Fortinet FCP_FSA_AD-5.0 Dumps Questions Answers

From the High Availability and Management lesson, the Study Guide states:

" You use the hc-settings command and options to configure the main HA settings, such as enable HA, and to configure the node ' s mode of operation, node alias, group name, group password, and the HA interface. "

The CLI flags breakdown:

-sc = Set configuration

-t = Node type flag where N = Secondary node

-n = Node alias (SecondaryNode)

-c = Cluster/group name (FSAGrp)

-p = Password

-i = HA interface (port4)

The Study Guide confirms the secondary node type uses -tN designation. Option B (-tM) represents the primary/master node, Option C (-tP) and Option D (-tR) are not valid node type designators for secondary nodes in the FortiSandbox HA CLI syntax.

From the Attack Methodologies lesson, the Study Guide explicitly states:

" During the lateral movement stage, the attacker is trying to compromise and infect other computers in the network. If these computers are protected with FortiClient, FortiClient can send any file that the computer downloads, to FortiSandbox for analysis. "

" FortiDeceptor creates a network of decoys, to lure attackers and monitor their activities on the network. When attackers attack a decoy, an alert is generated. FortiDeceptor engages FortiSandBox to get a verdict on the suspected malware. "

" If you deploy FortiGate as an ISFW firewall, FortiGate can analyze the traffic moving across subnets and send any files to FortiSandbox for analysis to prevent propagation. "

Both FortiDeceptor (Option B) and FortiGate (Option D) are specifically identified as protecting against the lateral movement stage through their FortiSandbox integration.

From the Deployment and System Settings lesson, the Study Guide explicitly states what SIMNET cannot do with real traffic:

" When the malware attempts to download a file, FortiSandbox provides a fake download package. This allows the downloader to successfully execute; however, FortiSandbox cannot run its antivirus inspection on the file. "

" If the malware creates a callback connection to an IP, FortiSandbox cannot rate the IP, to determine if it ' s a botnet server. "

This confirms:

Option A (AV inspection) — Cannot be performed because SIMNET provides fake download packages, preventing real antivirus scanning

Option C (IP reputation) — Cannot be performed because SIMNET uses internal IPs for DNS responses, making IP reputation lookups meaningless against real botnet databases

Dynamic scan and URL rating can still occur inside the sandbox even without real internet access.