NSE4 Practice Test 32 — 15 Questions

Question 1

A network administrator notices that users can access websites categorized as 'Pornography' despite a web filter profile blocking that category. The firewall policy uses the web filter profile and is applied to the users' traffic. What is the MOST likely cause?

Accepted Answer

The FortiGate cannot reach the FortiGuard servers. Option C is correct because if the FortiGate cannot reach the FortiGuard servers, web filtering will fail open by default, allowing all web traffic. The administrator should verify FortiGuard connectivity.

Answer

The web filter profile is applied to the wrong policy

Answer

The users are bypassing the FortiGate using a proxy

Answer

The web filter profile has the 'Override' feature enabled

Question 2

An organization uses FortiSandbox to detect advanced threats. The administrator wants to ensure that files downloaded from the internet are sent to FortiSandbox for analysis before being delivered to users. Which Antivirus profile setting should be configured?

Accepted Answer

Enable 'Inline Scan' for FortiSandbox. Option D is correct. The 'FortiSandbox Inline Scan' option sends files to FortiSandbox and waits for verdict before allowing or blocking the file.

Answer

Enable 'FortiSandbox Monitoring'

Answer

Enable 'FortiSandbox Quarantine'

Answer

Set 'Scan Mode' to 'Quick'

Question 3

A FortiGate administrator has configured an Application Control profile to block 'P2P' applications. However, users are still able to use BitTorrent. What is the MOST likely reason?

Accepted Answer

The firewall policy does not have SSL deep inspection enabled, and BitTorrent is using encryption. Option A is correct. If the Firewall policy does not have 'Deep Inspection' enabled for HTTPS, encrypted P2P traffic cannot be inspected by Application Control, and the application may not be detected.

Answer

The Application Control profile is configured in 'Monitor' mode instead of 'Block'

Answer

The BitTorrent signatures are not included in the FortiGate firmware

Answer

The Application Control profile is applied to the wrong direction

Question 4

An administrator wants to allow users to override a blocked category (e.g., Social Networking) by entering an administrator-defined password. Which of the following must be configured?

Accepted Answer

Enable 'Override' in the Web Filter profile and configure an authentication scheme. Option A is correct. Web filter override allows users to request access to blocked sites by providing a password. The override must be enabled in the web filter profile and a FortiGate authentication scheme must be set up.

Answer

Configure a DNS filter to bypass the block

Answer

Create a separate firewall policy with a higher priority that permits the traffic

Answer

Set the web filter profile to 'Monitor' mode instead of 'Block'

Question 5

Which FortiGate feature allows the administrator to scan SMTP, IMAP, and POP3 traffic for spam and apply actions such as tagging or discarding?

Accepted Answer

Email filter profile. Option C is correct. The email filter profile is designed to scan email traffic for spam and can apply actions like tag, discard, or quarantine.

Answer

Application control profile

Answer

Antivirus profile

Answer

Web filter profile

Question 6

A FortiGate administrator is configuring a data leak prevention (DLP) profile to prevent the leakage of social security numbers (SSNs) via email. Which TWO settings must be configured in the DLP profile?

Accepted Answer

Enable SSL deep inspection on the firewall policy. A DLP sensor with a custom pattern for SSNs is needed to detect the data. SSL deep inspection is required to decrypt email traffic (SMTP over TLS) so DLP can inspect the content. FortiSandbox and IPS do not directly handle DLP.

Answer

Set the email filter to quarantine

Answer

Configure IPS to block SSN patterns

Answer

Enable FortiSandbox integration

Question 7

A FortiGate receives a file via SMTP that contains a virus. The antivirus profile is set to 'Block' for viruses and the action is set to 'Quarantine'. However, the email is delivered to the user with the infected attachment. What could be the reason?

Accepted Answer

The antivirus profile is using flow-based inspection and the SMTP scan is not enabled. Option B is correct. If the antivirus profile is configured for flow-based inspection, some email protocols may not be fully inspected unless explicitly configured. Flow-based inspection may skip SMTP depending on the configuration.

Answer

The email filter profile is overriding the antivirus action

Answer

The antivirus signatures are outdated

Answer

The file is larger than the FortiGate's virus database can handle

Question 8

A FortiGate administrator receives reports that users cannot access a legitimate website that uses HTTPS. The web filtering profile is configured with strict FortiGuard categories and 'monitor all' for unknown sites. The firewall policy has an SSL/SSH inspection profile set to 'deep-inspection'. What is the most likely cause of the issue?

Accepted Answer

The website uses a self-signed certificate which is not trusted by the FortiGate CA bundle. When deep inspection is enabled, the FortiGate decrypts and re-encrypts traffic. If the website's certificate is not trusted by the FortiGate (e.g., self-signed or issuer not in CA bundle), the connection may fail.

Answer

The antivirus profile is blocking a file on the website

Answer

The DNS filter is blocking the domain

Answer

The website's FortiGuard category is set to 'block'

Question 9

An administrator runs the command 'diagnose ips anomaly list' and sees many entries for 'tcp_src_session' with high counts. Users report slow internet. What is the most likely issue?

Accepted Answer

A host on the network is infected with malware that is generating many outbound connections. High tcp_src_session counts indicate many TCP sessions from a single source, often due to a host generating excessive connections (e.g., malware or P2P).

Answer

The IPS signature database is corrupted

Answer

The FortiGate has a hardware failure

Answer

The FortiGate is under a DDoS attack

Question 10

Which security profile is used to detect and prevent spam email messages?

Accepted Answer

Email filter profile. Option B is correct: Email filter profile provides anti-spam capabilities using FortiGuard, custom rules, and integration with FortiMail.

Answer

DLP profile

Answer

Web filter profile

Answer

Antivirus profile

Question 11

A FortiGate is configured with SSL deep inspection using a locally generated CA certificate. A user reports that they cannot access https://www.example.com and receive a certificate error. The administrator checks the firewall policy and sees that the SSL inspection profile is set to 'certificate-inspection' instead of 'deep-inspection'. What is the MOST likely effect?

Accepted Answer

The FortiGate does not decrypt the traffic, so the original server certificate is presented to the client, which may be valid; the error is unrelated.. Option B is correct. Certificate-inspection does not decrypt; it only validates. Therefore, the user sees the original server certificate. If there is an error, it's likely due to something else.

Answer

The FortiGate decrypts the traffic but does not re-sign, causing mismatch errors.

Answer

The FortiGate blocks the connection because certificate-inspection cannot handle deep inspection profiles.

Answer

The user will see a warning about the certificate but will be able to proceed after accepting it.

Question 12

A network administrator notices that some users can access blocked web categories despite a web filter profile applied to the policy. The admin runs 'diagnose debug rating' and sees 'rating not allow' for the category. What is the MOST likely cause?

Accepted Answer

The web filter profile has an 'override' configured for those users. Option B is correct because the override feature can be used to grant users temporary access to blocked categories, bypassing the web filter rating.

Answer

The policy is not using the correct web filter profile

Answer

DNS filter is allowing the domain

Answer

The FortiGuard web filter database is outdated

Question 13

What is the primary purpose of FortiSandbox integration with FortiGate antivirus?

Accepted Answer

To detect zero-day malware by analyzing file behavior in a sandbox environment. Option B is correct. FortiSandbox provides advanced threat detection by executing files in a controlled environment.

Answer

To replace the local antivirus scanning engine

Answer

To perform SSL deep inspection

Answer

To cache antivirus signatures locally

Question 14

An administrator wants to ensure that all DNS traffic from internal users is filtered by the FortiGate to block malicious domains. Which TWO configurations are necessary? (Choose two.)

Accepted Answer

Apply the DNS filter profile to a firewall policy that matches DNS traffic. Options A and B are correct. The DNS filter profile and its application to a firewall policy are necessary.

Answer

Set DNS server to FortiGate's IP

Answer

Enable sinkhole on the DNS filter profile

Answer

Configure SSL deep inspection for DNS over HTTPS

Question 15

An administrator wants to block users from uploading files to cloud storage services like Google Drive via HTTPS. Which security profile combination is required?

Accepted Answer

Application control profile to block cloud storage applications, with deep inspection enabled. To block file uploads to HTTPS sites, deep inspection must be enabled to decrypt traffic. Then, application control can be used to identify cloud storage applications, and a DLP or file filter can block uploads. However, the most direct method is to use an antivirus profile with file pattern blocking, but that requires deep inspection. Alternatively, use application control to block the application entirely.

Answer

IPS profile to block file uploads to cloud services

Answer

DNS filter to block Google Drive domain

Answer

Web filter profile with URL filter to block Google Drive