Free Practice Questions for the Fortinet Certified Professional Security Operations FCP_FSA_AD-5.0 Exam (2026 Updated)

From the FortiGate Integration lesson, the Study Guide explicitly states:

" The quarantine daemon is involved in submitting files to FortiSandbox. "

From the Lab Guide (Exercise 3 - Using FortiGate Diagnostics) , the following is explicitly documented:

" Enter the following commands to enable debugging for the quarantine daemon: diagnose debug application quarantine -1 diagnose debug enable "

" Use the following CLI debug command to diagnose the connection and file transfer issue between HQ-FGT-1 and HQ-FSA-1: diagnose debug application quarantine -1 "

This command enables real-time debug output for the quarantine daemon on FortiGate, which is specifically responsible for submitting files to FortiSandbox and receiving verdicts. Option B clears the analytics cache rather than providing diagnostic information, and the other options relate to different functions entirely.

The exhibit shows the Connectivity and Services widget with VM Internet = GRAY (disabled) while Web Filter = GREEN (enabled) and Tracer/Rating = GREEN (enabled) .

Since VM Internet access is disabled (SIMNET mode), the Study Guide explicitly states what CANNOT be performed:

" When the malware does a DNS query, FortiSandbox responds with an internal IP address. Performing an IP reputation lookup on an internal IP would be meaningless. " — eliminates Option A

" When the malware attempts to download a file, FortiSandbox provides a fake download package. This allows the downloader to successfully execute; however, FortiSandbox cannot run its antivirus inspection on the file. " — eliminates Option B

" If the malware creates a callback connection to an IP, FortiSandbox cannot rate the IP, to determine if it ' s a botnet server. "

However, the Study Guide confirms URL rating CAN still be performed:

" FortiSandbox checks connection attempts to any URLs against the FortiGuard web filtering database. "

" Similarly, FortiSandbox assesses all IP connection attempts against the FortiGuard IP rating database to identify known command-and-control (C & C) servers. "

Since the Web Filter service is GREEN (active) , FortiSandbox can still:

Option C — Perform URL rating on HTTP GET requests using the FortiGuard web filtering database

Option D — Perform URL rating on FQDN seen in DNS requests using the FortiGuard web filtering database

These URL rating inspections use FortiSandbox ' s own internet connectivity (port1) to query FortiGuard, independent of the VM internet access status on port3.

From the Scanning and Rating Components lesson, the Study Guide states:

" The universal VM license is a single license that grants you access to multiple VMs. Provides a scalable and cost-effective solution with up to 200 VMs on a single unit. Clone count limits shown on the VM Settings view apply to all enabled VM Types. "

" When you enable Adaptive Scan, FortiSandbox dynamically adjusts the number of clones of any local VMs you have enabled. Enabling this option does not affect the number of remote Mac OS or Windows cloud VMs. "

This confirms:

Option A — Deploying remote WindowsCloudVM and MACOSX clones expands capacity beyond local clone limits since remote VMs are not subject to local clone restrictions

Option D — Adding VM licenses directly increases the number of available VMs up to 200 on a single unit

Reorganizing the scan priority list (B) only affects scan order, not capacity. Adding custom VMs (C) would still be subject to the same local clone limits.

From the Scanning and Rating Components lesson, the Study Guide explicitly states:

" VM images are downloaded from FortiGuard, using port1. So, you must ensure FortiSandbox has a default route and internet connectivity for port1. "

The exhibit confirms this — the test-network output shows:

System DNS resolve: Failed for both bing.com and fsavm.fortinet.net

fsavm.fortinet.net is the FortiGuard VM image download server

This DNS failure on the system side (port1) confirms there is no internet connectivity on port1 , preventing VM image downloads. Note that port3 internet shows " Warning: VM to access internet: Disabled " — but port3 is only for VM sandboxing traffic, not for downloading VM images.

From the FortiWeb Integration lesson, the Study Guide explicitly states:

" You can configure FortiSandbox file submission in a file security policy. Any files not detected by the FortiGuard antivirus engine will be uploaded to FortiSandbox. "

" You can configure FortiWeb to send attachments to FortiSandbox for additional scans to detect advanced persistent threats or zero-day attacks. "

From the Lab Guide (Exercise 1 - FortiWeb Integration):

" Click Web Protection > Input Validation > File Security. In the File Security Policy section, click Create New. Configure Send Files to FortiSandbox: Enabled. "

This confirms that File Security (Option A) is the correct location on FortiWeb to configure FortiSandbox file submission settings.

From the Deployment and System Settings lesson, the Study Guide states:

" The test-network command checks FortiGuard services as its last set of validation tests. These include the FortiGuard distribution network (FDN) accessibility, FDN contract expiration, web filtering service, and the community cloud service. All these FortiGuard services should be reachable and valid for FortiSandbox to be effective. "

" The diagnose-debug fdn command provides details around FortiSandbox and the FortiGuard Distribution Network (FDN) communication and updates. "

FortiGuard Distribution Network (FDN) communication requires TCP/443 for HTTPS-based update and licensing communication. The current firewall rules allow TCP/4443 (API/management), UDP/8888 (FortiGuard queries), and UDP/53 (DNS), but TCP/443 is missing — which is the standard port required for FortiGuard FDN connectivity and license validation.