FCP_FSA_AD-5.0 Fortinet FCP - FortiSandbox 5.0 Administrator Free Practice Exam Questions (2026 Updated)

The Study Guide states that in an HA cluster, “As well as normal scanning duties, the primary node also manages the cluster, distributes jobs, and gathers the verdicts.” It also says that “The worker nodes provide load balancing. The primary node distributes scan jobs to the worker nodes.”

From those official statements, the primary node is not just a coordinator. It also performs normal scanning duties itself, while distributing scan jobs across worker nodes for load balancing. That rules out A, because the secondary node is for failover, not normal job distribution. It rules out C, because the primary is not restricted to itself only. It also rules out D, because the primary can still perform scanning duties and is not limited to sending all jobs only to workers. Therefore, when the primary receives MTA jobs, the correct behavior is that it distributes the MTA jobs to itself or to worker nodes .

From the Scanning and Rating Components lesson, the Study Guide explicitly states:

" VM images are downloaded from FortiGuard, using port1. So, you must ensure FortiSandbox has a default route and internet connectivity for port1. "

The exhibit confirms this — the test-network output shows:

System DNS resolve: Failed for both bing.com and fsavm.fortinet.net

fsavm.fortinet.net is the FortiGuard VM image download server

This DNS failure on the system side (port1) confirms there is no internet connectivity on port1 , preventing VM image downloads. Note that port3 internet shows " Warning: VM to access internet: Disabled " — but port3 is only for VM sandboxing traffic, not for downloading VM images.

From the Deployment and System Settings lesson, the Study Guide states:

" Other ports, with the exception of port3, can also be configured as management ports from CLI. "

" You can set additional ports as management port using the CLI command shown on this slide. "

From the Lab Guide (Exercise 4 - Using Inline Scanning) :

" FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443. "

" Enter the following command to enable API access on port2: set api-port port2 "

Ports that are designated as either administration interfaces or API interfaces cannot be selected for 802.3ad aggregate bonding because:

Option A — Port 4 configured as an administration interface is reserved for management traffic and cannot be repurposed for link aggregation

Option C — Port 4 configured as an API interface is dedicated for API communication (port 4443) and is similarly restricted from being used in aggregate bonding configurations

Port 4 in the Lab Guide is specifically referenced as the HA communication and management port, confirming these restrictions apply when special roles are assigned to interfaces.

From the FortiClient EMS Integration lesson, the Study Guide explicitly states:

" It is always a good idea to place the files that are submitted by FortiClient, high on the Job Queue Priority since these are files that end users need immediate access to. In most cases, end users might not be willing to wait for a long time to access these files and placing the FortiClient submitted files high on the Job Queue Priority ensures that these files receive high priority for scanning from FortiSandbox. "

Looking at the exhibit, the Job Priority Configuration shows:

Positions 1-4: On-Demand inputs (highest priority)

Position 5: FortiGate InlineBlock

Positions 6-11: Other sources including FortiWeb, File RPC, Device, FortiClient

As a best practice, FortiClient should rank after On-Demand (positions 1-4) but before FortiGate inputs — since end users need immediate file access, FortiClient submissions should be near the top but On-Demand scanning takes highest precedence.

The correct answer is D . The Study Guide states that FortiSandbox has default administrative profiles and specifically says: “The Read Only profile is intended to be used for system-wide monitoring and reporting tasks, whereas the Device profile is intended to be used for monitoring alerts and reporting for a specific device.” That wording directly matches the question requirement to limit access based on the system that submitted the scan request . In other words, FortiSandbox uses administrator profiles to control whether an admin can view broad system-wide activity or only jobs and alerts related to a specific submitting device.

This eliminates the other options. The Study Guide does not describe device groups , log server settings , or netshare groups as the mechanism for restricting admin visibility of scan jobs by submitter. Instead, access control is tied to the admin profile model . The Device profile is the exact fit because it narrows monitoring and reporting to a particular device context rather than the entire system. Therefore, the way to limit an administrator’s access to scan jobs by the submitting system is by configuring administrator profiles that define job access .

From the Deployment and System Settings lesson, the Study Guide explicitly states:

" Initial port1 IP configuration must be performed from the console, using the commands shown on this slide. If your management computer is on a separate subnet from FortiSandbox, you must specify a gateway address using the commands shown on this slide. "

The two required commands are:

set port1-ip <</b> IP address > — to assign the IP address to port1 for GUI access

set default-gw <</b> IP Address > — to configure the default gateway so the management computer can reach FortiSandbox from a different subnet

Option B (set api-port port1) is for API access configuration, and Option C (set admin-port port1) is not a valid FortiSandbox CLI command for this purpose.