Free Fortinet FCP_FSA_AD-5.0 Exam Dumps August 2026

From the High Availability and Management lesson, the Study Guide states:

'You use the hc-settings command and options to configure the main HA settings, such as enable HA, and to configure the node's mode of operation, node alias, group name, group password, and the HA interface.'

The CLI flags breakdown:

-sc = Set configuration

-t = Node type flag where N = Secondary node

-n = Node alias (SecondaryNode)

-c = Cluster/group name (FSAGrp)

-p = Password

-i = HA interface (port4)

The Study Guide confirms the secondary node type uses -tN designation. Option B (-tM) represents the primary/master node, Option C (-tP) and Option D (-tR) are not valid node type designators for secondary nodes in the FortiSandbox HA CLI syntax.

From the Lab Guide (Exercise 4 - Using Inline Scanning), the following is stated:

'FortiGate and FortiSandbox communicate through port 4443. Management or API ports grant access through port 4443.'

And the CLI command used:

'Enter the following command to enable API access on port2: set api-port port2'

This confirms:

Option B is correct: Port 4443 uses HTTPS only --- API ports will not accept HTTP traffic.

Option C is correct: The API port configuration must be performed using the CLI (set api-port port2), as there is no GUI option for this.

Option A is incorrect: The Study Guide states port3 cannot be a management port, and HA communication ports have dedicated roles that are not interchangeable with API ports.

Option D is incorrect: The CLI command sets the API port directly without requiring a separate administrative interface designation.

The Study Guide states that HA is configured from the CLI and that ''the main HA cluster CLI commands are hc-settings, hc-slave, and hc-status''. It also explains that ''You use the hc-settings command and options to configure the main HA settings... node alias, group name, group password, and the HA interface.'' The same HA section further says that the primary and secondary nodes must have a dedicated HA communication interface, and specifically notes that ''port4 in this example'' is the HA interface between them.

On the primary-node example configuration shown on page 137 of the uploaded study guide, the command uses -tM for the primary node with -iport4 for the HA interface. That directly matches option D. The other options use different node-type flags and do not correspond to the primary-node example. Therefore, the correct command is hc-settings -sc -tM -nPrimaryNode -cFSAGrp -p -iport4.

The best answer is B. enable Pipeline Mode. The FortiSandbox 5.0 Administrator Study Guide states: ''The Pipeline Mode feature improves performance by allowing to scan multiple files, one at a time, without shutting down the VM instance after scanning each file.'' It further explains that ''FortiSandbox will continue scanning files without shutting down the VM instance, as long as the VM status hasn't changed.'' This directly improves the throughput of dynamic VM-based scanning, which is exactly what the question asks for.

The other options do not fit as well. Option A would reduce waiting time for users, but it lowers security because files could be accessed before a sandbox verdict is returned; the EMS lab profile intentionally enables ''Wait for FortiSandbox Results before Allowing File Access'' with a Low detection level to maintain strong protection. Option C also weakens security by making remediation apply only when the verdict ''equals or exceeds the selected FortiSandbox Detection Verdict Level,'' so raising it to Medium would ignore Low-risk detections. Option D enables prefiltering logic, which can reduce submissions, but it does not directly accelerate jobs that already require dynamic scanning. Therefore, Pipeline Mode is the only choice that both preserves a high security level and speeds dynamic scan processing.

From the Deployment and System Settings lesson, the Study Guide states:

'The test-network command checks FortiGuard services as its last set of validation tests. These include the FortiGuard distribution network (FDN) accessibility, FDN contract expiration, web filtering service, and the community cloud service. All these FortiGuard services should be reachable and valid for FortiSandbox to be effective.'

'The diagnose-debug fdn command provides details around FortiSandbox and the FortiGuard Distribution Network (FDN) communication and updates.'

FortiGuard Distribution Network (FDN) communication requires TCP/443 for HTTPS-based update and licensing communication. The current firewall rules allow TCP/4443 (API/management), UDP/8888 (FortiGuard queries), and UDP/53 (DNS), but TCP/443 is missing --- which is the standard port required for FortiGuard FDN connectivity and license validation.