NSE7 Advanced Threat Protection Practice Question
A security admin notices that FortiClient ATP is not blocking threats on a managed endpoint. The FortiClient is registered with FortiGate and the ATP feature is enabled in the FortiClient profile. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently assume enabling the ATP feature in the FortiClient profile is sufficient for real-time blocking, overlooking that the FortiGate antivirus profile's 'Scan on Access' setting is the actual control that enables real-time scanning on the endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The FortiGate antivirus profile applied to the FortiClient policy has 'Scan on Access' disabled
FortiClient ATP (AntiVirus/AntiMalware) relies on the FortiGate's antivirus profile to enforce real-time scanning. Even if the ATP feature is enabled in the FortiClient profile, the 'Scan on Access' setting in the FortiGate antivirus profile applied to the FortiClient policy must be enabled for the endpoint to block threats on access. If 'Scan on Access' is disabled, FortiClient will not perform real-time scanning, allowing threats to go undetected despite ATP being enabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FortiGate's antivirus signatures are outdated
Why it's wrong here
Outdated signatures could cause missed detection, but ATP would still attempt scanning.
- ✗
The FortiClient endpoint has a different antivirus product installed that conflicts
Why it's wrong here
FortiClient can coexist with other products, but the issue is likely configuration.
- ✓
The FortiGate antivirus profile applied to the FortiClient policy has 'Scan on Access' disabled
Why this is correct
ATP relies on on-access scanning to block threats immediately.
- ✗
FortiClient is in standalone mode instead of managed mode
Why it's wrong here
Managed mode is required for ATP, but the admin said FortiClient is registered.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.