How should I use these Advanced Threat Protection practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Advanced Threat Protection questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Advanced Threat Protection domain.

NSE7 · topic practice

Advanced Threat Protection practice questions

Practise Fortinet NSE 7 Advanced Security NSE7 Advanced Threat Protection practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Advanced Threat Protection

Practice 10 questions Browse domain →

What the exam tests

What to know about Advanced Threat Protection

Advanced Threat Protection questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Advanced Threat Protection exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Advanced Threat Protection questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Advanced Threat Protection explanation →

A company is deploying FortiGate with Advanced Threat Protection (ATP) and wants to block advanced malware that uses encrypted C2 communications. Which security profile should be configured to perform SSL inspection and detect malicious traffic?

Trap 1: Data Leak Prevention profile

DLP prevents data exfiltration, not malware detection.

Trap 2: Web Filtering profile

Web filtering profiles do not inspect encrypted traffic unless SSL inspection is configured separately, but the primary profile for malware detection is antivirus.

Trap 3: Intrusion Prevention profile

IPS profiles detect exploits but do not decrypt traffic by themselves.

Study all Advanced Threat Protection common traps →

A
Data Leak Prevention profile
Why wrong: DLP prevents data exfiltration, not malware detection.
B
Antivirus profile with SSL inspection
Antivirus profiles can be configured with SSL inspection to detect malware in encrypted C2 traffic.
C
Web Filtering profile
Why wrong: Web filtering profiles do not inspect encrypted traffic unless SSL inspection is configured separately, but the primary profile for malware detection is antivirus.
D
Intrusion Prevention profile
Why wrong: IPS profiles detect exploits but do not decrypt traffic by themselves.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Advanced Threat Protection explanation →

A network administrator notices that several endpoints are infected with ransomware despite having FortiGate ATP enabled. The logs show that the files were downloaded over HTTPS, and the antivirus profile did not detect them. What is the most likely reason?

Trap 1: Application control profile blocked the download

Application control does not detect malware; it controls application usage.

Trap 2: FortiSandbox was not configured to analyze the files

FortiSandbox enhances detection but is not required to scan encrypted traffic; SSL inspection is needed first.

Trap 3: IPS signature database was outdated

IPS does not inspect encrypted traffic without SSL inspection.

Study all Advanced Threat Protection common traps →

A
SSL inspection was not enabled on the antivirus profile
Without SSL inspection, encrypted traffic bypasses antivirus scanning.
B
Application control profile blocked the download
Why wrong: Application control does not detect malware; it controls application usage.
C
FortiSandbox was not configured to analyze the files
Why wrong: FortiSandbox enhances detection but is not required to scan encrypted traffic; SSL inspection is needed first.
D
IPS signature database was outdated
Why wrong: IPS does not inspect encrypted traffic without SSL inspection.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Advanced Threat Protection explanation →

A security engineer is troubleshooting a scenario where FortiGate is not blocking a known malicious URL categorized as 'Malware'. The web filtering profile is configured with 'monitor all' for the Malware category. What change should be made to block the URL?

Trap 1: Configure traffic shaping to rate limit the URL

Traffic shaping does not block; it only limits bandwidth.

Trap 2: Add a static URL filter with the exact URL and action 'block'

While this would work, it is not the most efficient solution; the category action should be changed.

Trap 3: Enable DNS filter with botnet C2 domain blocking

DNS filter blocks domains, not URLs.

Study all Advanced Threat Protection common traps →

A
Configure traffic shaping to rate limit the URL
Why wrong: Traffic shaping does not block; it only limits bandwidth.
B
Add a static URL filter with the exact URL and action 'block'
Why wrong: While this would work, it is not the most efficient solution; the category action should be changed.
C
Enable DNS filter with botnet C2 domain blocking
Why wrong: DNS filter blocks domains, not URLs.
D
Change the action for Malware category from 'monitor' to 'block' in the web filter profile
Setting the category action to 'block' will block all URLs in that category.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full Advanced Threat Protection explanation →

A company wants to detect and block phishing emails that contain malicious links. Which FortiGate security profile should be used?

Trap 1: Antivirus profile

Antivirus scans attachments, not links in email body.

Trap 2: Web Filtering profile

Web filtering does not inspect email traffic.

Trap 3: Data Leak Prevention profile

DLP is for sensitive data, not phishing.

Study all Advanced Threat Protection common traps →

A
Antivirus profile
Why wrong: Antivirus scans attachments, not links in email body.
B
Web Filtering profile
Why wrong: Web filtering does not inspect email traffic.
C
Data Leak Prevention profile
Why wrong: DLP is for sensitive data, not phishing.
D
Email Filtering profile
Email filtering can block phishing emails based on content and reputation.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Advanced Threat Protection explanation →

A FortiGate administrator receives alerts about a device communicating with a known botnet C2 server. The traffic is encrypted with TLS. Which ATP feature is most effective to block this communication?

Trap 1: Application control to block the C2 application

Application control may not identify the C2 traffic as a specific application.

Trap 2: Antivirus profile with SSL inspection

Antivirus can detect malware but not necessarily block C2 if the traffic is just a beacon.

Trap 3: IPS signature for botnet activity

IPS may detect but requires SSL inspection for encrypted traffic.

Study all Advanced Threat Protection common traps →

A
Application control to block the C2 application
Why wrong: Application control may not identify the C2 traffic as a specific application.
B
Antivirus profile with SSL inspection
Why wrong: Antivirus can detect malware but not necessarily block C2 if the traffic is just a beacon.
C
IPS signature for botnet activity
Why wrong: IPS may detect but requires SSL inspection for encrypted traffic.
D
DNS Filter with botnet C2 domain blocking
DNS filter blocks resolution of known malicious domains, preventing communication.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full Advanced Threat Protection explanation →

Which TWO features are part of FortiGate's Advanced Threat Protection (ATP) suite?

Trap 1: Data Leak Prevention (DLP)

DLP is not part of ATP.

Trap 2: SSL Inspection

SSL inspection is an enabler, not an ATP feature itself.

Trap 3: Intrusion Prevention System (IPS)

IPS is a separate security function, not exclusively ATP.

Study all Advanced Threat Protection common traps →

A
Data Leak Prevention (DLP)
Why wrong: DLP is not part of ATP.
B
SSL Inspection
Why wrong: SSL inspection is an enabler, not an ATP feature itself.
C
FortiGuard Antivirus
Part of ATP for malware detection.
D
FortiSandbox
FortiSandbox is an ATP component for advanced analysis.
E
Intrusion Prevention System (IPS)
Why wrong: IPS is a separate security function, not exclusively ATP.

Full breakdown with real-world context →

Question 7hardmulti select

Read the full Advanced Threat Protection explanation →

Which THREE actions should be taken to optimize FortiGate ATP performance while maintaining security?

Trap 1: Disable unnecessary security profiles to reduce CPU load

Disabling profiles reduces security.

Trap 2: Enable proxy-based inspection for all traffic

Proxy-based inspection increases latency.

Study all Advanced Threat Protection common traps →

A
Implement allow lists for trusted IP addresses to bypass scanning
Bypassing scanning for trusted sources improves performance.
B
Disable unnecessary security profiles to reduce CPU load
Why wrong: Disabling profiles reduces security.
C
Enable proxy-based inspection for all traffic
Why wrong: Proxy-based inspection increases latency.
D
Enable flow-based inspection for antivirus and IPS
Flow-based inspection improves performance.
E
Use SSL certificate inspection only for trusted categories
Selective inspection reduces overhead.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Advanced Threat Protection explanation →

Refer to the exhibit. An administrator notices that some malware files are not being detected by FortiGate. The antivirus profile uses flow-based scanning with FortiSandbox disabled. What is the most likely reason for missed detections?

Exhibit

Refer to the exhibit.

config antivirus profile
    edit "default"
        set comment "Default antivirus"
        config http
            set options scan
            set av-scan mode=flow-based
            set fortisandbox inline-scan disable
            set quarantine enable
        end
        config ftp
            set options scan
            set av-scan mode=flow-based
            set fortisandbox inline-scan disable
            set quarantine enable
        end
        config smb
            set options scan
            set av-scan mode=flow-based
            set fortisandbox inline-scan disable
            set quarantine enable
        end
    next
end

Trap 1: Flow-based scanning is less thorough than proxy-based

Flow-based is efficient but can miss some threats; however, the main issue is missing sandbox.

Trap 2: Quarantine is enabled, which causes files to be dropped before…

Quarantine is applied after detection, not before.

Trap 3: The antivirus profile is not applied to the firewall policy

The exhibit does not indicate policy application; the profile itself is configured.

Study all Advanced Threat Protection common traps →

A
Flow-based scanning is less thorough than proxy-based
Why wrong: Flow-based is efficient but can miss some threats; however, the main issue is missing sandbox.
B
FortiSandbox inline-scan is disabled, so unknown malware is not analyzed
Without FortiSandbox, new malware may not be detected by signatures alone.
C
Quarantine is enabled, which causes files to be dropped before scanning
Why wrong: Quarantine is applied after detection, not before.
D
The antivirus profile is not applied to the firewall policy
Why wrong: The exhibit does not indicate policy application; the profile itself is configured.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Advanced Threat Protection explanation →

Refer to the exhibit. A user reports that accessing a legitimate HTTPS website is blocked. The FortiGate logs show that the connection was denied by the antivirus profile. What is the most likely cause?

Exhibit

Refer to the exhibit.

config firewall policy
    edit 1
        set name "Web Access"
        set srcintf "port1"
        set dstintf "port2"
        set srcaddr "10.0.1.0/24"
        set dstaddr "10.0.2.0/24"
        set action accept
        set schedule "always"
        set service "HTTP" "HTTPS"
        set utm-status enable
        set profile-protocol-options "default"
        set ssl-ssh-profile "deep-inspection"
        set av-profile "default"
        set ips-profile "default"
        set application-list "default"
    next
end

Trap 1: The application list blocked the HTTPS application

Application control does not block individual websites unless the app is blocked.

Trap 2: The IPS profile blocked a vulnerability in the website

IPS would block exploit attempts, not normal access.

Trap 3: The protocol options profile blocked the SSL handshake

Protocol options control protocol behavior, not block websites.

Study all Advanced Threat Protection common traps →

A
The antivirus profile detected a false positive in the encrypted traffic
Deep inspection decrypts traffic, and antivirus may incorrectly flag legitimate content.
B
The application list blocked the HTTPS application
Why wrong: Application control does not block individual websites unless the app is blocked.
C
The IPS profile blocked a vulnerability in the website
Why wrong: IPS would block exploit attempts, not normal access.
D
The protocol options profile blocked the SSL handshake
Why wrong: Protocol options control protocol behavior, not block websites.

Full breakdown with real-world context →

Question 10hardmultiple choice

Read the full VPN explanation →

A large enterprise uses FortiGate as their perimeter firewall with ATP features enabled. They have a mix of internal users and remote VPN users. Recently, several remote users reported that their machines became infected with ransomware after connecting to the VPN. The IT team suspects that the ransomware entered through the VPN tunnel. The FortiGate has an antivirus profile applied to the VPN policy with SSL inspection enabled for all traffic. However, the logs show that no malware was detected. Upon investigation, the team finds that the remote users' machines are not managed by the company and do not have any endpoint protection. The ransomware was delivered via a spear-phishing email that the users opened on their remote machines. The email traffic passed through the VPN tunnel to the corporate mail server first, then back to the user. The FortiGate antivirus profile is configured to scan SMTP traffic but the email was sent from an external source to the corporate mail server, and the mail server uses STARTTLS to receive emails. The FortiGate does not perform SSL inspection on the SMTP traffic because the SMTP service is not included in the SSL inspection profile. What action should the administrator take to prevent this in the future?

Trap 1: Disable STARTTLS on the corporate mail server to force plaintext…

This weakens security and is not a best practice.

Trap 2: Require remote users to install endpoint protection with FortiClient

This is not directly enforceable via FortiGate configuration.

Trap 3: Block all SMTP traffic from remote VPN users

This would prevent legitimate email access and is too restrictive.

Study all Advanced Threat Protection common traps →

A
Disable STARTTLS on the corporate mail server to force plaintext SMTP
Why wrong: This weakens security and is not a best practice.
B
Add SMTP to the SSL inspection profile to decrypt and scan email traffic
This allows the antivirus to inspect encrypted SMTP traffic and detect malware.
C
Require remote users to install endpoint protection with FortiClient
Why wrong: This is not directly enforceable via FortiGate configuration.
D
Block all SMTP traffic from remote VPN users
Why wrong: This would prevent legitimate email access and is too restrictive.

Full breakdown with real-world context →

Question 11mediumdrag order

Review the full OSPF breakdown →

Drag and drop the steps to configure OSPF on a FortiGate firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 12mediummatching

Read the full Advanced Threat Protection explanation →

Match each FortiGate security profile to its category.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Malware protection

URL and content filtering

DNS-based threat protection

Application visibility and control

Intrusion prevention

Question 13mediummultiple choice

Read the full Advanced Threat Protection explanation →

A network admin configures FortiGate to submit files to FortiSandbox for analysis. After submission, the FortiGate logs show that files are being sent but no verdict is returned. The FortiSandbox is reachable and licensed. What is the most likely cause?

Trap 1: The FortiGate is using proxy-based inspection instead of flow-based

Inspection mode does not affect verdict retrieval.

Trap 2: The FortiSandbox server's IP is not added to the FortiGate's…

Trusted hosts affect management access, not verdict communication.

Trap 3: The antivirus profile is set to block without scanning

Block without scanning would prevent submission, not affect verdict retrieval.

Study all Advanced Threat Protection common traps →

A
The FortiGate is using proxy-based inspection instead of flow-based
Why wrong: Inspection mode does not affect verdict retrieval.
B
The FortiSandbox server's IP is not added to the FortiGate's trusted hosts
Why wrong: Trusted hosts affect management access, not verdict communication.
C
The FortiGate does not have a FortiGuard Security Rating subscription
FortiSandbox verdicts are delivered via FortiGuard rating; without the subscription, verdicts are not returned.
D
The antivirus profile is set to block without scanning
Why wrong: Block without scanning would prevent submission, not affect verdict retrieval.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full Advanced Threat Protection explanation →

An organization wants to protect against unknown malware by using machine learning on FortiGate. Which antivirus setting should be enabled to achieve this?

Trap 1: Enable 'Outbreak Prevention' under FortiGuard settings

Outbreak Prevention uses real-time intelligence, not ML.

Trap 2: Set 'av-engine' to 'flow' under system settings

This sets the inspection mode, not ML.

Trap 3: Enable 'FortiSandbox inline scanning' in the antivirus profile

Inline scanning submits files to FortiSandbox, not ML.

Study all Advanced Threat Protection common traps →

A
Enable 'Outbreak Prevention' under FortiGuard settings
Why wrong: Outbreak Prevention uses real-time intelligence, not ML.
B
Set 'av-engine' to 'flow' under system settings
Why wrong: This sets the inspection mode, not ML.
C
Enable 'Machine Learning Engine' in the antivirus profile
This enables the ML engine to detect unknown malware based on behavioral analysis.
D
Enable 'FortiSandbox inline scanning' in the antivirus profile
Why wrong: Inline scanning submits files to FortiSandbox, not ML.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full Advanced Threat Protection explanation →

A FortiGate administrator wants to block a custom protocol anomaly where a client sends an HTTP request with a malformed header containing a null byte. Which advanced IPS feature should be used?

Trap 1: Create a custom IPS signature to match the null byte pattern

Custom signatures are specific; protocol anomaly detection is a separate engine.

Trap 2: Enable 'Outbreak Prevention' in the IPS sensor

Outbreak Prevention is for fast-spreading threats, not protocol anomalies.

Trap 3: Use the 'http-policy' setting in the WAF profile

WAF handles web attacks, not protocol anomalies at the TCP/IP level.

Study all Advanced Threat Protection common traps →

A
Create a custom IPS signature to match the null byte pattern
Why wrong: Custom signatures are specific; protocol anomaly detection is a separate engine.
B
Enable 'Outbreak Prevention' in the IPS sensor
Why wrong: Outbreak Prevention is for fast-spreading threats, not protocol anomalies.
C
Use the 'http-policy' setting in the WAF profile
Why wrong: WAF handles web attacks, not protocol anomalies at the TCP/IP level.
D
Enable Protocol Anomaly Detection in the IPS sensor
Protocol anomaly detection identifies malformed packets that violate protocol standards.

Full breakdown with real-world context →

Question 16easymultiple choice

Read the full Advanced Threat Protection explanation →

What is the primary purpose of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus features?

Trap 1: To convert files into PDF format for safer viewing

CDR does not change file format.

Trap 2: To detect zero-day malware using sandboxing

Sandboxing is a separate feature.

Trap 3: To block all files containing macros

CDR does not block; it sanitizes.

Study all Advanced Threat Protection common traps →

A
To remove potentially malicious content from documents and rebuild them as safe files
CDR strips active content and reconstructs files to eliminate threats.
B
To convert files into PDF format for safer viewing
Why wrong: CDR does not change file format.
C
To detect zero-day malware using sandboxing
Why wrong: Sandboxing is a separate feature.
D
To block all files containing macros
Why wrong: CDR does not block; it sanitizes.

Full breakdown with real-world context →

Question 17mediummulti select

Read the full Advanced Threat Protection explanation →

An organization uses FortiMail and wants to validate that incoming emails are from legitimate senders by checking the sender's domain against a published policy. Which two email authentication mechanisms can FortiMail use? (Choose two.)

Trap 1: DKIM and DMARC

DMARC is not authentication.

Trap 2: STARTTLS and SPF

STARTTLS is encryption, not authentication.

Trap 3: DMARC and SPF

DMARC is a policy, not an authentication mechanism.

Study all Advanced Threat Protection common traps →

A
DKIM and DMARC
Why wrong: DMARC is not authentication.
B
STARTTLS and SPF
Why wrong: STARTTLS is encryption, not authentication.
C
DMARC and SPF
Why wrong: DMARC is a policy, not an authentication mechanism.
D
SPF and DKIM
SPF verifies the sending IP, DKIM verifies the signature.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full Advanced Threat Protection explanation →

A FortiGate admin runs 'diagnose ips anomaly list' and sees many 'tcp_src_session' events from a single internal IP. The admin suspects a scanning attack. What action should be taken to block this traffic without affecting legitimate traffic?

Trap 1: Create a firewall rule to block the IP address entirely

Blocking the entire IP may affect legitimate services.

Trap 2: Enable 'tcp_src_session' anomaly action to 'block' in the IPS sensor

This blocks the anomaly but may also impact legitimate users if thresholds are too low.

Trap 3: Use a WAF profile to block the IP based on rate

WAF is for web traffic, not general TCP anomalies.

Study all Advanced Threat Protection common traps →

A
Create a firewall rule to block the IP address entirely
Why wrong: Blocking the entire IP may affect legitimate services.
B
Create a custom IPS signature to detect and block the scanning pattern
A custom signature can precisely target the scan behavior.
C
Enable 'tcp_src_session' anomaly action to 'block' in the IPS sensor
Why wrong: This blocks the anomaly but may also impact legitimate users if thresholds are too low.
D
Use a WAF profile to block the IP based on rate
Why wrong: WAF is for web traffic, not general TCP anomalies.

Full breakdown with real-world context →

Question 19easymultiple choice

Read the full Advanced Threat Protection explanation →

What is the primary function of FortiDeceptor in a network security architecture?

Trap 1: To provide network access control for endpoints

That is FortiNAC's role.

Trap 2: To aggregate logs from multiple security devices

That is FortiAnalyzer's role.

Trap 3: To detect and block malware at the endpoint

That is FortiClient's role.

Study all Advanced Threat Protection common traps →

A
To provide network access control for endpoints
Why wrong: That is FortiNAC's role.
B
To aggregate logs from multiple security devices
Why wrong: That is FortiAnalyzer's role.
C
To lure attackers into interacting with decoys and generate alerts
FortiDeceptor uses decoys to detect lateral movement.
D
To detect and block malware at the endpoint
Why wrong: That is FortiClient's role.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full NAT/PAT explanation →

An administrator configures an automation stitch on FortiGate to automatically block an IP address when a specific IPS signature triggers. What must be configured as the trigger and action?

Trap 1: Trigger: 'Incoming Webhook'; Action: 'CLI Script'

Webhook is not a trigger for IPS events.

Trap 2: Trigger: 'FortiOS CLI'; Action: 'Alert Email'

FortiOS CLI is not a trigger.

Trap 3: Trigger: 'Schedule'; Action: 'Banned IP'

Schedule is time-based, not event-driven.

Study all Advanced Threat Protection common traps →

A
Trigger: 'Event Log' with filter for the IPS signature; Action: 'Add IP to Blocklist'
Event log triggers on specific log IDs; action adds IP to blocklist.
B
Trigger: 'Incoming Webhook'; Action: 'CLI Script'
Why wrong: Webhook is not a trigger for IPS events.
C
Trigger: 'FortiOS CLI'; Action: 'Alert Email'
Why wrong: FortiOS CLI is not a trigger.
D
Trigger: 'Schedule'; Action: 'Banned IP'
Why wrong: Schedule is time-based, not event-driven.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Advanced Threat Protection sessions

Start a Advanced Threat Protection only practice session

Every question in these sessions is drawn from the Advanced Threat Protection domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Advanced Threat Protection questions →Mixed NSE7 session

Frequently asked questions

What does the NSE7 exam test about Advanced Threat Protection?: Advanced Threat Protection questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Advanced Threat Protection questions in a focused session?: Yes — the session launcher on this page draws every question from the Advanced Threat Protection domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other NSE7 topics?: Use the topic links above to move to related areas, or go back to the NSE7 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the NSE7 exam covers. They are not copied from any real exam or dump site.

Advanced Threat Protection only

10 questions 20 questions 30 questions 50 questions

Mixed NSE7 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All NSE7 questions Advanced Threat Protection domain overview NSE7 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Advanced Threat Protection practice questions

What to know about Advanced Threat Protection

Common Advanced Threat Protection exam traps

Advanced Threat Protection questions

A company is deploying FortiGate with Advanced Threat Protection (ATP) and wants to block advanced malware that uses encrypted C2 communications. Which security profile should be configured to perform SSL inspection and detect malicious traffic?

A network administrator notices that several endpoints are infected with ransomware despite having FortiGate ATP enabled. The logs show that the files were downloaded over HTTPS, and the antivirus profile did not detect them. What is the most likely reason?

A security engineer is troubleshooting a scenario where FortiGate is not blocking a known malicious URL categorized as 'Malware'. The web filtering profile is configured with 'monitor all' for the Malware category. What change should be made to block the URL?

A company wants to detect and block phishing emails that contain malicious links. Which FortiGate security profile should be used?

A FortiGate administrator receives alerts about a device communicating with a known botnet C2 server. The traffic is encrypted with TLS. Which ATP feature is most effective to block this communication?

Which TWO features are part of FortiGate's Advanced Threat Protection (ATP) suite?

Which THREE actions should be taken to optimize FortiGate ATP performance while maintaining security?

Refer to the exhibit. An administrator notices that some malware files are not being detected by FortiGate. The antivirus profile uses flow-based scanning with FortiSandbox disabled. What is the most likely reason for missed detections?

Exhibit

Refer to the exhibit. A user reports that accessing a legitimate HTTPS website is blocked. The FortiGate logs show that the connection was denied by the antivirus profile. What is the most likely cause?

Exhibit

Drag and drop the steps to configure OSPF on a FortiGate firewall into the correct order.

Match each FortiGate security profile to its category.

A network admin configures FortiGate to submit files to FortiSandbox for analysis. After submission, the FortiGate logs show that files are being sent but no verdict is returned. The FortiSandbox is reachable and licensed. What is the most likely cause?

An organization wants to protect against unknown malware by using machine learning on FortiGate. Which antivirus setting should be enabled to achieve this?

A FortiGate administrator wants to block a custom protocol anomaly where a client sends an HTTP request with a malformed header containing a null byte. Which advanced IPS feature should be used?

What is the primary purpose of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus features?

An organization uses FortiMail and wants to validate that incoming emails are from legitimate senders by checking the sender's domain against a published policy. Which two email authentication mechanisms can FortiMail use? (Choose two.)

A FortiGate admin runs 'diagnose ips anomaly list' and sees many 'tcp_src_session' events from a single internal IP. The admin suspects a scanning attack. What action should be taken to block this traffic without affecting legitimate traffic?

What is the primary function of FortiDeceptor in a network security architecture?

An administrator configures an automation stitch on FortiGate to automatically block an IP address when a specific IPS signature triggers. What must be configured as the trigger and action?

Track your progress over time

Start a Advanced Threat Protection only practice session

Related NSE7 topic practice pages

Advanced Networking and SD-WAN practice questions

Advanced VPN and Zero Trust practice questions

Enterprise Firewall and VDOMs practice questions