NSE7 Advanced Threat Protection Practice Question
A network security administrator is deploying a FortiSandbox appliance in a FortiGate environment. The administrator wants to ensure that when a zero-day malware sample is detonated, the FortiGate immediately blocks the file hash and the C2 callback. Which FortiSandbox integration method should the administrator configure on the FortiGate to achieve this?
⚠ Common exam trap
The trap here is assuming that any connection to FortiSandbox automatically blocks threats, when in fact the antivirus profile must be configured to block malicious files and the fabric connector must be properly established.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the FortiGate to send files to FortiSandbox via the 'fortisandbox' fabric connector and enable 'block malicious files' in the antivirus profile.
The FortiSandbox fabric connector on FortiGate enables seamless submission of files and retrieval of verdicts. When a file is deemed malicious, the FortiGate can block the file hash and C2 traffic via the antivirus profile's block action. This integrated approach automates threat protection without manual intervention, ensuring immediate response to zero-day threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure an external threat feed on the FortiGate using the FortiSandbox API to pull malicious IPs every 5 minutes.
Why it's wrong here
While FortiSandbox can provide threat intelligence, using an external threat feed to pull IPs is not the native integration for file submission and verdict blocking. This method would not automatically block file hashes based on sandbox detonation results. The fabric connector is the designed feature for this purpose, providing real-time verdicts and dynamic blocklists.
- ✗
Configure a syslog server on the FortiSandbox to send logs to the FortiGate, and create a firewall policy that denies traffic from the sandbox subnet.
Why it's wrong here
Syslog alone does not provide automated blocking. The FortiGate would not automatically parse sandbox verdicts from syslog to create blocklists. Denying traffic from the sandbox subnet is unrelated and would not block malicious files or C2 callbacks originating from internal hosts. This approach lacks the necessary integration for dynamic threat response.
- ✓
Configure the FortiGate to send files to FortiSandbox via the 'fortisandbox' fabric connector and enable 'block malicious files' in the antivirus profile.
Why this is correct
The FortiSandbox fabric connector allows the FortiGate to submit files and receive verdicts. Enabling 'block malicious files' in the antivirus profile ensures that once a verdict is returned, the FortiGate blocks the file hash and subsequent C2 traffic based on the sandbox's dynamic blocklist. This is the standard integration for automated threat blocking.
- ✗
Enable 'Use FortiSandbox for unknown files' in the antivirus profile and set the action to 'monitor' for all protocols.
Why it's wrong here
Setting the action to 'monitor' only logs the event without blocking. The requirement is to immediately block the file hash and C2 callback. Monitor mode would not enforce any blocking, leaving the network vulnerable. Additionally, simply enabling sandbox submission without the fabric connector may not provide the dynamic blocklist updates needed for C2 blocking.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.