NSE4 Practice Test 34 — 15 Questions

Question 1

An administrator configures SSL deep inspection with a CA certificate. Users accessing an internal site (internal.company.com) receive a certificate error. The administrator wants to avoid the error without disabling deep inspection. What should be done?

Accepted Answer

Add internal.company.com to the SSL/SSH inspection exemption list. Option A is correct. The exemption list allows certain domains to bypass deep inspection, preserving trust.

Answer

Replace the CA certificate with a self-signed one

Answer

Use certificate inspection instead of deep inspection

Answer

Disable certificate validation in the deep inspection profile

Question 2

A network administrator configures an application control profile to block social media applications. Users can still access Facebook through a web browser. What is the MOST likely reason?

Accepted Answer

Application control is not enabled for HTTPS traffic without deep inspection. Option A is correct. Application control requires deep inspection to identify applications in encrypted traffic.

Answer

The application signatures are outdated

Answer

The firewall policy is in proxy-based mode

Answer

The application control profile is not applied to the correct policy

Question 3

A network administrator wants to allow employees to access a specific web application but block all other application traffic. The administrator creates a firewall policy with an application control profile that allows the desired application. However, employees can still access other applications. What is the MOST likely reason?

Accepted Answer

The application control profile is set to 'Monitor All' rather than 'Block All'. If the application control profile is set to 'Monitor All', it will only log but not block unlisted applications. To block all except allowed, the profile should be set to 'Block All' with exceptions for allowed applications.

Answer

The application control profile is applied to the wrong firewall policy

Answer

The firewall policy has SSL inspection disabled

Answer

The application signatures are outdated

Question 4

A FortiGate administrator wants to block all traffic to a known malicious IP address range using the Intrusion Prevention System (IPS). Which IPS configuration method is most appropriate?

Accepted Answer

Create a custom IPS signature that matches the IP range. Option B is correct. IPS signatures are designed to detect and block specific attack patterns, including traffic to known malicious IPs. The 'IPS sensor' can include signatures that match traffic to specific IP addresses. Alternatively, a firewall policy with a destination address object is simpler, but the question specifies using IPS.

Answer

Use a predefined IPS signature for known malicious IPs

Answer

Configure an IPS anomaly detection rule to block the IP range

Answer

Use a local IPS signature database

Question 5

An administrator wants to configure a DNS filter to block access to known malicious domains and also enforce safe search on search engines. Which THREE settings are required in the DNS filter profile? (Choose three.)

Accepted Answer

Add entries to the static domain blocklist. Options A, B, and D are correct. The DNS filter must have FortiGuard DNS filtering enabled for malicious domain blocking. 'Redirect to safe search' enforces safe search. A custom domain blocklist can be used to block additional domains. Option C is for DNS sinkhole, which is optional. Option E is for external DNS servers, not part of the profile.

Answer

Configure a DNS sinkhole IP address

Answer

Specify external DNS servers for resolution

Question 6

A network admin wants to block all traffic from the BitTorrent application. The admin has enabled application control on the firewall policy. Which TWO steps are necessary to achieve this?

Accepted Answer

Add the BitTorrent application signature to the application control profile and set action to block. Option A and C are correct: The application control profile must include the BitTorrent signature and be configured to block it. Additionally, if BitTorrent uses random high ports or encryption, SSL deep inspection may be needed to identify the traffic.

Answer

Add a DNS filter profile to block BitTorrent tracker domains

Answer

Set the application control inspection mode to proxy-based

Answer

Enable 'deep inspection' in the application control profile

Question 7

An administrator runs 'diagnose ips anomaly list' and sees the following output:
List of anomaly events:
 ID: 1, Type: tcp_syn_flood, Status: triggered, Count: 1500, Threshold: 1000
What does this indicate?

Accepted Answer

The FortiGate is experiencing a TCP SYN flood attack and has triggered rate-based detection.

Answer

The IPS anomaly sensor is configured to block all TCP traffic.

Answer

The FortiGate has detected a single TCP SYN packet and is logging it.

Answer

The FortiGate is performing a TCP SYN flood attack.

Question 8

An administrator has configured an IPS profile with an anomaly detection sensor for 'tcp_syn_flood'. After applying the profile to a firewall policy, users report intermittent connectivity issues. The administrator runs 'diagnose ips anomaly list' and sees entries for 'tcp_syn_flood' with action 'pass'. What is the MOST likely cause of the connectivity issues?

Accepted Answer

The anomaly sensor is not actually applied; the list shows default entries. The 'diagnose ips anomaly list' output shows default anomaly entries. If the sensor were properly applied, the action would be 'block' as configured. The connectivity issues may be unrelated to IPS; the administrator should verify the sensor is attached to the policy.

Answer

The anomaly sensor is set to 'block' but the action is overridden by the policy

Answer

The anomaly sensor is using a different action than expected; it might be set to 'block' for some other sensor

Answer

The anomaly sensor is set to 'pass' but the threshold is too low, causing false positives

Question 9

An administrator wants to prevent data leakage by blocking outbound emails that contain credit card numbers. Which security profile should be configured?

Accepted Answer

DLP profile. Option C is correct. DLP (Data Leak Prevention) profiles can inspect content for sensitive data patterns like credit card numbers and block or quarantine the traffic.

Answer

Email Filter profile

Answer

Web Filter profile

Answer

Antivirus profile

Question 10

A FortiGate administrator configures SSL deep inspection on a policy using a self-signed CA certificate. Users report that they see a certificate warning in their browsers when accessing HTTPS sites. What is the most effective solution to eliminate these warnings?

Accepted Answer

Install the FortiGate's CA certificate on all client machines in the trusted root store. To avoid certificate warnings, the FortiGate's CA certificate must be trusted by all clients. Deploying the CA certificate via Group Policy ensures that all domain-joined machines trust certificates signed by the FortiGate.

Answer

Use a publicly trusted CA certificate for the FortiGate

Answer

Disable deep inspection and use certificate inspection only

Answer

Add the websites to the exemption list in the SSL/SSH profile

Question 11

An administrator runs the following CLI command and sees the output: 'diagnose sys session list | grep -A 5 10.1.1.100' and finds a session with 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate about the session?

Accepted Answer

The session has been active for approximately 1 second. The duration is 3600 seconds and expire is 3599 seconds, meaning the session has been active for only about 1 second out of a 3600-second lifetime. The session is new.

Answer

The session is about to expire

Answer

The session has been active for 3600 seconds

Answer

The session is using UDP protocol

Question 12

A FortiGate administrator is troubleshooting an issue where users cannot access an internal HTTPS server (10.10.10.10:443) after enabling SSL deep inspection. The administrator sees that the server's certificate is self-signed. Which TWO actions should the administrator take to allow access while maintaining inspection?

Accepted Answer

Import the server's self-signed certificate into FortiGate's trusted CA list. To allow inspection of a server with a self-signed certificate, you need to either add the server to the exemption list in the SSL/SSH profile (so it is not inspected) or import the server's CA certificate and add it as a trusted CA so that deep inspection can validate the certificate.

Answer

Disable deep inspection on the policy

Answer

Change the policy action to DENY

Answer

Disable certificate validation in the SSL/SSH profile

Question 13

An administrator configures a web filter profile with FortiGuard category blocking and URL filter to allow example.com. Users report that example.com is still blocked. What is the most likely cause?

Accepted Answer

The FortiGuard category action is set to 'block' and takes precedence over the URL filter allow rule. In FortiOS, the FortiGuard category action takes precedence over URL filter exceptions unless the URL filter is configured with an action of 'allow' and a higher priority order. By default, category blocking overrides individual URL allow rules.

Answer

The URL filter requires deep inspection to be enabled

Answer

The URL filter entry is placed after the FortiGuard category in the policy

Answer

The DNS filter is blocking example.com before the web filter is evaluated

Question 14

Which IPS detection method analyzes traffic patterns over time to identify attacks that are characterized by a threshold of events?

Accepted Answer

Rate-based detection. Rate-based detection monitors the rate of events (e.g., connections per second) and triggers when a threshold is exceeded. Anomaly detection looks for deviations from a baseline, not specifically thresholds.

Answer

Protocol decoder-based detection

Answer

Signature-based detection

Answer

Anomaly-based detection

Question 15

An administrator configures an email filter profile to block spam. Despite correct configuration, spam emails still reach users' inboxes. The FortiGate is deployed as a transparent bridge. What is the most likely reason?

Accepted Answer

The firewall policy is using flow-based inspection, which does not support SMTP proxy. In transparent mode, the FortiGate forwards SMTP traffic without acting as a proxy unless explicitly configured for SMTP proxy. Email filtering requires proxy-based inspection for SMTP.

Answer

The FortiGate does not have a valid FortiGuard license

Answer

The emails are encrypted with TLS and deep inspection is not enabled

Answer

The email filter profile is set to 'monitor' instead of 'block'