[Q20-Q38] Pass Fortinet FCP_FSA_AD-5.0 Exam in First Attempt Guaranteed [Sep-2026]

Q20. A security analyst is reviewing a scan job report that indicates a true positive match. The job report displays that the malware attempts to replace vital system executables. Which type of malware is the analyst observing? (Choose one answer)

Q21. You are troubleshooting long delays between FortiMail file submissions to FortiSandbox and verdicts being returned form FortiSandbox. Which FortiMail debug tool must you use to troubleshoot this issue further? (Choose one answer)

Q22. What are three roles of the rating engine component of FortiSandbox? (Choose three answers)

Q23. Refer to the exhibits.

A FortiClient EMS server is integrated with a FortiSandbox device. You are asked to find ways to expedite all scan jobs that require dynamic scanning so end users do not have to wait too long for a rating on suspicious attachments and URLs. Which configuration change will maintain a high security level but expedite all dynamic scan job requests? (Choose one answer)

Q24. You are asked to configure FortiSandbox to use one VM instance for multiple sequential scan jobs without shutting down the instance between each scan job submission. Which scan profile setting must you enable to achieve this? (Choose one answer)

Q25. An organization has an existing FortiGate provisioned as a data center firewall (DCFW) that submits inbound files to FortiSandbox for inline scanning. As a result of a network redesign, traffic between the FortiSandbox and the DCFW now passes through an intermediate firewall. Inline scanning is no longer working. While examining the configuration of the intermediate firewall you notice that it is configured to allow traffic on ports TCP/3389, UDP/53, and TCP/443. What must you change for the integration to work? (Choose one answer)

Q26. Which stage of the Cyber Kill Chain does FortiSandbox and FortiClient EMS integration help to block? (Choose one answer)

Q27. There is a connectivity problem between FortiSandbox and the FortiGuard distribution servers. You observe that a firewall located between FortiSandbox and the internet allows traffic on ports TCP/4443, UDP/8888, and UDP/53. What is the cause of the issue? (Choose one answer)

Q28. Which three actions does FortiSandbox perform when it is integrated with FortiMail for advanced threat protection (ATP)? (Choose three answers)

Q29. When configuring wildcard administrator authentication, which two account types can you use? (Choose two answers)

Q30. Which three actions does FortiSandbox perform when it is integrated with FortiMail for advanced threat protection (ATP)? (Choose three answers)

Q31. You are asked to create some custom VMs to better represent your security environment. In which two FortiSandbox deployments is this supported? (Choose two answers)

Q32. You are attempting to troubleshoot a FortiGate device that is not sending samples to FortiSandbox. Which CLI command will provide you with useful diagnostic information? (Choose one answer)

Q33. A FortiSandbox HA cluster is configured with the MTA adapter. What does the primary node do when it receives MTA jobs? (Choose one answer)

Q34. Refer to the exhibit.

Which command must you use to configure the worker node? (Choose one answer)

Q35. How can you limit an administrator’s access to scan jobs on FortiSandbox based on the system that submitted the scan request? (Choose one answer)

Q36. Which FortiGate daemon can you monitor in real time to verify that verdicts are being received by FortiGate? (Choose one answer)

Q37. Refer to the CLI configuration below.
set device-authorization -a
How will FortiSandbox authorize new FortiClient devices after this command? (Choose one answer)