NSE4 Practice Test 38 — 15 Questions

Question 1

A FortiGate is configured with a firewall policy that applies an Application Control profile and a Web Filter profile. The administrator wants to log all traffic blocked by the Web Filter profile. Which TWO configurations are required?

Accepted Answer

Enable 'Log All Blocked Sites' in the Web Filter profile. Options A and D are correct. Logging of blocked traffic must be enabled in the Web Filter profile (A), and the firewall policy must have logging enabled (D) to capture the logs.

Answer

Set the global 'Logging' setting to 'Verbose'

Answer

Configure the Application Control profile to log blocked traffic

Answer

Enable 'Log All Allowed Sites' in the Web Filter profile

Question 2

Which security profile type requires a FortiSandbox license to enable advanced detection features?

Accepted Answer

Antivirus. FortiSandbox integration is configured within the Antivirus profile (and optionally with other profiles) to submit suspicious files for behavioral analysis. The license enables the FortiSandbox connection.

Answer

Application Control

Answer

DNS Filter

Answer

Web Filter

Question 3

An administrator configures a DLP profile to detect Social Security numbers in outbound traffic. The profile is applied to an outbound HTTP policy. Which TWO additional configurations are necessary for the DLP to inspect HTTPS traffic?

Accepted Answer

Enable SSL/TLS deep inspection on the firewall policy. DLP scanning of HTTPS traffic requires SSL deep inspection to decrypt the traffic. Additionally, the firewall policy must have deep inspection enabled and the DLP profile must be applied. The inspection mode (flow vs proxy) may affect performance but both can work.

Answer

Set the firewall policy inspection mode to proxy-based

Answer

Add an SSL exemption for the destination servers

Answer

Configure a web filter profile to allow the traffic

Question 4

Which security profile component is specifically designed to prevent data exfiltration by inspecting outgoing traffic for sensitive data patterns?

Accepted Answer

Data Leak Prevention (DLP). Data Leak Prevention (DLP) is the security profile that inspects outgoing data for sensitive information like credit card numbers, social security numbers, etc., to prevent data leaks.

Answer

Application Control

Answer

Antivirus

Answer

Web Filter

Question 5

What is the purpose of the DNS filter security profile on a FortiGate?

Accepted Answer

To block DNS queries to known malicious domains. DNS filter inspects DNS queries to block access to malicious or unwanted domains.

Answer

To inspect DNS traffic for virus signatures

Answer

To filter spam emails based on DNS blacklists

Answer

To prevent DNS tunneling attacks

Question 6

An administrator receives reports that some internal users can access Facebook despite a web filtering profile that blocks the 'Social Networking' category. The policy is configured with deep inspection. Which THREE checks should the administrator perform to troubleshoot this issue?

Accepted Answer

Check if the users are using HTTPS and if the SSL inspection profile has an exemption for Facebook. The issue could be due to policy order, category not being blocked for that specific user, or SSL inspection exemptions.

Answer

Ensure that the antivirus profile is enabled on the policy

Question 7

An admin runs the following command on a FortiGate: 'diagnose sys session filter dport 443' and sees output: 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate?

Accepted Answer

The session is in the SYN_SENT state and is not yet fully established. Option D is correct. The session state '01' indicates a TCP session in the SYN_SENT state, meaning the session is still in the process of being established. The short duration and expire time suggest it is a new session.

Answer

The session is stuck in a half-open state due to a firewall policy misconfiguration

Answer

The session is fully established and has been active for 3600 seconds

Answer

The session is using UDP protocol

Question 8

Which security profile is used to detect and prevent network-based attacks by analyzing traffic patterns and comparing them against known attack signatures?

Accepted Answer

IPS profile. Option C is correct. Intrusion Prevention System (IPS) profiles analyze traffic for malicious patterns and can block attacks in real-time.

Answer

DLP profile

Answer

Web filter profile

Answer

Antivirus profile

Question 9

An administrator configures an application control profile to block 'Facebook' and 'Twitter' using application signatures. Users can still access Facebook via HTTPS. The firewall policy has application control enabled and SSL deep inspection is not configured. Why is Facebook not blocked?

Accepted Answer

HTTPS traffic is encrypted and cannot be inspected without SSL deep inspection. Option A is correct: Without SSL deep inspection, FortiGate cannot see the encrypted application payload to match application signatures for HTTPS traffic. Application control requires decryption for encrypted applications.

Answer

The application signature for Facebook is not updated

Answer

The application control profile is configured in monitor-only mode

Answer

Facebook uses a non-standard port that application control does not monitor

Question 10

A FortiGate administrator runs the following command and sees: 'diagnose ips anomaly list' returns no entries, but the IPS sensor is configured with anomaly signatures. What is the MOST likely reason the signatures are not appearing?

Accepted Answer

The anomaly signatures have not triggered any events yet because traffic thresholds have not been exceeded.. Option C is correct. Anomaly signatures are dynamic; they only appear in the anomaly list when traffic triggers them. Empty output means no thresholds have been exceeded.

Answer

The IPS sensor is configured in 'passive' mode, which suppresses anomaly detection.

Answer

Anomaly signatures are not displayed by 'diagnose ips anomaly list'; they require a different command.

Answer

The IPS sensor is not enabled on any firewall policy.

Question 11

An organization wants to implement data leak prevention (DLP) to detect when credit card numbers are sent via email (SMTP) and webmail (HTTPS). The FortiGate is using proxy-based inspection. Which THREE configurations are necessary? (Choose three.)

Accepted Answer

Create a DLP sensor with a rule to match credit card patterns.. The correct answers are A, B, and C. DLP sensor, SSL inspection for HTTPS, and applying the sensor to the policy are all required.

Answer

Set the inspection mode to flow-based for better performance.

Answer

Configure the antivirus profile to scan email attachments.

Question 12

A FortiGate admin is troubleshooting email filtering. Legitimate emails from a specific external domain are being marked as spam. Which THREE steps should the admin take to resolve this?

Accepted Answer

Check the spam filter logs to see why the email was flagged. Options A, B, and C are correct. Checking the spam filter logs, adding the domain to the allowlist, and verifying the FortiGuard reputation can all help resolve false positives.

Answer

Disable the spam filter entirely

Answer

Enable deep inspection for SMTP traffic

Question 13

You run the following CLI command on a FortiGate:
diagnose sys session filter dport 443
diagnose sys session list
The output shows many sessions with 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate about the traffic?

Accepted Answer

The sessions are in the SYN_SENT state and have not completed the three-way handshake. Option B is correct. The proto=6 indicates TCP, and proto_state=01 indicates a TCP session in the SYN_SENT state (i.e., the three-way handshake is not complete). The long duration suggests these are half-open sessions, possibly indicating a SYN flood attack.

Answer

The sessions are fully established and idle

Answer

The sessions are for UDP traffic

Answer

The sessions are being inspected by SSL deep inspection

Question 14

Which FortiGate security profile is BEST suited for blocking DNS queries to known malicious domains?

Accepted Answer

DNS Filter profile. Option D is correct. DNS Filter profile can block DNS queries based on FortiGuard categories or custom domain lists, preventing users from resolving malicious domains.

Answer

Web Filter profile

Answer

IPS profile

Answer

Application Control profile

Question 15

An administrator needs to ensure that all HTTPS traffic to a critical server is inspected by the IPS. The server uses a valid certificate from a public CA. Which THREE steps are required to achieve this?

Accepted Answer

Apply an IPS profile to the same firewall policy. Options A, D, and E are correct. SSL deep inspection must be enabled on the policy (A), the IPS profile must be applied in the same policy (D), and the FortiGate's CA certificate must be installed on clients (E) to avoid certificate errors.

Answer

Set the Antivirus profile to 'Deep Inspection'

Answer

Upload the server's certificate to the FortiGate