FCP_FSA_AD-5.0 Dumps with Practice Exam Questions Answers

The correct answer is C. cleandb . The FortiSandbox 5.0 Administrator Study Guide explicitly states: “The cleandb command will erase all stored data in the FortiSandbox database and reboot the system.” This directly matches the scenario, because the issue is that FortiSandbox contains many obsolete samples and related stored analysis data that are no longer needed. Removing those database contents is exactly what cleandb is designed to do.

The other options do not fit this requirement. The same study guide section says “The log-purge command will remove all system logs,” which affects logs only, not the stored sample database. It also says “The fsck-storage command will check the integrity of the hard disks and repair them if any issues are discovered,” which is for disk integrity troubleshooting, not cleanup of obsolete samples. A factory reset would be far more destructive and is not the stated maintenance tool for this issue. Therefore, cleandb is the correct CLI remediation tool.

The FortiSandbox 5.0 Administrator Lab Guide explicitly states during the inline scanning configuration: “FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443.” In the same exercise, the guide has you enable API access on port2 specifically so inline scanning can function, which confirms that the integration depends on FortiGate reaching FortiSandbox over TCP/4443 .

In this scenario, the intermediate firewall currently allows TCP/3389, UDP/53, and TCP/443, but not TCP/4443 . That is why inline scanning stopped working after the redesign. TCP/443 is not sufficient here because the documented FortiGate-to-FortiSandbox inline communication port is 4443 , not standard HTTPS 443. The other ports in the options do not match the inline-scanning communication requirement described in the uploaded lab materials. Therefore, the required fix is to allow FortiGate access to FortiSandbox on TCP/4443 .

The exhibit summary says the file was “flagged by the PAIX engine” and describes it as “high-risk behavior.” The lab guide also states for a similar file analysis scenario: “The PAIX engine detected potentially malicious activity… The overall assessment is that there is a high likelihood of malicious activity.” In addition, the FortiGate integration lab explains that “FortiSandbox identified the fsa_dropper.exe file as high risk… because the advanced AI engine was able to detect malicious behaviour… at the static scan phase.” These extracts confirm that the advanced AI / PAIX engine identified the threat , so A is true .

Option D is not supported. The study guide distinguishes high risk from malicious and explains that high risk is a suspicious threat-level rating, not the same as a malicious verdict. It states that FortiSandbox groups results into ratings such as high risk, medium risk, low risk, clean, and malicious , and defines high-risk separately as a serious suspicious rating. Since the exhibit explicitly refers to high-risk behavior , not a malicious verdict, D is false as written . The duplicated B/C options are also not proven by the exhibit text provided.

If your original source intended D to say “The analysis resulted in a high-risk verdict” instead of malicious verdict , then the correct pair would be A and D .

From the FortiGate Integration lesson, the Study Guide explicitly states:

" The quarantine daemon is involved in submitting files to FortiSandbox. "

From the Lab Guide (Exercise 3 - Using FortiGate Diagnostics) , the following is explicitly documented:

" Enter the following commands to enable debugging for the quarantine daemon: diagnose debug application quarantine -1 diagnose debug enable "

" Use the following CLI debug command to diagnose the connection and file transfer issue between HQ-FGT-1 and HQ-FSA-1: diagnose debug application quarantine -1 "

This command enables real-time debug output for the quarantine daemon on FortiGate, which is specifically responsible for submitting files to FortiSandbox and receiving verdicts. Option B clears the analytics cache rather than providing diagnostic information, and the other options relate to different functions entirely.

From the Scanning and Rating Components lesson, the Study Guide states:

" The universal VM license is a single license that grants you access to multiple VMs. Provides a scalable and cost-effective solution with up to 200 VMs on a single unit. Clone count limits shown on the VM Settings view apply to all enabled VM Types. "

" When you enable Adaptive Scan, FortiSandbox dynamically adjusts the number of clones of any local VMs you have enabled. Enabling this option does not affect the number of remote Mac OS or Windows cloud VMs. "

This confirms:

Option A — Deploying remote WindowsCloudVM and MACOSX clones expands capacity beyond local clone limits since remote VMs are not subject to local clone restrictions

Option D — Adding VM licenses directly increases the number of available VMs up to 200 on a single unit

Reorganizing the scan priority list (B) only affects scan order, not capacity. Adding custom VMs (C) would still be subject to the same local clone limits.