Get Fortinet FCP_FSA_AD-5.0 Exam Practice Questions - Real and Updated

Answer : B

The best answer is B. enable Pipeline Mode. The FortiSandbox 5.0 Administrator Study Guide states: ''The Pipeline Mode feature improves performance by allowing to scan multiple files, one at a time, without shutting down the VM instance after scanning each file.'' It further explains that ''FortiSandbox will continue scanning files without shutting down the VM instance, as long as the VM status hasn't changed.'' This directly improves the throughput of dynamic VM-based scanning, which is exactly what the question asks for.

The other options do not fit as well. Option A would reduce waiting time for users, but it lowers security because files could be accessed before a sandbox verdict is returned; the EMS lab profile intentionally enables ''Wait for FortiSandbox Results before Allowing File Access'' with a Low detection level to maintain strong protection. Option C also weakens security by making remediation apply only when the verdict ''equals or exceeds the selected FortiSandbox Detection Verdict Level,'' so raising it to Medium would ignore Low-risk detections. Option D enables prefiltering logic, which can reduce submissions, but it does not directly accelerate jobs that already require dynamic scanning. Therefore, Pipeline Mode is the only choice that both preserves a high security level and speeds dynamic scan processing.

Answer : A, B

From the Deployment and System Settings lesson, the Study Guide explicitly states:

'The default administrator account has a blank password. You should change this as soon as possible for all Fortinet devices. Aside from local accounts, FortiSandbox also supports LDAP, SAML SSO, and RADIUS.'

This confirms the supported remote authentication types for FortiSandbox administrator accounts are:

LDAP (Option A)

RADIUS (Option B)

SAML SSO (not listed as an option)

TACACS (Option C) and Local (Option D) are not listed as wildcard administrator authentication types in the Study Guide. Local accounts are standard administrator accounts, not wildcard authentication, and TACACS is not mentioned as a supported authentication method.

Answer : D

The exhibit labels 10.25.1.50 as the cluster virtual IP address. The Study Guide explains that in HA configuration, ''You must configure the HA group name, password, and the virtual IP only on the primary node.'' It also says: ''You must also configure an external interface for external communication and an IP address that will be used as a virtual IP for the whole cluster. Devices will interact with the cluster using this virtual IP.''

That is why the command for the primary node must point to the cluster virtual IP, not to the individual port1 addresses of the primary, secondary, or upstream firewall. In the exhibit, 10.25.1.30 is the primary node's own port1 IP, 10.25.1.40 is the secondary node's port1 IP, and 10.25.1.254 is the network device. The only address that matches the required cluster virtual IP is 10.25.1.50, so the correct command is hc-settings -si iport1 -a10.25.1.50.

Answer : A, C

From the Deployment and System Settings lesson, the Study Guide states:

'Other ports, with the exception of port3, can also be configured as management ports from CLI.'

'You can set additional ports as management port using the CLI command shown on this slide.'

From the Lab Guide (Exercise 4 - Using Inline Scanning):

'FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443.'

'Enter the following command to enable API access on port2: set api-port port2'

Ports that are designated as either administration interfaces or API interfaces cannot be selected for 802.3ad aggregate bonding because:

Option A --- Port 4 configured as an administration interface is reserved for management traffic and cannot be repurposed for link aggregation

Option C --- Port 4 configured as an API interface is dedicated for API communication (port 4443) and is similarly restricted from being used in aggregate bonding configurations

Port 4 in the Lab Guide is specifically referenced as the HA communication and management port, confirming these restrictions apply when special roles are assigned to interfaces.

Answer : C

The Study Guide explains the default behavior first: ''You must authorize FortiClient EMS on FortiSandbox. FortiSandbox automatically authorizes all FortiClient endpoints managed by an authorized FortiClient EMS.'' It then adds the key point for this question: ''To change the default FortiClient authorization behavior, use the command shown on this slide to authorize FortiClient endpoints using FortiSandbox CLI. By default, FortiClient inherits its authorization status from the managing EMS or FortiGate.''

Because the question specifically shows the CLI command set device-authorization -a, it is asking about the behavior after changing the default. The default inheritance model described in option A applies before the override. After this command, FortiSandbox is set to authorize FortiClient endpoints directly and automatically, which makes C the correct answer. Option B is incorrect because the command is specifically about FortiClient endpoints, not other devices in general. Option D is too broad and does not match the Study Guide's explanation, which is limited to FortiClient authorization behavior.