From the FortiClient EMS Integration lesson, the Study Guide states that FortiSandbox and FortiClient EMS integration helps break the kill chain by monitoring all downloads, removable media, mapped network drives, and email client file downloads - intercepting threats at the Delivery stage before they can execute on the endpoint.
Additionally, from the Attack Methodologies section: "When a USB is attached to a host protected with FortiClient, FortiClient can send the files on the USB drive to FortiSandbox for analysis, before allowing the user access to the files" - further confirming the Delivery stage focus.

The FortiClient EMS Integration section is explicit on this point. It says: "You must include the sandbox profile in the active endpoint policy." It then explains how off-fabric handling works: "FortiClient on-fabric detection rules configured within the policy will classify endpoints as on-fabric or off-fabric. The Profile (Off-Fabric) setting allows you to select a second profile to be applied to endpoints when they are determined to be off-fabric." This means the control point for applying FortiSandbox-related behavior to off-fabric endpoints is the endpoint policy, not the fabric connector, not a workgroup, and not the sandbox profile by itself. The sandbox profile defines FortiSandbox behavior, but it must be attached through the active endpoint policy, where the Off-Fabric profile selection is made. Therefore, the correct answer is C. As part of the endpoint policy configuration.

From the Deployment and System Settings lesson, the Study Guide states:
"You can submit emails from an upstream MTA server to FortiSandbox using a BCC adapter. FortiSandbox will extract attachment files and URLs in an email body." For a BCC adapter to function correctly, two critical prerequisites must be in place:
Option C - The upstream SEG must be configured to BCC emails to a FortiSandbox sub-domain so that email copies are routed to FortiSandbox for analysis Option D - An MX record must be added to the DNS server for the BCC email sub-domain, so that the sub-domain resolves to the FortiSandbox IP address, allowing the SEG to properly deliver BCC email copies Option A is incorrect because the BCC adapter handles full email inspection - FortiSandbox itself extracts files and URLs rather than the SEG doing this. Option B is incorrect because an MX record (not just an A record) is the required DNS configuration for email routing.

From the Scanning and Rating Components lesson, the Study Guide explicitly states:
"The rating engine analyzes the tracer engine's information." - confirms Option E
"FortiSandbox checks connection attempts to any URLs against the FortiGuard web filtering database. FortiSandbox submits hashes of files generated during sandbox analysis to the Sandbox Community Cloud to check for existing verdicts. Additionally, it compares these file hashes against the FortiGuard Cloud-Based Threat Intelligence database." - confirms Option B
"After analysis is complete, the rating engine generates a verdict." - confirms Option D
"Finally, the rating engine generates a report containing all details collected by the tracer engine." Option A is incorrect as the rating engine does not rate third-party device effectiveness. Option C is incorrect - verdict sharing is done by the FortiSandbox system through malware/URL packages, not specifically by the rating engine component.

The Study Guide states that in an HA cluster, "As well as normal scanning duties, the primary node also manages the cluster, distributes jobs, and gathers the verdicts." It also says that "The worker nodes provide load balancing. The primary node distributes scan jobs to the worker nodes." From those official statements, the primary node is not just a coordinator. It also performs normal scanning duties itself, while distributing scan jobs across worker nodes for load balancing. That rules out A, because the secondary node is for failover, not normal job distribution. It rules out C, because the primary is not restricted to itself only. It also rules out D, because the primary can still perform scanning duties and is not limited to sending all jobs only to workers. Therefore, when the primary receives MTA jobs, the correct behavior is that it distributes the MTA jobs to itself or to worker nodes.