FortiSandbox File Submission Conditions on FortiGate
A FortiGate administrator is troubleshooting why files are not being submitted to FortiSandbox for analysis. Which THREE conditions must be met for file submission to work? (Choose three.)
Quick Answer
The answer is that three conditions must be met for FortiSandbox file submission on FortiGate: a valid FortiSandbox license, the file type must be in the supported list (e.g., PE, PDF, Office documents), and the FortiGate must have network connectivity to the FortiSandbox appliance or cloud service. This is correct because the FortiGate acts as a filtering gateway, checking the license first to ensure the service is authorized, then verifying the file type against a predefined supported list—if the file type is unsupported, it is dropped immediately regardless of other settings. On the Fortinet NSE 7 Advanced Security NSE7 exam, this question tests your understanding of the FortiGate-FortiSandbox integration flow, often trapping candidates who overlook the file-type filter or assume any file can be submitted. A common memory tip is to think of the three Cs: Credentials (license), Category (file type), and Connection (network path).
⚠ Common exam trap
A common mix-up: candidates confuse the requirement for SSL inspection (must be enabled, not disabled) and assume FortiSandbox must be in inline mode, when in fact the FortiGate's inspection mode (proxy-based) is the critical factor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file type must be in FortiSandbox's supported list
FortiSandbox only supports analysis for specific file types (e.g., PE, PDF, Office documents). If the file type is not in the supported list, the FortiGate will not submit it, even if all other conditions are met. This is a fundamental filtering step in the FortiGate-FortiSandbox integration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSL inspection must be disabled for the policy
Why it's wrong here
SSL inspection does not affect file submission.
- ✓
The file type must be in FortiSandbox's supported list
Why this is correct
Unsupported files are not submitted.
- ✓
The antivirus profile must be in proxy-based inspection mode
Why this is correct
Flow-based does not support file submission.
- ✗
The FortiSandbox must be in inline scanning mode
Why it's wrong here
Inline scanning is a mode, but file submission works in other modes too.
- ✓
The FortiGate must have a valid FortiSandbox license
Why this is correct
License is required for submission.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network administrator has configured FortiGate to send files to FortiSandbox for analysis. However, files are not being submitted. The administrator checks the FortiGate configuration and sees that the FortiSandbox server IP is correctly entered. What is the most likely cause of the issue?
medium- ✓ A.A firewall policy is blocking communication to FortiSandbox on port 514
- B.The FortiSandbox is not licensed for file submission
- C.The file type is not supported by FortiSandbox
- D.The FortiGate antivirus profile is set to flow-based inspection
Why A: The most likely cause is that a firewall policy is blocking communication to FortiSandbox on port 514. FortiGate uses port 514 (syslog) to submit files to FortiSandbox, and if this port is blocked by an intermediate firewall or an implicit deny policy, the submission will fail even if the server IP is correctly configured. The administrator should verify that traffic to the FortiSandbox IP on UDP/TCP 514 is permitted by all relevant policies.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.