NSE7 Advanced Threat Protection Practice Question
An administrator wants to block a zero-day malware outbreak detected by FortiGuard. Which feature should be configured to automatically block the threat across all enabled FortiGate devices?
⚠ Common exam trap
Many candidates confuse FortiSandbox Cloud with a real-time blocking mechanism, but FortiSandbox Cloud provides analysis and retrospective detection, not automatic, proactive blocking across all devices like Outbreak Prevention does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FortiGuard Outbreak Prevention
FortiGuard Outbreak Prevention (option C) is the correct feature because it automatically pushes signatures to all FortiGate devices enrolled in the same FortiGuard network when a new zero-day malware outbreak is detected. This enables immediate, coordinated blocking without manual intervention, which is exactly what the administrator needs for a fast-spreading threat.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FortiSandbox Cloud
Why it's wrong here
FortiSandbox Cloud detonates suspicious files and returns a verdict, but it does not push automatic blocking across all FortiGates; that requires FortiGuard outbreak prevention or an IOC feed. It is tempting because sandboxing genuinely detects zero-day malware, and would be correct for analysing unknown files before a signature exists.
- ✗
IPS Custom Signatures
Why it's wrong here
Custom IPS signatures require the administrator to author and distribute the signature manually, so they do not automatically propagate a FortiGuard-detected outbreak across devices. They suit bespoke, organisation-specific threats. Automatic blocking of a known outbreak across all FortiGates is delivered through FortiGuard outbreak prevention and push updates.
- ✓
FortiGuard Outbreak Prevention
Why this is correct
FortiGuard Outbreak Prevention pushes indicators and IPS signatures for active outbreaks to every licensed FortiGate, blocking the zero-day automatically without manual signature authoring. This satisfies the requirement for immediate, fleet-wide blocking rather than per-device configuration.
- ✗
Application Control
Why it's wrong here
Application Control matches application signatures and categories, not FortiGuard-distributed malware indicators, so it cannot automatically block a newly detected outbreak fleet-wide. It is tempting because it enforces policy on applications, and would be correct for restricting which applications users may run rather than blocking malware.
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.