FCP_FSA_AD-5.0 Practice Questions

The Study Guide is explicit about the FortiMail–FortiSandbox workflow. It states: “On top of file submissions, FortiMail can also submit extracted URLs from emails to FortiSandbox for inspection. FortiMail queues the email while waiting for a verdict. FortiSandbox inspects all submitted files and URLs. FortiSandbox then generates a verdict and sends that verdict in reply to FortiMail. FortiMail uses the verdict to apply the configured action.”

This directly supports D because FortiSandbox analyzes file and URL objects . It supports B because FortiSandbox generates a verdict and returns it to FortiMail. And it supports E because the integrated workflow includes the email being queued during analysis while FortiSandbox is processing the submitted objects. Option C is incorrect because FortiMail is the device that submits the objects to FortiSandbox, not FortiSandbox itself. Option A is also incorrect because updating FortiGuard databases is not one of the three ATP integration actions described for the FortiMail workflow. Therefore, the correct three answers are B, D, and E .

From the Scanning and Rating Components lesson, the Study Guide explicitly states:

" The rating engine analyzes the tracer engine ' s information. " — confirms Option E

" FortiSandbox checks connection attempts to any URLs against the FortiGuard web filtering database. FortiSandbox submits hashes of files generated during sandbox analysis to the Sandbox Community Cloud to check for existing verdicts. Additionally, it compares these file hashes against the FortiGuard Cloud-Based Threat Intelligence database. " — confirms Option B

" After analysis is complete, the rating engine generates a verdict. " — confirms Option D

" Finally, the rating engine generates a report containing all details collected by the tracer engine. "

Option A is incorrect as the rating engine does not rate third-party device effectiveness. Option C is incorrect — verdict sharing is done by the FortiSandbox system through malware/URL packages, not specifically by the rating engine component.