How should I use these Advanced Threat Protection practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Advanced Threat Protection questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Advanced Threat Protection domain.

NSE7 · topic practice

Advanced Threat Protection practice questions

Practise Fortinet NSE 7 Advanced Security NSE7 Advanced Threat Protection practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Advanced Threat Protection

Practice 10 questions Browse domain →

What the exam tests

What to know about Advanced Threat Protection

Advanced Threat Protection questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Advanced Threat Protection exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Advanced Threat Protection questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Advanced Threat Protection explanation →

A network administrator has configured FortiGate to send files to FortiSandbox for analysis. However, files are not being submitted. The administrator checks the FortiGate configuration and sees that the FortiSandbox server IP is correctly entered. What is the most likely cause of the issue?

Trap 1: The FortiSandbox is not licensed for file submission

Licensing issues would typically appear in logs, but the network connectivity check is more fundamental.

Trap 2: The file type is not supported by FortiSandbox

Unsupported file types would be excluded based on configuration, not silently fail submission.

Trap 3: The FortiGate antivirus profile is set to flow-based inspection

D is incorrect because flow-based inspection does not prevent file submission to FortiSandbox; file submission works with both flow-based and proxy-based inspection. The most common cause is a firewall blocking UDP/TCP port 514.

Study all Advanced Threat Protection common traps →

A
A firewall policy is blocking communication to FortiSandbox on port 514
FortiGate communicates with FortiSandbox via TCP port 514 (or custom). A missing or blocking policy would prevent file submission.
B
The FortiSandbox is not licensed for file submission
Why wrong: Licensing issues would typically appear in logs, but the network connectivity check is more fundamental.
C
The file type is not supported by FortiSandbox
Why wrong: Unsupported file types would be excluded based on configuration, not silently fail submission.
D
The FortiGate antivirus profile is set to flow-based inspection
Why wrong: D is incorrect because flow-based inspection does not prevent file submission to FortiSandbox; file submission works with both flow-based and proxy-based inspection. The most common cause is a firewall blocking UDP/TCP port 514.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Advanced Threat Protection explanation →

A FortiGate is configured to submit files to FortiSandbox. The administrator notices that files are being submitted but no verdicts are returned. Which two conditions could cause this?

Trap 1: The file type is not supported by FortiSandbox

Incorrect. Unsupported file types may be skipped or a 'no verdict' status is returned, but a verdict (e.g., 'not analyzed') is still possible.

Trap 2: The FortiSandbox license has expired

Incorrect. While an expired license may eventually cause issues, it does not prevent verdict return for already submitted files until renewal.

Trap 3: The antivirus profile is set to monitor mode

Incorrect. The antivirus profile setting does not affect verdict return; it controls actions taken based on verdict.

Study all Advanced Threat Protection common traps →

A
The FortiSandbox server is not reachable from the FortiGate
Correct. If FortiSandbox is unreachable, files cannot be analyzed and no verdict is returned.
B
The file type is not supported by FortiSandbox
Why wrong: Incorrect. Unsupported file types may be skipped or a 'no verdict' status is returned, but a verdict (e.g., 'not analyzed') is still possible.
C
The file size exceeds the FortiSandbox submission limit
Correct. If the file size exceeds the limit, the file may be rejected and no verdict generated.
D
The FortiSandbox license has expired
Why wrong: Incorrect. While an expired license may eventually cause issues, it does not prevent verdict return for already submitted files until renewal.
E
The antivirus profile is set to monitor mode
Why wrong: Incorrect. The antivirus profile setting does not affect verdict return; it controls actions taken based on verdict.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Advanced Threat Protection explanation →

Which FortiClient feature is specifically designed to prevent the execution of unknown malware by analyzing behavior in real-time?

Trap 1: FortiClient Vulnerability Scan

Vulnerability scan identifies missing patches, not malware execution.

Trap 2: FortiClient Application Firewall

Application firewall controls network access for applications, not behavior analysis.

Trap 3: FortiClient Web Filter

Web filter controls access to websites, not execution.

Study all Advanced Threat Protection common traps →

A
FortiClient Vulnerability Scan
Why wrong: Vulnerability scan identifies missing patches, not malware execution.
B
FortiClient Application Firewall
Why wrong: Application firewall controls network access for applications, not behavior analysis.
C
FortiClient Web Filter
Why wrong: Web filter controls access to websites, not execution.
D
FortiClient AI Engine
The AI engine uses machine learning to analyze behavior and stop unknown malware.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full Advanced Threat Protection explanation →

A company is deploying FortiGate with Advanced Threat Protection (ATP) and wants to block advanced malware that uses encrypted C2 communications. Which security profile should be configured to perform SSL inspection and detect malicious traffic?

Trap 1: Data Leak Prevention profile

DLP prevents data exfiltration, not malware detection.

Trap 2: Web Filtering profile

Web filtering profiles do not inspect encrypted traffic unless SSL inspection is configured separately, but the primary profile for malware detection is antivirus.

Trap 3: Intrusion Prevention profile

IPS profiles detect exploits but do not decrypt traffic by themselves.

Study all Advanced Threat Protection common traps →

A
Data Leak Prevention profile
Why wrong: DLP prevents data exfiltration, not malware detection.
B
Antivirus profile with SSL inspection
Antivirus profiles can be configured with SSL inspection to detect malware in encrypted C2 traffic.
C
Web Filtering profile
Why wrong: Web filtering profiles do not inspect encrypted traffic unless SSL inspection is configured separately, but the primary profile for malware detection is antivirus.
D
Intrusion Prevention profile
Why wrong: IPS profiles detect exploits but do not decrypt traffic by themselves.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Advanced Threat Protection explanation →

A network administrator notices that several endpoints are infected with ransomware despite having FortiGate ATP enabled. The logs show that the files were downloaded over HTTPS, and the antivirus profile did not detect them. What is the most likely reason?

Trap 1: Application control profile blocked the download

Application control does not detect malware; it controls application usage.

Trap 2: FortiSandbox was not configured to analyze the files

FortiSandbox enhances detection but is not required to scan encrypted traffic; SSL inspection is needed first.

Trap 3: IPS signature database was outdated

IPS does not inspect encrypted traffic without SSL inspection.

Study all Advanced Threat Protection common traps →

A
SSL inspection was not enabled on the antivirus profile
Without SSL inspection, encrypted traffic bypasses antivirus scanning.
B
Application control profile blocked the download
Why wrong: Application control does not detect malware; it controls application usage.
C
FortiSandbox was not configured to analyze the files
Why wrong: FortiSandbox enhances detection but is not required to scan encrypted traffic; SSL inspection is needed first.
D
IPS signature database was outdated
Why wrong: IPS does not inspect encrypted traffic without SSL inspection.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Advanced Threat Protection explanation →

A security engineer is troubleshooting a scenario where FortiGate is not blocking a known malicious URL categorized as 'Malware'. The web filtering profile is configured with 'monitor all' for the Malware category. What change should be made to block the URL?

Trap 1: Configure traffic shaping to rate limit the URL

Traffic shaping does not block; it only limits bandwidth.

Trap 2: Add a static URL filter with the exact URL and action 'block'

While this would work, it is not the most efficient solution; the category action should be changed.

Trap 3: Enable DNS filter with botnet C2 domain blocking

DNS filter blocks domains, not URLs.

Study all Advanced Threat Protection common traps →

A
Configure traffic shaping to rate limit the URL
Why wrong: Traffic shaping does not block; it only limits bandwidth.
B
Add a static URL filter with the exact URL and action 'block'
Why wrong: While this would work, it is not the most efficient solution; the category action should be changed.
C
Enable DNS filter with botnet C2 domain blocking
Why wrong: DNS filter blocks domains, not URLs.
D
Change the action for Malware category from 'monitor' to 'block' in the web filter profile
Setting the category action to 'block' will block all URLs in that category.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full Advanced Threat Protection explanation →

A company wants to detect and block phishing emails that contain malicious links. Which FortiGate security profile should be used?

Trap 1: Antivirus profile

Antivirus scans attachments, not links in email body.

Trap 2: Web Filtering profile

Web filtering does not inspect email traffic.

Trap 3: Data Leak Prevention profile

DLP is for sensitive data, not phishing.

Study all Advanced Threat Protection common traps →

A
Antivirus profile
Why wrong: Antivirus scans attachments, not links in email body.
B
Web Filtering profile
Why wrong: Web filtering does not inspect email traffic.
C
Data Leak Prevention profile
Why wrong: DLP is for sensitive data, not phishing.
D
Email Filtering profile
Email filtering can block phishing emails based on content and reputation.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Advanced Threat Protection explanation →

A FortiGate administrator receives alerts about a device communicating with a known botnet C2 server. The traffic is encrypted with TLS. Which ATP feature is most effective to block this communication?

Trap 1: Application control to block the C2 application

Application control may not identify the C2 traffic as a specific application.

Trap 2: Antivirus profile with SSL inspection

Antivirus can detect malware but not necessarily block C2 if the traffic is just a beacon.

Trap 3: IPS signature for botnet activity

IPS may detect but requires SSL inspection for encrypted traffic.

Study all Advanced Threat Protection common traps →

A
Application control to block the C2 application
Why wrong: Application control may not identify the C2 traffic as a specific application.
B
Antivirus profile with SSL inspection
Why wrong: Antivirus can detect malware but not necessarily block C2 if the traffic is just a beacon.
C
IPS signature for botnet activity
Why wrong: IPS may detect but requires SSL inspection for encrypted traffic.
D
DNS Filter with botnet C2 domain blocking
DNS filter blocks resolution of known malicious domains, preventing communication.

Full breakdown with real-world context →

Question 9mediummulti select

Read the full Advanced Threat Protection explanation →

Which TWO features are part of FortiGate's Advanced Threat Protection (ATP) suite?

Trap 1: Data Leak Prevention (DLP)

DLP is not part of ATP.

Trap 2: SSL Inspection

SSL inspection is an enabler, not an ATP feature itself.

Trap 3: Intrusion Prevention System (IPS)

IPS is a separate security function, not exclusively ATP.

Study all Advanced Threat Protection common traps →

A
Data Leak Prevention (DLP)
Why wrong: DLP is not part of ATP.
B
SSL Inspection
Why wrong: SSL inspection is an enabler, not an ATP feature itself.
C
FortiGuard Antivirus
Part of ATP for malware detection.
D
FortiSandbox
FortiSandbox is an ATP component for advanced analysis.
E
Intrusion Prevention System (IPS)
Why wrong: IPS is a separate security function, not exclusively ATP.

Full breakdown with real-world context →

Question 10hardmulti select

Read the full Advanced Threat Protection explanation →

Which THREE actions should be taken to optimize FortiGate ATP performance while maintaining security?

Trap 1: Disable unnecessary security profiles to reduce CPU load

Disabling profiles reduces security.

Trap 2: Enable proxy-based inspection for all traffic

Proxy-based inspection increases latency.

Study all Advanced Threat Protection common traps →

A
Implement allow lists for trusted IP addresses to bypass scanning
Bypassing scanning for trusted sources improves performance.
B
Disable unnecessary security profiles to reduce CPU load
Why wrong: Disabling profiles reduces security.
C
Enable proxy-based inspection for all traffic
Why wrong: Proxy-based inspection increases latency.
D
Enable flow-based inspection for antivirus and IPS
Flow-based inspection improves performance.
E
Use SSL certificate inspection only for trusted categories
Selective inspection reduces overhead.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Advanced Threat Protection explanation →

Refer to the exhibit. An administrator notices that some malware files are not being detected by FortiGate. The antivirus profile uses flow-based scanning with FortiSandbox disabled. What is the most likely reason for missed detections?

Exhibit

Refer to the exhibit.

config antivirus profile
    edit "default"
        set comment "Default antivirus"
        config http
            set options scan
            set av-scan mode=flow-based
            set fortisandbox inline-scan disable
            set quarantine enable
        end
        config ftp
            set options scan
            set av-scan mode=flow-based
            set fortisandbox inline-scan disable
            set quarantine enable
        end
        config smb
            set options scan
            set av-scan mode=flow-based
            set fortisandbox inline-scan disable
            set quarantine enable
        end
    next
end

Trap 1: Flow-based scanning is less thorough than proxy-based

Flow-based is efficient but can miss some threats; however, the main issue is missing sandbox.

Trap 2: Quarantine is enabled, which causes files to be dropped before…

Quarantine is applied after detection, not before.

Trap 3: The antivirus profile is not applied to the firewall policy

The exhibit does not indicate policy application; the profile itself is configured.

Study all Advanced Threat Protection common traps →

A
Flow-based scanning is less thorough than proxy-based
Why wrong: Flow-based is efficient but can miss some threats; however, the main issue is missing sandbox.
B
FortiSandbox inline-scan is disabled, so unknown malware is not analyzed
Without FortiSandbox, new malware may not be detected by signatures alone.
C
Quarantine is enabled, which causes files to be dropped before scanning
Why wrong: Quarantine is applied after detection, not before.
D
The antivirus profile is not applied to the firewall policy
Why wrong: The exhibit does not indicate policy application; the profile itself is configured.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full Advanced Threat Protection explanation →

Refer to the exhibit. A user reports that accessing a legitimate HTTPS website is blocked. The FortiGate logs show that the connection was denied by the antivirus profile. What is the most likely cause?

Exhibit

Refer to the exhibit.

config firewall policy
    edit 1
        set name "Web Access"
        set srcintf "port1"
        set dstintf "port2"
        set srcaddr "10.0.1.0/24"
        set dstaddr "10.0.2.0/24"
        set action accept
        set schedule "always"
        set service "HTTP" "HTTPS"
        set utm-status enable
        set profile-protocol-options "default"
        set ssl-ssh-profile "deep-inspection"
        set av-profile "default"
        set ips-profile "default"
        set application-list "default"
    next
end

Trap 1: The application list blocked the HTTPS application

Application control does not block individual websites unless the app is blocked.

Trap 2: The IPS profile blocked a vulnerability in the website

IPS would block exploit attempts, not normal access.

Trap 3: The protocol options profile blocked the SSL handshake

Protocol options control protocol behavior, not block websites.

Study all Advanced Threat Protection common traps →

A
The antivirus profile detected a false positive in the encrypted traffic
Deep inspection decrypts traffic, and antivirus may incorrectly flag legitimate content.
B
The application list blocked the HTTPS application
Why wrong: Application control does not block individual websites unless the app is blocked.
C
The IPS profile blocked a vulnerability in the website
Why wrong: IPS would block exploit attempts, not normal access.
D
The protocol options profile blocked the SSL handshake
Why wrong: Protocol options control protocol behavior, not block websites.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full VPN explanation →

A large enterprise uses FortiGate as their perimeter firewall with ATP features enabled. They have a mix of internal users and remote VPN users. Recently, several remote users reported that their machines became infected with ransomware after connecting to the VPN. The IT team suspects that the ransomware entered through the VPN tunnel. The FortiGate has an antivirus profile applied to the VPN policy with SSL inspection enabled for all traffic. However, the logs show that no malware was detected. Upon investigation, the team finds that the remote users' machines are not managed by the company and do not have any endpoint protection. The ransomware was delivered via a spear-phishing email that the users opened on their remote machines. The email traffic passed through the VPN tunnel to the corporate mail server first, then back to the user. The FortiGate antivirus profile is configured to scan SMTP traffic but the email was sent from an external source to the corporate mail server, and the mail server uses STARTTLS to receive emails. The FortiGate does not perform SSL inspection on the SMTP traffic because the SMTP service is not included in the SSL inspection profile. What action should the administrator take to prevent this in the future?

Trap 1: Disable STARTTLS on the corporate mail server to force plaintext…

This weakens security and is not a best practice.

Trap 2: Require remote users to install endpoint protection with FortiClient

This is not directly enforceable via FortiGate configuration.

Trap 3: Block all SMTP traffic from remote VPN users

This would prevent legitimate email access and is too restrictive.

Study all Advanced Threat Protection common traps →

A
Disable STARTTLS on the corporate mail server to force plaintext SMTP
Why wrong: This weakens security and is not a best practice.
B
Add SMTP to the SSL inspection profile to decrypt and scan email traffic
This allows the antivirus to inspect encrypted SMTP traffic and detect malware.
C
Require remote users to install endpoint protection with FortiClient
Why wrong: This is not directly enforceable via FortiGate configuration.
D
Block all SMTP traffic from remote VPN users
Why wrong: This would prevent legitimate email access and is too restrictive.

Full breakdown with real-world context →

Question 14mediumdrag order

Review the full OSPF breakdown →

Drag and drop the steps to configure OSPF on a FortiGate firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Step 1: Set router ID, Step 2: Create virtual router, Step 3:…

This is incorrect because the router ID is typically set after creating the virtual router (OSPF process) and before defining areas. Setting it first might work in some implementations but is not the standard order on FortiGate.

Trap 2: Step 1: Create virtual router, Step 2: Set router ID, Step 3:…

This is incorrect because you must define areas and networks before enabling OSPF on interfaces, as interfaces need to be associated with specific areas. Enabling without defined areas can cause misconfiguration.

Trap 3: Step 1: Define areas and networks, Step 2: Create virtual router,…

This is incorrect because you cannot define areas and networks before creating the OSPF virtual router process. The virtual router must exist first to hold those definitions.

Study all Advanced Threat Protection common traps →

A
Step 1: Create virtual router, Step 2: Define areas and networks, Step 3: Set router ID, Step 4: Enable on interfaces, Step 5: Verify
This is the correct order because you first create the OSPF process (virtual router), then define the areas and networks to match your topology, set the router ID for OSPF identification, enable OSPF on the appropriate interfaces, and finally verify the configuration.
B
Step 1: Set router ID, Step 2: Create virtual router, Step 3: Define areas and networks, Step 4: Enable on interfaces, Step 5: Verify
Why wrong: This is incorrect because the router ID is typically set after creating the virtual router (OSPF process) and before defining areas. Setting it first might work in some implementations but is not the standard order on FortiGate.
C
Step 1: Create virtual router, Step 2: Set router ID, Step 3: Enable on interfaces, Step 4: Define areas and networks, Step 5: Verify
Why wrong: This is incorrect because you must define areas and networks before enabling OSPF on interfaces, as interfaces need to be associated with specific areas. Enabling without defined areas can cause misconfiguration.
D
Step 1: Define areas and networks, Step 2: Create virtual router, Step 3: Set router ID, Step 4: Enable on interfaces, Step 5: Verify
Why wrong: This is incorrect because you cannot define areas and networks before creating the OSPF virtual router process. The virtual router must exist first to hold those definitions.

Full breakdown with real-world context →

Question 15mediummatching

Read the full Advanced Threat Protection explanation →

Match each FortiGate security profile to its category.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Malware protection

URL and content filtering

DNS-based threat protection

Application visibility and control

Intrusion prevention

Trap 1: Antivirus Profile: Controls web content based on categories.

Incorrect — controlling web content is the function of a Web Filter profile, not Antivirus.

Trap 2: Web Filter Profile: Scans for viruses in traffic.

Incorrect — scanning for viruses is the role of the Antivirus profile, not Web Filter.

Study all Advanced Threat Protection common traps →

A
Antivirus Profile: Protects against malware by scanning files and email attachments.
The Antivirus profile is specifically designed to detect and block malware in network traffic.
B
Web Filter Profile: Controls access to web content based on categories and URLs.
Web Filter profiles enforce web browsing policies by categorizing and filtering URLs.
C
Application Control Profile: Identifies and controls application traffic regardless of port.
Application Control profiles inspect traffic to identify applications and enforce policies.
D
Antivirus Profile: Controls web content based on categories.
Why wrong: Incorrect — controlling web content is the function of a Web Filter profile, not Antivirus.
E
Web Filter Profile: Scans for viruses in traffic.
Why wrong: Incorrect — scanning for viruses is the role of the Antivirus profile, not Web Filter.

Full breakdown with real-world context →

Question 16mediummultiple choice

Read the full Advanced Threat Protection explanation →

A network admin configures FortiGate to submit files to FortiSandbox for analysis. After submission, the FortiGate logs show that files are being sent but no verdict is returned. The FortiSandbox is reachable and licensed. What is the most likely cause?

Trap 1: The FortiGate is using proxy-based inspection instead of flow-based

Inspection mode does not affect verdict retrieval.

Trap 2: The FortiSandbox server's IP is not added to the FortiGate's…

Trusted hosts affect management access, not verdict communication.

Trap 3: The antivirus profile is set to block without scanning

Block without scanning would prevent submission, not affect verdict retrieval.

Study all Advanced Threat Protection common traps →

A
The FortiGate is using proxy-based inspection instead of flow-based
Why wrong: Inspection mode does not affect verdict retrieval.
B
The FortiSandbox server's IP is not added to the FortiGate's trusted hosts
Why wrong: Trusted hosts affect management access, not verdict communication.
C
The FortiGate does not have a FortiGuard Security Rating subscription
FortiSandbox verdicts are delivered via FortiGuard rating; without the subscription, verdicts are not returned.
D
The antivirus profile is set to block without scanning
Why wrong: Block without scanning would prevent submission, not affect verdict retrieval.

Full breakdown with real-world context →

Question 17mediummultiple choice

Read the full Advanced Threat Protection explanation →

An organization wants to protect against unknown malware by using machine learning on FortiGate. Which antivirus setting should be enabled to achieve this?

Trap 1: Enable 'Outbreak Prevention' under FortiGuard settings

Outbreak Prevention uses real-time intelligence, not ML.

Trap 2: Set 'av-engine' to 'flow' under system settings

This sets the inspection mode, not ML.

Trap 3: Enable 'FortiSandbox inline scanning' in the antivirus profile

Inline scanning submits files to FortiSandbox, not ML.

Study all Advanced Threat Protection common traps →

A
Enable 'Outbreak Prevention' under FortiGuard settings
Why wrong: Outbreak Prevention uses real-time intelligence, not ML.
B
Set 'av-engine' to 'flow' under system settings
Why wrong: This sets the inspection mode, not ML.
C
Enable 'Machine Learning Engine' in the antivirus profile
This enables the ML engine to detect unknown malware based on behavioral analysis.
D
Enable 'FortiSandbox inline scanning' in the antivirus profile
Why wrong: Inline scanning submits files to FortiSandbox, not ML.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full Advanced Threat Protection explanation →

A FortiGate administrator wants to block a custom protocol anomaly where a client sends an HTTP request with a malformed header containing a null byte. Which advanced IPS feature should be used?

Trap 1: Create a custom IPS signature to match the null byte pattern

Custom signatures are specific; protocol anomaly detection is a separate engine.

Trap 2: Enable 'Outbreak Prevention' in the IPS sensor

Outbreak Prevention is for fast-spreading threats, not protocol anomalies.

Trap 3: Use the 'http-policy' setting in the WAF profile

WAF handles web attacks, not protocol anomalies at the TCP/IP level.

Study all Advanced Threat Protection common traps →

A
Create a custom IPS signature to match the null byte pattern
Why wrong: Custom signatures are specific; protocol anomaly detection is a separate engine.
B
Enable 'Outbreak Prevention' in the IPS sensor
Why wrong: Outbreak Prevention is for fast-spreading threats, not protocol anomalies.
C
Use the 'http-policy' setting in the WAF profile
Why wrong: WAF handles web attacks, not protocol anomalies at the TCP/IP level.
D
Enable Protocol Anomaly Detection in the IPS sensor
Protocol anomaly detection identifies malformed packets that violate protocol standards.

Full breakdown with real-world context →

Question 19easymultiple choice

Read the full Advanced Threat Protection explanation →

What is the primary purpose of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus features?

Trap 1: To convert files into PDF format for safer viewing

CDR does not change file format.

Trap 2: To detect zero-day malware using sandboxing

Sandboxing is a separate feature.

Trap 3: To block all files containing macros

CDR does not block; it sanitizes.

Study all Advanced Threat Protection common traps →

A
To remove potentially malicious content from documents and rebuild them as safe files
CDR strips active content and reconstructs files to eliminate threats.
B
To convert files into PDF format for safer viewing
Why wrong: CDR does not change file format.
C
To detect zero-day malware using sandboxing
Why wrong: Sandboxing is a separate feature.
D
To block all files containing macros
Why wrong: CDR does not block; it sanitizes.

Full breakdown with real-world context →

Question 20mediummulti select

Read the full Advanced Threat Protection explanation →

An organization uses FortiMail and wants to validate that incoming emails are from legitimate senders by checking the sender's domain against a published policy. Which two email authentication mechanisms can FortiMail use? (Choose two.)

Trap 1: DKIM and DMARC

DMARC is not authentication.

Trap 2: STARTTLS and SPF

STARTTLS is encryption, not authentication.

Trap 3: DMARC and SPF

DMARC is a policy, not an authentication mechanism.

Study all Advanced Threat Protection common traps →

A
DKIM and DMARC
Why wrong: DMARC is not authentication.
B
STARTTLS and SPF
Why wrong: STARTTLS is encryption, not authentication.
C
DMARC and SPF
Why wrong: DMARC is a policy, not an authentication mechanism.
D
SPF and DKIM
SPF verifies the sending IP, DKIM verifies the signature.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Advanced Threat Protection sessions

Start a Advanced Threat Protection only practice session

Every question in these sessions is drawn from the Advanced Threat Protection domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Advanced Threat Protection questions →Mixed NSE7 session

Frequently asked questions

What does the NSE7 exam test about Advanced Threat Protection?: Advanced Threat Protection questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Advanced Threat Protection questions in a focused session?: Yes — the session launcher on this page draws every question from the Advanced Threat Protection domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other NSE7 topics?: Use the topic links above to move to related areas, or go back to the NSE7 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the NSE7 exam covers. They are not copied from any real exam or dump site.

Advanced Threat Protection only

10 questions 20 questions 30 questions 50 questions

Mixed NSE7 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All NSE7 questions Advanced Threat Protection domain overview NSE7 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Advanced Threat Protection practice questions

What to know about Advanced Threat Protection

Common Advanced Threat Protection exam traps

Advanced Threat Protection questions

A network administrator has configured FortiGate to send files to FortiSandbox for analysis. However, files are not being submitted. The administrator checks the FortiGate configuration and sees that the FortiSandbox server IP is correctly entered. What is the most likely cause of the issue?

A FortiGate is configured to submit files to FortiSandbox. The administrator notices that files are being submitted but no verdicts are returned. Which two conditions could cause this?

Which FortiClient feature is specifically designed to prevent the execution of unknown malware by analyzing behavior in real-time?

A company is deploying FortiGate with Advanced Threat Protection (ATP) and wants to block advanced malware that uses encrypted C2 communications. Which security profile should be configured to perform SSL inspection and detect malicious traffic?

A network administrator notices that several endpoints are infected with ransomware despite having FortiGate ATP enabled. The logs show that the files were downloaded over HTTPS, and the antivirus profile did not detect them. What is the most likely reason?

A security engineer is troubleshooting a scenario where FortiGate is not blocking a known malicious URL categorized as 'Malware'. The web filtering profile is configured with 'monitor all' for the Malware category. What change should be made to block the URL?

A company wants to detect and block phishing emails that contain malicious links. Which FortiGate security profile should be used?

A FortiGate administrator receives alerts about a device communicating with a known botnet C2 server. The traffic is encrypted with TLS. Which ATP feature is most effective to block this communication?

Which TWO features are part of FortiGate's Advanced Threat Protection (ATP) suite?

Which THREE actions should be taken to optimize FortiGate ATP performance while maintaining security?

Refer to the exhibit. An administrator notices that some malware files are not being detected by FortiGate. The antivirus profile uses flow-based scanning with FortiSandbox disabled. What is the most likely reason for missed detections?

Exhibit

Refer to the exhibit. A user reports that accessing a legitimate HTTPS website is blocked. The FortiGate logs show that the connection was denied by the antivirus profile. What is the most likely cause?

Exhibit

Drag and drop the steps to configure OSPF on a FortiGate firewall into the correct order.

Match each FortiGate security profile to its category.

A network admin configures FortiGate to submit files to FortiSandbox for analysis. After submission, the FortiGate logs show that files are being sent but no verdict is returned. The FortiSandbox is reachable and licensed. What is the most likely cause?

An organization wants to protect against unknown malware by using machine learning on FortiGate. Which antivirus setting should be enabled to achieve this?

A FortiGate administrator wants to block a custom protocol anomaly where a client sends an HTTP request with a malformed header containing a null byte. Which advanced IPS feature should be used?

What is the primary purpose of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus features?

An organization uses FortiMail and wants to validate that incoming emails are from legitimate senders by checking the sender's domain against a published policy. Which two email authentication mechanisms can FortiMail use? (Choose two.)

Track your progress over time

Start a Advanced Threat Protection only practice session

Related NSE7 topic practice pages

Advanced Networking and SD-WAN practice questions

Advanced VPN and Zero Trust practice questions

Enterprise Firewall and VDOMs practice questions