NSE7 Advanced Threat Protection Practice Question
An administrator wants to automatically block a file that FortiSandbox has determined to be malicious. The FortiGate is configured with an antivirus profile that includes FortiSandbox submission. Which verdict action should be set to 'block' in the antivirus profile to achieve this?
⚠ Common exam trap
Watch out — candidates often confuse 'Unknown' with 'Malicious' and think blocking unknown files is safer, but FortiSandbox's 'Unknown' verdict means the file could not be analyzed (e.g., due to size or timeout), and blocking it would disrupt legitimate traffic; the correct approach is to block only confirmed malicious files.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Malicious
The 'Malicious' verdict action in the antivirus profile is specifically designed to block files that FortiSandbox has determined to be malicious. When FortiSandbox submits a file and returns a 'malicious' verdict, the FortiGate uses this action to enforce blocking, ensuring the file is not delivered to the end user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Exempted
Why it's wrong here
Exempted files are allowed.
- ✗
Unknown
Why it's wrong here
Unknown may be allowed or quarantined depending on settings, but not automatically blocked.
- ✓
Malicious
Why this is correct
The 'Malicious' verdict action will block files determined malicious by FortiSandbox.
- ✗
Clean
Why it's wrong here
Clean allows the file.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.