FCP - FortiSandbox 5.0 Administrator Version: Demo [ Total Questions: 10] Web: www.dumpsleader.com Email: support@dumpsleader.com Fortinet FCP_FSA_AD-5.0 IMPORTANT NOTICE Feedback We have developed quality product and state-of-art service to ensure our customers interest. If you have any suggestions, please feel free to contact us at feedback@dumpsleader.com Support If you have any questions about our product, please provide the following items: exam code screenshot of the question login id/email please contact us at and our technical experts will provide support within 24 hours. support@dumpsleader.com Copyright The product of each order has its own encryption code, so you should use it independently. Any unauthorized changes will inflict legal punishment. We reserve the right of final explanation for this statement. Fortinet - FCP_FSA_AD-5.0 Valid Questions and Answers 1 of 12 100% Valid Questions - Guaranteed Success A. B. C. D. Category Breakdown Category Number of Questions Deployment and Configuration 3 Integration and Security Fabric 3 High Availability (HA) and Troubleshooting 3 Analysis and Scanning 1 TOTAL 10 Question #:1 - [Deployment and Configuration] Which two statements are true about creating an API interface? (Choose two answers) Ports configured for HA communication can also be configured as API ports. API ports will not accept HTTP traffic. The configuration must be performed using the CLI The interface must also be designated as an administrative interface. Answer: B C Explanation From the , the following is stated: Lab Guide (Exercise 4 - Using Inline Scanning) " FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443. " And the CLI command used: " Enter the following command to enable API access on port2: set api-port port2 " This confirms: Option B is correct: Port 4443 uses — API ports will not accept HTTP traffic. HTTPS only Option C is correct: The API port configuration (set api-port must be performed using the CLI port2), as there is no GUI option for this. Option A is incorrect: The Study Guide states port3 cannot be a management port, and HA communication ports have dedicated roles that are not interchangeable with API ports. Option D is incorrect: The CLI command sets the API port directly without requiring a separate administrative interface designation. Question #:2 - [Integration and Security Fabric] Fortinet - FCP_FSA_AD-5.0 Valid Questions and Answers 2 of 12 100% Valid Questions - Guaranteed Success Review the exhibits. Fortinet - FCP_FSA_AD-5.0 Valid Questions and Answers 3 of 12 100% Valid Questions - Guaranteed Success A. B. C. D. A FortiMail device is integrated with a FortiSandbox device. What is the expected behavior on FortiMail for emails that require FortiSandbox inspection? (Choose one answer) FortiMail will queue emails for up to 5 minutes during URL rating errors before submitting URLs to FortiSandbox FortiMail will queue emails for up to 30 minutes to allow FortiSandbox to finish scanning all attachments and URLs. FortiMail will not send attachments and URLs to FortiSandbox if their rating exists in the local cache. FortiMail will deliver all emails to the destination after the emails pass all local security checks. Answer: B Explanation From the lesson, the Study Guide explicitly states: FortiMail Integration " The Scan timeout value determines how long FortiMail will wait for a response from FortiSandbox. The default is 30 minutes. So, if after 30 minutes FortiSandbox is unable to generate a verdict, FortiMail will release the email to the end user. " " SMTP is a store-and-forward protocol. This allows FortiMail to queue the email while FortiSandbox inspects all submitted samples. FortiMail will release the email only if there is a scan timeout event, or FortiSandbox returns a clean verdict. " Fortinet - FCP_FSA_AD-5.0 Valid Questions and Answers 4 of 12 100% Valid Questions - Guaranteed Success A. B. C. D. The Integration Settings exhibit clearly confirms , and the AV Profile shows both Scan timeout = 30 minutes Attachment analysis and URL analysis are enabled — meaning FortiMail will hold/queue emails for up to 30 minutes while FortiSandbox completes inspection of all attachments and URLs before taking action. Question #:3 - [High Availability (HA) and Troubleshooting] Refer to the exhibit. Which command must you use to configure the worker node? (Choose one answer) hc-worker -a -sI0.50.1.30 -p < password > hc-worker -a -sI0.25.1.50 -p < password > hc-worker -a -sI0.75.1.254 -p < password > hc-worker -a -sI0.25.1.30 -p < password > Answer: B Explanation From the lesson, the Study Guide states: High Availability and Management " You must configure the HA group name, password, and the cluster virtual IP. The worker nodes provide load balancing. The primary node distributes scan jobs to the worker nodes. " Fortinet - FCP_FSA_AD-5.0 Valid Questions and Answers 5 of 12 100% Valid Questions - Guaranteed Success A. B. C. D. " You must configure the HA group name, password, and the virtual IP only on the primary node... Devices will interact with the cluster using this virtual IP. " From the exhibit topology: Cluster Virtual IP address = 10.25.1.50 Primary Node port1 = 10.25.1.30 Secondary Node port1 = 10.25.1.40 Worker Node port1 = 10.75.1.10 The worker node must be configured to point to the , not the individual Cluster Virtual IP (10.25.1.50) primary node IP. This is because worker nodes join the cluster by connecting to the cluster virtual IP address. Therefore the correct command is: hc-worker -a -sI0.25.1.50 -p < password > Question #:4 - [Deployment and Configuration] When configuring wildcard administrator authentication, which two account types can you use? (Choose two answers) LDAP RADIUS TACACS Local Answer: A B Explanation From the lesson, the Study Guide explicitly states: Deployment and System Settings " The default administrator account has a blank password. You should change this as soon as possible for all Fortinet devices. Aside from local accounts, FortiSandbox also supports LDAP, SAML SSO, and RADIUS. " This confirms the supported remote authentication types for FortiSandbox administrator accounts are: LDAP (Option A) # RADIUS (Option B) # SAML SSO (not listed as an option) Fortinet - FCP_FSA_AD-5.0 Valid Questions and Answers 6 of 12 100% Valid Questions - Guaranteed Success A. B. C. D. TACACS (Option C) and (Option D) are not listed as wildcard administrator authentication types in Local the Study Guide. Local accounts are standard administrator accounts, not wildcard authentication, and TACACS is not mentioned as a supported authentication method. Question #:5 - [High Availability (HA) and Troubleshooting] Refer to the exhibit. Which command must you use to configure the FortiSandbox device as the primary node? (Choose one answer) hc-settings -si iport1 -a10.25.1.30 hc-settings -si iport1 -a10.25.1.40 hc-settings -si iport1 -a10.25.1.254 hc-settings -si iport1 -a10.25.1.50 Answer: D Explanation The exhibit labels as the . The Study Guide explains that in HA 10.25.1.50 cluster virtual IP address configuration, “You must configure the HA group name, password, and the virtual IP only on the It also says: primary node.” “You must also configure an external interface for external communication and an IP address that will be used as a virtual IP for the whole cluster. Devices will interact with the cluster using this virtual IP.” That is why the command for the primary node must point to the , not to the individual cluster virtual IP port1 addresses of the primary, secondary, or upstream firewall. In the exhibit, 10.25.1.30 is the primary node’ s own port1 IP, 10.25.1.40 is the secondary node’s port1 IP, and 10.25.1.254 is the network device. The only address that matches the required cluster virtual IP is , so the correct command is 10.25.1.50 hc-settings -si iport1 -a10.25.1.50 Fortinet - FCP_FSA_AD-5.0 Valid Questions and Answers 7 of 12 100% Valid Questions - Guaranteed Success A. B. C. D. A. B. C. D. Question #:6 - [Integration and Security Fabric] Which stage of the Cyber Kill Chain does FortiSandbox and FortiClient EMS integration help to block? (Choose one answer) Delivery Weaponization Reconnaissance Command and control Answer: A Explanation From the lesson, the Study Guide states that FortiSandbox and FortiClient FortiClient EMS Integration EMS integration helps break the kill chain by monitoring all downloads, removable media, mapped network drives, and email client file downloads — intercepting threats at the stage before they can execute Delivery on the endpoint. Additionally, from the section: Attack Methodologies " When a USB is attached to a host protected with FortiClient, FortiClient can send the files on the USB drive to FortiSandbox for analysis, before allowing the — further confirming the stage focus. user access to the files " Delivery Question #:7 - [High Availability (HA) and Troubleshooting] A FortiSandbox VM has been deployed and has been functioning correctly for several months. Suddenly, the system begins rejecting file submissions with an error message indicating a licensing problem. How can you determine, using the CLI, if the license is still valid? (Choose one answer) vm-status hc-setting -1 vm-license -1 status Answer: D Explanation From the lesson, the Study Guide explicitly states: Deployment and System Settings " The status command shows information about the system, including firmware level, device serial number, disk usage, Windows VM status, states of the boot and data disks, and more. For VM appliances, it will also show the FortiSandbox license status. " Fortinet - FCP_FSA_AD-5.0 Valid Questions and Answers 8 of 12 100% Valid Questions - Guaranteed Success A. B. C. D. The key phrase is — making the " For VM appliances, it will also show the FortiSandbox license status " command the correct choice for verifying license validity on a FortiSandbox VM deployment. status While shows installed Windows/Microsoft Office license keys, and shows guest VM vm-license -l vm-status image information, neither directly reports on the FortiSandbox appliance license validity. The status command is the definitive command for checking overall system and license status. Question #:8 - [Deployment and Configuration] To allow access to the FortiSandbox GUI the administrator must configure an IP address and a default gateway. Which two commands must the administrator use to accomplish this task? (Choose two answers) set default-gw < IP Address > set api-port port1 set admin-port port1 set port1-ip < IP address > Answer: A D Explanation From the lesson, the Study Guide explicitly states: Deployment and System Settings " Initial port1 IP configuration must be performed from the console, using the commands shown on this slide. If your management computer is on a separate subnet from FortiSandbox, you must specify a gateway address using the commands shown on this slide. " The two required commands are: set port1-ip — to assign the IP address to port1 for GUI access < IP address > set default-gw — to configure the default gateway so the management computer can < IP Address > reach FortiSandbox from a different subnet Option B (set api-port port1) is for API access configuration, and Option C (set admin-port port1) is not a valid FortiSandbox CLI command for this purpose. Question #:9 - [Analysis and Scanning] Refer to the exhibits. Fortinet - FCP_FSA_AD-5.0 Valid Questions and Answers 9 of 12 100% Valid Questions - Guaranteed Success Fortinet - FCP_FSA_AD-5.0 Valid Questions and Answers 10 of 12 100% Valid Questions - Guaranteed Success A. B. C. D. You are asked to configure a FortiSandbox to leverage the real-time anti-phishing (RTAP) feature. After configuring the scan profile, testing shows that URLs are not being submitted to the RTAP service. What could cause this issue? (Choose one answer) The URL option is not selected as a Web file type. The WEBLink file type is not selected in the profile. The VM scan timeout for URLs should be at least 300 to provide enough time for a FortiGuard response. The URLs are not designated for active content pre-scan. Answer: B Explanation Fortinet - FCP_FSA_AD-5.0 Valid Questions and Answers 11 of 12 100% Valid Questions - Guaranteed Success A. B. C. D. From the lesson, the Study Guide confirms: Results Analysis " The Basic information section shows that, in this case, the file type is WEBLink and the file was submitted by FortiMail. " From the lesson: Scanning and Rating Components " The only exception to this is URL inputs. These inputs are submitted directly to the VM scan engine for sandboxing. " When URLs are submitted to FortiSandbox (from FortiMail or other sources), they are classified as WEBLink file type — which is distinct from the standard file extension shown in the VM Association Web types .url (htm, js, lnk, url). Looking at the exhibits: The VM Association shows — but is NOT listed Web: htm, js, lnk, url WEBLink The Advanced tab shows (green) Real-time Zero-Day Anti-Phishing Service is enabled Despite RTAP being enabled, URLs cannot reach the VM scan stage without being WEBLink explicitly included in the scan profile ' s VM Association Since RTAP operates during VM scanning, if WEBLink is not assigned to a VM in the scan profile, URLs submitted for inspection will never reach the VM, and therefore will never be evaluated by the RTAP service — regardless of RTAP being enabled. Question #:10 - [Integration and Security Fabric] On a FortiClient EMS integrated with FortiSandbox, how can you apply FortiSandbox profile configurations to endpoints even if they are off fabric? (Choose one answer) As part of the fabric connectors configuration As part of an endpoint workgroup configuration As part of the endpoint policy configuration As part of the sandbox profile configuration Answer: C Explanation The FortiClient EMS Integration section is explicit on this point. It says: “You must include the sandbox It then explains how off-fabric handling works: profile in the active endpoint policy.” “FortiClient on- fabric detection rules configured within the policy will classify endpoints as on-fabric or off-fabric. The Profile (Off-Fabric) setting allows you to select a second profile to be applied to endpoints when they are determined to be off-fabric.” Fortinet - FCP_FSA_AD-5.0 Valid Questions and Answers 12 of 12 100% Valid Questions - Guaranteed Success This means the control point for applying FortiSandbox-related behavior to off-fabric endpoints is the , not the fabric connector, not a workgroup, and not the sandbox profile by itself. The endpoint policy sandbox profile defines FortiSandbox behavior, but it must be attached through the active endpoint policy, where the profile selection is made. Therefore, the correct answer is Off-Fabric C. As part of the endpoint policy configuration About dumpsleader.com dumpsleader.com was founded in 2007. We provide latest & high quality IT / Business Certification Training Exam Questions, Study Guides, Practice Tests. We help you pass any IT / Business Certification Exams with 100% Pass Guaranteed or Full Refund. Especially Cisco, CompTIA, Citrix, EMC, HP, Oracle, VMware, Juniper, Check Point, LPI, Nortel, EXIN and so on. View list of all certification exams: All vendors We prepare state-of-the art practice tests for certification exams. You can reach us at any of the email addresses listed below. Sales: sales@dumpsleader.com Feedback: feedback@dumpsleader.com Support: support@dumpsleader.com Any problems about IT certification or our products, You can write us back and we will get back to you within 24 hours.