Check Real Fortinet FCP_FSA_AD-5.0 Exam Question for Free (2026)
Get Ready to Boost your Prepare for your FCP_FSA_AD-5.0 Exam with 45 Questions
NEW QUESTION # 27
You are asked to configure a FortiSandbox HA cluster. Port 4 on the primary and secondary nodes is dedicated for HA-specific communication. Which command must you use to configure the secondary node? (Choose one answer)
- A. hc-settings -sc -tM -nSecondaryNode -cFSAGrp -p<password> -iport4
- B. hc-settings -sc -tR -nSecondaryNode -cFSAGrp -p<password> -iport4
- C. hc-settings -sc -tN -nSecondaryNode -cFSAGrp -p<password> -iport4
- D. hc-settings -sc -tP -nSecondaryNode -cFSAGrp -p<password> -iport4
Answer: C
Explanation:
From the High Availability and Management lesson, the Study Guide states:
"You use the hc-settings command and options to configure the main HA settings, such as enable HA, and to configure the node's mode of operation, node alias, group name, group password, and the HA interface." The CLI flags breakdown:
-sc = Set configuration
-t = Node type flag where N = Secondary node
-n = Node alias (SecondaryNode)
-c = Cluster/group name (FSAGrp)
-p = Password
-i = HA interface (port4)
The Study Guide confirms the secondary node type uses -tN designation. Option B (-tM) represents the primary/master node, Option C (-tP) and Option D (-tR) are not valid node type designators for secondary nodes in the FortiSandbox HA CLI syntax.
NEW QUESTION # 28
Refer to the exhibit.
Which two statements about the scanned file are true? (Choose two answers)
- A. The analysis resulted in a malicious verdict.
- B. The URL was identified as a known malicious URL.
- C. The analysis resulted are defined.
- D. The advanced AI feature identified the threat.
Answer: A,D
Explanation:
The exhibit summary says the file was "flagged by the PAIX engine" and describes it as "high-risk behavior." The lab guide also states for a similar file analysis scenario: "The PAIX engine detected potentially malicious activity... The overall assessment is that there is a high likelihood of malicious activity." In addition, the FortiGate integration lab explains that "FortiSandbox identified the fsa_dropper.exe file as high risk... because the advanced AI engine was able to detect malicious behaviour... at the static scan phase." These extracts confirm that the advanced AI / PAIX engine identified the threat, so A is true.
Option D is not supported. The study guide distinguishes high risk from malicious and explains that high risk is a suspicious threat-level rating, not the same as a malicious verdict. It states that FortiSandbox groups results into ratings such as high risk, medium risk, low risk, clean, and malicious, and defines high-risk separately as a serious suspicious rating. Since the exhibit explicitly refers to high-risk behavior, not a malicious verdict, D is false as written. The duplicated B/C options are also not proven by the exhibit text provided.
If your original source intended D to say "The analysis resulted in a high-risk verdict" instead of malicious verdict, then the correct pair would be A and D.
NEW QUESTION # 29
On a FortiClient EMS integrated with FortiSandbox, how can you apply FortiSandbox profile configurations to endpoints even if they are off fabric? (Choose one answer)
- A. As part of an endpoint workgroup configuration
- B. As part of the sandbox profile configuration
- C. As part of the endpoint policy configuration
- D. As part of the fabric connectors configuration
Answer: C
Explanation:
The FortiClient EMS Integration section is explicit on this point. It says: "You must include the sandbox profile in the active endpoint policy." It then explains how off-fabric handling works: "FortiClient on-fabric detection rules configured within the policy will classify endpoints as on-fabric or off-fabric. The Profile (Off-Fabric) setting allows you to select a second profile to be applied to endpoints when they are determined to be off-fabric." This means the control point for applying FortiSandbox-related behavior to off-fabric endpoints is the endpoint policy, not the fabric connector, not a workgroup, and not the sandbox profile by itself. The sandbox profile defines FortiSandbox behavior, but it must be attached through the active endpoint policy, where the Off-Fabric profile selection is made. Therefore, the correct answer is C. As part of the endpoint policy configuration.
NEW QUESTION # 30
To allow access to the FortiSandbox GUI the administrator must configure an IP address and a default gateway. Which two commands must the administrator use to accomplish this task? (Choose two answers)
- A. set admin-port port1
- B. set default-gw <IP Address>
- C. set api-port port1
- D. set port1-ip <IP address>
Answer: B,D
Explanation:
From the Deployment and System Settings lesson, the Study Guide explicitly states:
"Initial port1 IP configuration must be performed from the console, using the commands shown on this slide. If your management computer is on a separate subnet from FortiSandbox, you must specify a gateway address using the commands shown on this slide." The two required commands are:
set port1-ip <IP address> - to assign the IP address to port1 for GUI access set default-gw <IP Address> - to configure the default gateway so the management computer can reach FortiSandbox from a different subnet Option B (set api-port port1) is for API access configuration, and Option C (set admin-port port1) is not a valid FortiSandbox CLI command for this purpose.
NEW QUESTION # 31
You are troubleshooting long delays between FortiMail file submissions to FortiSandbox and verdicts being returned form FortiSandbox. Which FortiMail debug tool must you use to troubleshoot this issue further? (Choose one answer)
- A. diagnose debug application hoststatd
- B. diagnose debug application mailfilterd
- C. diagnose debug application oftpd
- D. diagnose debug application deferd
Answer: D
Explanation:
The FortiSandbox 5.0 Administrator Lab Guide shows that, when diagnosing FortiMail submission issues, the required FortiMail debugs are sandboxclid and deferd. It explicitly instructs: "Enter the following commands to enable both deferd and sandboxclid debugging" and then shows that the deferd daemon spools the email and later releases the email from the queue folder after FortiSandbox processing.
Because sandboxclid is not one of the answer choices, the best answer among the listed FortiMail debug tools is deferd. It is the FortiMail daemon directly shown in the official lab workflow for troubleshooting submission-and-verdict handling. The other options in the answer list are not the ones the lab uses for FortiMail-to-FortiSandbox submission troubleshooting. So, based on the uploaded guide, diagnose debug application deferd is the correct choice.
NEW QUESTION # 32
Which two products integrated with FortiSandbox work to protect against the lateral movement stage of the Cyber Kill Chain? (Choose two answers)
- A. FortiDeceptor
- B. FortiMail
- C. FortiGate
- D. FortiADC
Answer: A,C
Explanation:
From the Attack Methodologies lesson, the Study Guide explicitly states:
"During the lateral movement stage, the attacker is trying to compromise and infect other computers in the network. If these computers are protected with FortiClient, FortiClient can send any file that the computer downloads, to FortiSandbox for analysis."
"FortiDeceptor creates a network of decoys, to lure attackers and monitor their activities on the network. When attackers attack a decoy, an alert is generated. FortiDeceptor engages FortiSandBox to get a verdict on the suspected malware."
"If you deploy FortiGate as an ISFW firewall, FortiGate can analyze the traffic moving across subnets and send any files to FortiSandbox for analysis to prevent propagation." Both FortiDeceptor (Option B) and FortiGate (Option D) are specifically identified as protecting against the lateral movement stage through their FortiSandbox integration.
NEW QUESTION # 33
When using SIMNET, which two inspections cannot be performed with real traffic? (Choose two answers)
- A. AV inspection
- B. Dynamic scan
- C. URL rating
- D. IP reputation
Answer: A,D
Explanation:
From the Deployment and System Settings lesson, the Study Guide explicitly states what SIMNET cannot do with real traffic:
"When the malware attempts to download a file, FortiSandbox provides a fake download package. This allows the downloader to successfully execute; however, FortiSandbox cannot run its antivirus inspection on the file."
"If the malware creates a callback connection to an IP, FortiSandbox cannot rate the IP, to determine if it's a botnet server." This confirms:
Option A (AV inspection) - Cannot be performed because SIMNET provides fake download packages, preventing real antivirus scanning Option C (IP reputation) - Cannot be performed because SIMNET uses internal IPs for DNS responses, making IP reputation lookups meaningless against real botnet databases Dynamic scan and URL rating can still occur inside the sandbox even without real internet access.
NEW QUESTION # 34
To assign a file to a VM image, which two conditions must be true? (Choose two answers)
- A. The VM image must have the software required to open the file.
- B. The file type must be configured to enter the job queue.
- C. The VM image clone value must be a non-zero number.
- D. FortiSandbox must have the appropriate license entitlements.
Answer: B,C
Explanation:
From the Scanning and Rating Components lesson, the Study Guide explicitly states:
"The second section of the Scan Profile, VM Association, allows you to define file extensions and VM image associations. This means that specific files are sandboxed by the associated VM image. To assign a file to a VM image, the following conditions must be true:
The file type must be configured to enter the job queue (first section of the scan profile).
The VM image clone value cannot be a non-zero number."
This directly confirms:
Option B - The VM image clone value must be a non-zero number (clones must be allocated) Option C - The file type must be configured to enter the job queue via the scan profile Pre-Filter section Options A and D, while potentially relevant in practice, are not listed as the two required conditions in the Study Guide.
NEW QUESTION # 35
An organization has an existing FortiGate provisioned as a data center firewall (DCFW) that submits inbound files to FortiSandbox for inline scanning. As a result of a network redesign, traffic between the FortiSandbox and the DCFW now passes through an intermediate firewall. Inline scanning is no longer working. While examining the configuration of the intermediate firewall you notice that it is configured to allow traffic on ports TCP/3389, UDP/53, and TCP/443. What must you change for the integration to work? (Choose one answer)
- A. FortiGate must be able to access FortiSandbox on TCP/8890.
- B. FortiGate must be able to access FortiSandbox on UDP/8888.
- C. FortiGate must be able to access FortiSandbox on TCP/4443.
- D. FortiGate must be able to access FortiSandbox on UDP/1344.
Answer: C
Explanation:
The FortiSandbox 5.0 Administrator Lab Guide explicitly states during the inline scanning configuration: "FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443." In the same exercise, the guide has you enable API access on port2 specifically so inline scanning can function, which confirms that the integration depends on FortiGate reaching FortiSandbox over TCP/4443.
In this scenario, the intermediate firewall currently allows TCP/3389, UDP/53, and TCP/443, but not TCP/4443. That is why inline scanning stopped working after the redesign. TCP/443 is not sufficient here because the documented FortiGate-to-FortiSandbox inline communication port is 4443, not standard HTTPS 443. The other ports in the options do not match the inline-scanning communication requirement described in the uploaded lab materials. Therefore, the required fix is to allow FortiGate access to FortiSandbox on TCP/4443.
NEW QUESTION # 36
You are attempting to troubleshoot a FortiGate device that is not sending samples to FortiSandbox. Which CLI command will provide you with useful diagnostic information? (Choose one answer)
- A. diagnose antivirus quarantine purge
- B. diagnose test application ipsmonitor 99
- C. diagnose test application quarantined 8
- D. diagnose debug application quarantine -1
Answer: D
Explanation:
From the FortiGate Integration lesson, the Study Guide explicitly states:
"The quarantine daemon is involved in submitting files to FortiSandbox." From the Lab Guide (Exercise 3 - Using FortiGate Diagnostics), the following is explicitly documented:
"Enter the following commands to enable debugging for the quarantine daemon: diagnose debug application quarantine -1 diagnose debug enable"
"Use the following CLI debug command to diagnose the connection and file transfer issue between HQ-FGT-1 and HQ-FSA-1: diagnose debug application quarantine -1" This command enables real-time debug output for the quarantine daemon on FortiGate, which is specifically responsible for submitting files to FortiSandbox and receiving verdicts. Option B clears the analytics cache rather than providing diagnostic information, and the other options relate to different functions entirely.
NEW QUESTION # 37
When configuring wildcard administrator authentication, which two account types can you use? (Choose two answers)
- A. RADIUS
- B. Local
- C. TACACS
- D. LDAP
Answer: A,D
Explanation:
From the Deployment and System Settings lesson, the Study Guide explicitly states:
"The default administrator account has a blank password. You should change this as soon as possible for all Fortinet devices. Aside from local accounts, FortiSandbox also supports LDAP, SAML SSO, and RADIUS." This confirms the supported remote authentication types for FortiSandbox administrator accounts are:
LDAP (Option A) ✓
RADIUS (Option B) ✓
SAML SSO (not listed as an option)
TACACS (Option C) and Local (Option D) are not listed as wildcard administrator authentication types in the Study Guide. Local accounts are standard administrator accounts, not wildcard authentication, and TACACS is not mentioned as a supported authentication method.
NEW QUESTION # 38
Refer to the exhibit.
Which command must you use to configure the worker node? (Choose one answer)
- A. hc-worker -a -sI0.50.1.30 -p<password>
- B. hc-worker -a -sI0.75.1.254 -p<password>
- C. hc-worker -a -sI0.25.1.30 -p<password>
- D. hc-worker -a -sI0.25.1.50 -p<password>
Answer: D
Explanation:
From the High Availability and Management lesson, the Study Guide states:
"You must configure the HA group name, password, and the cluster virtual IP. The worker nodes provide load balancing. The primary node distributes scan jobs to the worker nodes."
"You must configure the HA group name, password, and the virtual IP only on the primary node... Devices will interact with the cluster using this virtual IP." From the exhibit topology:
Cluster Virtual IP address = 10.25.1.50
Primary Node port1 = 10.25.1.30
Secondary Node port1 = 10.25.1.40
Worker Node port1 = 10.75.1.10
The worker node must be configured to point to the Cluster Virtual IP (10.25.1.50), not the individual primary node IP. This is because worker nodes join the cluster by connecting to the cluster virtual IP address.
Therefore the correct command is: hc-worker -a -sI0.25.1.50 -p<password>
NEW QUESTION # 39
You are asked to configure FortiSandbox to use one VM instance for multiple sequential scan jobs without shutting down the instance between each scan job submission. Which scan profile setting must you enable to achieve this? (Choose one answer)
- A. Adaptive VM scan
- B. Parallel VM scan
- C. VM scan ratio
- D. Pipeline mode
Answer: D
Explanation:
From the Scanning and Rating Components lesson, the Study Guide explicitly states:
"The Pipeline Mode feature improves performance by allowing to scan multiple files, one at a time, without shutting down the VM instance after scanning each file."
"FortiSandbox will continue scanning files without shutting down the VM instance, as long as the VM status hasn't changed. If the VM status changes, then the VM instance will shut down and will be restored for the next job." This precisely matches the requirement - using one VM instance for multiple sequential scan jobs without shutting down between submissions. The other options serve different purposes:
Adaptive Scan dynamically adjusts clone numbers
VM Scan Ratio controls the percentage of jobs scanned in a VM
Parallel VM Scan runs multiple VMs simultaneously for a single job
NEW QUESTION # 40
Refer to the exhibit.
A network topology is shown. Which two important steps must you take before you enable a BCC adapter on FortiSandbox? (Choose two answers)
- A. Add an MX record on the DNS server for the BCC email sub-domain to resolve to the FortiSandbox IP.
- B. Configure the sub-domain on the upstream SEG to BCC emails to FortiSandbox.
- C. Configure an A record on the DNS server for the FortiSandbox IP.
- D. Configure the upstream SEG to extract files and URLs from emails and send them to FortiSandbox for analysis.
Answer: A,B
Explanation:
From the Deployment and System Settings lesson, the Study Guide states:
"You can submit emails from an upstream MTA server to FortiSandbox using a BCC adapter. FortiSandbox will extract attachment files and URLs in an email body." For a BCC adapter to function correctly, two critical prerequisites must be in place:
Option C - The upstream SEG must be configured to BCC emails to a FortiSandbox sub-domain so that email copies are routed to FortiSandbox for analysis Option D - An MX record must be added to the DNS server for the BCC email sub-domain, so that the sub-domain resolves to the FortiSandbox IP address, allowing the SEG to properly deliver BCC email copies Option A is incorrect because the BCC adapter handles full email inspection - FortiSandbox itself extracts files and URLs rather than the SEG doing this. Option B is incorrect because an MX record (not just an A record) is the required DNS configuration for email routing.
NEW QUESTION # 41
You are asked to configure a FortiSandbox HA cluster. Port 4 on the primary and secondary nodes is dedicated for HA-specific communication. Which command must you use to configure the primary node? (Choose one answer)
- A. hc-settings -sc -tR -nPrimaryNode -cFSAGrp -p -iport4
- B. hc-settings -sc -tM -nPrimaryNode -cFSAGrp -p -iport4
- C. hc-settings -sc -tF -nPrimaryNode -cFSAGrp -p -iport4
- D. hc-settings -sc -tN -nPrimaryNode -cFSAGrp -p -iport4
Answer: B
Explanation:
The Study Guide states that HA is configured from the CLI and that "the main HA cluster CLI commands are hc-settings, hc-slave, and hc-status". It also explains that "You use the hc-settings command and options to configure the main HA settings... node alias, group name, group password, and the HA interface." The same HA section further says that the primary and secondary nodes must have a dedicated HA communication interface, and specifically notes that "port4 in this example" is the HA interface between them.
On the primary-node example configuration shown on page 137 of the uploaded study guide, the command uses -tM for the primary node with -iport4 for the HA interface. That directly matches option D. The other options use different node-type flags and do not correspond to the primary-node example. Therefore, the correct command is hc-settings -sc -tM -nPrimaryNode -cFSAGrp -p<password> -iport4.
NEW QUESTION # 42
You are troubleshooting long delays between FortiMail file submissions to FortiSandbox and verdicts being returned form FortiSandbox. Which FortiMail debug tool must you use to troubleshoot this issue further? (Choose one answer)
- A. diagnose debug application hoststatd
- B. diagnose debug application mailfilterd
- C. diagnose debug application oftpd
- D. diagnose debug application deferd
Answer: D
NEW QUESTION # 43
Refer to the exhibits.
A FortiClient EMS server is integrated with a FortiSandbox device. You are asked to find ways to expedite all scan jobs that require dynamic scanning so end users do not have to wait too long for a rating on suspicious attachments and URLs. Which configuration change will maintain a high security level but expedite all dynamic scan job requests? (Choose one answer)
- A. On FortiSandbox, in the Advanced settings, enable Pipeline Mode.
- B. On FortiSandbox, in the Pre-Filter settings, enable Office, PDF, URL, and Archive.
- C. On FortiClient EMS, disable Wait for FortiSandbox Results before Allowing File Access.
- D. On FortiClient EMS, change FortiSandbox Detection Verdict Level to Medium.
Answer: A
Explanation:
The best answer is B. enable Pipeline Mode. The FortiSandbox 5.0 Administrator Study Guide states: "The Pipeline Mode feature improves performance by allowing to scan multiple files, one at a time, without shutting down the VM instance after scanning each file." It further explains that "FortiSandbox will continue scanning files without shutting down the VM instance, as long as the VM status hasn't changed." This directly improves the throughput of dynamic VM-based scanning, which is exactly what the question asks for.
The other options do not fit as well. Option A would reduce waiting time for users, but it lowers security because files could be accessed before a sandbox verdict is returned; the EMS lab profile intentionally enables "Wait for FortiSandbox Results before Allowing File Access" with a Low detection level to maintain strong protection. Option C also weakens security by making remediation apply only when the verdict "equals or exceeds the selected FortiSandbox Detection Verdict Level," so raising it to Medium would ignore Low-risk detections. Option D enables prefiltering logic, which can reduce submissions, but it does not directly accelerate jobs that already require dynamic scanning. Therefore, Pipeline Mode is the only choice that both preserves a high security level and speeds dynamic scan processing.
NEW QUESTION # 44
What is the default timeout value on FortiGate for inline scanning mode? (Choose one answer)
- A. 50 seconds
- B. 30 minutes
- C. 300 seconds
- D. 40 minutes
Answer: A
Explanation:
The correct answer is B. 50 seconds. The Study Guide explicitly states: "FortiGate holds the file while waiting for a verdict from FortiSandbox... The default file inspection timeout, and maximum, is 50 seconds." This is the clearest direct statement for the default timeout used with inline scanning mode on FortiGate.
The Lab Guide confirms the same design limit from the operational side. During the inline scanning exercise, it notes: "Because of the inline scanning time-out limit (maximum of 50 seconds), it's not recommended to submit files for VM inspection." That reinforces that inline scanning is designed for quick decision phases such as active content, community cloud, antivirus, and static analysis, not long VM dynamic analysis jobs. Therefore, options A, C, and D are incorrect because they are far above the documented inline inspection limit. The default FortiGate inline scanning timeout is 50 seconds.
NEW QUESTION # 45
......
Use Free FCP_FSA_AD-5.0 Exam Questions that Stimulates Actual EXAM : https://www.suretorrent.com/FCP_FSA_AD-5.0-exam-guide-torrent.html