NSE7 Advanced Threat Protection Practice Question
A FortiGate is configured with an antivirus profile that has the machine learning engine enabled. An administrator notices that some files are being detected by the ML engine but the verdict is 'probably clean'. What does this verdict indicate?
⚠ Common exam trap
Watch out — candidates often confuse 'probably clean' with 'clean' or assume it requires external verification, when in fact it is a low-confidence verdict designed to avoid blocking potentially safe files.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ML engine has low confidence that the file is malicious; it may be a false positive.
The ML engine in FortiGate's antivirus profile assigns a verdict of 'probably clean' when its confidence level is low that the file is malicious. This indicates a potential false positive, meaning the file is likely benign but the engine cannot be certain. The correct action is to allow the file to pass while logging the event for further analysis, not to block it outright.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file is clean and safe to pass.
Why it's wrong here
Clean is a separate verdict.
- ✗
The file is definitely malicious and should be blocked.
Why it's wrong here
That would be 'malicious' verdict.
- ✗
The ML engine has detected an outbreak but needs FortiGuard to confirm.
Why it's wrong here
Outbreak prevention is a different feature.
- ✓
The ML engine has low confidence that the file is malicious; it may be a false positive.
Why this is correct
'Probably clean' indicates low malicious confidence, often requiring further analysis.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.