NSE7 Advanced Threat Protection Practice Question
You receive an alert from FortiSandbox that a file has been rated 'highly malicious'. The FortiGate has the FortiSandbox inline scanning enabled with the action 'block malicious'. However, the file is still being downloaded by users. What is the most likely reason?
⚠ Common exam trap
Candidates often assume 'block malicious' applies universally to all files, but FortiSandbox inline scanning only inspects files whose types are explicitly configured in the scanning profile, so a missing file type bypasses the sandbox entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file type is not listed in the scanning profile for FortiSandbox
FortiSandbox inline scanning only inspects file types that are explicitly listed in the scanning profile. If the file type (e.g., .zip, .pdf, or a specific executable extension) is not included in the profile, FortiGate will allow the file to pass through without sending it to FortiSandbox for analysis, even if the action is set to 'block malicious'. This explains why a file rated 'highly malicious' can still be downloaded by users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FortiSandbox device is not reachable from FortiGate
Why it's wrong here
If unreachable, inline scanning would fail or fall back, not allow malicious files through without any action.
- ✗
The IPS sensor is blocking the connection before the antivirus inspection
Why it's wrong here
IPS blocking would prevent the download entirely, not allow it without scanning.
- ✗
The antivirus database is outdated
Why it's wrong here
Outdated signatures do not affect FortiSandbox verdicts; the inline scanner uses sandbox analysis.
- ✓
The file type is not listed in the scanning profile for FortiSandbox
Why this is correct
If the file type is excluded, FortiGate will not submit it to FortiSandbox for analysis, allowing it to pass.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.