View all questions & answers for the NSE 7 - FortiSASE 25 Enterprise Administrator Exam Materials exam


Question 31 Discussion

Refer to the exhibit. Based on the configuration shown, in which two ways will FortiSASE process sessions that require FortiSandbox inspection? (Choose two answers)

  • A. All files will be sent to an on-premises FortiSandbox for inspection.
  • B. FortiClient quarantines only infected files that FortiSandbox detects as medium level.
  • C. All files executed on a USB drive will be sent to FortiSandbox for analysis.
  • D. Only endpoints assigned a profile for sandbox detection will be processed by the sandbox feature.
Correct Answer: B,C

Brave-Dump Clients Votes

BC 100%

Comments



javaughn Bryan 2025-11-21 20:40:18

Selected Answers: B, C


D is incorrect.

Explanation:

C is correct because under the "File Submission Options," the setting "All Files Executed from Removable Media" is enabled. A USB drive is a type of removable media, so any file executed from it will be submitted for sandbox inspection.

B is correct because under "Remediation Actions," the "Action" is set to "Quarantine". The "Sandbox Detection Verdict Level" shows that the "Medium" level is selected. This means FortiClient will quarantine files that FortiSandbox detects at a medium level or higher.

PAGE 107 & 108. SASE CORE ADMINISTRATOR GUIDE
  • Brave-Dumps Admin 2025-11-25 12:56:55
    Thank you.