[2026] Pass Fortinet FCP_FSA_AD-5.0 Test Practice Test Questions Exam Dumps [Q13-Q32]

Posted On October 26, 2026

[2026] Pass Fortinet FCP_FSA_AD-5.0 Test Practice Test Questions Exam Dumps

Verified FCP_FSA_AD-5.0 dumps Q&As – FCP_FSA_AD-5.0 dumps with Correct Answers

Fortinet FCP_FSA_AD-5.0 Exam Syllabus Topics:

Topic	Details
Topic 1	Scanning and rating components: This section focuses on FortiSandbox scanning mechanisms, including scanning components, managing guest virtual machines, and configuring scan options to properly analyze and rate suspicious files.
Topic 2	Results analysis: This section involves understanding common attack vectors, analyzing malware behavior, and interpreting scan job reports to assess threats and make informed security decisions.
Topic 3	Integration: This domain explains how to integrate FortiSandbox within the Fortinet Security Fabric and with third-party tools, as well as identifying ATP deployments and resolving integration-related issues.
Topic 4	Deployment and system settings: This domain covers understanding FortiSandbox deployment within different stages of the Cyber Kill Chain, along with configuring system settings, high availability (HA) clusters, and troubleshooting system-related issues.

NEW QUESTION 13
You must increase the scanning capacity of a FortiSandbox device by increasing the number of clones, but the FortiSandbox local clone limit is already at maximum. Which two actions can you take to expand the scanning capacity of the unit? (Choose two answers)

Deploy remote WindowsCloudVM and MACOSX clones

Reorganize the scan priority list

Add custom VMs

Add VM licenses to FortiSandbox

NEW QUESTION 14
When configuring wildcard administrator authentication, which two account types can you use? (Choose two answers)

LDAP

RADIUS

TACACS

Local

NEW QUESTION 15
You determine that there are a large number of samples on FortiSandbox that are obsolete and no longer needed for future analysis. Which CLI tool must you use to remediate this issue? (Choose one answer)

log-purge

factory-reset

cleandb

fsck-storage

NEW QUESTION 16
You are asked to configure a FortiSandbox HA cluster. Port 4 on the primary and secondary nodes is dedicated for HA-specific communication. Which command must you use to configure the secondary node? (Choose one answer)

hc-settings -sc -tN -nSecondaryNode -cFSAGrp -p<password> -iport4

hc-settings -sc -tM -nSecondaryNode -cFSAGrp -p<password> -iport4

hc-settings -sc -tP -nSecondaryNode -cFSAGrp -p<password> -iport4

hc-settings -sc -tR -nSecondaryNode -cFSAGrp -p<password> -iport4

NEW QUESTION 17
Refer to the exhibits.

You are unable to download guest VMs on a new FortiSandbox VM. What is the reason for this? (Choose one answer)

FortiSandbox is using a private DNS server.

There is no internet connectivity on port1.

There is no internet connectivity on port3.

FortiSandbox does not have the necessary licenses.

NEW QUESTION 18
Which two products integrated with FortiSandbox work to protect against the lateral movement stage of the Cyber Kill Chain? (Choose two answers)

FortiMail

FortiDeceptor

FortiADC

FortiGate

NEW QUESTION 19
A security analyst is reviewing a scan job report that indicates a true positive match. The job report displays that the malware attempts to replace vital system executables. Which type of malware is the analyst observing? (Choose one answer)

Exploit

Trojan

Dropper

Rootkit

NEW QUESTION 20
An organization has an existing FortiGate provisioned as a data center firewall (DCFW) that submits inbound files to FortiSandbox for inline scanning. As a result of a network redesign, traffic between the FortiSandbox and the DCFW now passes through an intermediate firewall. Inline scanning is no longer working. While examining the configuration of the intermediate firewall you notice that it is configured to allow traffic on ports TCP/3389, UDP/53, and TCP/443. What must you change for the integration to work? (Choose one answer)

FortiGate must be able to access FortiSandbox on TCP/4443.

FortiGate must be able to access FortiSandbox on TCP/8890.

FortiGate must be able to access FortiSandbox on UDP/8888.

FortiGate must be able to access FortiSandbox on UDP/1344.

NEW QUESTION 21
To assign a file to a VM image, which two conditions must be true? (Choose two answers)

FortiSandbox must have the appropriate license entitlements.

The VM image clone value must be a non-zero number.

The file type must be configured to enter the job queue.

The VM image must have the software required to open the file.

NEW QUESTION 22
Refer to the CLI configuration below.
set device-authorization -a
How will FortiSandbox authorize new FortiClient devices after this command? (Choose one answer)

When a new FortiClient registers, it inherits authorization status from the managing EMS or FortiGate.

When a new device other than FortiClient registers, FortiSandbox will authorize it automatically.

When a new FortiClient registers, FortiSandbox will authorize it automatically.

When a Fabric device is not authorized, FortiSandbox will authorize it automatically.

NEW QUESTION 23
On a FortiClient EMS integrated with FortiSandbox, how can you apply FortiSandbox profile configurations to endpoints even if they are off fabric? (Choose one answer)

As part of the fabric connectors configuration

As part of an endpoint workgroup configuration

As part of the endpoint policy configuration

As part of the sandbox profile configuration

NEW QUESTION 24
There is a connectivity problem between FortiSandbox and the FortiGuard distribution servers. You observe that a firewall located between FortiSandbox and the internet allows traffic on ports TCP/4443, UDP/8888, and UDP/53. What is the cause of the issue? (Choose one answer)

They must allow TCP 443 out

They must allow TCP 8890 out

They must allow UDP 514 out

They must allow UDP 443 out

NEW QUESTION 25
You notice a recent file downloaded by some end stations is exhibiting malware behavior, however, on the sandbox the file is rated clean. After further investigation you determine that only end stations using the Opera browser are being affected. What must you do to prevent these infections? (Choose one answer)

Enable the STIX/TAXII Integration setting on FortiSandbox.

Configure a custom VM to use the same browser as the exploited end stations.

Modify the scan profile to include the malware file type.

Change the job queue priority to process web-based files first.

NEW QUESTION 26
Refer to the exhibits.

A FortiClient EMS server is integrated with a FortiSandbox device. You are asked to find ways to expedite all scan jobs that require dynamic scanning so end users do not have to wait too long for a rating on suspicious attachments and URLs. Which configuration change will maintain a high security level but expedite all dynamic scan job requests? (Choose one answer)

On FortiClient EMS, disable Wait for FortiSandbox Results before Allowing File Access.

On FortiSandbox, in the Advanced settings, enable Pipeline Mode.

On FortiClient EMS, change FortiSandbox Detection Verdict Level to Medium.

On FortiSandbox, in the Pre-Filter settings, enable Office, PDF, URL, and Archive.

NEW QUESTION 27
Review the exhibits.

A FortiMail device is integrated with a FortiSandbox device. What is the expected behavior on FortiMail for emails that require FortiSandbox inspection? (Choose one answer)

FortiMail will queue emails for up to 5 minutes during URL rating errors before submitting URLs to FortiSandbox

FortiMail will queue emails for up to 30 minutes to allow FortiSandbox to finish scanning all attachments and URLs.

FortiMail will not send attachments and URLs to FortiSandbox if their rating exists in the local cache.

FortiMail will deliver all emails to the destination after the emails pass all local security checks.

NEW QUESTION 28
How can you limit an administrator’s access to scan jobs on FortiSandbox based on the system that submitted the scan request? (Choose one answer)

By configuring device groups to assign to users

By configuring access in the log server configuration settings

By configuring netshare groups to define access

By configuring administrator profiles that define job access

NEW QUESTION 29
A security analyst is reviewing a scan job report that indicates a true positive match. The job report displays that the malware attempts to replace vital system executables. Which type of malware is the analyst observing? (Choose one answer)

Trojan

Exploit

Rootkit

Dropper

NEW QUESTION 30
Refer to the exhibits.

You are asked to configure a FortiSandbox to leverage the real-time anti-phishing (RTAP) feature. After configuring the scan profile, testing shows that URLs are not being submitted to the RTAP service. What could cause this issue? (Choose one answer)