FCP_FSA_AD-5.0 FCP - FortiSandbox 5.0 Administrator Questions and Answers

The Study Guide explains the default behavior first: “You must authorize FortiClient EMS on FortiSandbox. FortiSandbox automatically authorizes all FortiClient endpoints managed by an authorized FortiClient EMS.” It then adds the key point for this question: “To change the default FortiClient authorization behavior, use the command shown on this slide to authorize FortiClient endpoints using FortiSandbox CLI. By default, FortiClient inherits its authorization status from the managing EMS or FortiGate.”

Because the question specifically shows the CLI command set device-authorization -a , it is asking about the behavior after changing the default . The default inheritance model described in option A applies before the override. After this command, FortiSandbox is set to authorize FortiClient endpoints directly and automatically , which makes C the correct answer. Option B is incorrect because the command is specifically about FortiClient endpoints , not other devices in general. Option D is too broad and does not match the Study Guide’s explanation, which is limited to FortiClient authorization behavior.

From the FortiClient EMS Integration lesson, the Study Guide explicitly states:

" It is always a good idea to place the files that are submitted by FortiClient, high on the Job Queue Priority since these are files that end users need immediate access to. In most cases, end users might not be willing to wait for a long time to access these files and placing the FortiClient submitted files high on the Job Queue Priority ensures that these files receive high priority for scanning from FortiSandbox. "

Looking at the exhibit, the Job Priority Configuration shows:

Positions 1-4: On-Demand inputs (highest priority)

Position 5: FortiGate InlineBlock

Positions 6-11: Other sources including FortiWeb, File RPC, Device, FortiClient

As a best practice, FortiClient should rank after On-Demand (positions 1-4) but before FortiGate inputs — since end users need immediate file access, FortiClient submissions should be near the top but On-Demand scanning takes highest precedence.

From the Deployment and System Settings lesson, the Study Guide explicitly states:

" Initial port1 IP configuration must be performed from the console, using the commands shown on this slide. If your management computer is on a separate subnet from FortiSandbox, you must specify a gateway address using the commands shown on this slide. "

The two required commands are:

set port1-ip < IP address > — to assign the IP address to port1 for GUI access

set default-gw < IP Address > — to configure the default gateway so the management computer can reach FortiSandbox from a different subnet

Option B (set api-port port1) is for API access configuration, and Option C (set admin-port port1) is not a valid FortiSandbox CLI command for this purpose.

From the Deployment and System Settings lesson, the Study Guide explicitly states:

" The status command shows information about the system, including firmware level, device serial number, disk usage, Windows VM status, states of the boot and data disks, and more. For VM appliances, it will also show the FortiSandbox license status. "

The key phrase is " For VM appliances, it will also show the FortiSandbox license status " — making the status command the correct choice for verifying license validity on a FortiSandbox VM deployment.

While vm-license -l shows installed Windows/Microsoft Office license keys, and vm-status shows guest VM image information, neither directly reports on the FortiSandbox appliance license validity. The status command is the definitive command for checking overall system and license status.

The Study Guide is explicit about the FortiMail–FortiSandbox workflow. It states: “On top of file submissions, FortiMail can also submit extracted URLs from emails to FortiSandbox for inspection. FortiMail queues the email while waiting for a verdict. FortiSandbox inspects all submitted files and URLs. FortiSandbox then generates a verdict and sends that verdict in reply to FortiMail. FortiMail uses the verdict to apply the configured action.”

This directly supports D because FortiSandbox analyzes file and URL objects . It supports B because FortiSandbox generates a verdict and returns it to FortiMail. And it supports E because the integrated workflow includes the email being queued during analysis while FortiSandbox is processing the submitted objects. Option C is incorrect because FortiMail is the device that submits the objects to FortiSandbox, not FortiSandbox itself. Option A is also incorrect because updating FortiGuard databases is not one of the three ATP integration actions described for the FortiMail workflow. Therefore, the correct three answers are B, D, and E .

From the Results Analysis lesson, the Study Guide confirms:

" The Basic information section shows that, in this case, the file type is WEBLink and the file was submitted by FortiMail. "

From the Scanning and Rating Components lesson:

" The only exception to this is URL inputs. These inputs are submitted directly to the VM scan engine for sandboxing. "

When URLs are submitted to FortiSandbox (from FortiMail or other sources), they are classified as WEBLink file type — which is distinct from the standard .url file extension shown in the VM Association Web types (htm, js, lnk, url).

Looking at the exhibits:

The VM Association shows Web: htm, js, lnk, url — but WEBLink is NOT listed

The Advanced tab shows Real-time Zero-Day Anti-Phishing Service is enabled (green)

Despite RTAP being enabled, URLs cannot reach the VM scan stage without WEBLink being explicitly included in the scan profile ' s VM Association

Since RTAP operates during VM scanning, if WEBLink is not assigned to a VM in the scan profile, URLs submitted for inspection will never reach the VM, and therefore will never be evaluated by the RTAP service — regardless of RTAP being enabled.

From the High Availability and Management lesson, the Study Guide states:

" You must configure the HA group name, password, and the cluster virtual IP. The worker nodes provide load balancing. The primary node distributes scan jobs to the worker nodes. "

" You must configure the HA group name, password, and the virtual IP only on the primary node... Devices will interact with the cluster using this virtual IP. "

From the exhibit topology:

Cluster Virtual IP address = 10.25.1.50

Primary Node port1 = 10.25.1.30

Secondary Node port1 = 10.25.1.40

Worker Node port1 = 10.75.1.10

The worker node must be configured to point to the Cluster Virtual IP (10.25.1.50) , not the individual primary node IP. This is because worker nodes join the cluster by connecting to the cluster virtual IP address.

Therefore the correct command is: hc-worker -a -sI0.25.1.50 -p < password >

From the Deployment and System Settings lesson, the Study Guide states:

" Other ports, with the exception of port3, can also be configured as management ports from CLI. "

" You can set additional ports as management port using the CLI command shown on this slide. "

From the Lab Guide (Exercise 4 - Using Inline Scanning) :

" FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443. "

" Enter the following command to enable API access on port2: set api-port port2 "

Ports that are designated as either administration interfaces or API interfaces cannot be selected for 802.3ad aggregate bonding because:

Option A — Port 4 configured as an administration interface is reserved for management traffic and cannot be repurposed for link aggregation

Option C — Port 4 configured as an API interface is dedicated for API communication (port 4443) and is similarly restricted from being used in aggregate bonding configurations

Port 4 in the Lab Guide is specifically referenced as the HA communication and management port, confirming these restrictions apply when special roles are assigned to interfaces.

From the Scanning and Rating Components lesson, the Study Guide explicitly states:

" The Pipeline Mode feature improves performance by allowing to scan multiple files, one at a time, without shutting down the VM instance after scanning each file. "

" FortiSandbox will continue scanning files without shutting down the VM instance, as long as the VM status hasn ' t changed. If the VM status changes, then the VM instance will shut down and will be restored for the next job. "

This precisely matches the requirement — using one VM instance for multiple sequential scan jobs without shutting down between submissions. The other options serve different purposes:

Adaptive Scan dynamically adjusts clone numbers

VM Scan Ratio controls the percentage of jobs scanned in a VM

Parallel VM Scan runs multiple VMs simultaneously for a single job