FCP_FSA_AD-5.0 FCP - FortiSandbox 5.0 Administrator Questions and Answers

From the Scanning and Rating Components lesson, the Study Guide explicitly states:

" The second section of the Scan Profile, VM Association, allows you to define file extensions and VM image associations. This means that specific files are sandboxed by the associated VM image. To assign a file to a VM image, the following conditions must be true:

The file type must be configured to enter the job queue (first section of the scan profile).

The VM image clone value cannot be a non-zero number. "

This directly confirms:

Option B — The VM image clone value must be a non-zero number (clones must be allocated)

Option C — The file type must be configured to enter the job queue via the scan profile Pre-Filter section

Options A and D, while potentially relevant in practice, are not listed as the two required conditions in the Study Guide.

From the High Availability and Management lesson, the Study Guide states:

" You must configure the HA group name, password, and the virtual IP only on the primary node. After you configure those, you can add the secondary node to the group using the commands shown on this slide. "

The hc-slave command (shown as hc-worker for secondary) requires pointing to the Primary Node ' s HA interface IP , not the cluster virtual IP or the primary node ' s port1.

From the exhibit:

Primary Node port4 (HA interface) = 10.50.1.30

Secondary Node port4 = 10.50.1.40

Primary Node port1 = 10.25.1.30

Cluster Virtual IP = 10.25.1.50

The secondary node must connect to the Primary Node ' s dedicated HA communication port (port4 = 10.50.1.30) to join the cluster, making Option B the correct answer.

From the Deployment and System Settings lesson, the Study Guide explicitly states:

" The default administrator account has a blank password. You should change this as soon as possible for all Fortinet devices. Aside from local accounts, FortiSandbox also supports LDAP, SAML SSO, and RADIUS. "

This confirms the supported remote authentication types for FortiSandbox administrator accounts are:

LDAP (Option A) ✓

RADIUS (Option B) ✓

SAML SSO (not listed as an option)

TACACS (Option C) and Local (Option D) are not listed as wildcard administrator authentication types in the Study Guide. Local accounts are standard administrator accounts, not wildcard authentication, and TACACS is not mentioned as a supported authentication method.

The FortiClient EMS Integration section is explicit on this point. It says: “You must include the sandbox profile in the active endpoint policy.” It then explains how off-fabric handling works: “FortiClient on-fabric detection rules configured within the policy will classify endpoints as on-fabric or off-fabric. The Profile (Off-Fabric) setting allows you to select a second profile to be applied to endpoints when they are determined to be off-fabric.”

This means the control point for applying FortiSandbox-related behavior to off-fabric endpoints is the endpoint policy , not the fabric connector, not a workgroup, and not the sandbox profile by itself. The sandbox profile defines FortiSandbox behavior, but it must be attached through the active endpoint policy, where the Off-Fabric profile selection is made. Therefore, the correct answer is C. As part of the endpoint policy configuration .

From the Deployment and System Settings lesson, the Study Guide explicitly states:

" The status command shows information about the system, including firmware level, device serial number, disk usage, Windows VM status, states of the boot and data disks, and more. For VM appliances, it will also show the FortiSandbox license status. "

The key phrase is " For VM appliances, it will also show the FortiSandbox license status " — making the status command the correct choice for verifying license validity on a FortiSandbox VM deployment.

While vm-license -l shows installed Windows/Microsoft Office license keys, and vm-status shows guest VM image information, neither directly reports on the FortiSandbox appliance license validity. The status command is the definitive command for checking overall system and license status.

The exhibit labels 10.25.1.50 as the cluster virtual IP address . The Study Guide explains that in HA configuration, “You must configure the HA group name, password, and the virtual IP only on the primary node.” It also says: “You must also configure an external interface for external communication and an IP address that will be used as a virtual IP for the whole cluster. Devices will interact with the cluster using this virtual IP.”

That is why the command for the primary node must point to the cluster virtual IP , not to the individual port1 addresses of the primary, secondary, or upstream firewall. In the exhibit, 10.25.1.30 is the primary node’s own port1 IP, 10.25.1.40 is the secondary node’s port1 IP, and 10.25.1.254 is the network device. The only address that matches the required cluster virtual IP is 10.25.1.50 , so the correct command is hc-settings -si iport1 -a10.25.1.50 .

From the Lab Guide (Exercise 4 - Using Inline Scanning) , the following is stated:

" FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443. "

And the CLI command used:

" Enter the following command to enable API access on port2: set api-port port2 "

This confirms:

Option B is correct: Port 4443 uses HTTPS only — API ports will not accept HTTP traffic.

Option C is correct: The API port configuration must be performed using the CLI (set api-port port2), as there is no GUI option for this.

Option A is incorrect: The Study Guide states port3 cannot be a management port, and HA communication ports have dedicated roles that are not interchangeable with API ports.

Option D is incorrect: The CLI command sets the API port directly without requiring a separate administrative interface designation.

From the FortiClient EMS Integration lesson, the Study Guide states that FortiSandbox and FortiClient EMS integration helps break the kill chain by monitoring all downloads, removable media, mapped network drives, and email client file downloads — intercepting threats at the Delivery stage before they can execute on the endpoint.

Additionally, from the Attack Methodologies section: " When a USB is attached to a host protected with FortiClient, FortiClient can send the files on the USB drive to FortiSandbox for analysis, before allowing the user access to the files " — further confirming the Delivery stage focus.

From the Scanning and Rating Components lesson, the Study Guide states:

" The universal VM license is a single license that grants you access to multiple VMs. Provides a scalable and cost-effective solution with up to 200 VMs on a single unit. Clone count limits shown on the VM Settings view apply to all enabled VM Types. "

" When you enable Adaptive Scan, FortiSandbox dynamically adjusts the number of clones of any local VMs you have enabled. Enabling this option does not affect the number of remote Mac OS or Windows cloud VMs. "

This confirms:

Option A — Deploying remote WindowsCloudVM and MACOSX clones expands capacity beyond local clone limits since remote VMs are not subject to local clone restrictions

Option D — Adding VM licenses directly increases the number of available VMs up to 200 on a single unit

Reorganizing the scan priority list (B) only affects scan order, not capacity. Adding custom VMs (C) would still be subject to the same local clone limits.