NSE4 Practice Test 33 — 15 Questions

Question 1

An administrator wants to block an application named 'Skype' on the network. They create an application control profile and add a rule to block 'Skype'. However, after applying the profile to the policy, users can still use Skype. What is the most likely reason?

Accepted Answer

Skype traffic is encrypted and SSL deep inspection is not enabled. Application control requires that the traffic be visible to the FortiGate. If Skype is allowed to bypass inspection (e.g., because SSL deep inspection is not enabled, or because the application uses a non-standard port not monitored), the rule may not match.

Answer

The application control profile is not enabled on the firewall policy

Answer

The application signature for Skype is outdated

Answer

The application control rule is set to 'monitor' instead of 'block'

Question 2

An administrator integrates FortiGate with FortiSandbox for advanced threat detection. The FortiGate is configured to send files to FortiSandbox for analysis. Despite correct configuration, files are not being submitted. The administrator runs 'diagnose debug application fortisandbox -1' and sees 'no server configured'. What is the issue?

Accepted Answer

The FortiSandbox server IP address is not configured on the FortiGate. The debug output indicates that the FortiSandbox server is not configured. Even if the integration settings are present, the FortiGate must have the FortiSandbox server IP and credentials properly configured under Security Fabric > FortiSandbox.

Answer

The FortiSandbox license has expired

Answer

Firewall policies are blocking communication to the FortiSandbox server

Answer

The antivirus profile is not configured to submit files to FortiSandbox

Question 3

A network administrator wants to prevent users from accessing known malicious websites using FortiGate. Which security profile should be applied to the firewall policy to achieve this goal?

Accepted Answer

Web filtering profile. Web filtering profiles allow administrators to control access to websites based on FortiGuard categories, URL filtering, and DNS filtering.

Answer

Antivirus profile

Answer

Application control profile

Answer

IPS profile

Question 4

A FortiGate administrator wants to create a web filter profile that blocks access to social networking sites during work hours but allows them during lunch breaks. Additionally, the administrator wants to ensure that HTTPS social networking sites are blocked. Which TWO configurations are required? (Choose two.)

Accepted Answer

Create a web filter profile with a FortiGuard category filter that blocks the 'Social Networking' category and set a time-based schedule.

Answer

Apply the web filter profile to a firewall policy that uses a schedule for work hours.

Answer

Use a URL filter to manually list all social networking sites.

Answer

Configure DNS filter to block social networking domains.

Question 5

Which TWO are valid types of SSL/TLS inspection available on FortiGate?

Accepted Answer

Full SSL Deep Inspection. Options A and B are correct. FortiGate supports certificate inspection (examining certificates) and full deep inspection (decrypting and scanning content).

Answer

Off-box SSL Inspection

Answer

Proxy SSL Inspection

Answer

Passive SSL Inspection

Question 6

An administrator wants to block users from uploading sensitive documents through webmail. Which security profile should be configured on the FortiGate to achieve this goal?

Accepted Answer

Data Leak Prevention (DLP). Option B is correct because DLP profiles can block data based on content inspection, including file uploads to webmail.

Answer

Antivirus

Answer

Application control

Answer

Web filter

Question 7

An administrator configures an IPS profile to block SQL injection attacks. However, SQL injection traffic is still passing through the FortiGate. The administrator confirms the IPS profile is applied to the correct policy. What is the most likely reason?

Accepted Answer

IPS signatures for SQL injection are disabled in the profile. Option A is correct. The administrator must verify that the relevant IPS signatures are enabled and set to an action like 'block' or 'reset'.

Answer

The firewall policy is in proxy-based mode

Answer

The IPS profile is configured for anomaly detection only

Answer

Deep inspection is required for IPS to work

Question 8

What is the difference between certificate inspection and full SSL deep inspection on a FortiGate?

Accepted Answer

Certificate inspection only validates the server certificate; deep inspection decrypts and inspects the content. Option B is correct. Certificate inspection checks the server certificate, while deep inspection decrypts and inspects the entire session.

Answer

Certificate inspection decrypts traffic; deep inspection does not

Answer

Deep inspection is faster than certificate inspection

Answer

Both provide the same level of security

Question 9

An administrator runs the CLI command: 'diagnose sys session list | grep -i dns' and sees sessions with dst port 53. The administrator has configured a DNS filter profile on the firewall policy. However, DNS requests are not being filtered. What is the MOST likely cause?

Accepted Answer

DNS filtering requires proxy-based inspection mode on the policy. DNS filtering in FortiOS requires proxy-based inspection mode. If the policy is set to flow-based, DNS filtering will not work. The administrator should change the inspection mode to proxy.

Answer

The DNS filter profile is applied to the wrong policy direction

Answer

The DNS filter profile has no rules defined

Answer

The FortiGate is in transparent mode

Question 10

A FortiGate is configured with an IPS profile that includes a signature with a 'Pass' action. The firewall policy uses this IPS profile. What will happen when traffic matching that signature is detected?

Accepted Answer

The traffic is allowed without logging. Option C is correct. A 'Pass' action means the traffic is allowed and not logged (unlike 'Allow' which logs). The signature will generate an event but will not drop or reset the session.

Answer

The traffic is allowed, but the session is reset

Answer

The traffic is blocked and logged

Answer

The traffic is blocked and the session is reset

Question 11

What is the primary difference between flow-based and proxy-based Antivirus inspection on a FortiGate?

Accepted Answer

Proxy-based inspection reassembles the file before scanning, while flow-based scans as the file passes through. Flow-based inspection uses the FortiASIC for accelerated scanning and has lower latency, while proxy-based inspection reassembles the entire content before scanning, allowing for more thorough detection but with higher resource usage.

Answer

Flow-based inspection is only available on hardware models with CP8

Answer

Proxy-based inspection uses fewer resources than flow-based

Answer

Flow-based inspection supports virus outbreak detection, but proxy-based does not

Question 12

An administrator wants to prevent sensitive data (e.g., credit card numbers) from being sent out of the network via email. Which THREE components must be configured to achieve this?

Accepted Answer

A firewall policy that allows email traffic and applies the email filter profile. To block sensitive data via email, you need: a DLP sensor to define the data pattern, an email filter profile to apply the DLP sensor to email traffic, and a firewall policy that applies the email filter profile to SMTP/IMAP traffic.

Answer

SSL deep inspection to decrypt email traffic if encrypted

Answer

An application control profile to block email applications

Question 13

A network administrator wants to prevent users from downloading files with .exe extensions via HTTP and HTTPS. Which security profile feature should be used?

Accepted Answer

Antivirus profile with 'block' action for file pattern matching .exe. An antivirus profile can block files by file extension for both HTTP and HTTPS traffic, but only if SSL deep inspection is enabled for HTTPS. The file pattern filter is part of the antivirus profile.

Answer

Web filter profile with URL filter to block .exe sites

Answer

Application control profile to block file transfer applications

Answer

IPS profile to block executable file transfers

Question 14

An administrator wants to block all traffic from the 'P2P' application category but allow traffic from 'File Sharing' applications like Dropbox. Which THREE configurations are required to achieve this?

Accepted Answer

Create an application control profile that sets 'P2P' category to 'block' and 'File Sharing' category to 'allow'. To block P2P and allow File Sharing, the administrator needs to create an application control profile that blocks P2P category and allows File Sharing category. This profile must be applied to a firewall policy that has deep inspection enabled for encrypted traffic. Proxy-based inspection might be needed for granular control, but flow-based also works with deep inspection.

Answer

Set the firewall policy inspection mode to proxy-based

Answer

Apply a web filter profile to override the application control

Question 15

Which inspection mode in the antivirus profile processes traffic by buffering the entire file before scanning, allowing more thorough detection but potentially increasing latency?

Accepted Answer

Proxy-based inspection. Option C is correct. Proxy-based inspection buffers the entire file for scanning, which can detect threats more accurately but introduces latency. Flow-based inspection scans packets as they pass through without full buffering.

Answer

Deep inspection

Answer

DNS inspection

Answer

Flow-based inspection