattern matching or volumetric thresholds.

How to eliminate wrong answers

Option A is wrong because rate-based signatures are designed to detect traffic patterns based on thresholds (e.g., connections per second) rather than deviations from normal protocol behavior; they focus on volume anomalies, not protocol compliance. Option B is wrong because custom signatures are user-defined patterns (e.g., using the FSL language) that match specific content or byte sequences, not protocol deviations; they rely on known attack signatures, not behavioral analysis. Option D is wrong because Geo-IP blocking filters traffic based on geographic source or destination IP addresses, which is unrelated to protocol behavior or anomaly detection.

Practice this question →

MCQmedium

A company uses FortiMail for email security. They want to prevent email spoofing by verifying that incoming emails originate from authorized servers. Which email authentication method should be configured on FortiMail to check the sending server's IP against a published SPF record?

A.SPF verification

B.DKIM verification

C.DMARC verification

D.Sender Policy Framework (SPF) is not supported on FortiMail

AnswerA

SPF checks if the sending IP is authorized by the domain's SPF record.

Why this answer

SPF (Sender Policy Framework) verification on FortiMail checks the sending server's IP address against the SPF record published in the domain's DNS. This directly matches the requirement to verify that incoming emails originate from authorized servers, as SPF is designed to prevent spoofing by validating the envelope sender's domain against a list of permitted IPs.

Exam trap

The trap here is that candidates may confuse SPF verification with DKIM or DMARC, thinking that any of these methods directly check the sending server's IP, when only SPF performs that specific IP-to-record lookup.

How to eliminate wrong answers

Option B (DKIM verification) is wrong because DKIM uses a digital signature to verify that an email was not tampered with during transit and that it came from a domain that signs its messages, but it does not check the sending server's IP against a published record. Option C (DMARC verification) is wrong because DMARC builds on SPF and DKIM to provide a policy for how to handle failures, but it is not the method that directly checks the sending server's IP against an SPF record. Option D (Sender Policy Framework (SPF) is not supported on FortiMail) is wrong because FortiMail fully supports SPF verification as part of its anti-spoofing and anti-phishing capabilities.

Practice this question →

MCQmedium

An administrator is deploying FortiClient with ATP features. They want to ensure that if a process is detected as malicious by the FortiClient machine learning engine, the endpoint is isolated from the network. Which configuration should they use?

A.Create a firewall policy to block traffic from that endpoint

B.Enable 'auto-network-access' in the FortiClient profile

C.Configure an automation stitch with trigger 'FortiClient event' and action 'quarantine endpoint'

D.Enable 'FortiClient quarantine' in the antivirus profile

AnswerC

Automation stitches can respond to FortiClient events and isolate the endpoint.

Why this answer

An automation stitch with the trigger 'FortiClient event' and action 'quarantine endpoint' allows FortiGate to automatically isolate an endpoint when the FortiClient machine learning engine detects a malicious process. This integration leverages FortiGate's Security Fabric to enforce network isolation based on endpoint telemetry, ensuring the compromised host is blocked from communicating with the rest of the network.

Exam trap

The trap here is confusing endpoint file quarantine (antivirus profile) with network quarantine (automation stitch), leading candidates to select Option D, which only addresses local file remediation, not network isolation.

How to eliminate wrong answers

Option A is wrong because creating a firewall policy to block traffic from that endpoint is a manual, static approach that does not automatically respond to the FortiClient machine learning detection; it requires pre-defined IP addresses or user groups and lacks dynamic triggering. Option B is wrong because 'auto-network-access' in the FortiClient profile controls automatic VPN or network access for the client, not isolation of a compromised endpoint; it is unrelated to quarantine actions. Option D is wrong because 'FortiClient quarantine' in the antivirus profile is a legacy setting that quarantines files locally on the endpoint, not the endpoint itself from the network; it does not trigger network isolation via FortiGate.

Practice this question →

MCQhard

A FortiGate administrator runs the following CLI command: 'diagnose ips anomaly log' The output shows numerous 'tcp_syn_flood' events from a single source IP. To mitigate this, the administrator wants to block the source IP automatically. Which feature should be used?

A.IPS Custom Signature

B.Local-in Policy

C.IP Block List

D.Automation Stitch

AnswerD

Automation stitches can automate responses to events like syn flood.

Why this answer

The 'diagnose ips anomaly log' command displays anomalies detected by the FortiGate's DoS (Denial of Service) sensor, such as TCP SYN flood events. An Automation Stitch (Option D) is the correct feature to automatically block the source IP because it can trigger a 'Block IP' action based on a 'IPS Anomaly' event, creating an automated response without manual intervention.

Exam trap

The trap here is that candidates often confuse the IP Block List (a static or manually managed list) with the Automation Stitch (the automated engine that can dynamically add entries to that list based on events), leading them to select Option C instead of D.

How to eliminate wrong answers

Option A is wrong because an IPS Custom Signature is used to detect and block specific application-layer attacks (e.g., SQL injection, buffer overflows) based on pattern matching, not to automatically block IPs based on DoS anomaly events like TCP SYN flood. Option B is wrong because a Local-in Policy controls traffic destined to the FortiGate itself (management traffic), not traffic passing through the FortiGate, and cannot automatically block a source IP based on anomaly logs. Option C is wrong because the IP Block List is a static list of manually or dynamically blocked IPs, but it does not provide the automated trigger-and-response mechanism needed to react to an anomaly event in real-time; it is a component that can be used within an Automation Stitch, not the feature itself.

Practice this question →

Multi-Selecthard

A network security team is evaluating options for web application security. They need to protect a critical web application from SQL injection and cross-site scripting (XSS) attacks, and they require granular control over HTTP request parameters. Which THREE factors should influence their decision between using FortiGate's WAF profiles versus deploying a dedicated FortiWeb appliance?

Select 3 answers

A.FortiGate's WAF supports integration with FortiSandbox for file upload inspection

B.FortiGate's WAF profiles offer the same level of customization as FortiWeb for signature creation

C.FortiWeb can perform SSL offloading and load balancing, reducing load on the web servers

D.FortiWeb provides dedicated hardware and software optimized for web application security, offering higher throughput and lower latency for WAF processing

E.FortiWeb allows creation of custom signatures for application-layer attacks like SQL injection and XSS with greater flexibility

AnswersC, D, E

FortiWeb can handle SSL termination and distribute traffic, which is beneficial for performance.

Why this answer

FortiWeb is a dedicated web application firewall appliance with specialized hardware and software optimized for WAF processing, offering higher throughput and lower latency compared to the integrated WAF profiles on a FortiGate. Additionally, FortiWeb can perform SSL offloading and load balancing, which reduces the processing burden on web servers and improves overall performance. These capabilities make FortiWeb the superior choice when granular control and high-performance protection against SQL injection and XSS are required.

Exam trap

The trap here is that candidates assume FortiGate's WAF profiles are as feature-rich as FortiWeb, but FortiWeb is purpose-built with dedicated hardware and software for web application security, offering superior performance, customization, and additional features like SSL offloading and load balancing that FortiGate lacks.

Practice this question →

MCQhard

An administrator runs 'diagnose ips anomaly http' and sees many entries with 'type=SQLi' and 'score=0'. What does a score of 0 indicate?

A.The anomaly detection is disabled

B.The traffic showed suspicious patterns but did not meet the threshold

C.The IPS sensor is not applied to any policy

D.The traffic is definitely an SQL injection attack

AnswerB

Score 0 means no anomaly above threshold; it's a low-confidence event.

Why this answer

In Fortinet's IPS anomaly detection, a score of 0 indicates that the traffic exhibited suspicious patterns (e.g., SQLi signatures) but did not accumulate enough anomaly points to meet the configured threshold for triggering an action. This means the traffic was flagged as potentially malicious but was not deemed severe enough to warrant logging or blocking, so it remains in a 'monitoring' state without enforcement.

Exam trap

The trap here is that candidates assume a score of 0 means 'no threat' or 'disabled', but Fortinet uses 0 to indicate a sub-threshold detection that is still tracked, not a lack of detection.

How to eliminate wrong answers

Option A is wrong because a score of 0 does not indicate that anomaly detection is disabled; if detection were disabled, the 'diagnose ips anomaly http' command would not show any entries for that traffic. Option C is wrong because the IPS sensor not being applied to any policy would result in no IPS inspection at all, not a score of 0 with SQLi type entries; the presence of entries proves the sensor is applied. Option D is wrong because a score of 0 explicitly means the traffic did not meet the threshold to be classified as a definite attack; a score above the threshold would indicate a confirmed SQL injection attempt.

Practice this question →

MCQhard

A FortiGate admin runs 'diagnose ips anomaly list' and sees many 'tcp_src_session' events from a single internal IP. The admin suspects a scanning attack. What action should be taken to block this traffic without affecting legitimate traffic?

A.Create a firewall rule to block the IP address entirely

B.Create a custom IPS signature to detect and block the scanning pattern

C.Enable 'tcp_src_session' anomaly action to 'block' in the IPS sensor

D.Use a WAF profile to block the IP based on rate

AnswerB

A custom signature can precisely target the scan behavior.

Why this answer

Creating a custom IPS signature allows you to define specific patterns (e.g., multiple TCP SYN packets to different ports from the same source) that match scanning behavior, and then set the action to 'block'. This granular approach blocks only the malicious scanning traffic while permitting legitimate traffic from the same IP, unlike a blanket IP block or a global anomaly action that could impact normal sessions.

Exam trap

The trap here is that candidates often confuse anomaly-based detection (which triggers on aggregate session counts) with signature-based detection (which matches specific packet patterns), leading them to choose Option C, not realizing that blocking the anomaly would indiscriminately drop all traffic from the source IP, including legitimate sessions.

How to eliminate wrong answers

Option A is wrong because blocking the entire IP address would also drop any legitimate traffic from that host, which is too aggressive and not required if only scanning behavior needs to be stopped. Option C is wrong because enabling 'tcp_src_session' anomaly action to 'block' in the IPS sensor would block all traffic from that source IP once the anomaly threshold is exceeded, including legitimate sessions, and does not differentiate between scanning and normal traffic. Option D is wrong because a WAF profile is designed for HTTP/HTTPS web application traffic and cannot block TCP-based scanning patterns at the network layer; it would not inspect or rate-limit raw TCP SYN floods or port scans.

Practice this question →

Multi-Selecthard

An administrator is configuring FortiMail to improve email security. Which three of the following features are part of FortiMail's advanced threat protection? (Choose three.)

Select 3 answers

A.Web Filtering

B.Application Control

C.Email Authentication (SPF, DKIM, DMARC)

D.Content Disarm and Reconstruction (CDR)

E.Sandboxing (integration with FortiSandbox)

AnswersC, D, E

FortiMail supports email authentication protocols.

Why this answer

Email Authentication (SPF, DKIM, DMARC) is part of FortiMail's advanced threat protection because it verifies sender identity and prevents email spoofing and phishing. SPF checks the sending server's IP against authorized records, DKIM uses cryptographic signatures to ensure message integrity, and DMARC provides policy enforcement for alignment. These mechanisms collectively reduce the risk of domain impersonation and are integral to FortiMail's anti-phishing capabilities.

Exam trap

The trap here is that candidates confuse FortiGate's UTM features (Web Filtering, Application Control) with FortiMail's specialized email security features, leading them to select options that are not part of FortiMail's advanced threat protection.

Practice this question →

Multi-Selectmedium

A FortiGate administrator wants to use threat intelligence feeds to block known malicious IP addresses. Which TWO steps are required to accomplish this? (Choose two.)

Select 2 answers

A.Create an external threat feed connector pointing to the IoC source

B.Enable IPS on all policies

C.Configure FortiGuard to push feeds automatically

D.Create a firewall policy with the threat feed as the source or destination

E.Subscribe to FortiSandbox

AnswersA, D

The connector fetches the list of malicious IPs.

Why this answer

An external threat feed connector must be created in FortiGate to import indicators of compromise (IoC) from a third-party source. This connector defines the URL, authentication, and update interval for the feed, allowing FortiGate to consume and store the malicious IP addresses as a local threat feed object.

Exam trap

The trap here is that candidates often confuse the external threat feed connector with FortiGuard push feeds or assume that enabling IPS is necessary to use threat feeds, when in fact the two required steps are creating the connector and then applying it in a firewall policy.

Practice this question →

100

MCQmedium

An administrator configures a WAF profile on FortiGate to protect a web application. However, the administrator notices that SQL injection attacks are not being blocked. What should the administrator check first?

A.The SQL injection signatures are enabled in the WAF profile

B.The WAF profile is attached to the correct firewall policy

C.The FortiGate has a valid Advanced Web Protection subscription

D.The web application is using HTTPS and SSL inspection is configured

AnswerA

WAF profiles have signature sets; SQL injection must be enabled.

Why this answer

SQL injection attacks are blocked by specific signatures within the WAF profile. If these signatures are not enabled, the WAF will not inspect HTTP requests for SQL injection patterns, allowing attacks to pass through. The administrator must verify that the SQL injection signatures are toggled on under the WAF profile's signature configuration.

Exam trap

The trap here is that candidates often assume attaching the WAF profile to a firewall policy is sufficient, overlooking the granular signature enablement required within the profile itself.

How to eliminate wrong answers

Option B is wrong because even if the WAF profile is attached to the correct firewall policy, it will not block SQL injection if the signatures themselves are disabled; the profile attachment is a prerequisite but not the root cause. Option C is wrong because a valid Advanced Web Protection subscription is required for the WAF feature to be available, but if the profile is already configured and applied, the subscription is active; the issue is signature enablement, not licensing. Option D is wrong because HTTPS and SSL inspection affect decryption of traffic, but SQL injection signatures operate on the decrypted HTTP payload; if SSL inspection is not configured, the WAF cannot inspect encrypted traffic, but the question states attacks are not being blocked, implying traffic is reaching the WAF, so the issue is signature enablement, not SSL inspection.

Practice this question →

101

MCQeasy

Which of the following best describes the function of FortiDeceptor in an enterprise network?

A.It provides endpoint detection and response (EDR) capabilities on workstations.

B.It deploys decoys and lures to detect attackers inside the network.

C.It acts as a web application firewall for protecting web servers.

D.It provides sandboxing for advanced malware analysis.

AnswerB

FortiDeceptor uses deception technology to detect lateral movement.

Practice this question →

102

Multi-Selecthard

Which THREE actions should be taken to optimize FortiGate ATP performance while maintaining security?

Select 3 answers

A.Implement allow lists for trusted IP addresses to bypass scanning

B.Disable unnecessary security profiles to reduce CPU load

C.Enable proxy-based inspection for all traffic

D.Enable flow-based inspection for antivirus and IPS

E.Use SSL certificate inspection only for trusted categories

AnswersA, D, E

Bypassing scanning for trusted sources improves performance.

Why this answer

Implementing allow lists for trusted IP addresses to bypass scanning (Option A) reduces unnecessary processing of traffic that is known to be safe, thereby optimizing FortiGate ATP performance without compromising security. This approach leverages the FortiGate's ability to exempt trusted sources from deep inspection, which lowers CPU and memory load while maintaining protection for untrusted traffic.

Exam trap

The trap here is that candidates often assume disabling security profiles (Option B) is acceptable for performance optimization, but the question explicitly requires maintaining security, making this a violation of the core constraint.

Practice this question →

103

MCQeasy

Which Fortinet product is designed specifically to detect and deceive attackers by creating decoy systems and luring them away from real assets?

A.FortiDeceptor

B.FortiSandbox

C.FortiEDR

D.FortiWeb

AnswerA

FortiDeceptor uses decoys to detect and divert attackers.

Why this answer

FortiDeceptor is Fortinet's dedicated deception-based threat detection solution. It creates realistic decoy systems (honeypots) and lures attackers away from real assets, providing early detection and threat intelligence without relying on signatures. This aligns with the question's specific requirement for a product designed to detect and deceive attackers using decoys.

Exam trap

The trap here is that candidates often confuse FortiSandbox's sandboxing (which also uses isolated environments) with deception technology, but sandboxing analyzes files while deception lures attackers with decoys.

How to eliminate wrong answers

Option B (FortiSandbox) is wrong because it is a malware analysis and detection platform that executes suspicious files in a sandboxed environment to identify threats, not a deception technology that creates decoy systems. Option C (FortiEDR) is wrong because it focuses on endpoint detection, response, and real-time threat hunting on endpoints, not on deploying decoys to lure attackers. Option D (FortiWeb) is wrong because it is a web application firewall (WAF) that protects web servers from application-layer attacks, not a deception-based system for luring attackers away from assets.

Practice this question →

104

MCQmedium

An organization uses FortiWeb to protect its web applications. The security team wants to block requests that contain a specific custom pattern in the URL. Which feature should be used?

A.Inline Protection Profile

B.Custom Attack Signature

C.URL Access Rule

D.Web Application Firewall Policy

AnswerB

Custom signatures define patterns to block.

Why this answer

Custom Attack Signatures in FortiWeb allow administrators to define user-specific patterns to match against HTTP request elements, including the URL. This feature is designed to block requests containing custom patterns, such as a specific string in the URL, by inspecting the request and triggering an action (e.g., alert or block) when the pattern is matched. Unlike other features, Custom Attack Signatures provide the granularity needed to detect and block arbitrary, organization-defined patterns in the URL.

Exam trap

The trap here is that candidates often confuse URL Access Rules (which control access based on URL paths) with Custom Attack Signatures (which detect arbitrary patterns in the URL), leading them to select URL Access Rule when the requirement is to block a specific custom pattern, not to restrict access to a directory.

How to eliminate wrong answers

Option A is wrong because Inline Protection Profiles are used to apply a set of predefined protection rules (e.g., SQL injection, XSS) to traffic, but they do not support the creation of custom patterns for URL matching. Option C is wrong because URL Access Rules control access based on URL path patterns (e.g., allow or deny access to specific directories), but they are not designed to block requests based on arbitrary custom patterns within the URL; they operate on access control logic, not attack signature matching. Option D is wrong because a Web Application Firewall Policy defines the overall security policy (e.g., which protections are enabled), but it does not itself contain the mechanism to define and match custom patterns in the URL; that is the role of signatures or rules within the policy.

Practice this question →

105

MCQeasy

What is the primary purpose of Content Disarm and Reconstruction (CDR) in advanced antivirus protection?

A.To detect and block known malware using signature-based detection

B.To reconstruct files by removing potentially malicious active content such as macros and scripts

C.To submit files to FortiSandbox for behavioral analysis

D.To encrypt files in transit to prevent interception

AnswerB

CDR strips active content and rebuilds files to prevent exploits.

Why this answer

Content Disarm and Reconstruction (CDR) is designed to proactively neutralize threats by stripping or disabling potentially dangerous active content—such as macros, scripts, and embedded objects—from files while preserving the file's usability. Unlike signature-based detection, CDR does not rely on known threat signatures; instead, it reconstructs the file in a safe state, removing any elements that could execute malicious code. This makes CDR a zero-day prevention technique that blocks threats before they can be analyzed or detected by traditional methods.

Exam trap

The trap here is that candidates confuse CDR with sandboxing or signature-based detection, assuming CDR's purpose is to detect malware rather than to preemptively remove all potentially dangerous content regardless of detection status.

How to eliminate wrong answers

Option A is wrong because CDR does not use signature-based detection; it removes active content regardless of whether the content is known malware, making it effective against unknown and zero-day threats. Option C is wrong because while CDR can be used in conjunction with FortiSandbox, its primary purpose is not to submit files for behavioral analysis but to sanitize files at the gateway before delivery. Option D is wrong because encrypting files in transit is a data protection measure (e.g., TLS or IPsec) unrelated to CDR's function of removing malicious content from files.

Practice this question →

106

MCQmedium

An organization wants to implement a solution that can detect and automatically respond to threats across multiple Fortinet security products. Which product should they use?

A.FortiManager

B.FortiSIEM

C.FortiSOAR

D.FortiAnalyzer

AnswerC

FortiSOAR orchestrates and automates incident response workflows across security tools.

Why this answer

FortiSOAR is the correct choice because it is a security orchestration, automation, and response (SOAR) platform designed to ingest alerts from multiple Fortinet products (e.g., FortiGate, FortiSIEM, FortiMail) and execute automated playbooks for threat detection and response. Unlike management or analytics tools, FortiSOAR provides the cross-product incident response and automation capabilities required to detect and automatically respond to threats across the Fortinet security fabric.

Exam trap

The trap here is that candidates often confuse FortiManager or FortiAnalyzer as the automation hub, but FortiSOAR is the only product specifically designed for cross-product automated threat response, while FortiManager focuses on configuration management and FortiAnalyzer on log analytics.

How to eliminate wrong answers

Option A is wrong because FortiManager is a centralized management platform for deploying and managing Fortinet device configurations and policies, not for detecting or automatically responding to threats across products. Option B is wrong because FortiSIEM is a security information and event management (SIEM) system that collects and correlates logs for threat detection and compliance, but it lacks native automated response orchestration across multiple Fortinet products. Option D is wrong because FortiAnalyzer is a log aggregation and reporting appliance that provides analytics and forensics, but it does not have built-in automation and response capabilities to act on detected threats.

Practice this question →

107

MCQeasy

What is the primary purpose of FortiGuard Outbreak Prevention service?

A.To provide proactive protection against zero-day and fast-spreading threats

B.To provide real-time threat intelligence feeds to third-party SIEM systems

C.To automatically patch vulnerabilities in FortiGate firmware

D.To block all traffic from IP addresses listed in a community-based blocklist

AnswerA

Outbreak Prevention uses AI and heuristics to detect and block emerging threats quickly.

Why this answer

FortiGuard Outbreak Prevention is designed to provide proactive protection against zero-day and fast-spreading threats by leveraging real-time threat intelligence from FortiGuard Labs. It automatically updates security policies and signatures to block emerging threats before they become widespread, reducing the window of vulnerability.

Exam trap

The trap here is that candidates often confuse Outbreak Prevention with general threat intelligence feeds or community blocklists, but the service specifically targets automated, proactive blocking of fast-spreading threats before signatures are fully developed.

How to eliminate wrong answers

Option B is wrong because FortiGuard Outbreak Prevention is not primarily for feeding threat intelligence to third-party SIEM systems; that function is served by FortiSIEM or FortiAnalyzer via syslog or API integrations. Option C is wrong because FortiGuard Outbreak Prevention does not patch FortiGate firmware; firmware patching is handled through FortiGuard Firmware Update service or manual upgrade processes. Option D is wrong because it does not rely on a community-based blocklist; instead, it uses curated, dynamic threat intelligence from FortiGuard Labs, not user-contributed lists.

Practice this question →

108

MCQeasy

An organization wants to prevent users from downloading malicious files from the internet. Which FortiGate security profile should be applied to the outbound firewall policy to block files based on their hash if they have been identified as malicious by FortiSandbox?

A.Application Control profile

B.IPS profile

C.Antivirus profile

D.Web Filter profile

AnswerC

Antivirus profile can use FortiSandbox verdicts to block files by hash.

Why this answer

The Antivirus profile is the correct choice because it integrates with FortiSandbox to block files based on their hash when identified as malicious. FortiGate's antivirus engine can submit files to FortiSandbox for analysis, and if the file's hash matches a known malicious signature, the antivirus profile will block the download. This is specifically designed for file-based threat detection at the application layer, unlike other profiles that focus on different security functions.

Exam trap

The trap here is that candidates may confuse the Antivirus profile with the Web Filter profile, thinking that web filtering handles all malicious content, but web filtering only controls URL access, not file hash-based blocking.

How to eliminate wrong answers

Option A is wrong because Application Control profiles manage and filter network traffic based on application signatures (e.g., Facebook, YouTube), not file hash-based blocking. Option B is wrong because IPS profiles detect and prevent network-level exploits and vulnerabilities using signature-based and behavioral analysis, not file hash matching. Option D is wrong because Web Filter profiles control access to URLs and web categories (e.g., blocking gambling sites), not file hash-based malicious content detection.

Practice this question →

109

Multi-Selecthard

A FortiGate administrator is troubleshooting why a custom IPS signature is not triggering on traffic matching the pattern. Which TWO checks should be performed?

Select 2 answers

A.Check the signature's severity level in the IPS sensor

B.Ensure the FortiGate is in proxy-based inspection mode

C.Confirm the IPS sensor is applied to the correct firewall policy

D.Verify the signature uses correct protocol decoder

E.Verify that the custom signature is enabled in the IPS sensor

AnswersC, E

Without policy attachment, no inspection occurs.

Why this answer

An IPS sensor must be explicitly attached to a firewall policy via the 'inspection-mode' or 'ips-sensor' configuration to inspect traffic. Even if a custom signature is correctly defined and enabled, it will never trigger if the sensor containing it is not applied to the policy that matches the target traffic. This is a fundamental prerequisite for any IPS signature to process packets.

Exam trap

The trap here is that candidates often focus on signature configuration details (severity, decoder, mode) and overlook the policy attachment step, which is the most common root cause for a custom signature not triggering.

Practice this question →

110

MCQhard

A FortiGate admin sees the following log: 'Action=blocked, Service=HTTP, Application=Outbreak, File=invoice.doc, ThreatScore=95'. What is the MOST likely explanation for this block?

A.The file was blocked by FortiGuard outbreak prevention

B.The file was blocked by the machine learning engine

C.The file was blocked by FortiSandbox verdict

D.The file was blocked by a custom IPS signature

AnswerA

Outbreak prevention uses threat scores and is logged as 'Outbreak' in the application field.

Why this answer

The log entry shows 'Application=Outbreak' and 'ThreatScore=95', which are specific indicators of FortiGuard outbreak prevention. FortiGuard outbreak prevention uses real-time threat intelligence to block files associated with widespread malware campaigns before traditional signatures are updated. The 'Outbreak' application tag and high threat score directly correspond to this feature, not to machine learning, sandbox verdicts, or custom IPS signatures.

Exam trap

The trap here is that candidates confuse 'Outbreak' with a generic malware detection term, not realizing it is a specific FortiGuard feature with its own log field, distinct from machine learning, sandbox, or IPS-based blocks.

How to eliminate wrong answers

Option B is wrong because the machine learning engine in FortiGate uses behavioral analysis and static file analysis to detect unknown malware, but it does not generate an 'Application=Outbreak' tag; that tag is specific to FortiGuard outbreak prevention. Option C is wrong because a FortiSandbox verdict would appear in logs as 'Action=blocked' with 'Application=Sandbox' or 'Verdict=malicious', not 'Application=Outbreak'. Option D is wrong because a custom IPS signature would log 'Action=blocked' with 'Signature=...' or 'IPS=...', not 'Application=Outbreak' or 'ThreatScore=95'.

Practice this question →

111

Multi-Selecthard

A FortiGate administrator wants to use automation stitches to respond to a detected threat. The trigger is 'event' and the action is to quarantine the source IP. Which TWO actions can be used in FortiGate automation stitches to achieve IP quarantine?

Select 2 answers

A.Send an email to the administrator

B.CLI script that runs 'diagnose user quarantine add'

C.Execute a CLI script that adds a firewall address object and policy to block the IP

D.Use the 'execute fortishield' command in a CLI script

E.Log the event to FortiAnalyzer

AnswersB, C

This command adds an IP to the quarantine list.

Why this answer

The 'diagnose user quarantine add' command is the native FortiGate CLI command to add an IP address to the quarantine list, which is a valid action in an automation stitch. Option C is also correct because executing a CLI script that creates a firewall address object and a corresponding policy to block the IP effectively achieves IP quarantine by preventing traffic from that source, which is a common alternative method.

Exam trap

The trap here is that candidates may think only the 'diagnose user quarantine add' command is valid for IP quarantine, overlooking that creating a firewall address object and policy is also a supported and effective method in FortiGate automation stitches.

Practice this question →

112

MCQeasy

Which Fortinet product is designed to deploy decoy systems to lure attackers and detect lateral movement within the network?

A.FortiSandbox

B.FortiDeceptor

C.FortiSOAR

D.FortiEDR

AnswerB

FortiDeceptor deploys decoys to detect and deceive attackers.

Why this answer

FortiDeceptor is specifically designed to deploy decoy systems (honeypots) that mimic real assets, such as servers or endpoints, to lure attackers. It detects lateral movement by monitoring decoy interactions and generating alerts when an attacker probes or compromises these fake targets, providing early warning of network intrusion.

Exam trap

The trap here is that candidates may confuse FortiDeceptor with FortiSandbox, assuming sandboxing involves decoys, but FortiSandbox focuses on file analysis while FortiDeceptor is purpose-built for deception-based threat detection.

How to eliminate wrong answers

Option A is wrong because FortiSandbox is a threat analysis and detection appliance that executes suspicious files in a sandboxed environment to identify malware, not a decoy system for luring attackers. Option C is wrong because FortiSOAR is a security orchestration, automation, and response (SOAR) platform that coordinates incident response workflows, not a deception-based detection tool. Option D is wrong because FortiEDR is an endpoint detection and response solution that monitors and protects endpoints from threats using behavioral analysis and machine learning, not by deploying decoy systems.

Practice this question →

113

MCQmedium

An administrator wants to create an automation stitch that sends a webhook notification when an IPS attack is detected. Which trigger and action should be used?

A.Trigger: 'IPS Event'; Action: 'Webhook'

B.Trigger: 'FortiGuard'; Action: 'Quarantine'

C.Trigger: 'System Event'; Action: 'Email'

D.Trigger: 'Incoming Webhook'; Action: 'IPS Event'

AnswerA

IPS event triggers the stitch, and webhook action sends the notification.

Why this answer

An automation stitch requires a trigger that matches the event type and an action that performs the desired response. 'IPS Event' is the correct trigger for detecting an IPS attack, and 'Webhook' is the action that sends an HTTP POST request to a configured endpoint, which is the standard method for webhook notifications in FortiOS.

Exam trap

The trap here is that candidates confuse 'IPS Event' with 'System Event' or 'FortiGuard', or mistakenly think 'Incoming Webhook' is a trigger for outbound notifications, when in fact it is for receiving external triggers.

How to eliminate wrong answers

Option B is wrong because 'FortiGuard' is a trigger for FortiGuard threat intelligence updates, not for IPS events, and 'Quarantine' is an action for isolating compromised hosts, not for sending webhook notifications. Option C is wrong because 'System Event' is a trigger for system-level events like interface status changes, not for IPS attacks, and 'Email' is an action for sending email alerts, not webhook notifications. Option D is wrong because 'Incoming Webhook' is a trigger for receiving external webhooks, not for detecting IPS attacks, and 'IPS Event' is a trigger, not an action.

Practice this question →

114

MCQmedium

Refer to the exhibit. A user reports that accessing a legitimate HTTPS website is blocked. The FortiGate logs show that the connection was denied by the antivirus profile. What is the most likely cause?

A.The antivirus profile detected a false positive in the encrypted traffic

B.The application list blocked the HTTPS application

C.The IPS profile blocked a vulnerability in the website

D.The protocol options profile blocked the SSL handshake

AnswerA

Deep inspection decrypts traffic, and antivirus may incorrectly flag legitimate content.

Why this answer

The antivirus (AV) profile on FortiGate performs deep inspection of HTTPS traffic by decrypting it, scanning the content, and re-encrypting it. If the AV signature database contains a false positive for a legitimate website's content (e.g., a benign JavaScript file matching a malware signature), the connection will be denied. The log explicitly states the denial was by the AV profile, not by any other security profile, making a false positive in encrypted traffic the most likely cause.

Exam trap

The trap here is that candidates may confuse the security profile that generated the log entry (antivirus) with other profiles (application control, IPS, protocol options) that could also block HTTPS traffic, but the log's explicit attribution to the AV profile eliminates those possibilities.

How to eliminate wrong answers

Option B is wrong because the log shows the connection was denied by the antivirus profile, not by an application control profile; the application list blocking HTTPS would generate a log entry from the application control module, not the AV module. Option C is wrong because an IPS profile blocking a vulnerability would generate a log entry from the IPS sensor, not the antivirus profile, and the log explicitly attributes the denial to the AV profile. Option D is wrong because the protocol options profile blocking the SSL handshake would produce a log from the SSL inspection module or a protocol violation, not from the antivirus profile, and the connection was denied after inspection, not during the handshake.

Practice this question →

115

MCQeasy

Which FortiGate security feature removes potentially malicious active content from files (e.g., macros, scripts) before delivering them to end users?

A.Antivirus

B.Data Leak Prevention

C.File Filter

D.Content Disarm and Reconstruction

AnswerD

CDR removes active content to neutralize threats.

Why this answer

Content Disarm and Reconstruction (CDR) is the correct answer because it specifically removes potentially malicious active content—such as macros, scripts, and embedded objects—from files (e.g., Office documents, PDFs) by stripping the active elements and reconstructing a safe, sanitized version before delivery. Unlike traditional scanning, CDR does not rely on signatures or heuristics; it assumes the file could be malicious and proactively neutralizes threats by rebuilding the file with only safe, static content.

Exam trap

The trap here is that candidates confuse 'File Filter' (which blocks file types) with 'Content Disarm and Reconstruction' (which sanitizes file content), or they assume 'Antivirus' handles all file-based threats, not realizing that CDR addresses zero-day macro and script attacks that antivirus signatures may miss.

How to eliminate wrong answers

Option A (Antivirus) is wrong because antivirus uses signature-based and heuristic detection to identify known malware, but it does not remove active content from files; it only blocks or quarantines files that match a threat pattern. Option B (Data Leak Prevention) is wrong because DLP focuses on detecting and preventing unauthorized transmission of sensitive data (e.g., credit card numbers, PII) via content inspection, not on removing active content from files. Option C (File Filter) is wrong because file filter controls which file types are allowed or blocked based on extension or MIME type, but it does not sanitize or remove active content from within permitted files.

Practice this question →

116

MCQeasy

What is the role of FortiGuard Outbreak Prevention in FortiGate's security suite?

A.To deliver real-time threat intelligence and block fast-spreading outbreaks

B.To provide offline signature updates for antivirus

C.To perform sandbox analysis of files

D.To manage endpoint security policies

AnswerA

Outbreak Prevention uses FortiGuard's real-time data.

Why this answer

FortiGuard Outbreak Prevention is a real-time threat intelligence service that proactively blocks fast-spreading outbreaks by delivering immediate signature updates and threat data to FortiGate devices. Unlike scheduled updates, it uses a push mechanism to rapidly deploy protections against emerging threats, reducing the window of vulnerability during zero-day or widespread attacks.

Exam trap

The trap here is that candidates often confuse Outbreak Prevention with regular antivirus signature updates or sandboxing, but the key distinction is that Outbreak Prevention is a real-time, push-based service for fast-spreading threats, not a scheduled or offline update mechanism.

How to eliminate wrong answers

Option B is wrong because offline signature updates are handled by FortiGuard's regular antivirus update service, not Outbreak Prevention, which requires an active internet connection for real-time intelligence. Option C is wrong because sandbox analysis is performed by FortiSandbox, a separate product that integrates with FortiGate but is not part of Outbreak Prevention's role. Option D is wrong because managing endpoint security policies is the function of FortiClient or FortiEDR, not FortiGate's Outbreak Prevention service.

Practice this question →

117

MCQmedium

An administrator configures an automation stitch to respond to a high severity event. The trigger is 'event' and the action is 'CLI script'. What must be defined for the action to execute properly?

A.An API token for authentication

B.A FortiManager to execute the script

C.An email server to send the script output

D.A valid CLI script that contains commands to be executed on the FortiGate

AnswerD

The action type 'CLI script' requires a script to be defined with the commands.

Why this answer

For an automation stitch action of type 'CLI script' to execute properly on a FortiGate, the action must reference a valid CLI script that contains the actual FortiGate CLI commands to be run. The script is defined locally on the FortiGate and does not require external authentication, a FortiManager, or an email server for execution.

Exam trap

The trap here is that candidates may assume a CLI script action requires an external orchestrator like FortiManager or authentication tokens, when in fact the script runs locally on the FortiGate and only needs a valid script definition.

How to eliminate wrong answers

Option A is wrong because an API token is not required for CLI script actions; API tokens are used for REST API authentication, not for executing predefined CLI scripts within an automation stitch. Option B is wrong because the CLI script action executes directly on the FortiGate itself, not on a FortiManager; FortiManager is only needed if the action type is 'FortiManager script'. Option C is wrong because an email server is only required if the action type is 'Email', not for executing a CLI script; the script output is handled locally or via other logging mechanisms.

Practice this question →

118

MCQhard

A company uses an advanced antivirus profile with machine learning engine enabled. After a recent outbreak, several files that were previously undetected are now flagged. How does the outbreak prevention feature help in this situation?

A.It downloads the latest ML models from FortiGuard to detect new threats

B.It sends all files to FortiSandbox for analysis

C.It quarantines all files for 24 hours until a signature is released

D.It blocks all executable files from being downloaded

AnswerA

Outbreak prevention provides immediate updates to ML models to catch new outbreaks.

Why this answer

The outbreak prevention feature in FortiGate's advanced antivirus profile automatically downloads the latest machine learning (ML) models from FortiGuard when a new outbreak is detected. This allows the ML engine to identify and flag previously undetected files without requiring a traditional signature update, enabling proactive detection of zero-day threats.

Exam trap

The trap here is that candidates often confuse outbreak prevention with FortiSandbox integration, assuming that all unknown files must be sandboxed, when in fact outbreak prevention leverages ML model updates for faster, inline detection without the latency of sandbox analysis.

How to eliminate wrong answers

Option B is wrong because outbreak prevention does not send all files to FortiSandbox; FortiSandbox is a separate advanced threat protection feature that performs behavioral analysis, and outbreak prevention focuses on updating ML models, not redirecting traffic. Option C is wrong because outbreak prevention does not quarantine files for a fixed 24-hour period; it uses real-time ML model updates to detect threats immediately, and quarantining without analysis would disrupt legitimate operations. Option D is wrong because outbreak prevention does not block all executable files; it selectively applies ML-based detection to identify malicious executables while allowing benign ones, avoiding the overly restrictive and impractical approach of blocking all executables.

Practice this question →

119

MCQhard

A company uses FortiMail to protect email. They set up DMARC with a policy of 'quarantine' for emails failing SPF and DKIM checks. However, legitimate emails from a third-party service are being quarantined. What should the admin do?

A.Add the sender domain to a whitelist in FortiMail

B.Change the DMARC policy to 'none'

C.Disable DMARC checking for that specific sender

D.Update the SPF record to include the third-party mail server IP

AnswerD

Adding the IP to SPF allows the service to pass SPF check, reducing false quarantines.

Why this answer

The root cause is that the third-party mail server's IP is not authorized in the sender domain's SPF record. DMARC uses SPF alignment: if the message fails SPF (because the sending IP is not listed) and also fails DKIM, DMARC enforces the 'quarantine' policy. Adding the third-party IP to the SPF record allows SPF to pass, achieving alignment and preventing quarantine.

Exam trap

The trap here is that candidates may think whitelisting or disabling DMARC is the quick fix, but the exam tests understanding that DMARC enforcement is based on SPF/DKIM alignment, so the correct solution is to authorize the legitimate sender in the SPF record.

How to eliminate wrong answers

Option A is wrong because whitelisting the sender domain in FortiMail bypasses all DMARC checks, which undermines security and does not fix the underlying SPF/DKIM alignment issue. Option B is wrong because changing the DMARC policy to 'none' disables enforcement for all senders, leaving the domain unprotected against spoofing. Option C is wrong because disabling DMARC checking for that specific sender removes protection for that sender's emails and does not address the SPF record misconfiguration that causes the failure.

Practice this question →

120

MCQeasy

An administrator wants to secure email traffic by ensuring that incoming emails are verified against the sender's domain SPF record. Which email authentication method provides this verification?

A.DKIM

B.SPF

C.DMARC

D.S/MIME

AnswerB

SPF verifies sender IP against domain's authorized servers.

Why this answer

SPF (Sender Policy Framework) is the email authentication method that verifies incoming emails against the sender's domain SPF record. It works by checking whether the sending mail server's IP address is authorized by the domain owner's DNS TXT record. This directly matches the administrator's requirement to verify incoming emails against the sender's domain SPF record.

Exam trap

The trap here is that candidates often confuse DKIM's signature verification with SPF's IP-based authorization, mistakenly thinking DKIM verifies the sender's domain against an SPF record.

How to eliminate wrong answers

Option A is wrong because DKIM (DomainKeys Identified Mail) uses a digital signature to verify that an email was not tampered with during transit, but it does not check the sending server's IP against the domain's SPF record. Option C is wrong because DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM to provide policy enforcement and reporting, but it does not itself perform IP-based verification against an SPF record. Option D is wrong because S/MIME (Secure/Multipurpose Internet Mail Extensions) provides end-to-end encryption and signing using certificates, but it has nothing to do with verifying the sending server's IP against a domain's SPF record.

Practice this question →

121

MCQeasy

Which feature in FortiMail provides an additional layer of protection by analyzing the behavior of email attachments in a sandbox environment?

A.Outbreak Prevention

B.Anti-spam

C.Content Disarm and Reconstruction

D.FortiSandbox integration

AnswerD

FortiSandbox integration sends attachments to the sandbox for dynamic analysis.

Why this answer

FortiSandbox integration allows FortiMail to forward email attachments to an external or internal FortiSandbox appliance for dynamic behavioral analysis. Unlike static signature-based detection, this sandboxing executes the attachment in a controlled environment to identify zero-day malware, ransomware, or advanced persistent threats based on runtime behavior, providing an additional layer of protection beyond traditional filtering.

Exam trap

The trap here is that candidates often confuse Content Disarm and Reconstruction (CDR) with sandboxing, but CDR only removes or neutralizes potentially dangerous content without executing it, whereas sandboxing actively runs the attachment to observe behavior, which is the key distinction tested in this question.

How to eliminate wrong answers

Option A is wrong because Outbreak Prevention is a FortiGate feature that uses real-time threat intelligence and outbreak alerts to block emerging threats at the network perimeter, not a sandbox-based attachment analysis feature within FortiMail. Option B is wrong because Anti-spam focuses on identifying and filtering unwanted bulk or phishing emails using techniques like SPF, DKIM, DMARC, and heuristic scoring, not on analyzing attachment behavior in a sandbox. Option C is wrong because Content Disarm and Reconstruction (CDR) strips active content (e.g., macros, scripts) from attachments and rebuilds them into safe versions, but it does not execute or analyze behavior in a sandbox environment.

Practice this question →

122

MCQhard

An administrator configures a custom IPS signature to detect traffic to a specific malicious domain. Which syntax is correct for a custom IPS signature in FortiGate?

A.config ips custom signature edit "malicious_domain" set signature "alert tcp any any -> any any (msg:"malicious"; content:"example.com";)" end

B.config firewall policy edit 1 set ips-filter "malicious_domain" end

C.set ips-sensor custom-signature "malicious_domain" pattern "example.com"

D.F-SBID( --name "malicious_domain"; --pattern "example.com"; --service HTTP; )

AnswerD

This is the correct FortiGate custom IPS signature syntax using F-SBID.

Why this answer

FortiGate custom IPS signatures use the F-SBID (Fortinet Signature-Based IDentification) syntax, which requires the --name and --pattern keywords to define the signature name and the malicious pattern to match. This syntax is specific to FortiGate's IPS engine and is not based on Snort or Suricata rule syntax.

Exam trap

The trap here is that candidates familiar with open-source IDS/IPS systems like Snort or Suricata may mistakenly apply their syntax (Option A) to FortiGate, not realizing that FortiGate uses its own F-SBID syntax for custom IPS signatures.

How to eliminate wrong answers

Option A is wrong because it uses Snort-like syntax (e.g., 'alert tcp any any -> any any') which is not supported by FortiGate's custom IPS signatures; FortiGate uses F-SBID syntax. Option B is wrong because it references a firewall policy configuration with an 'ips-filter' object, but custom IPS signatures are not applied via firewall policies directly; they are used in IPS sensors. Option C is wrong because it uses a 'set ips-sensor custom-signature' command with a 'pattern' keyword, which is not valid; custom IPS signatures are defined under 'config ips custom' and use F-SBID syntax, not a simple pattern assignment.

Practice this question →

123

MCQhard

Refer to the exhibit. An administrator notices that some malware files are not being detected by FortiGate. The antivirus profile uses flow-based scanning with FortiSandbox disabled. What is the most likely reason for missed detections?

A.Flow-based scanning is less thorough than proxy-based

B.FortiSandbox inline-scan is disabled, so unknown malware is not analyzed

C.Quarantine is enabled, which causes files to be dropped before scanning

D.The antivirus profile is not applied to the firewall policy

AnswerB

Without FortiSandbox, new malware may not be detected by signatures alone.

Why this answer

Flow-based scanning inspects files as they traverse the firewall, but it relies on signatures and heuristics for detection. Without FortiSandbox inline-scan enabled, unknown or zero-day malware that does not match existing signatures will not be sent to the sandbox for behavioral analysis, so it can pass undetected. Option B correctly identifies that disabling FortiSandbox removes the ability to analyze unknown threats, which is the most likely reason for missed detections.

Exam trap

The trap here is that candidates often assume flow-based scanning is always less thorough than proxy-based, but the real issue is the lack of FortiSandbox integration for unknown malware analysis, not the scanning mode itself.

How to eliminate wrong answers

Option A is wrong because flow-based scanning is not inherently less thorough than proxy-based; it uses a single-pass, low-latency approach that can still detect known malware effectively, and the question specifies that FortiSandbox is disabled, not that flow-based scanning is the cause. Option C is wrong because quarantine is a post-detection action that stores files after they are flagged as malicious; it does not cause files to be dropped before scanning, and enabling quarantine would not prevent detection. Option D is wrong because the question states that the antivirus profile is applied to the firewall policy (the administrator notices missed detections, implying the profile is in use), and if it were not applied, no malware would be detected at all, not just some files.

Practice this question →

124

Multi-Selectmedium

An organization uses FortiMail and wants to validate that incoming emails are from legitimate senders by checking the sender's domain against a published policy. Which two email authentication mechanisms can FortiMail use? (Choose two.)

Select 1 answer

A.DKIM and DMARC

B.STARTTLS and SPF

C.DMARC and SPF

D.SPF and DKIM

AnswersD

SPF verifies the sending IP, DKIM verifies the signature.

Why this answer

FortiMail can use SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to validate that incoming emails originate from legitimate senders by checking the sender's domain against a published policy. SPF verifies that the sending IP address is authorized by the domain's DNS TXT record, while DKIM uses a digital signature in the email header that can be validated against a public key published in the sender's DNS. Both mechanisms allow FortiMail to authenticate the sender's domain before accepting the message.

Exam trap

The trap here is that candidates often confuse DMARC as an authentication mechanism when it is actually a policy framework that relies on SPF and DKIM results, leading them to select options that include DMARC instead of the two core authentication protocols.

Practice this question →

125

Multi-Selectmedium

Which TWO email authentication mechanisms does FortiMail support to verify sender identity and reduce spoofing? (Choose two.)

Select 2 answers

A.DMARC (Domain-based Message Authentication, Reporting & Conformance)

B.SPF (Sender Policy Framework)

C.STARTTLS

D.S/MIME

E.DKIM (DomainKeys Identified Mail)

AnswersB, E

Checks if the sending IP is authorized.

Why this answer

FortiMail supports SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) as email authentication mechanisms to verify sender identity and reduce spoofing. SPF allows the domain owner to publish authorized sending IP addresses in DNS TXT records, while DKIM uses a digital signature added to the email header, verified against a public key in the sender's DNS. Both are core components of email authentication that FortiMail can enforce or validate.

Exam trap

The trap here is that candidates confuse DMARC as an authentication mechanism rather than a policy framework that relies on SPF and DKIM results, and they may also mistake STARTTLS or S/MIME for sender verification when they are actually transport or message security protocols.

Practice this question →

126

Multi-Selecthard

An administrator is investigating an alert from FortiEDR indicating a suspicious process on an endpoint. The administrator wants to gather more context. Which TWO sources can provide threat intelligence to enrich the investigation?

Select 2 answers

A.Local antivirus signature database

B.FortiGate traffic logs

C.FortiGuard Outbreak Prevention

D.Third-party threat intelligence feeds

E.FortiClient local cache

AnswersC, D

FortiGuard Outbreak Prevention provides real-time threat intelligence about outbreaks.

Why this answer

Options C and D are correct. FortiGuard Outbreak Prevention and third-party threat feeds provide external threat intelligence about indicators of compromise.

Practice this question →

127

MCQhard

A FortiGate administrator receives a report that a user downloaded a malicious PDF file. The antivirus profile has machine learning engine enabled, CDR enabled, and FortiSandbox integration. However, the file was allowed. The log shows: 'file=malicious.pdf, action=allow, ml_score=85, cd_result=clean, sandbox=not_submitted'. What is the most likely reason the file was not submitted to FortiSandbox?

A.The file size exceeded the maximum file size for FortiSandbox submission

B.CDR reconstructed the file, making it appear clean

C.The machine learning engine scored the file as clean (score below threshold)

D.The file was excluded by a file type filter in the antivirus profile

AnswerA

FortiSandbox has a configurable file size limit; files larger than that are not submitted.

Why this answer

The log shows 'sandbox=not_submitted', which directly indicates the file was never sent to FortiSandbox. FortiGate has a configurable maximum file size limit for sandbox submission (default 10 MB). If the PDF exceeds this limit, the file is allowed without sandbox inspection, even if other engines like ML or CDR are enabled.

The ml_score of 85 indicates a high malicious probability, but the sandbox submission was skipped due to size constraints.

Exam trap

The trap here is that candidates assume a high ML score (85) would automatically trigger sandbox submission, but FortiGate's sandbox submission is governed by separate size and protocol filters, not by ML score alone.

How to eliminate wrong answers

Option B is wrong because CDR (Content Disarm and Reconstruction) reconstructs the file to remove active content, but the log shows 'cd_result=clean', meaning CDR did not detect an issue; however, the file was still allowed, and CDR does not prevent sandbox submission. Option C is wrong because the ml_score of 85 is above typical thresholds (often 50-70), indicating the ML engine flagged it as malicious, not clean. Option D is wrong because a file type filter would block the file entirely (action=block), not allow it; the log shows 'action=allow', so no exclusion filter was applied.

Practice this question →

128

MCQhard

A large enterprise uses FortiGate as their perimeter firewall with ATP features enabled. They have a mix of internal users and remote VPN users. Recently, several remote users reported that their machines became infected with ransomware after connecting to the VPN. The IT team suspects that the ransomware entered through the VPN tunnel. The FortiGate has an antivirus profile applied to the VPN policy with SSL inspection enabled for all traffic. However, the logs show that no malware was detected. Upon investigation, the team finds that the remote users' machines are not managed by the company and do not have any endpoint protection. The ransomware was delivered via a spear-phishing email that the users opened on their remote machines. The email traffic passed through the VPN tunnel to the corporate mail server first, then back to the user. The FortiGate antivirus profile is configured to scan SMTP traffic but the email was sent from an external source to the corporate mail server, and the mail server uses STARTTLS to receive emails. The FortiGate does not perform SSL inspection on the SMTP traffic because the SMTP service is not included in the SSL inspection profile. What action should the administrator take to prevent this in the future?

A.Disable STARTTLS on the corporate mail server to force plaintext SMTP

B.Add SMTP to the SSL inspection profile to decrypt and scan email traffic

C.Require remote users to install endpoint protection with FortiClient

D.Block all SMTP traffic from remote VPN users

AnswerB

This allows the antivirus to inspect encrypted SMTP traffic and detect malware.

Why this answer

The FortiGate's antivirus profile is configured to scan SMTP traffic, but the email was encrypted via STARTTLS, and SMTP is not included in the SSL inspection profile. By adding SMTP to the SSL inspection profile, the FortiGate can decrypt the SMTP traffic, allowing the antivirus engine to inspect the email content for malware, including ransomware delivered via spear-phishing.

Exam trap

The trap here is that candidates assume the antivirus profile is sufficient because it is applied to the VPN policy and includes SMTP scanning, but they overlook that SSL inspection must be explicitly configured for the SMTP service to decrypt STARTTLS-encrypted traffic before scanning can occur.

How to eliminate wrong answers

Option A is wrong because disabling STARTTLS on the mail server would force plaintext SMTP, but this does not address the root cause—the FortiGate is already configured to scan SMTP traffic; the issue is that the traffic is encrypted and not being decrypted for inspection. Option C is wrong because requiring remote users to install FortiClient endpoint protection is a good security practice but does not solve the immediate problem of the FortiGate not inspecting encrypted SMTP traffic; the ransomware entered through the VPN tunnel and was not detected due to lack of SSL inspection on SMTP. Option D is wrong because blocking all SMTP traffic from remote VPN users would prevent legitimate email communication and is an overly restrictive measure; the goal is to inspect the traffic, not block it entirely.

Practice this question →

129

MCQeasy

Which FortiGate security feature can reconstruct files to remove potentially malicious content while preserving the file's usability?

A.Antivirus outbreak prevention

B.Content Disarm and Reconstruction

C.FortiSandbox

D.IPS application control

AnswerB

CDR disinfects files by removing active content and rebuilding them.

Why this answer

Content Disarm and Reconstruction (CDR) is the correct answer because it actively removes potentially malicious content—such as macros, scripts, or embedded objects—from files (e.g., Office documents, PDFs) and then reconstructs a clean, usable version. Unlike detection-based approaches, CDR eliminates threats by sanitizing the file structure itself, ensuring the file remains functional for the end user while blocking exploits.

Exam trap

The trap here is that candidates often confuse FortiSandbox's detection capabilities with CDR's proactive sanitization, mistakenly thinking sandboxing can reconstruct files when it only analyzes and blocks them.

How to eliminate wrong answers

Option A is wrong because Antivirus outbreak prevention relies on signature-based detection and blocking of known malware patterns, not on file reconstruction or sanitization. Option C is wrong because FortiSandbox uses behavioral analysis and sandboxing to detect unknown threats, but it does not reconstruct files to remove malicious content; it only provides verdicts and can block or quarantine files. Option D is wrong because IPS application control focuses on detecting and preventing network-level attacks and application misuse, not on file-level content sanitization or reconstruction.

Practice this question →

130

Multi-Selecthard

An administrator is configuring automation stitches to respond to a detected ransomware outbreak. Which THREE components are essential for an automation stitch?

Select 3 answers

A.Schedule

B.Condition

C.Log device

D.Action

E.Trigger

AnswersB, D, E

Conditions refine when the action should be taken.

Why this answer

In Fortinet's NSE7 context, an automation stitch requires three essential components: a Trigger (which initiates the stitch), a Condition (which filters or qualifies the trigger), and an Action (which executes the response). The Condition is correct because it allows the stitch to evaluate specific criteria—such as a ransomware detection event—before proceeding to the Action, ensuring precise and efficient automated responses.

Exam trap

The trap here is that candidates often confuse 'Schedule' as a required component because they think automation must be time-based, but Fortinet's automation stitches are event-driven, and the Schedule is only an optional trigger type, not a core structural element.

Practice this question →

131

Multi-Selecteasy

An administrator is configuring FortiMail to be more secure against advanced email threats. Which THREE features should they enable to protect against email-based phishing attacks?

Select 3 answers

A.DKIM signing/verification

B.CDR (Content Disarm and Reconstruction)

C.FortiSandbox inline scanning

D.SPF verification

E.DMARC policy enforcement

AnswersA, D, E

DKIM verifies message integrity and sender domain.

Why this answer

DKIM (DomainKeys Identified Mail) signing and verification allow the receiving mail server to cryptographically verify that an email was not tampered with during transit and that it originated from an authorized domain. This prevents attackers from spoofing the sender domain in phishing emails, as the DKIM signature will fail validation if the message body or headers are altered.

Exam trap

The trap here is that candidates often confuse features that block malicious content (like CDR or sandboxing) with those that verify sender authenticity (like DKIM, SPF, and DMARC), leading them to select options that address malware rather than the specific threat of email-based phishing via domain spoofing.

Practice this question →

132

MCQmedium

A network administrator notices that several endpoints are infected with ransomware despite having FortiGate ATP enabled. The logs show that the files were downloaded over HTTPS, and the antivirus profile did not detect them. What is the most likely reason?

A.SSL inspection was not enabled on the antivirus profile

B.Application control profile blocked the download

C.FortiSandbox was not configured to analyze the files

D.IPS signature database was outdated

AnswerA

Without SSL inspection, encrypted traffic bypasses antivirus scanning.

Why this answer

FortiGate ATP's antivirus engine cannot inspect encrypted HTTPS traffic unless SSL inspection is explicitly enabled on the antivirus profile. Without SSL inspection, the antivirus profile only sees encrypted payloads and cannot match file signatures or heuristics, allowing ransomware to pass undetected. The logs confirm files were downloaded over HTTPS, making this the most likely root cause.

Exam trap

The trap here is that candidates assume FortiGate's antivirus can automatically inspect HTTPS traffic because it is part of the ATP suite, but FortiGate requires explicit SSL inspection configuration to decrypt and scan encrypted downloads.

How to eliminate wrong answers

Option B is wrong because an application control profile blocks applications or categories, not files; it would not prevent the download of a ransomware file over HTTPS unless the application itself (e.g., a specific browser) was blocked, which is unrelated to the antivirus detection failure. Option C is wrong because FortiSandbox is an additional analysis layer that can detect unknown threats, but the primary reason the file was not detected is that the antivirus profile never saw the decrypted content; even if FortiSandbox were configured, it would not receive the file for analysis without SSL inspection. Option D is wrong because an outdated IPS signature database affects intrusion prevention, not antivirus file scanning; IPS signatures are for network-level attacks, not for detecting malware in downloaded files, and the antivirus engine uses its own signature database.

Practice this question →

133

MCQmedium

A network administrator notices that FortiGate is not blocking a known malicious file that was submitted to FortiSandbox and received a 'malicious' verdict. The firewall policy includes a FortiSandbox inline scan profile. What is the MOST likely cause?

A.The antivirus signature database is outdated

B.The FortiSandbox license has expired

C.The FortiSandbox is not configured as an inline scanner in the antivirus profile

D.The file is larger than the maximum file size allowed for scanning

AnswerC

Inline scanning requires configuration in the antivirus profile to forward files to FortiSandbox for real-time analysis and enforce blocking based on verdict.

Why this answer

The FortiGate uses an antivirus profile to define how files are scanned, including whether to send files to FortiSandbox for inline analysis. Even if the firewall policy references a FortiSandbox inline scan profile, the antivirus profile must have the 'FortiSandbox inline scan' option enabled to actually forward files to the FortiSandbox appliance. Without this setting, the FortiGate will not submit files for sandboxing, so a malicious verdict from FortiSandbox is never applied to the traffic.

Exam trap

The trap here is that candidates confuse the firewall policy's 'FortiSandbox inline scan profile' with the antivirus profile's inline scan setting, assuming that referencing a sandbox profile in the policy is sufficient to enable file submission, when in fact the antivirus profile must also have the inline scan option explicitly enabled.

How to eliminate wrong answers

Option A is wrong because an outdated antivirus signature database would affect signature-based detection, but the question states the file was submitted to FortiSandbox and received a 'malicious' verdict, indicating the sandbox analysis worked; the issue is that the verdict is not being enforced, not that signatures are missing. Option B is wrong because an expired FortiSandbox license would prevent the FortiSandbox from processing files or returning verdicts, but the scenario says the file received a malicious verdict, meaning the sandbox is operational and licensed. Option D is wrong because if the file were larger than the maximum file size allowed for scanning, the FortiGate would typically skip scanning or pass the file without sandboxing, but the question states the file was submitted to FortiSandbox and received a verdict, so size is not the blocking factor.

Practice this question →

134

MCQhard

A security analyst is investigating a phishing email that bypassed email security. The email's headers show SPF=pass, DKIM=pass, but DMARC=quarantine. The email was delivered to the inbox. What is the most likely reason DMARC did not block or quarantine the email?

A.The email was sent from a subdomain not covered by DMARC

B.The SPF and DKIM alignment checks passed, so DMARC treated the email as authentic

C.The DMARC record had a pct (percentage) of less than 100

D.The DMARC policy was set to 'none'

AnswerB

DMARC uses alignment of SPF and DKIM. If both pass, DMARC passes, and the policy (quarantine) is not triggered.

Why this answer

DMARC uses SPF and DKIM alignment to determine authenticity. When both SPF and DKIM pass and are aligned (i.e., the domain in the From header matches the domain used in SPF/DKIM), DMARC considers the email authentic and applies the policy accordingly. In this case, the DMARC policy was set to 'quarantine', but because alignment checks passed, DMARC treated the email as legitimate and allowed delivery to the inbox, rather than quarantining it.

Exam trap

Fortinet often tests the misconception that a DMARC policy of 'quarantine' or 'reject' will always block or quarantine emails that fail SPF or DKIM, but the trap here is that DMARC only applies its policy when both SPF and DKIM fail alignment; if either passes alignment, DMARC considers the email authentic and does not enforce the policy.

How to eliminate wrong answers

Option A is wrong because if the email was sent from a subdomain not covered by DMARC, DMARC would not apply at all, and the email would be subject to the parent domain's policy only if the subdomain is explicitly included; however, the question states DMARC=quarantine, indicating DMARC did apply. Option C is wrong because a pct value less than 100 would only reduce the percentage of emails subject to the DMARC policy, but the email still passed alignment, so DMARC would not quarantine it regardless of the pct setting. Option D is wrong because if the DMARC policy was set to 'none', DMARC would not quarantine or reject the email, but the header shows DMARC=quarantine, meaning the policy was indeed set to quarantine, yet the email was delivered because alignment passed.

Practice this question →

135

MCQeasy

What is the primary function of FortiDeceptor in a network security architecture?

A.To provide network access control for endpoints

B.To aggregate logs from multiple security devices

C.To lure attackers into interacting with decoys and generate alerts

D.To detect and block malware at the endpoint

AnswerC

FortiDeceptor uses decoys to detect lateral movement.

Why this answer

FortiDeceptor is a deception-based threat detection solution that deploys decoys (fake assets) across the network to lure attackers. When an attacker interacts with a decoy, FortiDeceptor generates a high-fidelity alert, enabling early detection of lateral movement or reconnaissance without relying on signatures.

Exam trap

The trap here is that candidates confuse FortiDeceptor's deception-based detection with endpoint protection or log aggregation, but the exam specifically tests that its primary function is to lure attackers into interacting with decoys and generate alerts.

How to eliminate wrong answers

Option A is wrong because network access control for endpoints is the function of FortiNAC, not FortiDeceptor, which focuses on deception rather than admission control. Option B is wrong because log aggregation from multiple security devices is the role of FortiAnalyzer or a SIEM, not FortiDeceptor, which generates its own alerts from decoy interactions. Option D is wrong because detecting and blocking malware at the endpoint is the domain of FortiEDR or endpoint security solutions, whereas FortiDeceptor does not execute or block code on endpoints.

Practice this question →

136

Multi-Selectmedium

An organization wants to implement email authentication to prevent spoofing. Which TWO standards should they configure? (Choose two.)

Select 2 answers

A.SPF

B.DMARC

C.TLS

D.STARTTLS

E.DKIM

AnswersA, E

SPF specifies which servers are authorized to send email.

Why this answer

SPF (Sender Policy Framework) is correct because it allows the domain owner to publish a list of authorized sending IP addresses in a DNS TXT record, enabling receiving mail servers to verify that the email originated from an approved source. DKIM (DomainKeys Identified Mail) is correct because it adds a digital signature to email headers, which the receiving server validates against a public key published in DNS, ensuring the message was not tampered with and truly came from the claimed domain. Together, SPF and DKIM form the foundational layers of email authentication that DMARC builds upon.

Exam trap

Fortinet often tests the distinction between authentication standards (SPF, DKIM) and transport security protocols (TLS, STARTTLS), leading candidates to mistakenly select TLS or STARTTLS as anti-spoofing measures when they only provide encryption, not sender verification.

Practice this question →

137

MCQhard

A FortiGate administrator wants to block a custom protocol anomaly where a client sends an HTTP request with a malformed header containing a null byte. Which advanced IPS feature should be used?

A.Create a custom IPS signature to match the null byte pattern

B.Enable 'Outbreak Prevention' in the IPS sensor

C.Use the 'http-policy' setting in the WAF profile

D.Enable Protocol Anomaly Detection in the IPS sensor

AnswerD

Protocol anomaly detection identifies malformed packets that violate protocol standards.

Why this answer

Protocol Anomaly Detection in the IPS sensor is designed to identify deviations from standard protocol behavior, such as malformed headers or null bytes in HTTP requests. This feature inspects traffic for known protocol violations without requiring custom signatures, making it the correct choice for blocking a null byte anomaly in HTTP headers.

Exam trap

The trap here is that candidates often confuse custom IPS signatures with protocol anomaly detection, assuming any pattern match requires a signature, when in fact FortiGate's IPS engine includes built-in protocol decoders that automatically detect RFC violations like null bytes.

How to eliminate wrong answers

Option A is wrong because creating a custom IPS signature to match a null byte pattern is unnecessary and less efficient; Protocol Anomaly Detection already handles such protocol violations natively. Option B is wrong because Outbreak Prevention is a feature for blocking emerging threats based on real-time intelligence, not for detecting protocol anomalies like malformed headers. Option C is wrong because the 'http-policy' setting in a WAF profile is used for web application firewall rules (e.g., SQL injection, XSS), not for low-level protocol anomaly detection like null bytes in headers.

Practice this question →

138

MCQhard

A FortiGate administrator runs 'diagnose ips anomaly list' and sees many entries with 'protocol anomaly - tcp_port_scan'. The administrator wants to reduce false positives. Which action should be taken in the IPS sensor configuration?

A.Increase the threshold for the port scan detection in the IPS sensor.

B.Add the trusted server IPs to an exemption list in the IPS sensor.

C.Disable the TCP port scan filter entirely.

D.Change the action from 'block' to 'monitor' for all IPS filters.

AnswerA

Increasing the threshold reduces false positives by requiring more ports to be scanned in the time window.

Why this answer

Increasing the threshold for port scan detection in the IPS sensor reduces false positives by requiring a higher number of scan attempts within the detection window before an alert is triggered. The 'diagnose ips anomaly list' output shows 'protocol anomaly - tcp_port_scan' entries, which are generated by the IPS engine's anomaly-based detection; raising the threshold makes the sensor less sensitive to benign network scanning activity, such as legitimate port sweeps by monitoring tools.

Exam trap

The trap here is that candidates may confuse 'reducing false positives' with 'changing the action to monitor' (Option D), thinking that logging instead of blocking reduces false positives, when in fact the number of alerts remains the same; the correct approach is to adjust the detection sensitivity via threshold tuning.

How to eliminate wrong answers

Option B is wrong because adding trusted server IPs to an exemption list in the IPS sensor would only suppress alerts for those specific IPs, but the administrator wants to reduce false positives globally without disabling detection for legitimate traffic. Option C is wrong because disabling the TCP port scan filter entirely would remove all detection of port scans, including malicious ones, which is an overreaction and not a targeted reduction of false positives. Option D is wrong because changing the action from 'block' to 'monitor' for all IPS filters would only change the response (e.g., from blocking to logging), but would not reduce the number of false positive alerts generated; the sensor would still trigger the same number of events.

Practice this question →

139

MCQmedium

An admin wants to ensure that office documents (e.g., Word, Excel) downloaded from the internet are safe before users open them. Which feature should be used to remove potentially malicious macros and active content?

A.Machine learning engine

B.Content Disarm and Reconstruction (CDR)

C.Antivirus pattern matching

D.FortiSandbox file submission

AnswerB

CDR strips active content like macros, scripts, and embedded objects from documents.

Why this answer

Content Disarm and Reconstruction (CDR) is the correct feature because it proactively removes potentially malicious macros, scripts, and active content from office documents by stripping the original file's active elements and rebuilding a safe, sanitized version. Unlike detection-based methods, CDR eliminates threats before the file reaches the user, ensuring that even unknown or zero-day macro-based attacks are neutralized.

Exam trap

The trap here is that candidates often confuse CDR with sandboxing or signature-based detection, mistakenly thinking that analyzing or scanning a file is sufficient to ensure safety, when in fact only CDR actively removes the threat vector (macros/active content) from the document itself.

How to eliminate wrong answers

Option A is wrong because the Machine Learning engine is a detection-based technology that identifies threats by analyzing file characteristics and behavior patterns, but it does not remove macros or active content from documents—it only flags or blocks files based on risk scores. Option C is wrong because Antivirus pattern matching relies on signature databases to detect known malware, which cannot protect against unknown or polymorphic macro-based attacks that have no existing signature. Option D is wrong because FortiSandbox file submission is a dynamic analysis tool that detonates files in a sandboxed environment to observe malicious behavior, but it does not sanitize or reconstruct the document; it only provides a verdict after execution, which still requires the user to open the original file if no threat is detected.

Practice this question →

140

MCQeasy

What is the purpose of FortiDeceptor in an enterprise security architecture?

A.To simulate real assets and detect attackers attempting to interact with decoys

B.To provide VPN access for remote users

C.To encrypt all data at rest on endpoints

D.To block all inbound traffic from suspicious IP addresses

AnswerA

FortiDeceptor creates decoys to attract and detect attackers.

Why this answer

FortiDeceptor is a deception-based threat detection solution that deploys decoys (simulated real assets like servers, databases, or IoT devices) across the network. When an attacker probes or interacts with these decoys, FortiDeceptor generates high-fidelity alerts, enabling early detection of lateral movement or reconnaissance without relying on signatures. This aligns with the Advanced Threat Protection domain by shifting from reactive blocking to proactive deception.

Exam trap

The trap here is that candidates confuse FortiDeceptor's deception-based detection with traditional prevention mechanisms like firewalls or VPNs, assuming it blocks threats directly rather than detecting them through interaction with decoys.

How to eliminate wrong answers

Option B is wrong because FortiDeceptor does not provide VPN access; that is the function of FortiClient or FortiGate's IPsec/SSL VPN capabilities. Option C is wrong because FortiDeceptor does not encrypt data at rest on endpoints; endpoint encryption is typically handled by solutions like FortiClient with full disk encryption or third-party tools. Option D is wrong because FortiDeceptor does not block inbound traffic from suspicious IPs; that is the role of FortiGate's firewall policies, IPS, or FortiGuard IP reputation filtering.

Practice this question →

141

MCQmedium

An admin receives an email from FortiMail regarding a message that was rejected due to SPF failure. What does this indicate about the email?

A.The email's From address domain does not match the sending server's IP per the domain's SPF record

B.The email's DKIM signature is invalid

C.The email contains a virus

D.The email is missing a Message-ID header

AnswerA

SPF checks the envelope sender domain against the sending IP.

Why this answer

SPF (Sender Policy Framework) validation checks whether the sending mail server's IP address is authorized to send mail for the domain in the envelope 'From' (RFC 5321.MailFrom) or the header 'From' address. When FortiMail rejects a message due to SPF failure, it means the IP of the connecting server does not match any of the authorized IPs listed in the domain's SPF TXT record (as defined in RFC 7208). This is a direct authentication failure, not a content-based or signature-based issue.

Exam trap

The trap here is that candidates often confuse SPF with DKIM or assume SPF validates the 'From' header domain, when in fact SPF validates the envelope sender domain (Return-Path) against the connecting IP, and a failure does not imply the message is malicious—only that it failed an authorization check.

How to eliminate wrong answers

Option B is wrong because DKIM (DomainKeys Identified Mail) uses a digital signature to verify message integrity and domain association, not the sending server's IP; an SPF failure is unrelated to DKIM signature validity. Option C is wrong because SPF failure indicates a sending server authorization problem, not the presence of a virus; antivirus scanning is a separate content inspection process. Option D is wrong because a missing Message-ID header is a formatting issue that may affect message threading or compliance but is not checked by SPF; SPF operates at the transport level, not on header completeness.

Practice this question →

142

MCQeasy

What is the primary benefit of using FortiClient with ATP features in conjunction with FortiGate?

A.It allows users to bypass security policies

B.It replaces the need for a firewall

C.It enables endpoint detection and response with automated quarantine through FortiGate

D.It provides a single sign-on portal for all users

AnswerC

FortiClient ATP can detect threats and trigger FortiGate to isolate the endpoint.

Why this answer

FortiClient with ATP (Advanced Threat Protection) features, such as Antivirus, Web Filtering, and Vulnerability Scan, integrates with FortiGate via the FortiTelemetry protocol. This integration enables endpoint detection and response (EDR) capabilities, allowing FortiGate to automatically quarantine compromised endpoints based on telemetry and threat intelligence from FortiClient, thereby containing threats at the network edge.

Exam trap

The trap here is that candidates often confuse FortiClient's ATP features with basic VPN or compliance-only modes, overlooking the automated quarantine and EDR integration that requires FortiTelemetry and Security Fabric coordination.

How to eliminate wrong answers

Option A is wrong because FortiClient with ATP does not bypass security policies; instead, it enforces and augments them by providing endpoint compliance and threat telemetry to FortiGate. Option B is wrong because FortiClient does not replace the need for a firewall; it works as a complementary endpoint security agent, while FortiGate remains the core network firewall enforcing access control and inspection. Option D is wrong because FortiClient does not provide a single sign-on portal; SSO is typically handled by FortiAuthenticator or FSSO agents, not by FortiClient ATP features.

Practice this question →

143

MCQmedium

An administrator wants to prevent users from downloading known malicious files from the internet. The administrator has enabled FortiGuard Outbreak Prevention and applied an antivirus profile to the outbound policy. However, some malicious files are still reaching users. What configuration step is most likely missing?

A.The antivirus profile has 'FortiGuard Outbreak Prevention' enabled

B.The FortiGuard subscription has expired

C.The antivirus profile does not have 'FortiGuard Outbreak Prevention' enabled

D.The security policy is not configured for proxy-based inspection

AnswerC

Outbreak prevention is an additional toggle in the antivirus profile; without it, the feature does not activate.

Why this answer

FortiGuard Outbreak Prevention is a separate toggle within the antivirus profile that must be explicitly enabled to leverage real-time outbreak intelligence. Even if the administrator believes they have enabled it, the profile may have the feature disabled by default or inadvertently left off, allowing known malicious files to bypass detection. Without this toggle, the antivirus engine relies only on static signatures and cannot block files flagged by FortiGuard's outbreak database.

Exam trap

The trap here is that candidates assume enabling FortiGuard Outbreak Prevention at the system or global level automatically applies it to all antivirus profiles, when in fact it must be explicitly enabled within each antivirus profile's settings.

How to eliminate wrong answers

Option A is wrong because stating that the antivirus profile has 'FortiGuard Outbreak Prevention' enabled would contradict the scenario where malicious files are still reaching users; if it were enabled, the outbreak prevention would block those files. Option B is wrong because an expired FortiGuard subscription would affect all FortiGuard services, not just outbreak prevention, and the question specifies that the administrator enabled FortiGuard Outbreak Prevention, implying the subscription is active. Option D is wrong because proxy-based inspection is not a prerequisite for FortiGuard Outbreak Prevention; the feature works with both proxy-based and flow-based inspection modes as long as the antivirus profile is applied and the toggle is enabled.

Practice this question →

144

MCQmedium

An administrator wants to detect lateral movement and early stages of an attack using decoy systems that mimic production assets. Which Fortinet product should they deploy?

A.FortiSIEM

B.FortiEDR

C.FortiNDR

D.FortiDeceptor

AnswerD

FortiDeceptor uses decoys to detect attacks.

Why this answer

FortiDeceptor is specifically designed to detect lateral movement and early-stage attacks by deploying decoy systems (honeypots) that mimic production assets. It uses deception technology to lure attackers away from real targets and trigger alerts when decoys are probed or compromised, enabling early threat detection without impacting production systems.

Exam trap

The trap here is that candidates may confuse FortiDeceptor with FortiNDR or FortiEDR because all three involve threat detection, but only FortiDeceptor uses active decoy systems to mimic production assets for deception-based detection.

How to eliminate wrong answers

Option A is wrong because FortiSIEM is a security information and event management solution that aggregates logs and correlates events, but it does not deploy decoy systems or actively mimic production assets for deception. Option B is wrong because FortiEDR is an endpoint detection and response solution that protects endpoints via behavioral analysis and threat hunting, but it does not create decoy systems or honeypots to simulate production assets. Option C is wrong because FortiNDR is a network detection and response solution that analyzes network traffic for anomalies and threats using machine learning, but it does not deploy decoy systems or mimic production assets for deception-based detection.

Practice this question →

145

MCQhard

A company uses FortiWeb to protect its web application. They want to block SQL injection attempts. Which FortiWeb feature should be configured to inspect HTTP requests for malicious SQL patterns?

A.URL Access Rule

B.Web Application Firewall (WAF) Signatures

C.HTTP Protocol Constraint

D.IP List

AnswerB

WAF Signatures include pre-defined rules for SQL injection, XSS, etc.

Why this answer

FortiWeb's WAF Signatures (option B) are specifically designed to inspect HTTP request payloads for known attack patterns, including SQL injection signatures. This feature uses a regularly updated signature database to match malicious SQL syntax (e.g., UNION, OR 1=1) within GET/POST parameters, cookies, or headers, making it the correct choice for blocking SQL injection attempts.

Exam trap

The trap here is that candidates confuse 'HTTP Protocol Constraint' (which only checks protocol compliance) with content inspection features like WAF Signatures, leading them to select option C instead of B.

How to eliminate wrong answers

Option A is wrong because URL Access Rules control access based on URL patterns or source IPs, not by inspecting request content for SQL injection patterns. Option C is wrong because HTTP Protocol Constraints enforce RFC compliance (e.g., header length, method restrictions) and do not perform content-level pattern matching for SQL injection. Option D is wrong because IP Lists allow or block traffic based on source IP addresses, with no capability to analyze the payload for malicious SQL syntax.

Practice this question →

146

Multi-Selectmedium

An administrator is configuring FortiDeceptor to detect threats within the network. Which TWO statements about FortiDeceptor are correct?

Select 2 answers

A.It requires a separate hardware appliance for each network segment

B.It sends alerts to FortiSIEM or FortiSOAR for automated response

C.It uses decoys and lures to attract attackers

D.It uses signature-based detection to identify malware

E.It can replace firewall functionality

AnswersB, C

Integration with SIEM/SOAR enables automated response to detected threats.

Why this answer

FortiDeceptor integrates with FortiSIEM and FortiSOAR to automatically trigger incident response workflows when a threat is detected. This integration allows security teams to quickly contain and remediate attacks without manual intervention, leveraging the Fortinet Security Fabric's automation capabilities.

Exam trap

The trap here is that candidates may confuse FortiDeceptor's deception-based detection with traditional signature-based IDS/IPS, leading them to incorrectly select option D, or assume it requires dedicated hardware per segment (option A) due to misunderstanding its deployment flexibility.

Practice this question →

147

Multi-Selectmedium

A FortiGate administrator wants to detect and block protocol anomalies as part of advanced IPS. Which three options are available in FortiGate's custom IPS signatures? (Choose three.)

Select 3 answers

A.Protocol-specific fields

B.Protocol anomaly detection

C.Packet length constraints

D.Application signatures

E.URL filtering

AnswersA, B, C

Can specify fields like TCP flags, HTTP headers.

Why this answer

Custom IPS signatures in FortiGate allow matching on protocol-specific fields such as TCP flags, ICMP type/code, or DNS query types. This enables detection of anomalies like invalid flag combinations or malformed protocol headers, which is a core part of advanced IPS.

Exam trap

The trap here is that candidates confuse application control signatures (which identify applications by traffic patterns) with IPS protocol anomaly signatures, or mistakenly think URL filtering is part of IPS when it is a separate security profile feature.

Practice this question →

148

Multi-Selectmedium

A company has deployed FortiClient with advanced threat protection (ATP) features. Which TWO capabilities does FortiClient ATP provide beyond basic antivirus?

Select 2 answers

A.Exploit prevention and vulnerability scanning

B.Application control and inventory

C.Real-time malware protection using machine learning

D.VPN connectivity

E.Web filtering and URL rating

AnswersA, C

FortiClient ATP includes exploit prevention and vulnerability assessment.

Practice this question →

149

MCQmedium

An admin wants to block malicious files detected by FortiSandbox at the FortiGate level. Which configuration is required on the FortiGate to automatically block files based on FortiSandbox verdict?

A.Enable Threat Feeds on FortiGate and subscribe to FortiSandbox feeds

B.Enable 'FortiSandbox inline prevention' in the antivirus profile

C.Configure an Automation Stitch that triggers on malware detected events and blocks the source IP

D.Configure a security policy with a Web Filter profile that blocks malware categories

AnswerB

This setting allows the FortiGate to block files immediately based on FortiSandbox verdicts.

Why this answer

Enabling 'FortiSandbox inline prevention' in the antivirus profile allows FortiGate to automatically block files based on the verdict received from FortiSandbox. When this option is enabled, the FortiGate will hold the file until the sandbox analysis completes, then either allow or block the file based on the verdict (e.g., malware detected). This is the direct configuration for automatic file blocking at the gateway level.

Exam trap

The trap here is that candidates confuse reactive automation (Option C) with proactive inline prevention, or mistake web filtering (Option D) for file-based sandbox verdict enforcement.

How to eliminate wrong answers

Option A is wrong because Threat Feeds are used to consume external threat intelligence (e.g., IP reputation lists), not to block files based on FortiSandbox verdicts; FortiSandbox feeds are not a standard subscription for file blocking. Option C is wrong because an Automation Stitch that blocks the source IP after malware detection is a reactive, post-infection response, not a real-time file blocking mechanism at the FortiGate level. Option D is wrong because a Web Filter profile blocks URLs or web categories, not individual files based on sandbox verdicts; malware categories in web filtering are URL-based, not file-based.

Practice this question →

150

MCQmedium

A network admin notices that files submitted to FortiSandbox are not being analyzed. The FortiGate is configured to send files to FortiSandbox. What is the MOST likely cause?

A.FortiSandbox license is expired

B.FortiGate firewall policy is blocking the connection to FortiSandbox on port 443

C.FortiSandbox is in quarantine mode

D.File size exceeds the maximum submission size limit on FortiGate

AnswerA

An expired license prevents analysis. The file submission queue will accumulate.

Why this answer

The most likely cause is an expired FortiSandbox license. When the license expires, FortiSandbox stops analyzing submitted files and may reject new submissions, even though the FortiGate is configured to send them. The FortiGate will still attempt to forward files, but FortiSandbox will not process them, resulting in no analysis results being returned.

Exam trap

The trap here is that candidates assume connectivity or configuration issues (like firewall rules or file size limits) are the cause, but FortiSandbox will still accept submissions with an expired license and simply not analyze them, making the license status the most likely root cause.

How to eliminate wrong answers

Option B is wrong because FortiGate uses port 514 (syslog) or a dedicated API port (typically 443 for HTTPS) to communicate with FortiSandbox, but a firewall policy blocking port 443 would prevent the initial connection, not cause files to be submitted but not analyzed. Option C is wrong because quarantine mode on FortiSandbox isolates detected threats but does not prevent file analysis; files are still analyzed before being quarantined. Option D is wrong because if the file size exceeds the maximum submission size limit on FortiGate, the file would not be sent to FortiSandbox at all, whereas the issue is that files are submitted but not analyzed.

Practice this question →