NSE7 Advanced Threat Protection Practice Question
Exhibit
Refer to the exhibit.
config antivirus profile
edit "default"
set comment "Default antivirus"
config http
set options scan
set av-scan mode=flow-based
set fortisandbox inline-scan disable
set quarantine enable
end
config ftp
set options scan
set av-scan mode=flow-based
set fortisandbox inline-scan disable
set quarantine enable
end
config smb
set options scan
set av-scan mode=flow-based
set fortisandbox inline-scan disable
set quarantine enable
end
next
endRefer to the exhibit. An administrator notices that some malware files are not being detected by FortiGate. The antivirus profile uses flow-based scanning with FortiSandbox disabled. What is the most likely reason for missed detections?
⚠ Common exam trap
Candidates often assume flow-based scanning is always less thorough than proxy-based, but the real issue is the lack of FortiSandbox integration for unknown malware analysis, not the scanning mode itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FortiSandbox inline-scan is disabled, so unknown malware is not analyzed
Flow-based scanning inspects files as they traverse the firewall, but it relies on signatures and heuristics for detection. Without FortiSandbox inline-scan enabled, unknown or zero-day malware that does not match existing signatures will not be sent to the sandbox for behavioral analysis, so it can pass undetected. Option B correctly identifies that disabling FortiSandbox removes the ability to analyze unknown threats, which is the most likely reason for missed detections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Flow-based scanning is less thorough than proxy-based
Why it's wrong here
Flow-based is efficient but can miss some threats; however, the main issue is missing sandbox.
- ✓
FortiSandbox inline-scan is disabled, so unknown malware is not analyzed
Why this is correct
Without FortiSandbox, new malware may not be detected by signatures alone.
- ✗
Quarantine is enabled, which causes files to be dropped before scanning
Why it's wrong here
Quarantine is applied after detection, not before.
- ✗
The antivirus profile is not applied to the firewall policy
Why it's wrong here
The exhibit does not indicate policy application; the profile itself is configured.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.