NSE4 Practice Test 31 — 15 Questions

Question 1

A FortiGate configured with IPS anomaly detection is generating false positives for the 'tcp_syn_flood' anomaly. The administrator wants to reduce the false positives without completely disabling the detection. Which action should the administrator take?

Accepted Answer

Increase the threshold value. The threshold determines the number of SYN packets per second that trigger an alarm. Increasing the threshold will require more SYN packets to trigger, reducing false positives while still detecting heavy floods.

Answer

Disable the anomaly and use a custom IPS signature

Answer

Decrease the threshold value

Answer

Set the action to 'pass'

Question 2

A FortiGate is configured with flow-based antivirus and an IPS profile on a policy. The administrator runs 'diagnose ips packet-list' and sees that packets are being forwarded without inspection. What is the most likely reason?

Accepted Answer

The session is offloaded to the NPU and is not being sent to the IPS engine. Flow-based inspection offloads traffic to the network processor (NPU) for forwarding without sending all packets to the CPU for inspection. The IPS diagnostic output showing packets forwarded without inspection indicates flow-based mode is skipping inspection for non-TCP traffic or when a session is offloaded.

Answer

The antivirus profile is set to proxy-based, conflicting with flow-based IPS

Answer

The IPS profile is configured with 'monitor' mode instead of 'protect'

Answer

The traffic is UDP and flow-based inspection does not inspect UDP

Question 3

A FortiGate administrator receives reports that some users are receiving spam emails despite an email filter profile being applied to the SMTP traffic. The email filter profile has 'spam' action set to 'discard'. What is the most likely reason spam is still reaching users?

Accepted Answer

The internal email server receives email directly from the internet without passing through the FortiGate. Email filter profiles scan email traffic that passes through the FortiGate. If users are receiving spam from external mail servers that connect directly to the internal mail server without passing through the FortiGate, the email filter will not inspect that traffic.

Answer

The spam dictionary is not updated with latest spam signatures

Answer

The email filter profile is not configured to scan outbound emails

Answer

The email filter profile is applied to the wrong policy direction (inbound vs outbound)

Question 4

A FortiGate administrator is troubleshooting why antivirus scanning is not working for HTTPS traffic. Which TWO steps should be verified?

Accepted Answer

Ensure the firewall policy has SSL/TLS deep inspection enabled. For antivirus to scan HTTPS traffic, deep inspection must be enabled on the firewall policy, and the antivirus profile must be configured with the appropriate inspection mode. Both are required.

Answer

Ensure the antivirus profile is set to proxy-based inspection

Answer

Confirm that the web filter profile is also applied

Answer

Check that the FortiSandbox is online for advanced scanning

Question 5

A FortiGate administrator needs to configure a policy so that traffic to a specific external server is exempted from SSL deep inspection. Which method should be used?

Accepted Answer

Add the server's address to the 'SSL/SSH Inspection Profile' exemptions list. Exemptions can be added in the SSL/SSH inspection profile to bypass inspection for specific destinations.

Answer

Create a separate firewall policy without SSL inspection for that server

Answer

Disable the IPS sensor on that policy

Answer

Set the antivirus profile to 'monitor' only

Question 6

A school district uses a FortiGate to filter web traffic for students. The administrator wants to enforce that Google searches are filtered for explicit content. Which configuration should be applied?

Accepted Answer

Enable 'Google Safe Search' in the web filter profile under 'FortiGuard Categories' -> 'Safe Search'.

Answer

Use an application control profile to block the 'Google Search' application.

Answer

Create a URL filter to block URLs containing 'porn' or 'adult'.

Answer

Block the URL category 'Search Engines' and allow only approved search engines.

Question 7

Which FortiGate security feature can be used to block outgoing emails that contain specific keywords, such as confidential information?

Accepted Answer

Email Filter. Email Filter profiles can scan SMTP, POP3, and IMAP traffic for keywords and patterns in email content. Antivirus scans for malware, web filter for URLs, application control for apps.

Answer

Web Filter

Answer

Application Control

Answer

Antivirus

Question 8

A FortiGate administrator wants to block spam emails destined for internal users. The FortiGate receives SMTP traffic on port 25. What is the most effective way to filter spam using the email filter profile?

Accepted Answer

Apply an email filter profile to a firewall policy that allows SMTP traffic. The email filter profile is applied to a firewall policy that matches SMTP traffic. It can perform spam filtering based on FortiGuard IP reputation and other heuristics.

Answer

Enable spam filtering in the antivirus profile

Answer

Use a DNS filter to block spam domains

Answer

Configure a web filter to block webmail

Question 9

A FortiGate administrator is configuring IPS to protect against a known exploit targeting a web server. The administrator wants to ensure that the IPS engine can decode the HTTP protocol. Which TWO actions are necessary?

Accepted Answer

Enable the HTTP protocol decoder in the IPS sensor. IPS protocol decoders are enabled per protocol. For HTTP, you need to enable the HTTP decoder. Additionally, if the traffic is HTTPS, SSL deep inspection must be enabled to decrypt the traffic so the decoder can analyze it.

Answer

Configure an IP pool for the web server

Answer

Set the IPS action to 'block'

Answer

Disable the FTP protocol decoder

Question 10

A FortiGate is configured with flow-based inspection and an IPS profile. The administrator runs 'diagnose ips session list' and sees many sessions with 'state=bypass'. What does this indicate?

Accepted Answer

The sessions are being offloaded to the NPU and are not inspected by IPS. In flow-based IPS, sessions can be bypassed when the IPS engine determines that further inspection is unnecessary, for example, if the session is considered low-risk or to reduce CPU load. This is normal behavior in flow-based mode.

Answer

The IPS profile is configured with 'pass' action for all signatures

Answer

The IPS signatures have expired and are not being applied

Answer

The FortiGate is under DoS attack and is dropping sessions

Question 11

A FortiGate administrator wants to block access to gambling websites using web filtering. Which FortiGuard category should be blocked?

Accepted Answer

Gambling. FortiGuard categorizes websites into many categories. Gambling is a specific category, and blocking it prevents access to those sites.

Answer

Spam

Answer

Malware

Answer

Pornography

Question 12

An administrator configures a DLP profile to detect credit card numbers in email traffic. The DLP rule uses a regular expression. However, the DLP sensor is not triggering on emails containing credit card numbers. What is a likely reason?

Accepted Answer

SSL deep inspection is not enabled on the policy. DLP sensors operate on traffic that has been decrypted if necessary. If the email is sent over TLS, the FortiGate needs SSL deep inspection to see the email content. Also, the DLP sensor needs to be applied to the correct direction (e.g., both send and receive).

Answer

The regular expression is case-sensitive and credit card numbers are lowercase

Answer

The DLP sensor is configured to 'monitor' only

Answer

The DLP profile is applied to the inbound policy only

Question 13

A network administrator notices that traffic from a specific internal host is not being inspected by the application control profile applied to the firewall policy. The policy is configured with proxy-based inspection and the application control profile includes a rule to block 'Facebook'. The administrator confirms the host can still access Facebook. What is the MOST likely cause?

Accepted Answer

The host is accessing Facebook over HTTPS and the policy does not have SSL/TLS deep inspection enabled.. Option D is correct because Facebook uses HTTPS. Without SSL deep inspection, FortiGate cannot see the application layer inside the encrypted tunnel, so application control cannot block Facebook.

Answer

The firewall policy is using flow-based inspection instead of proxy-based.

Answer

The application control profile is configured with 'deep inspection' disabled.

Answer

The application control profile is applied only to outgoing traffic, but the host is using a proxy.

Question 14

What is the difference between 'certificate inspection' and 'full SSL deep inspection' on a FortiGate?

Accepted Answer

Certificate inspection only validates the server certificate, while deep inspection decrypts and inspects the entire TLS session content.

Answer

Certificate inspection decrypts the traffic but does not check the certificate.

Answer

Deep inspection is less secure than certificate inspection.

Answer

Both methods provide the same level of inspection.

Question 15

A FortiGate in flow-based mode is configured with an antivirus profile to block infected files. A user downloads a .zip file containing a known virus, but the download is allowed and the file is not quarantined. What is the MOST likely reason?

Accepted Answer

Flow-based inspection does not decompress archives by default. Option C is correct because flow-based inspection does not buffer files for decompression, so viruses inside archives may be missed.

Answer

The antivirus profile is not set to 'block' for virus outbreaks

Answer

The virus definition database is outdated

Answer

Flow-based inspection does not support antivirus for .zip archives