Fortinet NSE7_ATP-2.5 Online Practice Questions and Exam Preparation

Fortinet NSE7_ATP-2.5 Online Questions & Answers

• Question 1:

  Which of the following actions are performed by FortiSandbox at the static analysis stage?

  A. All activity is monitored and recorded while the sample is executed in a virtual environment.
  B. The sample's file type is determined and submitted into the appropriate scan job queue.
  C. The sample behavior is analyzed and embedded objects are extracted for analysis.
  D. Embedded attachments are scanned using the FortiGuard antivirus engine and the latest signature database.
  D. Embedded attachments are scanned using the FortiGuard antivirus engine and the latest signature database.

• Question 2:

  FortiSandbox generates structured threat information exchange (STIX) packages for which of the following threats? (Choose two.)

  A. Botnet connections
  B. Malware
  C. Intrusion attempts
  D. Malicious URLs
  A. Botnet connections
  C. Intrusion attempts

• Question 3:

  Which FortiSandbox interfaces can you use for sniffer mode? (Choose two.)

  A. port2
  B. port3
  C. port1
  D. port4
  B. port3
  C. port1

• Question 4:

  When using FortiSandbox in sniffer-mode, you should configure FortiSandbox to inspect both inbound and outbound traffic. What type of threats can FortiSandbox detect on inbound traffic? (Choose two.)

  A. Botnet connections
  B. Malware
  C. Malicious URLs
  D. Intrusion attempts
  A. Botnet connections
  D. Intrusion attempts

• Question 5:

  Which of the following are features of network share scanning of FortiSandbox? (Choose two.)

  A. Move clean files to a separate network share.
  B. Replace suspicious files with a replacement message.
  C. Detect malicious URLs.
  D. Detect network attacks.
  A. Move clean files to a separate network share.
  B. Replace suspicious files with a replacement message.

• Question 6:

  Examine the virtual Simulator section of the scan job report shown in the exhibit, then answer the following question:

  

  Based on the behavior observed by the virtual simulator, which of the following statements is the most likely scenario?

  A. The file contained a malicious image file.
  B. The file contained malicious JavaScript.
  C. The file contained a malicious macro.
  D. The file contained a malicious URL.
  B. The file contained malicious JavaScript.

• Question 7:

  Examine the Suspicious Indicators section of the scan job shown in the exhibit, then answer the following question:

  

  Which FortiSandbox component identified the vulnerability exploits?

  A. VM scan
  B. Antivirus scan
  C. Static analysis
  D. Cache check
  C. Static analysis

• Question 8:

  Which of the advanced threat protection solutions should you use to protect against an attacker may take during the lateral movement stage of the kill chain? (Choose two.)

  A. FortiClient and FortiSandbox
  B. FortiMail and FortiSandbox
  C. FortiGate and FortiSandbox
  D. FortiWeb and FortiSandbox
  B. FortiMail and FortiSandbox
  D. FortiWeb and FortiSandbox

• Question 9:

  Which threats can FortiSandbox inspect when it is deployed in sniffer mode? (Choose three.)

  A. Spam emails
  B. Known malware
  C. Encrypted files
  D. Malicious URLs
  E. Botnet connections
  B. Known malware
  D. Malicious URLs
  E. Botnet connections

• Question 10:

  At which stage of the kill chain will an attacker use tools, such as nmap, ARIN, and banner grabbing, on the targeted organization's network?

  A. Exploitation
  B. Reconnaissance
  C. Lateral movement
  D. Weaponization
  B. Reconnaissance