NSE7 Advanced Threat Protection Practice Question
A FortiGate administrator is configuring a security profile group and wants to enable inline blocking of malicious files based on FortiGuard cloud threat intelligence, without sending files to FortiSandbox. The administrator has already enabled the antivirus profile and selected the 'Block' action for infected files. Which additional setting should be configured to ensure that files identified as malicious by the FortiGuard service are blocked in real time?
⚠ Common exam trap
Many candidates confuse FortiGuard AI-based inline prevention with FortiSandbox integration, assuming that any cloud-based file analysis requires a sandbox appliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'FortiGuard AI-Based Inline Malware Prevention' in the antivirus profile.
The correct setting is 'FortiGuard AI-Based Inline Malware Prevention', which enables real-time blocking of malicious files using FortiGuard's cloud-based AI and machine learning, without the need for a FortiSandbox. This feature is part of the antivirus profile and provides inline protection against known and unknown malware, aligning with the administrator's goal of blocking based on FortiGuard intelligence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable 'Scan with FortiSandbox' in the antivirus profile.
Why it's wrong here
Enabling 'Scan with FortiSandbox' sends files to a FortiSandbox appliance for analysis, which is explicitly not desired in this scenario. The administrator wants to avoid using FortiSandbox and instead rely on FortiGuard cloud intelligence for inline blocking. This option would introduce latency and dependency on a sandbox, contrary to the requirement.
- ✓
Enable 'FortiGuard AI-Based Inline Malware Prevention' in the antivirus profile.
Why this is correct
This feature uses FortiGuard AI-based malware prevention to inspect files inline and block malicious content without relying on sandbox detonation. It leverages cloud-based threat intelligence and machine learning to identify and block known and unknown malware in real time, which directly satisfies the requirement to block files identified by FortiGuard without using FortiSandbox.
- ✗
Enable 'Use FortiSandbox Database' in the antivirus profile.
Why it's wrong here
The FortiSandbox Database option allows the FortiGate to use verdicts from a connected FortiSandbox appliance, not from FortiGuard cloud services. This would require a FortiSandbox deployment and does not provide the real-time inline blocking based on FortiGuard threat intelligence that the scenario requires. It is a valid feature but not the correct choice here.
- ✗
Configure 'External Blocklist' with a threat intelligence feed.
Why it's wrong here
External blocklists are used to block IP addresses, domains, or URLs based on threat intelligence feeds, not to inspect and block malicious files inline. While this can enhance security, it does not address file-based threats or leverage FortiGuard's file analysis capabilities. The scenario specifically requires blocking malicious files, so this is not the correct setting.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 718-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.