Why Some Files Are Not Forwarded to FortiSandbox: File Size Configuration
An administrator configured FortiGate to forward suspected malicious files to FortiSandbox. They set the action to 'block' for malicious verdicts. Some files are being blocked, but others with a 'clean' verdict are allowed. However, they notice that some files that should have been sent to FortiSandbox are not being forwarded. Which reason is MOST likely?
Quick Answer
The answer is that the file size exceeds the maximum size configured for FortiSandbox scanning. This is the most likely reason because FortiGate’s antivirus and web filtering profiles enforce file size limits before any submission to FortiSandbox occurs; if a file is larger than the configured threshold, FortiGate simply skips forwarding it, regardless of the action set for malicious verdicts. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding of how scanning profiles interact with external sandboxing—a common trap is assuming all suspicious files are automatically sent, when in reality size and type filters act as a gatekeeper. Remember that FortiSandbox submission is not a blanket process; it respects the same file-size constraints you set for local scanning. A helpful memory tip: think of it as a bouncer at a club—if the file is too big, it never even gets to the sandbox line.
⚠ Common exam trap
Candidates often assume network or resource issues (overloaded FortiSandbox or disk space) are the cause, but the question specifically describes files that 'should have been sent' but are not, pointing to a configuration-based filter like file size limits rather than transient failures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file size exceeds the maximum size configured for FortiSandbox scanning
The most likely reason is that the file size exceeds the maximum size configured for FortiSandbox scanning. FortiGate has a configurable limit (default 10 MB) for files sent to FortiSandbox; files larger than this threshold are not forwarded, even if the antivirus engine would otherwise trigger a submission. This explains why some files are blocked or allowed based on verdicts, while others are never submitted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FortiGate antivirus engine is set to proxy-based mode
Why it's wrong here
Proxy mode is fine for sandbox integration.
- ✗
The FortiGate has insufficient disk space for temporary files
Why it's wrong here
Disk space issues would affect overall scanning but are less specific to sandbox submission.
- ✓
The file size exceeds the maximum size configured for FortiSandbox scanning
Why this is correct
File size limits in the scanning profile prevent oversized files from being submitted to FortiSandbox.
- ✗
The FortiSandbox device is overloaded and rejecting submissions
Why it's wrong here
Overload would affect submissions but would likely result in errors, not silent dropping.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate is configured to submit files to FortiSandbox. The administrator notices that files are being submitted but no verdicts are returned. Which two conditions could cause this?
hard- ✓ A.The FortiSandbox server is not reachable from the FortiGate
- B.The file type is not supported by FortiSandbox
- ✓ C.The file size exceeds the FortiSandbox submission limit
- D.The FortiSandbox license has expired
- E.The antivirus profile is set to monitor mode
Why A: When FortiSandbox is not reachable from the FortiGate, the file cannot be submitted for analysis, resulting in no verdict returned. Similarly, if the file size exceeds the FortiSandbox submission limit, the file may be rejected, preventing verdict generation. Unsupported file types (B) still get a verdict (e.g., skipped). An expired license (D) also prevents verdict return, but the explanation must match the new correct set: A and C are the only correct conditions among the list. The antivirus profile set to monitor mode (E) does not affect verdict return; it only controls action taken on verdict.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.