NSE 5 - FortiSandbox 5.0 Administrator Exam Materials - Question #51 Discussion
Which two products integrated with FortiSandbox work to protect against the lateral movement stage of the Cyber Kill Chain?
176 Certification Products • 3429 Comments • 2479 Questions
Which two products integrated with FortiSandbox work to protect against the lateral movement stage of the Cyber Kill Chain?
What are three roles of the rating engine component of FortiSandbox?
There is a connectivity problem between FortiSandbox and the FortiGuard distribution servers. You observe that a firewall located between FortiSandbox and the internet allows traffic on ports TCP/4443, UDP/8888, and UDP/53. What is the cause of the issue?
You are configuring an integration between FortiWeb and FortiSandbox. On FortiWeb, where must you define the settings to submit files to FortiSandbox?
Which FortiGate daemon can you monitor in real time to verify that verdicts are being received by FortiGate?
Refer to the exhibits. The firewall policy ID 1 of the DCFW policy package and the reinstall preview window for the DCFW policy package installation are shown. Why is FortiManager installing set srcaddr "SSLVPN_TUNNEL_ADDR1" on firewall policy ID 1 when the policy package D...
An administrator is checking an enterprise network and sees a suspicious packet with the MAC address e0:23:ff:fc:00:86. What two conclusions can the administrator draw?
Refer to the exhibits. An analyst wants the rule shown in the exhibit to trigger when three failed login attempts occur within three minutes. What should the values be for the condition time window and aggregate count?
While troubleshooting a FortiGate web filter issue, users report that they cannot access any websites, even though those sites are not explicitly blocked by any web filter profiles that are applied to firewall policies. What are the three most likely reasons for this behavior?
Refer to the exhibits. A FortiClient EMS server is integrated with a FortiSandbox device. You are asked to find ways to expedite all scan jobs that require dynamic scanning so end users do not have to wait too long for a rating on suspicious attachments and URLs. Which conf...
Refer to the exhibit. Which two inspections will FortiSandbox perform on samples submitted for sandboxing?
Which three actions does FortiSandbox perform when it is integrated with FortiMail for advanced threat protection (ATP)?
You determine that there are a large number of samples on FortiSandbox that are obsolete and no longer needed for future analysis. Which CLI tool must you use to remediate this issue?
Refer to the exhibit. Which two statements about the scanned file are true?
How can you limit an administrator's access to scan jobs on FortiSandbox based on the system that submitted the scan request?
You notice a recent file downloaded by some end stations is exhibiting malware behavior, however, on the sandbox the file is rated clean. After further investigation you determine that only end stations using the Opera browser are being affected. What must you do to prevent th...
What is the default timeout value on FortiGate for inline scanning mode?
You are asked to configure a FortiSandbox HA cluster. Port 4 on the primary and secondary nodes is dedicated for HA-specific communication. Which command must you use to configure the primary node?
A security analyst is reviewing a scan job report that indicates a true positive match. The job report displays that the malware attempts to replace vital system executables. Which type of malware is the analyst observing?
On a FortiClient EMS integrated with FortiSandbox, how can you apply FortiSandbox profile configurations to endpoints even if they are off fabric?