NSE7 Advanced Threat Protection Practice Question
A network admin notices that files submitted to FortiSandbox from FortiGate are not being analyzed. The FortiGate has a valid FortiSandbox license and the device is reachable. What configuration step is most likely missing?
⚠ Common exam trap
A common mix-up: candidates assume a valid license and reachability are sufficient, overlooking that the antivirus profile must explicitly enable the inline scan feature to trigger file submission to FortiSandbox.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The antivirus profile has 'FortiSandbox Inline Scan' disabled
FortiGate uses antivirus profiles to define scanning behavior for traffic. Even with a valid FortiSandbox license and reachability, the antivirus profile must have 'FortiSandbox Inline Scan' enabled to submit files to FortiSandbox for analysis. Without this setting, files are not forwarded for sandboxing, regardless of other configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FortiSandbox feature is not enabled in the VDOM settings
Why it's wrong here
There is no VDOM-level toggle; integration is per policy via profiles.
- ✓
The antivirus profile has 'FortiSandbox Inline Scan' disabled
Why this is correct
Inline scan must be enabled in the antivirus profile to send files to FortiSandbox.
- ✗
The FortiSandbox server IP is not configured under Security Fabric > Fabric Connectors
Why it's wrong here
While the IP can be set there, the most common missing step is the profile configuration.
- ✗
The FortiGate is not registered with FortiCloud
Why it's wrong here
Registration is not required for FortiSandbox integration.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.