Fortinet Fortinet Certifications NSE7_ATP-2.5 Questions & Answers

• Question 11:

  Which threats can FortiSandbox inspect when it is deployed in sniffer mode? (Choose three.)

  A. Spam emails

  B. Known malware

  C. Encrypted files

  D. Malicious URLs

  E. Botnet connections

  Correct Answer: BDE

• Question 12:

  Which FortiSandbox diagnostic command should you use to diagnose Internet connectivity issues on port3?

  A. ping

  B. tcpdump

  C. test-network

  D. traceroute

  Correct Answer: D

  Reference: https://dokumen.tips/documents/fortios-54-cookbook-fortinet-docs-fortinetknowledgebasetechnicaldocumentation-.html

• Question 13:

  What information does a scan job report include? (Choose two.)

  A. Updates to the antivirus database

  B. Summary of the file activity

  C. Details about system files deleted of modified

  D. Changes to the FortiSandbox configuration

  Correct Answer: BC

• Question 14:

  Examine the CLI configuration, than answer the following question:

  

  Which of the following statements is true regarding this FortiMail's inspection behavior?

  A. Malicious URLs will be removed by antispam and replaced with a message.

  B. Suspicious files not detected by antivirus will be inspected by FortiSandbox.

  C. Known malicious URLs will be inspected by FortiSandbox.

  D. Files are skipped by content profile will be inspected by FortiSandbox.

  Correct Answer: C

• Question 15:

  What advantage does sandboxing provide over traditional virus detection methods?

  A. Heuristics detection that can detect new variants of existing viruses.

  B. Pattern-based detection that can catch multiple variants of a virus.

  C. Full code execution in an isolated and protected environment.

  D. Code emulation as packets are handled in real-time.

  Correct Answer: A

  Heuristic analysis is capable of detecting many previously unknown viruses and new variants of current viruses. However, heuristic analysis operates on the basis of experience (by comparing the suspicious file to the code and functions of known viruses Reference: https://en.wikipedia.org/wiki/Heuristic_analysis

• Question 16:

  Examine the FortiClient configuration shown in the exhibit. then answer the following question:

  

  What is the general rule you should follow when configuring the Timeout value for files submitted to FortiSandbox?

  A. It should be long enough for FortiSandbox to complete an antivirus scan of files.

  B. It should be long enough for FortiSandbox to complete a cloud query of file hashes.

  C. It should be long enough for FortiSandbox to complete sandbox analysis of files.

  D. It should be long enough for FortiSandbox to complete a static analysis of files.

  Correct Answer: C

  Reference https://help.fortinet.com/fclient/olh/5-6-6/FortiClient-5.6-Admin/800_Sandbox% 20Detection/0605_Config%20submission%20and%20remediation.htm

• Question 17:

  Which of the following scan job report sections are generated by static analysis? (Choose two.)

  A. Office Behaviors

  B. Launched Processes

  C. Registry Changes

  D. Virtual Simulator

  Correct Answer: CD

• Question 18:

  When using FortiSandbox in sniffer-mode, you should configure FortiSandbox to inspect both inbound and outbound traffic.

  What type of threats can FortiSandbox detect on inbound traffic? (Choose two.)

  A. Botnet connections

  B. Malware

  C. Malicious URLs

  D. Intrusion attempts

  Correct Answer: AD

• Question 19:

  Which of the advanced threat protection solutions should you use to protect against an attacker may take during the lateral movement stage of the kill chain? (Choose two.)

  A. FortiClient and FortiSandbox

  B. FortiMail and FortiSandbox

  C. FortiGate and FortiSandbox

  D. FortiWeb and FortiSandbox

  Correct Answer: BD

• Question 20:

  Examine the Suspicious Indicators section of the scan job shown in the exhibit, then answer the following question:

  

  Which FortiSandbox component identified the vulnerability exploits?

  A. VM scan

  B. Antivirus scan

  C. Static analysis

  D. Cache check

  Correct Answer: C