NSE4 Security Profiles Practice Test 11 — 15 Questions

Question 1

An administrator configures an antivirus profile in proxy-based inspection mode on a FortiGate. However, SMTP traffic is not being scanned for viruses. The firewall policy includes the antivirus profile and the FortiGate has a valid FortiGuard subscription. What is the most likely cause?

Accepted Answer

The SMTP protocol is not enabled in the proxy options of the security profile. In proxy-based inspection, the FortiGate acts as a proxy for the protocol. If SMTP inspection is not enabled in the proxy options, the traffic bypasses scanning.

Answer

Flow-based inspection is required for SMTP scanning

Answer

The FortiGate does not have a valid SSL certificate for SMTP inspection

Answer

The antivirus profile is configured to scan only HTTP traffic

Question 2

A FortiGate administrator receives reports that users cannot access a legitimate website that uses HTTPS. The web filtering profile is configured with strict FortiGuard categories and 'monitor all' for unknown sites. The firewall policy has an SSL/SSH inspection profile set to 'deep-inspection'. What is the most likely cause of the issue?

Accepted Answer

The website uses a self-signed certificate which is not trusted by the FortiGate CA bundle. When deep inspection is enabled, the FortiGate decrypts and re-encrypts traffic. If the website's certificate is not trusted by the FortiGate (e.g., self-signed or issuer not in CA bundle), the connection may fail.

Answer

The antivirus profile is blocking a file on the website

Answer

The DNS filter is blocking the domain

Answer

The website's FortiGuard category is set to 'block'

Question 3

Which IPS detection method uses a baseline of normal traffic and alerts when deviations exceed a threshold?

Accepted Answer

Anomaly detection. Anomaly detection learns normal traffic patterns and triggers when traffic deviates significantly.

Answer

Rate-based detection

Answer

Signature-based detection

Answer

Protocol decode-based detection

Question 4

An administrator configures an application control profile to block social media applications. Users can still access Facebook and Twitter via web browsers. What is the most likely reason?

Accepted Answer

The firewall policy has SSL/SSH inspection set to 'certificate-inspection' instead of 'deep-inspection'. Application control relies on signatures to detect applications. If deep inspection is not enabled, encrypted traffic may not be identified correctly.

Answer

The application signatures for Facebook and Twitter are not up to date

Answer

The application control profile is set to 'monitor' instead of 'block'

Answer

The firewall policy is configured with flow-based inspection

Question 5

An administrator runs the command 'diagnose ips anomaly list' and sees many entries for 'tcp_src_session' with high counts. Users report slow internet. What is the most likely issue?

Accepted Answer

A host on the network is infected with malware that is generating many outbound connections. High tcp_src_session counts indicate many TCP sessions from a single source, often due to a host generating excessive connections (e.g., malware or P2P).

Answer

The IPS signature database is corrupted

Answer

The FortiGate has a hardware failure

Answer

The FortiGate is under a DDoS attack

Question 6

What is the purpose of the DNS filter security profile on a FortiGate?

Accepted Answer

To block DNS queries to known malicious domains. DNS filter inspects DNS queries to block access to malicious or unwanted domains.

Answer

To inspect DNS traffic for virus signatures

Answer

To filter spam emails based on DNS blacklists

Answer

To prevent DNS tunneling attacks

Question 7

A company policy requires that all web searches by employees use safe search. Which setting should be configured in the web filtering profile?

Accepted Answer

Enable 'Enforce 'Safe Search' on Google, Bing, and Yahoo'. Option C is correct because the 'Enforce Safe Search' setting in a FortiGate web filtering profile forces Google, Bing, and Yahoo to use their built-in safe search parameters (e.g., &safe=active for Google). This ensures that all web searches from the network comply with the company policy by appending the required query strings to search URLs, blocking explicit content at the search engine level.

Answer

Enable 'Restrict YouTube Access'

Answer

Create a URL filter to block URLs with 'safe search'

Answer

Set the 'Action' for FortiGuard categories to 'Warning'

Question 8

An administrator configures a data leak prevention (DLP) profile to detect credit card numbers in outgoing emails. However, no violations are logged. The email filter profile is applied with the DLP profile on the same policy. What is the most likely cause?

Accepted Answer

The SSL inspection profile on the policy is set to 'certificate-inspection' only. DLP scanning requires that the traffic be inspected. If the traffic is encrypted and not decrypted, DLP cannot see the content.

Answer

The credit card numbers are being sent in PDF attachments, which are not scanned

Answer

The DLP profile is not applied to SMTP traffic

Answer

The FortiGate needs a FortiSandbox license for DLP to work

Question 9

An administrator sees the following CLI output when checking an IPS sensor: 'config ips sensor edit test config entries edit 1 set severity medium set action block set target default end'. However, attacks with severity medium are still passing. The IPS sensor is applied to a policy with flow-based inspection. What is the likely issue?

Accepted Answer

The IPS sensor rule has 'target' set to 'default' which may not apply to the traffic direction. In flow-based inspection, the IPS sensor rules may require that the protocol decoder be enabled or that the traffic matches the rule's target (client, server, default). The output shows 'target default' which might not match the traffic flow.

Answer

The IPS sensor is not enabled in the policy

Answer

The FortiGate needs a FortiSandbox for IPS to work

Answer

The severity level is set too high

Question 10

Which SSL/TLS inspection mode only validates the server certificate without decrypting the traffic?

Accepted Answer

Certificate inspection. Certificate inspection checks the certificate chain but does not decrypt the content.

Answer

Deep inspection

Answer

Flow-based inspection

Answer

Proxy-based inspection

Question 11

An administrator configures an email filter profile to block spam. Despite correct configuration, spam emails still reach users' inboxes. The FortiGate is deployed as a transparent bridge. What is the most likely reason?

Accepted Answer

The firewall policy is using flow-based inspection, which does not support SMTP proxy. In transparent mode, the FortiGate forwards SMTP traffic without acting as a proxy unless explicitly configured for SMTP proxy. Email filtering requires proxy-based inspection for SMTP.

Answer

The FortiGate does not have a valid FortiGuard license

Answer

The emails are encrypted with TLS and deep inspection is not enabled

Answer

The email filter profile is set to 'monitor' instead of 'block'

Question 12

A FortiGate administrator needs to configure a policy so that traffic to a specific external server is exempted from SSL deep inspection. Which method should be used?

Accepted Answer

Add the server's address to the 'SSL/SSH Inspection Profile' exemptions list. Exemptions can be added in the SSL/SSH inspection profile to bypass inspection for specific destinations.

Answer

Create a separate firewall policy without SSL inspection for that server

Answer

Disable the IPS sensor on that policy

Answer

Set the antivirus profile to 'monitor' only

Question 13

An administrator wants to detect and prevent malware outbreaks. The FortiGate is integrated with FortiSandbox. Which TWO actions should be taken to ensure files are sent to FortiSandbox for analysis?

Accepted Answer

Enable FortiSandbox in the antivirus profile settings. To leverage FortiSandbox, the antivirus profile must be configured to send files to FortiSandbox, and the inspection mode must be proxy-based for file submission.

Answer

Set the firewall policy inspection mode to flow-based

Answer

Enable deep inspection for HTTPS traffic

Answer

Disable the antivirus profile on the policy

Question 14

An administrator receives reports that some internal users can access Facebook despite a web filtering profile that blocks the 'Social Networking' category. The policy is configured with deep inspection. Which THREE checks should the administrator perform to troubleshoot this issue?

Accepted Answer

Check if the users are using HTTPS and if the SSL inspection profile has an exemption for Facebook. The issue could be due to policy order, category not being blocked for that specific user, or SSL inspection exemptions.

Answer

Ensure that the antivirus profile is enabled on the policy

Question 15

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. Option B is correct because HTTPS uses TLS encryption. Without SSL deep inspection enabled on the policy, FortiGate cannot decrypt and inspect the content of HTTPS traffic. The antivirus profile will only scan unencrypted traffic or traffic where deep inspection has decrypted it first.

Answer

The FortiGuard antivirus subscription has expired

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based