StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Antivirus

Practice question 296 of 440 · hard

An EMS threat feed and an external malware blocklist contain the same file hash. Both feed actions are explicitly Block, and local AV did not match. Which detection source is reported first under the documented order?

Choose the single best answer.

  1. A.Both detections must be reported before either feed can block.
  2. B.EMS threat feed.
  3. C.External malware blocklist.
  4. D.FortiGuard outbreak prevention.
Show the answer and explanation

✓ Correct answer

  • EMS threat feed.

The documented order checks local AV, then EMS, then the external hash list, then outbreak prevention. With local AV clean and both feed actions set to Block, the EMS hit blocks and is reported first; the later checks do not take precedence.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.