NSE4 Security Profiles Practice Question
Which security profile type requires a FortiSandbox license to enable advanced detection features?
⚠ Common exam trap
Candidates often assume all security profiles can leverage FortiSandbox for advanced detection, but only the Antivirus profile requires the license to enable its core advanced features like outbreak prevention and cloud-based pattern matching.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Antivirus
The Antivirus security profile (Option C) is correct because FortiGate's advanced antivirus features, such as outbreak prevention and cloud-based pattern matching, require a FortiSandbox license to offload suspicious files for dynamic analysis. Without this license, the antivirus engine relies solely on local signatures and cannot leverage sandboxing for zero-day threat detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Application Control
Why it's wrong here
Application Control identifies and controls network traffic based on application signatures and protocol decoders, not by detonating files. It inspects application behavior and metadata in real time, so it doesn't require FortiSandbox licensing. Even with a FortiSandbox license, application control remains a separate engine; sandboxing is only invoked when configured within an antivirus or content profile. Thus, no FortiSandbox license is needed for application control to function.
- ✗
DNS Filter
Why it's wrong here
DNS Filtering is based on domain reputation and category lookups against FortiGuard DNS databases, with no file submission or behavioral analysis. It blocks or redirects DNS queries to malicious domains before any content is downloaded. FortiSandbox is designed to analyze suspicious files and URLs in a secure environment, not to evaluate DNS queries. So DNS filter works independent of a FortiSandbox license.
- ✓
Antivirus
Why this is correct
Antivirus profile is the correct answer because FortiSandbox integration is a feature of the antivirus security profile in FortiOS. When an antivirus profile encounters an unknown file, it can send a copy to FortiSandbox for advanced static and dynamic analysis if the FortiSandbox license is available. This extends the signature-based antivirus capability to detect zero-day and advanced persistent threats. Without a license, the AV profile still scans using FortiGuard signatures, but cannot offload files to sandbox.
- ✗
Web Filter
Why it's wrong here
Web Filter controls access based on URL categories, IP reputation, and content ratings via FortiGuard web filtering database, not by executing files. It evaluates the website's category or rating and either allows or blocks accordingly. FortiSandbox is not involved in the URL rating or filtering decision; it inspects downloaded files only when an antivirus profile routes them. Hence, web filtering does not require a FortiSandbox license.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.