NSE7 Advanced Threat Protection Practice Question
A FortiGate administrator receives a report that a user downloaded a malicious PDF file. The antivirus profile has machine learning engine enabled, CDR enabled, and FortiSandbox integration. However, the file was allowed. The log shows: 'file=malicious.pdf, action=allow, ml_score=85, cd_result=clean, sandbox=not_submitted'. What is the most likely reason the file was not submitted to FortiSandbox?
⚠ Common exam trap
It's easy for candidates to assume a high ML score (85) would automatically trigger sandbox submission, but FortiGate's sandbox submission is governed by separate size and protocol filters, not by ML score alone.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file size exceeded the maximum file size for FortiSandbox submission
The log shows 'sandbox=not_submitted', which directly indicates the file was never sent to FortiSandbox. FortiGate has a configurable maximum file size limit for sandbox submission (default 10 MB). If the PDF exceeds this limit, the file is allowed without sandbox inspection, even if other engines like ML or CDR are enabled. The ml_score of 85 indicates a high malicious probability, but the sandbox submission was skipped due to size constraints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The file size exceeded the maximum file size for FortiSandbox submission
Why this is correct
FortiSandbox has a configurable file size limit; files larger than that are not submitted.
- ✗
CDR reconstructed the file, making it appear clean
Why it's wrong here
CDR would have changed the file, but submission decision happens before CDR.
- ✗
The machine learning engine scored the file as clean (score below threshold)
Why it's wrong here
ML score 85 might be high, but submission is based on verdict, not score.
- ✗
The file was excluded by a file type filter in the antivirus profile
Why it's wrong here
If excluded, it would not be scanned at all, not allowed.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.