NSE7 Advanced Threat Protection Practice Question
An administrator configures FortiSandbox to quarantine files that are rated 'malicious'. They notice that some files are being quarantined even though the verdict is 'clean'. What could explain this?
⚠ Common exam trap
Candidates often assume quarantine is strictly tied to the verdict, overlooking that FortiSandbox's quarantine action can be independently triggered by a risk score threshold, leading to quarantine of 'clean' files with high risk scores.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The quarantine action is set to apply to files with a risk level above a certain threshold, and clean files have been incorrectly rated
FortiSandbox's quarantine action can be configured based on a risk score threshold, not solely on the verdict. If the risk score for a file rated 'clean' exceeds the configured threshold, the file may still be quarantined. This occurs because the verdict and risk score are separate attributes; a 'clean' verdict indicates no known malware, but the file's behavior or heuristics may still generate a high risk score that triggers quarantine.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The quarantine action is set to apply to files with a risk level above a certain threshold, and clean files have been incorrectly rated
Why this is correct
Risk level thresholds can cause false positives if set too aggressively.
- ✗
FortiSandbox uses a whitelist that includes those files
Why it's wrong here
Whitelisted files would not be quarantined.
- ✗
The files were submitted by a different FortiGate with different settings
Why it's wrong here
Submissions from different devices don't affect quarantine logic.
- ✗
The administrator has enabled 'aggressive mode' which quarantines all files
Why it's wrong here
There is no such mode in FortiSandbox.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.