Configure Malware Detection and Advanced Persistent Threat Mitigation NSE6-FORTIMAIL-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which sources of information can an APT mitigation policy in FortiMail use to make decisions?

   • ASandbox verdicts and threat intelligence feeds
   • BOnly the sender's email address
   • COnly the email subject line
   • DOnly the message size
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A FortiMail administrator is setting up a new appliance and wants to ensure that antivirus signatures are updated immediately after the initial configuration. What should the administrator do?

   • AWait for the next scheduled update.
   • BManually trigger an update from the FortiGuard update page.
   • CConfigure the update schedule to 'daily' and wait.
   • DReboot the appliance to start the update process.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the purpose of configuring sandbox integration on a FortiMail appliance?

   • ATo encrypt email messages in transit
   • BTo replace the antivirus engine
   • CTo submit suspicious attachments or URLs to an external sandbox for analysis
   • DTo block all email attachments larger than a specified size
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An administrator needs to configure FortiMail to stop delivering messages that contain a detected virus. Which setting must be configured in the antivirus scanning policy?

   • AThe antivirus engine set to 'Extended'
   • BThe action policy set to 'Quarantine' or 'Discard'
   • CThe recipient policy set to 'Block sender'
   • DThe scan mode set to 'Scan all messages'
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is implementing APT mitigation in FortiMail. They have a FortiSandbox and want to ensure that emails with malicious attachments are blocked, but they also want to avoid delays for emails with clean attachments. They have a large volume of email and are concerned about the performance impact of sandbox analysis. What is the best approach?

   • ASubmit all attachments but do not hold emails; deliver them immediately and retroactively quarantine if malicious.
   • BSubmit only attachments that are not detected by antivirus and hold those emails until the verdict is received.
   • CDisable sandbox analysis and rely on antivirus signatures only.
   • DSubmit all attachments to the sandbox and hold emails until the verdict is received.
   Reveal Solution Discussion Select an answer first