FCP-FSA-AD-5-0: Fortinet NSE 5 - FortiSandbox 5.0 Administrator

By Fortinet · Question Mode

QuestionQ35

VerifiedSystem Configuration

A security setup includes products from multiple vendors, among them a global proxy server that handles internet access for end users. You need to integrate FortiSandbox to protect this end-user web browsing traffic, and the integration must be able to prevent patient-zero infections.

Which integration method is best suited for this scenario?

Explanation

When a third-party (non-FortiGate) proxy server needs to send web traffic to FortiSandbox for real-time inspection, FortiSandbox is configured as an ICAP server and the proxy acts as the ICAP client, forwarding content for scanning before it reaches the end user. This inline, real-time scanning capability is what allows malicious files to be blocked before delivery, preventing patient-zero infections. The other options—adding a FortiGate device, network share scanning, or JSON API—either require a Fortinet device in the traffic path, operate on stored files rather than live traffic, or are used for on-demand submissions rather than real-time inline protection for a generic proxy.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!