NSE4 Practice Test 40 — 15 Questions

Question 1

An administrator wants to allow access to a specific website that is blocked by the FortiGuard web filter category 'Social Networking'. The administrator creates a URL filter override to allow the site. After applying, the site is still blocked. What should the administrator check?

Accepted Answer

Ensure the URL filter rule is placed above the FortiGuard category block in the web filter profile. URL filter overrides take precedence over FortiGuard categories only if the URL filter action is set appropriately and the override is applied before the FortiGuard check. Additionally, the order of rules matters: URL filter rules are evaluated before FortiGuard categories, but the action must be 'allow' and the override must be enabled.

Answer

Disable the FortiGuard category rating for Social Networking

Answer

Ensure the URL filter rule is set to 'exempt' instead of 'allow'

Answer

Set the web filter profile to use 'monitor' for the Social Networking category

Question 2

A FortiGate is configured to integrate with FortiSandbox for advanced threat detection. The antivirus profile is set to send files to FortiSandbox when a virus is detected. What action does FortiGate take on the file while it is being analyzed by FortiSandbox?

Accepted Answer

Blocks the file until a verdict is received from FortiSandbox. Option D is correct. While FortiSandbox analyzes a file, the default action is to 'monitor' or 'allow' the file to pass through temporarily, but the FortiGate can also be configured to block the file until verdict. Typically, the configuration includes 'quarantine' or 'block' options. The most common behavior is to allow the file with monitoring, but many administrators block. The question is ambiguous; however, based on standard FortiGate behavior, the action is usually 'monitor' unless specified. But the answer should be 'block until verdict' if configured. Given the options, D is the most accurate.

Answer

Quarantines the file on the FortiGate

Answer

Immediately blocks the file and logs the event

Answer

Allows the file to pass through and logs the event

Question 3

What is the purpose of enabling 'DNS filter' in a security profile?

Accepted Answer

To block DNS queries to known malicious domains. Option A is correct: DNS filter blocks malicious domains based on FortiGuard category or custom lists by inspecting DNS queries and responses.

Answer

To cache DNS responses for faster browsing

Answer

To prevent DNS tunneling attacks

Answer

To enforce safe search on search engines

Question 4

A FortiGate admin wants to enforce safe search on Google and Bing for all users. The firewall policy has web filtering enabled. Which TWO configurations are required?

Accepted Answer

Configure a URL filter to rewrite search URLs to include safe search parameters. Options B and C are correct: Safe search enforcement is done via web filter options or URL filter add-ons. DNS filter can also reroute search queries to enforce safe search.

Answer

Install a custom CA certificate on client browsers

Answer

Use an application control profile to block non-safe search applications

Answer

Enable SSL deep inspection

Question 5

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. Option B is correct because HTTPS uses TLS encryption. Without SSL deep inspection enabled on the policy, FortiGate cannot decrypt and inspect the content of HTTPS traffic. The antivirus profile will only scan unencrypted traffic or traffic where deep inspection has decrypted it first.

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The FortiGuard antivirus subscription has expired

Question 6

A network admin is configuring a security policy for outbound HTTP traffic. The requirements are: (1) block access to known malicious websites, (2) prevent users from downloading executable files, (3) detect and block C2 traffic. Which THREE security profiles should be applied to the policy?

Accepted Answer

Antivirus. Options A, B, and C are correct. Web filtering blocks malicious websites; antivirus blocks executable file downloads; IPS detects and blocks C2 traffic.

Answer

Application Control

Answer

DNS Filter

Question 7

A FortiGate administrator wants to prevent users from downloading executable files via HTTP from the internet. Which TWO security profile features can be used together to achieve this? (Choose two.)

Accepted Answer

Antivirus profile with a file filter to block 'exe' files. Antivirus can block file types by signature (e.g., exe), and application control can block file transfer applications or protocols. Additionally, web filter can block specific file extensions, but the most straightforward combination is antivirus and file filter within antivirus.

Answer

DNS filter to block domains that host executable files

Answer

Application control profile to block HTTP file transfer applications

Answer

SSL deep inspection to allow inspection of encrypted traffic

Question 8

An administrator configures a data leak prevention (DLP) profile to detect credit card numbers in outgoing emails. However, no violations are logged. The email filter profile is applied with the DLP profile on the same policy. What is the most likely cause?

Accepted Answer

The SSL inspection profile on the policy is set to 'certificate-inspection' only. DLP scanning requires that the traffic be inspected. If the traffic is encrypted and not decrypted, DLP cannot see the content.

Answer

The credit card numbers are being sent in PDF attachments, which are not scanned

Answer

The DLP profile is not applied to SMTP traffic

Answer

The FortiGate needs a FortiSandbox license for DLP to work

Question 9

A FortiGate administrator notices that some users can bypass the web filter to access prohibited categories. The web filter profile is applied to the firewall policy. Which TWO actions should the admin take to determine why the filter is being bypassed? (Choose two.)

Accepted Answer

Check if the firewall policy that the traffic matches has the web filter profile applied. Options A and D are correct. Verifying that the web filter profile is correctly applied to the policy is fundamental. Checking if HTTPS traffic is being inspected is critical because without SSL deep inspection, web filter cannot see the hostnames in encrypted traffic. Options B and C are not directly relevant; option E is about client-side, not the cause.

Answer

Ensure that the FortiGate has connectivity to FortiGuard

Answer

Verify that the DNS filter is also applied to the same policy

Answer

Examine the client's browser proxy settings

Question 10

A network administrator configures a web filtering profile to block access to the 'Social Networking' FortiGuard category. However, users can still access Facebook. The firewall policy has web filtering enabled. What is the MOST likely reason?

Accepted Answer

The web filter options are not set to use FortiGuard rating lookup. Option A is correct because the web filter must have the rating lookup set to 'FortiGuard' to use the cloud-based category database. If it's set to 'Local' or disabled, FortiGuard categories won't be enforced.

Answer

The Facebook URL is cached in the user's browser

Answer

The FortiGuard web filter database is outdated

Answer

The firewall policy does not have SSL deep inspection enabled

Question 11

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session has been established for 3600 seconds and will expire in 3599 seconds. Option C is correct: The session has been active for 3600 seconds and will expire in 3599 seconds (almost fresh start). 'proto_state=01' indicates TCP three-way handshake completion.

Answer

The session is using UDP protocol

Answer

The session is blocked by the firewall policy

Answer

The session is in SYN-SENT state

Question 12

Which inspection mode allows FortiGate to perform virus scanning by reassembling the entire file in memory before scanning, providing better detection but potentially higher latency?

Accepted Answer

Proxy-based inspection. Option B is correct. Proxy-based inspection reassembles the entire file in memory before scanning, which can detect threats that flow-based might miss, but at the cost of higher latency.

Answer

Fast-path inspection

Answer

Deep inspection

Answer

Flow-based inspection

Question 13

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. Option B is correct because HTTPS uses TLS encryption. Without SSL deep inspection enabled on the policy, FortiGate cannot decrypt and inspect the content of HTTPS traffic. The antivirus profile will only scan unencrypted traffic or traffic where deep inspection has decrypted it first.

Answer

The FortiGuard antivirus subscription has expired

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Question 14

A FortiGate with antivirus in flow-based inspection mode is not detecting a known virus in HTTP traffic. The same virus is detected when using proxy-based inspection. What is the most likely reason?

Accepted Answer

Flow-based inspection does not reassemble files or unpack archives, so it misses some viruses. Option B is correct: Flow-based inspection uses less resources and may not perform full file reassembly or unpacking that proxy-based does, allowing some viruses to evade detection.

Answer

Flow-based inspection requires FortiSandbox integration to detect viruses

Answer

The antivirus signature database is outdated for flow-based inspection

Answer

Flow-based inspection only scans on explicit proxy policies

Question 15

An organization wants to prevent users from downloading files with extensions such as .exe and .scr via HTTP and HTTPS. The FortiGate already has a web filter profile applied to the relevant policy. Which web filter feature should be configured to achieve this?

Accepted Answer

Content filtering with a block rule for the file extensions. Option D is correct. Content filtering inspects HTTP response bodies and can block file downloads by extension. For HTTPS, SSL deep inspection must be enabled.

Answer

FortiGuard category filtering set to block 'Malicious Websites'

Answer

A static URL filter block rule for the file extensions

Answer

URL filter with a block rule for *\.exe and *\.scr patterns