Why FortiGate ATP Misses Ransomware Over HTTPS
A network administrator notices that several endpoints are infected with ransomware despite having FortiGate ATP enabled. The logs show that the files were downloaded over HTTPS, and the antivirus profile did not detect them. What is the most likely reason?
Quick Answer
The answer is that SSL inspection was not enabled on the antivirus profile. This is the most likely reason because FortiGate ATP’s antivirus engine operates at the application layer and can only scan unencrypted payloads; when traffic is tunneled over HTTPS, the antivirus profile sees only ciphertext and cannot match file signatures, heuristics, or behavioral patterns, allowing ransomware to bypass detection entirely. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of the critical dependency between SSL inspection and security profiles—a common trap is assuming that enabling ATP alone covers encrypted threats, but without decryption, antivirus is effectively blind. Remember the memory tip: “No decrypt, no detect”—if the logs show HTTPS downloads, always check that SSL inspection is applied to the antivirus profile first.
⚠ Common exam trap
Candidates often assume FortiGate's antivirus can automatically inspect HTTPS traffic because it is part of the ATP suite, but FortiGate requires explicit SSL inspection configuration to decrypt and scan encrypted downloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL inspection was not enabled on the antivirus profile
FortiGate ATP's antivirus engine cannot inspect encrypted HTTPS traffic unless SSL inspection is explicitly enabled on the antivirus profile. Without SSL inspection, the antivirus profile only sees encrypted payloads and cannot match file signatures or heuristics, allowing ransomware to pass undetected. The logs confirm files were downloaded over HTTPS, making this the most likely root cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SSL inspection was not enabled on the antivirus profile
Why this is correct
Without SSL inspection, encrypted traffic bypasses antivirus scanning.
- ✗
Application control profile blocked the download
Why it's wrong here
Application control does not detect malware; it controls application usage.
- ✗
FortiSandbox was not configured to analyze the files
Why it's wrong here
FortiSandbox enhances detection but is not required to scan encrypted traffic; SSL inspection is needed first.
- ✗
IPS signature database was outdated
Why it's wrong here
IPS does not inspect encrypted traffic without SSL inspection.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An administrator notices that some malware files are not being detected by FortiGate. The antivirus profile uses flow-based scanning with FortiSandbox disabled. What is the most likely reason for missed detections?
hard- A.Flow-based scanning is less thorough than proxy-based
- ✓ B.FortiSandbox inline-scan is disabled, so unknown malware is not analyzed
- C.Quarantine is enabled, which causes files to be dropped before scanning
- D.The antivirus profile is not applied to the firewall policy
Why B: Flow-based scanning inspects files as they traverse the firewall, but it relies on signatures and heuristics for detection. Without FortiSandbox inline-scan enabled, unknown or zero-day malware that does not match existing signatures will not be sent to the sandbox for behavioral analysis, so it can pass undetected. Option B correctly identifies that disabling FortiSandbox removes the ability to analyze unknown threats, which is the most likely reason for missed detections.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.