How to Configure FortiSandbox to Automatically Block Malicious Files in Email
A security administrator is configuring FortiSandbox integration to automatically block malicious files detected in email attachments. Which TWO actions are required to achieve this integration?
Quick Answer
The answer is to enable 'Block malicious files detected by FortiSandbox' in the antivirus profile, paired with configuring the FortiGate to submit email attachments to FortiSandbox for verdict analysis. This integration works because FortiSandbox performs deep static and dynamic analysis on suspicious files, then sends a verdict back to FortiGate, which updates its local block list to quarantine or drop the malicious attachment at the email gateway. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of how antivirus profiles and FortiSandbox server objects interact within a security fabric—a common trap is assuming that enabling the block option alone is sufficient without also ensuring the FortiGate is configured to submit files to the sandbox. A useful memory tip is to think of it as a two-step handshake: submit first, then block based on the verdict.
⚠ Common exam trap
Many candidates confuse the requirement for FortiSandbox to send SNMP traps (which is only for alerting) with the actual blocking action, or they mistakenly think that enabling the machine learning engine alone provides sandbox integration, when in fact it is a separate local detection feature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure FortiGate to submit files to FortiSandbox for analysis
FortiGate must be configured to submit files to FortiSandbox for analysis, which is the foundational step to enable detection of malicious content in email attachments. This submission is typically done via the FortiGate antivirus profile, where the 'FortiSandbox' inline scanning option is enabled, allowing files to be sent to FortiSandbox for verdict-based blocking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure FortiGate to submit files to FortiSandbox for analysis
Why this is correct
File submission is required so FortiSandbox can analyze files.
- ✗
Deploy FortiClient endpoints with full disk encryption
Why it's wrong here
Full disk encryption is unrelated to FortiSandbox integration.
- ✗
Configure FortiSandbox to send SNMP traps when a file is malicious
Why it's wrong here
SNMP traps are not used for automatic blocking; verdicts are used.
- ✗
Enable FortiGate's machine learning engine on the antivirus profile
Why it's wrong here
Machine learning is a separate feature, not required for FortiSandbox integration.
- ✓
Enable 'Block malicious files detected by FortiSandbox' in the antivirus profile
Why this is correct
This setting tells FortiGate to automatically block files based on FortiSandbox verdicts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to automatically block a file that FortiSandbox has determined to be malicious. The FortiGate is configured with an antivirus profile that includes FortiSandbox submission. Which verdict action should be set to 'block' in the antivirus profile to achieve this?
medium- A.Exempted
- B.Unknown
- ✓ C.Malicious
- D.Clean
Why C: The 'Malicious' verdict action in the antivirus profile is specifically designed to block files that FortiSandbox has determined to be malicious. When FortiSandbox submits a file and returns a 'malicious' verdict, the FortiGate uses this action to enforce blocking, ensuring the file is not delivered to the end user.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.