NSE4 Practice Test 36 — 15 Questions

Question 1

A network administrator notices that HTTP traffic is being scanned by the antivirus profile, but HTTPS traffic to the same web server is not being scanned. The firewall policy has the antivirus profile applied and SSL inspection is set to 'certificate-inspection'. What is the most likely reason HTTPS traffic is not being scanned?

Accepted Answer

Certificate inspection does not decrypt the traffic, so the antivirus scanner cannot inspect the payload.

Answer

The antivirus profile is configured in flow mode, which does not support scanning HTTPS traffic.

Answer

The web server is not using a cipher supported by the FortiGate.

Answer

The FortiGate is using proxy-based inspection, which does not support HTTPS scanning.

Question 2

A FortiGate administrator is troubleshooting an issue where users cannot access a legitimate website that is categorized as 'Pornography' by FortiGuard. The web filter profile is configured to block that category. The administrator wants to allow access for a specific user group without modifying the global web filter profile. What is the BEST approach?

Accepted Answer

Create a separate firewall policy for that user group with a web filter profile that allows the category. Using a separate firewall policy with a different web filter profile allows granular control for specific user groups. URL filter exemption would apply to all users using that profile, not just the specific group.

Answer

Change the FortiGuard category rating for the website to 'Unrated'

Answer

Create a URL filter exemption for the website in the same web filter profile

Answer

Disable web filtering for that website in the global settings

Question 3

Which of the following best describes the difference between flow-based and proxy-based inspection for antivirus scanning?

Accepted Answer

Flow-based inspection uses pattern matching and anomaly detection with low latency, while proxy-based provides full content reassembly and higher detection rates. Flow-based inspection is faster using pattern matching and anomaly detection, while proxy-based provides full content reassembly and can detect more sophisticated threats. Both can use SSL inspection.

Answer

Flow-based inspection reassembles the entire file before scanning, while proxy-based scans packets on the fly

Answer

Flow-based inspection scans first packet and allows, while proxy-based buffers the entire session

Answer

Flow-based inspection requires SSL deep inspection, while proxy-based does not

Question 4

Which TWO types of inspection can be used for HTTPS traffic in a FortiGate security policy?

Accepted Answer

Deep inspection. FortiGate offers two modes for inspecting HTTPS: certificate inspection (which checks certificate validity but does not decrypt content) and deep inspection (which decrypts and inspects the content). Flow-based and proxy-based refer to the inspection mode for other security profiles, not specifically for HTTPS inspection type.

Answer

Full inspection

Answer

Flow-based inspection

Answer

Proxy-based inspection

Question 5

A network administrator notices that HTTP traffic to a specific website is being blocked by the web filter profile, but the website is categorized as 'General – Personal' in FortiGuard, which is allowed. What could cause this block?

Accepted Answer

A URL filter entry is blocking the specific website. The URL filter is applied before FortiGuard categories and can override the category rating. A static URL filter entry blocking the specific website would cause the block even if the category is allowed.

Answer

The web filter profile has an incorrect FortiGuard category override

Answer

The antivirus profile is blocking the website

Answer

DNS filter is blocking the domain

Question 6

An administrator wants to ensure that search engine results from Google, Bing, and Yahoo are filtered to exclude explicit content when users perform searches. Which feature should the administrator configure in the web filter profile?

Accepted Answer

Safe search. Safe search enforces the search engine's built-in safe search settings (like Google SafeSearch) by appending parameters to the search URL, ensuring explicit content is filtered.

Answer

FortiGuard category filter

Answer

URL filter

Answer

DNS filter

Question 7

An administrator configured a DLP profile to detect credit card numbers in outgoing emails. The profile is applied to an outbound SMTP policy. Users report that emails with credit card numbers are still being sent successfully. What is the most likely cause?

Accepted Answer

The SMTP traffic is encrypted and deep inspection is not enabled. DLP scanning requires deep inspection if the traffic is encrypted. If SMTP traffic is encrypted with TLS (SMTPS), the FortiGate needs SSL deep inspection to decrypt and inspect the content. Without it, DLP cannot see the credit card numbers.

Answer

The DLP profile is set to 'monitor' instead of 'block'

Answer

The DLP profile is not applied to the correct policy

Answer

The credit card number pattern is not correctly defined

Question 8

What is the purpose of enabling 'Safe Search' in a web filter profile on a FortiGate?

Accepted Answer

It forces search engines to filter explicit content from search results.

Answer

It blocks all searches containing the word 'safe'.

Answer

It redirects users to a safe landing page when a blocked site is accessed.

Answer

It encrypts search queries to protect user privacy.

Question 9

A FortiGate administrator is configuring SSL deep inspection for a firewall policy that handles traffic to multiple internal servers. Some servers have self-signed certificates. The administrator wants to avoid certificate errors for users. What configuration is recommended?

Accepted Answer

Add the server certificates to the FortiGate's trusted CA store. Adding the self-signed server certificates to the FortiGate's trusted CA store allows the FortiGate to trust them during deep inspection, preventing certificate errors for users. Disabling deep inspection or using certificate inspection would not inspect payloads.

Answer

Configure the firewall policy to accept invalid certificates

Answer

Use certificate inspection instead of deep inspection

Answer

Disable deep inspection for those servers

Question 10

A FortiGate administrator wants to block spam emails sent to the company's mail server. The mail server is behind the FortiGate. Which THREE configurations should be applied?

Accepted Answer

Enable FortiGuard spam filtering in the Email Filter profile. Options B, C, and E are correct. An email filter profile for spam detection (B), a firewall policy that applies the email filter to SMTP traffic (C), and FortiGuard spam filtering enabled (E) are all required.

Answer

Enable DLP to filter spam

Answer

Configure Application Control to block email applications

Question 11

An administrator configures an email filter profile to block spam. Users complain that legitimate emails from a specific partner are being blocked. The admin wants to allow emails from that partner's domain without disabling spam filtering for other domains. What is the BEST approach?

Accepted Answer

Add the partner's domain to the IP allowlist in the email filter profile. Option A is correct. An IP allowlist or domain whitelist in the email filter profile can be used to bypass spam filtering for specific senders, while still filtering other emails.

Answer

Increase the spam threshold until the emails pass

Answer

Disable spam filtering for the entire firewall policy

Answer

Create a separate firewall policy for the partner's traffic without email filtering

Question 12

A FortiGate is configured with an application control profile to allow only 'business-approved' applications. Users are still able to use Skype for Business. The admin wants to ensure that only Skype for Business is allowed and other Skype variants are blocked. Which THREE steps should the admin take? (Choose three.)

Accepted Answer

Identify the exact application signatures for Skype for Business. Options A, C, and D are correct. The admin should identify the correct application signature for Skype for Business and block other Skype signatures. Creating a custom signature is not necessary as the signatures already exist. Logging all traffic is not directly needed for blocking.

Answer

Enable logging for all traffic to verify the application being used

Answer

Create a custom application signature for Skype for Business

Question 13

A FortiGate is configured for SSL deep inspection using a CA certificate. Users report that some websites show certificate errors. The administrator wants to allow these sites without inspection. Which setting should be used?

Accepted Answer

Add the websites to the SSL/SSH exemption list. Option D is correct: SSL/SSH exemption list allows specific destinations to bypass deep inspection, while still applying other security profiles.

Answer

Disable certificate validation in the SSL inspection profile

Answer

Create a separate firewall policy without SSL inspection

Answer

Set the action for invalid certificates to 'allow'

Question 14

What is the function of an IPS 'protocol decoder'?

Accepted Answer

Parse and normalize protocol traffic to improve detection accuracy. Option D is correct: Protocol decoders parse application layer protocols to normalize traffic before signature matching, enabling detection of evasion techniques.

Answer

Encode traffic to prevent attacks

Answer

Rate-limit traffic based on protocol

Answer

Decrypt SSL traffic for inspection

Question 15

A FortiGate administrator needs to ensure that all outbound DNS queries from internal clients are inspected for malicious domains. The administrator has a DNS filter profile configured. What additional configuration is required on the firewall policy to make the DNS filter effective?

Accepted Answer

Apply the DNS filter profile to a firewall policy that matches DNS traffic (UDP/TCP port 53). Option C is correct. The DNS filter profile must be applied to a firewall policy that matches DNS traffic. Without that, the traffic is not inspected.

Answer

Enable SSL deep inspection on the policy

Answer

Configure FortiGuard DNS filtering service on the FortiGate

Answer

Set the inspection mode to proxy-based