FCP_FSA_AD-5.0 Online Practice Questions

Explanation:
From the Scanning and Rating Components lesson, the Study Guide explicitly states:
"The second section of the Scan Profile, VM Association, allows you to define file extensions and VM image associations. This means that specific files are sandboxed by the associated VM image.
To assign a file to a VM image, the following conditions must be true:
The file type must be configured to enter the job queue (first section of the scan profile).
The VM image clone value cannot be a non-zero number."
This directly confirms:
Option B ― The VM image clone value must be a non-zero number (clones must be allocated)
Option C ― The file type must be configured to enter the job queue via the scan profile Pre-Filter section
Options A and D, while potentially relevant in practice, are not listed as the two required conditions in the Study Guide.

Explanation:
From the Deployment and System Settings lesson, the Study Guide states:
"Other ports, with the exception of port3, can also be configured as management ports from CLI." "You can set additional ports as management port using the CLI command shown on this slide." From the Lab Guide (Exercise 4 - Using Inline Scanning):
"FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443."
"Enter the following command to enable API access on port2: set api-port port2"
Ports that are designated as either administration interfaces or API interfaces cannot be selected for

Explanation:
From the Scanning and Rating Components lesson, the Study Guide explicitly states:
"VM images are downloaded from FortiGuard, using port1. So, you must ensure FortiSandbox has a default route and internet connectivity for port1."
The exhibit confirms this ― the test-network output shows:
System DNS resolve: Failed for both bing.com and fsavm.fortinet.net fsavm.fortinet.net is the FortiGuard VM image download server
This DNS failure on the system side (port1) confirms there is no internet connectivity on port1, preventing VM image downloads. Note that port3 internet shows "Warning: VM to access internet: Disabled" ― but port3 is only for VM sandboxing traffic, not for downloading VM images.

Explanation:
From the Attack Methodologies lesson, the Study Guide explicitly states:
"During the lateral movement stage, the attacker is trying to compromise and infect other computers in the network. If these computers are protected with FortiClient, FortiClient can send any file that the computer downloads, to FortiSandbox for analysis."
"FortiDeceptor creates a network of decoys, to lure attackers and monitor their activities on the network. When attackers attack a decoy, an alert is generated. FortiDeceptor engages FortiSandBox to get a verdict on the suspected malware."
"If you deploy FortiGate as an ISFW firewall, FortiGate can analyze the traffic moving across subnets and send any files to FortiSandbox for analysis to prevent propagation."
Both FortiDeceptor (Option B) and FortiGate (Option D) are specifically identified as protecting against the lateral movement stage through their FortiSandbox integration.

Explanation:
From the FortiClient EMS Integration lesson, the Study Guide explicitly states:
"It is always a good idea to place the files that are submitted by FortiClient, high on the Job Queue Priority since these are files that end users need immediate access to. In most cases, end users might not be willing to wait for a long time to access these files and placing the FortiClient submitted files high on the Job Queue Priority ensures that these files receive high priority for scanning from FortiSandbox."
Looking at the exhibit, the Job Priority Configuration shows:
Positions 1-4: On-Demand inputs (highest priority)
Position 5: FortiGate InlineBlock
Positions 6-11: Other sources including FortiWeb, File RPC, Device, FortiClient
As a best practice, FortiClient should rank after On-Demand (positions 1-4) but before FortiGate inputs ― since end users need immediate file access, FortiClient submissions should be near the top but On-Demand scanning takes highest precedence.