Why FortiSandbox Is Not Analyzing Submitted Files
A network admin notices that files submitted to FortiSandbox are not being analyzed. The FortiGate is configured to send files to FortiSandbox. What is the MOST likely cause?
Quick Answer
The answer is that an expired FortiSandbox license is the most likely cause when submitted files are not being analyzed. This is because FortiSandbox relies on a valid subscription to activate its cloud-based or on-premise analysis engines; without it, the system will queue incoming files from the FortiGate but will not process them, leaving the admin with no analysis results. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of FortiSandbox licensing dependencies versus configuration errors—a common trap is to suspect network connectivity or FortiGate policy misconfigurations first, but the license status is the primary gatekeeper. Remember that even if the FortiGate successfully sends files, the sandbox itself must have an active license to perform the actual scanning. A quick memory tip: think of the license as the “key” that unlocks the analysis engine—no key, no work.
⚠ Common exam trap
A common mix-up: candidates assume connectivity or configuration issues (like firewall rules or file size limits) are the cause, but FortiSandbox will still accept submissions with an expired license and simply not analyze them, making the license status the most likely root cause.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FortiSandbox license is expired
The most likely cause is an expired FortiSandbox license. When the license expires, FortiSandbox stops analyzing submitted files and may reject new submissions, even though the FortiGate is configured to send them. The FortiGate will still attempt to forward files, but FortiSandbox will not process them, resulting in no analysis results being returned.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
FortiSandbox license is expired
Why this is correct
An expired license prevents analysis. The file submission queue will accumulate.
- ✗
FortiGate firewall policy is blocking the connection to FortiSandbox on port 443
Why it's wrong here
FortiSandbox communication uses port 514 (syslog) or other ports, not typically 443.
- ✗
FortiSandbox is in quarantine mode
Why it's wrong here
Quarantine mode does not affect analysis; it affects how verdicts are handled.
- ✗
File size exceeds the maximum submission size limit on FortiGate
Why it's wrong here
Oversize files are typically dropped or not submitted, but the admin would see an error.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network admin notices that files submitted to FortiSandbox from FortiGate are not being analyzed. The FortiGate has a valid FortiSandbox license and the device is reachable. What configuration step is most likely missing?
medium- A.The FortiSandbox feature is not enabled in the VDOM settings
- ✓ B.The antivirus profile has 'FortiSandbox Inline Scan' disabled
- C.The FortiSandbox server IP is not configured under Security Fabric > Fabric Connectors
- D.The FortiGate is not registered with FortiCloud
Why B: FortiGate uses antivirus profiles to define scanning behavior for traffic. Even with a valid FortiSandbox license and reachability, the antivirus profile must have 'FortiSandbox Inline Scan' enabled to submit files to FortiSandbox for analysis. Without this setting, files are not forwarded for sandboxing, regardless of other configurations.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.