Enable Machine Learning Engine for Antivirus on FortiGate
An administrator wants to configure FortiGate to use the machine learning engine for advanced antivirus detection. Which setting must be enabled in the antivirus profile?
Quick Answer
The correct answer is to enable the 'Machine Learning Engine' setting within the antivirus profile. This is required because FortiGate’s advanced antivirus detection relies on a dedicated on-device ML engine that analyzes behavioral patterns and heuristics to catch unknown or zero-day malware, moving beyond traditional signature-based detection. On the Fortinet NSE 7 Advanced Security NSE7 exam, this question tests your understanding of how to configure layered threat protection, often appearing as a direct multiple-choice item where the trap is confusing the ML engine toggle with other profile options like "Use Extreme Database" or "Block Malicious URLs." A common memory tip is to think of the ML engine as your "behavioral bouncer"—it must be explicitly invited to the party in the antivirus profile to analyze file actions, not just file names. Remember: if you want FortiGate to spot the unknown, flip the ML switch on.
⚠ Common exam trap
It's easy for candidates to confuse the machine learning engine with FortiSandbox integration, assuming that sandboxing is required for ML-based detection, when in fact the ML engine is a standalone on-device feature that must be enabled separately in the antivirus profile.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Machine Learning Engine' in the antivirus profile
The machine learning engine for advanced antivirus detection is a dedicated feature within the antivirus profile that must be explicitly enabled. This engine uses behavioral analysis and heuristics to detect unknown or zero-day malware without relying solely on signature-based detection. Enabling this setting allows FortiGate to leverage on-device ML models to identify malicious files based on patterns and anomalies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable 'Machine Learning Engine' in the antivirus profile
Why this is correct
The machine learning engine must be enabled in the antivirus profile to use AI-based detection.
- ✗
Enable 'Detect All' in the antivirus profile
Why it's wrong here
'Detect All' is not a standard setting.
- ✗
Set 'Scan Mode' to 'Quick' in the antivirus profile
Why it's wrong here
Scan mode affects scanning depth, not ML engine.
- ✗
Enable 'Use FortiSandbox' in the antivirus profile
Why it's wrong here
FortiSandbox is different from machine learning engine.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to protect against zero-day malware that has not yet been discovered by signature-based detection. Which TWO technologies can help mitigate such threats?
medium- ✓ A.Machine Learning Engine
- ✓ B.Outbreak Prevention
- C.Signature-based antivirus
- D.Web filtering
- E.Application control
Why A: The Machine Learning Engine (A) is correct because it uses behavioral analysis and static file analysis to detect previously unknown malware based on patterns and anomalies, without relying on signatures. This allows it to identify zero-day threats by analyzing file characteristics and runtime behavior in real time.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.