Full FCP_FSA_AD-5.0 Practice Test and 45 Unique Questions, Get it Now!
The Best FCP_FSA_AD-5.0 Exam Study Material Premium Files and Preparation Tool
Fortinet FCP_FSA_AD-5.0 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 16
You are configuring an integration between FortiWeb and FortiSandbox. On FortiWeb, where must you define the settings to submit files to FortiSandbox? (Choose one answer)
- A. Web anti-defacement
- B. File security
- C. Attack signature
- D. Antivirus
Answer: B
Explanation:
From the FortiWeb Integration lesson, the Study Guide explicitly states:
"You can configure FortiSandbox file submission in a file security policy. Any files not detected by the FortiGuard antivirus engine will be uploaded to FortiSandbox."
"You can configure FortiWeb to send attachments to FortiSandbox for additional scans to detect advanced persistent threats or zero-day attacks." From the Lab Guide (Exercise 1 - FortiWeb Integration):
"Click Web Protection > Input Validation > File Security. In the File Security Policy section, click Create New. Configure Send Files to FortiSandbox: Enabled." This confirms that File Security (Option A) is the correct location on FortiWeb to configure FortiSandbox file submission settings.
NEW QUESTION # 17
A FortiSandbox HA cluster is configured with the MTA adapter. What does the primary node do when it receives MTA jobs? (Choose one answer)
- A. It distributes the MTA jobs to secondary members.
- B. It assigns the MTA jobs only to worker members.
- C. It assigns the MTA jobs to itself
- D. It distributes the MTA jobs to itself or to worker nodes.
Answer: D
Explanation:
The Study Guide states that in an HA cluster, "As well as normal scanning duties, the primary node also manages the cluster, distributes jobs, and gathers the verdicts." It also says that "The worker nodes provide load balancing. The primary node distributes scan jobs to the worker nodes." From those official statements, the primary node is not just a coordinator. It also performs normal scanning duties itself, while distributing scan jobs across worker nodes for load balancing. That rules out A, because the secondary node is for failover, not normal job distribution. It rules out C, because the primary is not restricted to itself only. It also rules out D, because the primary can still perform scanning duties and is not limited to sending all jobs only to workers. Therefore, when the primary receives MTA jobs, the correct behavior is that it distributes the MTA jobs to itself or to worker nodes.
NEW QUESTION # 18
An organization has an existing FortiGate provisioned as a data center firewall (DCFW) that submits inbound files to FortiSandbox for inline scanning. As a result of a network redesign, traffic between the FortiSandbox and the DCFW now passes through an intermediate firewall. Inline scanning is no longer working. While examining the configuration of the intermediate firewall you notice that it is configured to allow traffic on ports TCP/3389, UDP/53, and TCP/443. What must you change for the integration to work? (Choose one answer)
- A. FortiGate must be able to access FortiSandbox on TCP/4443.
- B. FortiGate must be able to access FortiSandbox on UDP/8888.
- C. FortiGate must be able to access FortiSandbox on TCP/8890.
- D. FortiGate must be able to access FortiSandbox on UDP/1344.
Answer: A
Explanation:
The FortiSandbox 5.0 Administrator Lab Guide explicitly states during the inline scanning configuration: "FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443." In the same exercise, the guide has you enable API access on port2 specifically so inline scanning can function, which confirms that the integration depends on FortiGate reaching FortiSandbox over TCP/4443.
In this scenario, the intermediate firewall currently allows TCP/3389, UDP/53, and TCP/443, but not TCP/4443. That is why inline scanning stopped working after the redesign. TCP/443 is not sufficient here because the documented FortiGate-to-FortiSandbox inline communication port is 4443, not standard HTTPS 443. The other ports in the options do not match the inline-scanning communication requirement described in the uploaded lab materials. Therefore, the required fix is to allow FortiGate access to FortiSandbox on TCP/4443.
NEW QUESTION # 19
When using SIMNET, which two inspections cannot be performed with real traffic? (Choose two answers)
- A. URL rating
- B. IP reputation
- C. Dynamic scan
- D. AV inspection
Answer: B,D
Explanation:
From the Deployment and System Settings lesson, the Study Guide explicitly states what SIMNET cannot do with real traffic:
"When the malware attempts to download a file, FortiSandbox provides a fake download package. This allows the downloader to successfully execute; however, FortiSandbox cannot run its antivirus inspection on the file."
"If the malware creates a callback connection to an IP, FortiSandbox cannot rate the IP, to determine if it's a botnet server." This confirms:
Option A (AV inspection) - Cannot be performed because SIMNET provides fake download packages, preventing real antivirus scanning Option C (IP reputation) - Cannot be performed because SIMNET uses internal IPs for DNS responses, making IP reputation lookups meaningless against real botnet databases Dynamic scan and URL rating can still occur inside the sandbox even without real internet access.
NEW QUESTION # 20
Which three actions does FortiSandbox perform when it is integrated with FortiMail for advanced threat protection (ATP)? (Choose three answers)
- A. It updates FortiGuard databases.
- B. It queues email during analysis.
- C. It analyzes file and URL objects.
- D. It submits objects for sandbox scanning.
- E. It assigns and returns a rating for analyzed objects.
Answer: B,C,E
Explanation:
The Study Guide is explicit about the FortiMail-FortiSandbox workflow. It states: "On top of file submissions, FortiMail can also submit extracted URLs from emails to FortiSandbox for inspection. FortiMail queues the email while waiting for a verdict. FortiSandbox inspects all submitted files and URLs. FortiSandbox then generates a verdict and sends that verdict in reply to FortiMail. FortiMail uses the verdict to apply the configured action." This directly supports D because FortiSandbox analyzes file and URL objects. It supports B because FortiSandbox generates a verdict and returns it to FortiMail. And it supports E because the integrated workflow includes the email being queued during analysis while FortiSandbox is processing the submitted objects. Option C is incorrect because FortiMail is the device that submits the objects to FortiSandbox, not FortiSandbox itself. Option A is also incorrect because updating FortiGuard databases is not one of the three ATP integration actions described for the FortiMail workflow. Therefore, the correct three answers are B, D, and E.
NEW QUESTION # 21
To allow access to the FortiSandbox GUI the administrator must configure an IP address and a default gateway. Which two commands must the administrator use to accomplish this task? (Choose two answers)
- A. set admin-port port1
- B. set default-gw <IP Address>
- C. set api-port port1
- D. set port1-ip <IP address>
Answer: B,D
Explanation:
From the Deployment and System Settings lesson, the Study Guide explicitly states:
"Initial port1 IP configuration must be performed from the console, using the commands shown on this slide. If your management computer is on a separate subnet from FortiSandbox, you must specify a gateway address using the commands shown on this slide." The two required commands are:
set port1-ip <IP address> - to assign the IP address to port1 for GUI access set default-gw <IP Address> - to configure the default gateway so the management computer can reach FortiSandbox from a different subnet Option B (set api-port port1) is for API access configuration, and Option C (set admin-port port1) is not a valid FortiSandbox CLI command for this purpose.
NEW QUESTION # 22
Refer to the exhibits.
A FortiClient EMS server is integrated with a FortiSandbox device. You are asked to find ways to expedite all scan jobs that require dynamic scanning so end users do not have to wait too long for a rating on suspicious attachments and URLs. Which configuration change will maintain a high security level but expedite all dynamic scan job requests? (Choose one answer)
- A. On FortiSandbox, in the Advanced settings, enable Pipeline Mode.
- B. On FortiClient EMS, disable Wait for FortiSandbox Results before Allowing File Access.
- C. On FortiSandbox, in the Pre-Filter settings, enable Office, PDF, URL, and Archive.
- D. On FortiClient EMS, change FortiSandbox Detection Verdict Level to Medium.
Answer: A
Explanation:
The best answer is B. enable Pipeline Mode. The FortiSandbox 5.0 Administrator Study Guide states: "The Pipeline Mode feature improves performance by allowing to scan multiple files, one at a time, without shutting down the VM instance after scanning each file." It further explains that "FortiSandbox will continue scanning files without shutting down the VM instance, as long as the VM status hasn't changed." This directly improves the throughput of dynamic VM-based scanning, which is exactly what the question asks for.
The other options do not fit as well. Option A would reduce waiting time for users, but it lowers security because files could be accessed before a sandbox verdict is returned; the EMS lab profile intentionally enables "Wait for FortiSandbox Results before Allowing File Access" with a Low detection level to maintain strong protection. Option C also weakens security by making remediation apply only when the verdict "equals or exceeds the selected FortiSandbox Detection Verdict Level," so raising it to Medium would ignore Low-risk detections. Option D enables prefiltering logic, which can reduce submissions, but it does not directly accelerate jobs that already require dynamic scanning. Therefore, Pipeline Mode is the only choice that both preserves a high security level and speeds dynamic scan processing.
NEW QUESTION # 23
Which two statements are true about creating an API interface? (Choose two answers)
- A. The configuration must be performed using the CLI
- B. API ports will not accept HTTP traffic.
- C. Ports configured for HA communication can also be configured as API ports.
- D. The interface must also be designated as an administrative interface.
Answer: A,B
Explanation:
From the Lab Guide (Exercise 4 - Using Inline Scanning), the following is stated:
"FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443." And the CLI command used:
"Enter the following command to enable API access on port2: set api-port port2" This confirms:
Option B is correct: Port 4443 uses HTTPS only - API ports will not accept HTTP traffic.
Option C is correct: The API port configuration must be performed using the CLI (set api-port port2), as there is no GUI option for this.
Option A is incorrect: The Study Guide states port3 cannot be a management port, and HA communication ports have dedicated roles that are not interchangeable with API ports.
Option D is incorrect: The CLI command sets the API port directly without requiring a separate administrative interface designation.
NEW QUESTION # 24
You are troubleshooting long delays between FortiMail file submissions to FortiSandbox and verdicts being returned form FortiSandbox. Which FortiMail debug tool must you use to troubleshoot this issue further? (Choose one answer)
- A. diagnose debug application hoststatd
- B. diagnose debug application mailfilterd
- C. diagnose debug application deferd
- D. diagnose debug application oftpd
Answer: C
Explanation:
The FortiSandbox 5.0 Administrator Lab Guide shows that, when diagnosing FortiMail submission issues, the required FortiMail debugs are sandboxclid and deferd. It explicitly instructs: "Enter the following commands to enable both deferd and sandboxclid debugging" and then shows that the deferd daemon spools the email and later releases the email from the queue folder after FortiSandbox processing.
Because sandboxclid is not one of the answer choices, the best answer among the listed FortiMail debug tools is deferd. It is the FortiMail daemon directly shown in the official lab workflow for troubleshooting submission-and-verdict handling. The other options in the answer list are not the ones the lab uses for FortiMail-to-FortiSandbox submission troubleshooting. So, based on the uploaded guide, diagnose debug application deferd is the correct choice.
NEW QUESTION # 25
How can you limit an administrator's access to scan jobs on FortiSandbox based on the system that submitted the scan request? (Choose one answer)
- A. By configuring access in the log server configuration settings
- B. By configuring netshare groups to define access
- C. By configuring device groups to assign to users
- D. By configuring administrator profiles that define job access
Answer: D
Explanation:
The correct answer is D. The Study Guide states that FortiSandbox has default administrative profiles and specifically says: "The Read Only profile is intended to be used for system-wide monitoring and reporting tasks, whereas the Device profile is intended to be used for monitoring alerts and reporting for a specific device." That wording directly matches the question requirement to limit access based on the system that submitted the scan request. In other words, FortiSandbox uses administrator profiles to control whether an admin can view broad system-wide activity or only jobs and alerts related to a specific submitting device.
This eliminates the other options. The Study Guide does not describe device groups, log server settings, or netshare groups as the mechanism for restricting admin visibility of scan jobs by submitter. Instead, access control is tied to the admin profile model. The Device profile is the exact fit because it narrows monitoring and reporting to a particular device context rather than the entire system. Therefore, the way to limit an administrator's access to scan jobs by the submitting system is by configuring administrator profiles that define job access.
NEW QUESTION # 26
You are asked to create some custom VMs to better represent your security environment. In which two FortiSandbox deployments is this supported? (Choose two answers)
- A. Azure non-nested mode
- B. Private cloud
- C. FortiSandbox Cloud
- D. Device-based
Answer: B,D
Explanation:
From the Scanning and Rating Components lesson, the Study Guide explicitly states:
"FortiSandbox allows you to modify the number of CPUs and memory assigned to a custom VM. This feature is supported on hardware models and private cloud VMs." Hardware models = Device-based (Option C) Private cloud VMs = Private cloud (Option A) Azure non-nested mode and FortiSandbox Cloud do not support custom VM creation as per the Study Guide.
NEW QUESTION # 27
Refer to the exhibits.
You are unable to download guest VMs on a new FortiSandbox VM. What is the reason for this? (Choose one answer)
- A. There is no internet connectivity on port3.
- B. FortiSandbox is using a private DNS server.
- C. There is no internet connectivity on port1.
- D. FortiSandbox does not have the necessary licenses.
Answer: C
Explanation:
From the Scanning and Rating Components lesson, the Study Guide explicitly states:
"VM images are downloaded from FortiGuard, using port1. So, you must ensure FortiSandbox has a default route and internet connectivity for port1." The exhibit confirms this - the test-network output shows:
System DNS resolve: Failed for both bing.com and fsavm.fortinet.net
fsavm.fortinet.net is the FortiGuard VM image download server
This DNS failure on the system side (port1) confirms there is no internet connectivity on port1, preventing VM image downloads. Note that port3 internet shows "Warning: VM to access internet: Disabled" - but port3 is only for VM sandboxing traffic, not for downloading VM images.
NEW QUESTION # 28
You are asked to create an 802.3ad interface on FortiSandbox with port 2 and port 4. However, when attempting to make the configuration change, you discover that you cannot select port 4 for the aggregate bonding. What are two reasons for this issue? (Choose two answers)
- A. Port 4 does not have an IP address.
- B. Port 4 is an api interface.
- C. Port 4 is an administration interface.
- D. Port 4 is a sniffer interface.
Answer: B,C
Explanation:
From the Deployment and System Settings lesson, the Study Guide states:
"Other ports, with the exception of port3, can also be configured as management ports from CLI."
"You can set additional ports as management port using the CLI command shown on this slide." From the Lab Guide (Exercise 4 - Using Inline Scanning):
"FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443."
"Enter the following command to enable API access on port2: set api-port port2" Ports that are designated as either administration interfaces or API interfaces cannot be selected for 802.3ad aggregate bonding because:
Option A - Port 4 configured as an administration interface is reserved for management traffic and cannot be repurposed for link aggregation Option C - Port 4 configured as an API interface is dedicated for API communication (port 4443) and is similarly restricted from being used in aggregate bonding configurations Port 4 in the Lab Guide is specifically referenced as the HA communication and management port, confirming these restrictions apply when special roles are assigned to interfaces.
NEW QUESTION # 29
Refer to the CLI configuration below.
set device-authorization -a
How will FortiSandbox authorize new FortiClient devices after this command? (Choose one answer)
- A. When a Fabric device is not authorized, FortiSandbox will authorize it automatically.
- B. When a new device other than FortiClient registers, FortiSandbox will authorize it automatically.
- C. When a new FortiClient registers, it inherits authorization status from the managing EMS or FortiGate.
- D. When a new FortiClient registers, FortiSandbox will authorize it automatically.
Answer: D
Explanation:
The Study Guide explains the default behavior first: "You must authorize FortiClient EMS on FortiSandbox. FortiSandbox automatically authorizes all FortiClient endpoints managed by an authorized FortiClient EMS." It then adds the key point for this question: "To change the default FortiClient authorization behavior, use the command shown on this slide to authorize FortiClient endpoints using FortiSandbox CLI. By default, FortiClient inherits its authorization status from the managing EMS or FortiGate." Because the question specifically shows the CLI command set device-authorization -a, it is asking about the behavior after changing the default. The default inheritance model described in option A applies before the override. After this command, FortiSandbox is set to authorize FortiClient endpoints directly and automatically, which makes C the correct answer. Option B is incorrect because the command is specifically about FortiClient endpoints, not other devices in general. Option D is too broad and does not match the Study Guide's explanation, which is limited to FortiClient authorization behavior.
NEW QUESTION # 30
Which three actions does FortiSandbox perform when it is integrated with FortiMail for advanced threat protection (ATP)? (Choose three answers)
- A. It updates FortiGuard databases.
- B. It queues email during analysis.
- C. It analyzes file and URL objects.
- D. It submits objects for sandbox scanning.
- E. It assigns and returns a rating for analyzed objects.
Answer: B,C,E
NEW QUESTION # 31
......
Get Instant Access to FCP_FSA_AD-5.0 Practice Exam Questions: https://examtorrent.vce4dumps.com/FCP_FSA_AD-5.0-latest-dumps.html