Free FCP_FSA_AD-5.0 Practice Test Questions and Answers (2026)

In a FortiSandbox High Availability (HA) cluster, the secondary node must be configured to communicate with the primary node over the dedicated cluster internal communication network. According to the exhibit, port 4 serves as this internal HA communication link, where the primary node operates on the IP address 10.50.1.30. The hc-worker command is utilized on the secondary appliance to join the HA cluster. The command's -s flag specifically designates the primary unit's internal HA IP address to bind the cluster topology. Therefore, the command hc-worker -a -s10.50.1.30 -p correctly targets the primary node's dedicated cluster interface to successfully establish the HA pairing.

Option A: 10.25.1.30 is the primary node's external management interface (port 1) IP, not the dedicated internal HA cluster communication IP required by the command.

Option C: 10.50.1.40 is the secondary node's own port 4 interface IP address, whereas the configuration requires the primary node's IP to join the cluster.

Option D: 10.25.1.50 represents the shared Cluster Virtual IP address (Failover IP) for external client traffic, which cannot be used for internal node synchronization.

Fortinet Document Library, "FortiSandbox 5.0.6 CLI Reference Guide", Section: CLI Reference > HA Cluster > hc-worker.

Fortinet Document Library, "FortiSandbox Public Cloud 5.0.0 Administration Guide", Section: Optional: Using HA cluster > Configuring an HA cluster.

Enabling the pre-filter to check for active content in file types like Office, PDF, URL, and Archives optimizes system throughput by ensuring only files containing embedded executable code (such as macros or scripts) are sent to the dynamic VM scan. Because files without active content are static and incapable of executing malicious behavior, bypassing the VM scan for them maintains a high security level. This drastically reduces the VM queue, allowing the system to rapidly expedite the files that actually require dynamic scanning, thereby minimizing the wait time for end-users waiting for a file access verdict.

A: Disabling "Wait for FortiSandbox Results" severely reduces security. End-users would be granted immediate access to potentially malicious files before a clean verdict is established.

B: Pipeline Mode accelerates processing by scanning multiple files sequentially within the same VM instance. However, this degrades security because residual traces from previous malware samples can cause cross-contamination.

C: Changing the Detection Verdict Level to Medium inherently lowers the system's security posture by allowing the gateway to ignore low-risk threats.

FortiSandbox Best Practices and Troubleshooting Guide: Section: Improving scan performance. The documentation explicitly lists "Turn on FortiSandbox Pre-Filtering of certain file types" as a primary recommendation to optimize overall system throughput.

FortiSandbox Best Practices and Troubleshooting Guide: Section: Enhancing Threat Detection. The guide officially warns against Pipeline Mode for high-security environments, stating: "without restoring the VM clone, there is a slight risk that a previous sample may leave hidden traces... To ensure each sample is scanned in a clean VM environment, it is recommended to disable the sandboxing-pipeline feature."

FortiSandbox Administration Guide: Section: Scan Profile Pre-Filter Tab. Validates that static files without active content can be safely pre-filtered from VM scanning to preserve critical system resources for dynamic execution.

To configure a FortiSandbox unit as a secondary node in a High Availability (HA) cluster, the set-ha slave command must be used. This command designates the device's role as a slave (secondary). It requires specifying the IP address of the primary (master) node using the -n parameter, allowing the secondary to initiate a connection and join the cluster. The command also requires a shared password (-p) for authentication and the dedicated HA interface (-i port4), as specified in the scenario. The primary node is configured separately using the set-ha master command.

A command using set-ha master is incorrect because it configures the device as the primary node, not the secondary node as required by the question.

Any command that omits the primary node's IP address is incorrect, as the secondary node needs this information to connect and join the HA cluster.

Diagnostic commands, such as diagnose-ha status, are incorrect because they are used for viewing the cluster status, not for initial configuration.

1. FortiSandbox 5.0.0 Administration Guide, Page 111, Section: "Configuring the HA cluster". This section explicitly details the CLI commands for setting up the HA cluster. It states: "On the slave unit, enter the following command: set-ha slave -p -n -i ". This directly supports the use of the set-ha slave command for the secondary node.

For FortiSandbox to successfully assign a file to a specific Virtual Machine (VM) for sandboxing analysis, two fundamental conditions must be met. First, the target VM image must be in an 'Activated' state, meaning it is installed, licensed, and ready to accept scan jobs. An uninstalled or inactive VM is not available in the processing pool. Second, the VM must be configured to support the file type in question. This is managed through the 'VM Association' settings, which map file extensions to the VMs equipped with the necessary software (e.g., Microsoft Office for .docx files) to properly execute and analyze the file's behavior.

A. The file has not been scanned before.

This is incorrect. FortiSandbox allows users to manually resubmit files for analysis, even if they have a previous scan result. This is useful for testing against updated VM images or signatures.

D. The file was submitted by an administrator.

This is incorrect. While user permissions are required to submit files, the action is not restricted to the super administrator account. Other user profiles can be granted permission to submit files for on-demand scanning.

1. FortiSandbox 5.0 Administration Guide, Page 43, "Scan Policy & Object > VM Association"

Quote: "You can associate file types with specific VMs for scanning. For a file to be scanned by a specific VM, the file type must be enabled in the VM Association page and the VM must be activated." This statement directly confirms that both the VM's activated status and its support for the file type are mandatory conditions.

2. FortiSandbox 5.0 Administration Guide, Page 107, "VM Images"

Content: This section describes the various statuses of VM images, including "Not installed", "Initializing", and "Activated". It clarifies that only VMs in the "Activated" state are operational and available for sandboxing tasks. This supports the requirement for an activated VM.

3. FortiSandbox 5.0 Administration Guide, Page 28, "Scan Input > On-Demand"

Content: The "File On-Demand" feature allows users to submit files and optionally select a specific VM for scanning. The dropdown list of available VMs only populates with those that are currently activated, reinforcing that activation is a prerequisite for assignment.

The FortiSandbox SIMNET is a closed, simulated network environment designed to analyze malware behavior safely. The virtual machines (VMs) running within this environment do not have direct, live access to the internet. Instead, SIMNET intercepts all network traffic and provides simulated responses to trick the malware into executing its payload.

Consequently, any inspection that requires a real-time query to a live, external cloud service cannot be performed on the traffic generated by the malware. Both Web Filtering (which queries the FortiGuard URL category database) and modern Antivirus (which often uses cloud-based lookups for the latest threat intelligence) rely on such external connectivity. While FortiSandbox uses these services for its own updates and static analysis, it cannot perform these specific inspections live on the malware's traffic from within the isolated SIMNET.

B. Protocol decoding: This is a local analysis of the structure and content of network packets generated by the malware. It is a fundamental process performed within FortiSandbox and does not require external connectivity.

D. Botnet C&C inspection: Detecting botnet command-and-control (C&C) communication is a primary function of SIMNET. The system is explicitly designed to simulate C&C servers to elicit and analyze this malicious behavior.

1. FortiSandbox 5.0 Administration Guide, Page 10, Section: "Network connections".

The document states: "The guest VMs do not have direct Internet access. Instead, a simulated network (SimNet) is used to mimic a real network and the Internet." This directly supports the reasoning that inspections requiring live internet access, such as real-time web filtering and AV cloud lookups, are not possible from the guest VM.

2. FortiSandbox 5.0 Administration Guide, Page 10, Section: "Network connections".

It further explains: "FortiSandbox intercepts network traffic from the guest VM and interacts with the malware. For example, if the malware makes a DNS request, FortiSandbox will respond with a simulated IP address." This confirms that services are simulated, not passed through to real servers, making live external inspections impossible.

When creating an API user in FortiSIEM, two key configuration steps are required for security and multi-tenancy. First, the administrator must define the specific source IP addresses or subnets that are permitted to send API requests to the interface. This acts as a network-level access control list. Second, in a multi-tenant deployment, the API user can and should be associated with a specific organization. This ensures that the API key only has access to the data and resources belonging to that designated organization, enforcing data segregation and the principle of least privilege.

C. API interfaces use a system-generated API key and a secret (labeled API Password), not a traditional interactive username and password combination for authentication.

D. While the super/global user can create any API user, an administrative user with sufficient privileges can also create an API user scoped to their own organization.

1. FortiSIEM 5.2.5 Administration Guide, Page 51, "Creating an API User".

The guide provides a screenshot and description of the "New API User" dialog box. It explicitly shows the "Organization" dropdown menu, confirming that an API user can be assigned to a specific organization.

The same section details the "Allowed IPs" field, stating, "Enter the IP addresses that are allowed to access the API," which confirms the requirement for IP-based access control.

2. FortiSIEM 6.3.0 Administration Guide, "Creating API Users" section.

This document reinforces the same principles: "From the Organization drop-down list, select the organization that this API user will belong to."

It also states, "In the Allowed IPs field, enter the IP addresses that are allowed to access the API." This directly supports both correct answers.

The guide also clarifies authentication: "FortiSIEM will generate an API Key and API Password for this user," distinguishing it from standard password authentication.

The get system vm-license command is the most specific and appropriate CLI command to determine the validity and detailed status of a FortiSandbox VM license. This command displays comprehensive information, including the license status (e.g., valid, invalid, expired), the exact expiry date, the VM's unique universal identifier (UUID), and the associated FortiCare account ID. This level of detail is essential for troubleshooting the exact cause of a licensing problem, which is the scenario described in the question.

A. get system status: While this command includes a summary line for the VM license, it is less detailed and not the primary command for license-specific troubleshooting.

B. diagnose-debug vminfo: This is not a valid FortiSandbox command for checking license status. diagnose commands are generally used for real-time debugging, not for retrieving static license information.

C. get vm-license status: This command uses an incorrect syntax. In the FortiSandbox CLI hierarchy, license information is managed under the system object.

1. FortiSandbox 5.0 CLI Reference Guide, Page 118.

Command: get system vm-license

Description: "Display VM license information."

Details: The documentation shows that the output of this command includes fields such as status, expirydate, warningdate, and vmuuid, which directly address the question of license validity and troubleshooting.

2. FortiSandbox 5.0 CLI Reference Guide, Page 101.

Command: get system status

Details: The sample output for this command shows a line item VM License: Valid. This confirms it can show the status, but it lacks the detailed information (like expiry date) provided by get system vm-license, making the latter the superior choice for troubleshooting.

The fortisandboxd daemon is the dedicated process on a FortiGate unit responsible for managing all communications with a connected FortiSandbox appliance or FortiSandbox Cloud. Its functions include submitting suspicious files for analysis and, critically, receiving the resulting verdicts. An administrator can monitor this daemon in real time using CLI debug commands (diagnose debug application fortisandboxd -1) to observe the communication flow and verify that verdicts are being successfully received and processed. This makes it the correct daemon to monitor for this specific purpose.

A. scanunitd: This is the antivirus engine daemon. It performs local file scanning and can flag a file for sandboxing, but it does not handle receiving the verdict from FortiSandbox.

C. ipsengine: This daemon is responsible for the Intrusion Prevention System (IPS). It processes network traffic against attack signatures and is unrelated to file sandboxing verdicts.

D. wad: The Web Application Daemon (WAD) processes web proxy and web filter traffic. While it may be the process that initially sends a file for inspection, fortisandboxd manages the verdict communication.

---

1. Fortinet FortiOS 7.0.0 CLI Reference:

Page 1010: Under the diagnose debug application command section, the daemon fortisandboxd is listed with the description "FortiSandbox daemon." This officially identifies the specific process for FortiSandbox integration.

2. Fortinet Knowledge Base - Technical Tip (FD36107):

Title: Troubleshooting Tip: FortiGate and FortiSandbox integration

Section: "On FortiGate"

Content: This official troubleshooting guide explicitly instructs administrators to use the command diagnose debug application fortisandboxd -1 to debug the FortiSandbox process. The sample output shows the daemon handling file submissions and receiving job status updates, which include the final verdicts.

3. FortiSandbox 4.2 Administration Guide:

Page 110: In the "FortiGate Integration" chapter, the guide details the workflow where FortiGate sends files and receives results. It states, "When FortiSandbox completes the scan, the results are sent to the FortiGate." The fortisandboxd daemon is the process on the FortiGate that facilitates this documented exchange.

As a best practice in FortiSandbox, FortiClient job inputs should be ranked lowest in the job queue priority, effectively after all other input methods. High-priority queues must be reserved for highly time-sensitive sources like On-Demand user submissions, FortiGate InlineBlock, and FortiMail. These systems actively hold live network traffic or delay email delivery while waiting for a verdict; delaying them causes severe network latency, connection timeouts, or a poor user experience. Conversely, FortiClient operates at the endpoint level, where the file has already been downloaded to the local host disk. The FortiClient agent can safely quarantine or restrict the file locally while waiting for the background sandbox verdict, making it the least time-sensitive input source.

Option A: Placing FortiClient before FortiGate would delay inline network traffic waiting for a verdict, unnecessarily increasing network latency and causing connection timeouts.

Option C: This incorrectly prioritizes local endpoint background scans over active network traffic held by FortiGate inline blocking, which directly degrades real-time network performance.

Option D: Prioritizing FortiClient above all others disrupts live network traffic, email delivery, and administrator-initiated on-demand scans that are highly time-sensitive.

Fortinet. FortiSandbox 5.0.6 Administration Guide, Document ID: 637808, Section: Job Priority.

Fortinet. FortiSandbox 5.0 Best Practices Guide, Document ID: 484751, Section: Advanced procedures (Improving scan performance).

The diagnose test application fortisandbox command suite is the primary tool for troubleshooting FortiGate-to-FortiSandbox connectivity and service issues. It provides a set of specific tests to verify the service status, test network connectivity to the FortiSandbox appliance, display statistics about submitted files, and even inject a test file to confirm the end-to-end process. When a FortiGate is not sending samples, running these tests provides direct, actionable diagnostic information to identify the point of failure, whether it is a network issue, a service daemon problem, or a misconfiguration.

(Assuming plausible incorrect options for a question of this type)

A. get system fortisandbox status: This command typically displays static configuration settings rather than real-time diagnostic or status information needed for active troubleshooting.

B. diagnose debug application fgtqd -1: This command enables debugging for the FortiGuard Query Daemon (fgtqd), which is incorrect. The daemon responsible for FortiSandbox communication is fortisandboxd or fsaed.

C. execute ping : While this command can verify basic Layer 3 network connectivity, it does not confirm that the FortiSandbox application service is running, reachable, or properly configured on the specified port.

1. FortiGate CLI Reference: The diagnose test application fortisandbox command is documented as a specific tool for this purpose. The guide details the available options for testing.

Source: Fortinet FortiOS 7.0.5 CLI Reference, Page 1001.

Details: "Use this command to test the FortiSandbox application." The document lists options such as 1 (Display FSA service status), 2 (Test FSA connectivity), and 4 (Display FSA statistics).

2. FortiSandbox Administration Guide: The integration section often provides troubleshooting steps for connected devices, highlighting the use of specific diagnostic commands on the FortiGate.

Source: FortiSandbox 4.4 Administration Guide, Page 103, "Troubleshooting".

Details: The guide recommends checking the connection from the network device (FortiGate) using its specific CLI commands. It states, "On FortiGate, use the CLI command diagnose test application fortisandbox to check the FortiSandbox connection status."