Important Fortinet FCP_FSA_AD-5.0 Exam Questions

Answer: A

Explanation:

The FortiSandbox 5.0 Administrator Lab Guide explicitly states during the inline scanning configuration: ''FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443.'' In the same exercise, the guide has you enable API access on port2 specifically so inline scanning can function, which confirms that the integration depends on FortiGate reaching FortiSandbox over TCP/4443.

In this scenario, the intermediate firewall currently allows TCP/3389, UDP/53, and TCP/443, but not TCP/4443. That is why inline scanning stopped working after the redesign. TCP/443 is not sufficient here because the documented FortiGate-to-FortiSandbox inline communication port is 4443, not standard HTTPS 443. The other ports in the options do not match the inline-scanning communication requirement described in the uploaded lab materials. Therefore, the required fix is to allow FortiGate access to FortiSandbox on TCP/4443.

Answer: A, B

Explanation:

From the Deployment and System Settings lesson, the Study Guide explicitly states:

'The default administrator account has a blank password. You should change this as soon as possible for all Fortinet devices. Aside from local accounts, FortiSandbox also supports LDAP, SAML SSO, and RADIUS.'

This confirms the supported remote authentication types for FortiSandbox administrator accounts are:

LDAP (Option A)

RADIUS (Option B)

SAML SSO (not listed as an option)

TACACS (Option C) and Local (Option D) are not listed as wildcard administrator authentication types in the Study Guide. Local accounts are standard administrator accounts, not wildcard authentication, and TACACS is not mentioned as a supported authentication method.

Answer: A

Explanation:

From the FortiClient EMS Integration lesson, the Study Guide states that FortiSandbox and FortiClient EMS integration helps break the kill chain by monitoring all downloads, removable media, mapped network drives, and email client file downloads --- intercepting threats at the Delivery stage before they can execute on the endpoint.

Additionally, from the Attack Methodologies section: 'When a USB is attached to a host protected with FortiClient, FortiClient can send the files on the USB drive to FortiSandbox for analysis, before allowing the user access to the files' --- further confirming the Delivery stage focus.

Answer: C, D

Explanation:

From the Deployment and System Settings lesson, the Study Guide states:

'You can submit emails from an upstream MTA server to FortiSandbox using a BCC adapter. FortiSandbox will extract attachment files and URLs in an email body.'

For a BCC adapter to function correctly, two critical prerequisites must be in place:

Option C --- The upstream SEG must be configured to BCC emails to a FortiSandbox sub-domain so that email copies are routed to FortiSandbox for analysis

Option D --- An MX record must be added to the DNS server for the BCC email sub-domain, so that the sub-domain resolves to the FortiSandbox IP address, allowing the SEG to properly deliver BCC email copies

Option A is incorrect because the BCC adapter handles full email inspection --- FortiSandbox itself extracts files and URLs rather than the SEG doing this. Option B is incorrect because an MX record (not just an A record) is the required DNS configuration for email routing.

Answer: B

Explanation:

From the Scanning and Rating Components lesson, the Study Guide explicitly states:

'VM images are downloaded from FortiGuard, using port1. So, you must ensure FortiSandbox has a default route and internet connectivity for port1.'

The exhibit confirms this --- the test-network output shows:

System DNS resolve: Failed for both bing.com and fsavm.fortinet.net

fsavm.fortinet.net is the FortiGuard VM image download server

This DNS failure on the system side (port1) confirms there is no internet connectivity on port1, preventing VM image downloads. Note that port3 internet shows 'Warning: VM to access internet: Disabled' --- but port3 is only for VM sandboxing traffic, not for downloading VM images.