Fortinet FCP_FSA_AD-5.0 Exam Dumps

From the Deployment and System Settings lesson, the Study Guide explicitly states what SIMNET cannot do with real traffic:

'When the malware attempts to download a file, FortiSandbox provides a fake download package. This allows the downloader to successfully execute; however, FortiSandbox cannot run its antivirus inspection on the file.'

'If the malware creates a callback connection to an IP, FortiSandbox cannot rate the IP, to determine if it's a botnet server.'

This confirms:

Option A (AV inspection) --- Cannot be performed because SIMNET provides fake download packages, preventing real antivirus scanning

Option C (IP reputation) --- Cannot be performed because SIMNET uses internal IPs for DNS responses, making IP reputation lookups meaningless against real botnet databases

Dynamic scan and URL rating can still occur inside the sandbox even without real internet access.

From the FortiGate Integration lesson, the Study Guide explicitly states:

'The quarantine daemon is involved in submitting files to FortiSandbox.'

From the Lab Guide (Exercise 3 - Using FortiGate Diagnostics), the following is explicitly documented:

'Enter the following commands to enable debugging for the quarantine daemon: diagnose debug application quarantine -1 diagnose debug enable'

'Use the following CLI debug command to diagnose the connection and file transfer issue between HQ-FGT-1 and HQ-FSA-1: diagnose debug application quarantine -1'

This command enables real-time debug output for the quarantine daemon on FortiGate, which is specifically responsible for submitting files to FortiSandbox and receiving verdicts. Option B clears the analytics cache rather than providing diagnostic information, and the other options relate to different functions entirely.

From the Deployment and System Settings lesson, the Study Guide states:

'Other ports, with the exception of port3, can also be configured as management ports from CLI.'

'You can set additional ports as management port using the CLI command shown on this slide.'

From the Lab Guide (Exercise 4 - Using Inline Scanning):

'FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443.'

'Enter the following command to enable API access on port2: set api-port port2'

Ports that are designated as either administration interfaces or API interfaces cannot be selected for 802.3ad aggregate bonding because:

Option A --- Port 4 configured as an administration interface is reserved for management traffic and cannot be repurposed for link aggregation

Option C --- Port 4 configured as an API interface is dedicated for API communication (port 4443) and is similarly restricted from being used in aggregate bonding configurations

Port 4 in the Lab Guide is specifically referenced as the HA communication and management port, confirming these restrictions apply when special roles are assigned to interfaces.

From the FortiMail Integration lesson, the Study Guide explicitly states:

'The Scan timeout value determines how long FortiMail will wait for a response from FortiSandbox. The default is 30 minutes. So, if after 30 minutes FortiSandbox is unable to generate a verdict, FortiMail will release the email to the end user.'

'SMTP is a store-and-forward protocol. This allows FortiMail to queue the email while FortiSandbox inspects all submitted samples. FortiMail will release the email only if there is a scan timeout event, or FortiSandbox returns a clean verdict.'

The Integration Settings exhibit clearly confirms Scan timeout = 30 minutes, and the AV Profile shows both Attachment analysis and URL analysis are enabled --- meaning FortiMail will hold/queue emails for up to 30 minutes while FortiSandbox completes inspection of all attachments and URLs before taking action.

The Study Guide states that HA is configured from the CLI and that ''the main HA cluster CLI commands are hc-settings, hc-slave, and hc-status''. It also explains that ''You use the hc-settings command and options to configure the main HA settings... node alias, group name, group password, and the HA interface.'' The same HA section further says that the primary and secondary nodes must have a dedicated HA communication interface, and specifically notes that ''port4 in this example'' is the HA interface between them.

On the primary-node example configuration shown on page 137 of the uploaded study guide, the command uses -tM for the primary node with -iport4 for the HA interface. That directly matches option D. The other options use different node-type flags and do not correspond to the primary-node example. Therefore, the correct command is hc-settings -sc -tM -nPrimaryNode -cFSAGrp -p -iport4.