NSE4 Security Profiles Practice Test 11 — 15 Questions

Question 1

A FortiGate administrator wants to block spam emails destined for internal users. The FortiGate receives SMTP traffic on port 25. What is the most effective way to filter spam using the email filter profile?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply an email filter profile to a firewall policy that allows SMTP traffic. An email filter profile is specifically designed to inspect SMTP traffic and apply anti-spam techniques such as RBL, MIME header checks, and heuristic analysis. By applying the email filter profile to a firewall policy that allows SMTP traffic on port 25, the FortiGate can intercept and filter spam before it reaches internal users.

Answer

Enable spam filtering in the antivirus profile

Answer

Use a DNS filter to block spam domains

Answer

Configure a web filter to block webmail

Question 2

An administrator configures a DLP sensor to detect credit card numbers in traffic. However, the sensor is not detecting any credit card numbers even though they are present in emails. What could be the reason?

Accepted Answer

Email traffic is encrypted and SSL deep inspection is not enabled. If a DLP sensor is configured to detect credit card numbers in emails but is not detecting them, a likely reason is that the email traffic is encrypted (e.g., via TLS) and SSL deep inspection is not enabled on the FortiGate. Without SSL deep inspection, the FortiGate cannot see the contents of encrypted emails, so the DLP sensor cannot inspect the payload for credit card numbers. Therefore, enabling SSL deep inspection would allow the DLP sensor to detect the patterns.

Answer

The DLP sensor is applied to the wrong policy

Answer

The credit card regular expression is incorrect

Answer

The DLP sensor is in 'Monitor' mode

Question 3

Which of the following best describes the function of FortiGuard web filtering categories?

Accepted Answer

They categorize websites to allow granular control over access based on content type. FortiGuard web filtering categories are pre-classified buckets (e.g., Social Networking, Malware, Phishing, Streaming Media) that map URLs/domains to content types. Administrators use these categories in web filter profiles to allow, block, monitor, or warn on entire classes of sites, giving granular, policy-driven control without maintaining manual URL lists. This is the core function of the FortiGuard category database.

Answer

They are used to quarantine infected files

Answer

They block specific IP addresses known for hosting malware

Answer

They provide a list of allowed websites only

Question 4

An administrator wants to ensure that search engine results from Google, Bing, and Yahoo are filtered to exclude explicit content when users perform searches. Which feature should the administrator configure in the web filter profile?

Accepted Answer

Safe search. Safe search is a feature within FortiGate's web filter profile that enforces search engine providers (Google, Bing, Yahoo) to filter explicit content from search results. It works by appending specific parameters to search URLs or using HTTPS inspection to inject the safe search cookie, ensuring compliance with content filtering policies.

Answer

FortiGuard category filter

Answer

URL filter

Answer

DNS filter

Question 5

A FortiGate administrator is configuring IPS to protect against a known exploit targeting a web server. The administrator wants to ensure that the IPS engine can decode the HTTP protocol. Which TWO actions are necessary?

Accepted Answer

Enable the HTTP protocol decoder in the IPS sensor. The HTTP protocol decoder must be enabled in the IPS sensor because the IPS engine uses protocol decoders to normalize traffic and apply signatures correctly. Without the HTTP decoder, the IPS engine cannot parse HTTP headers, methods, or URIs, making it blind to web-based exploits. This is a prerequisite for any HTTP-specific IPS inspection.

Answer

Configure an IP pool for the web server

Answer

Set the IPS action to 'block'

Answer

Disable the FTP protocol decoder

Question 6

An administrator configures a web filter profile with FortiGuard category blocking and URL filter to allow example.com. Users report that example.com is still blocked. What is the most likely cause?

Accepted Answer

The FortiGuard category action is set to 'block' and takes precedence over the URL filter allow rule. When both FortiGuard category blocking and a URL filter are configured in the same web filter profile, the FortiGuard category action (e.g., 'block') is evaluated first and takes precedence over any URL filter allow rule. This is because FortiGate processes web filter rules in a specific order: FortiGuard category blocking is applied before URL filter entries. Therefore, even if a URL filter explicitly allows example.com, the FortiGuard category block will prevent access.

Answer

The URL filter requires deep inspection to be enabled

Answer

The URL filter entry is placed after the FortiGuard category in the policy

Answer

The DNS filter is blocking example.com before the web filter is evaluated

Question 7

A FortiGate is configured with flow-based antivirus and an IPS profile on a policy. The administrator runs 'diagnose ips packet-list' and sees that packets are being forwarded without inspection. What is the most likely reason?

Accepted Answer

The session is offloaded to the NPU and is not being sent to the IPS engine. When a FortiGate offloads a session to the NPU (Network Processor Unit), the traffic bypasses the CPU and therefore does not reach the IPS engine for inspection. The 'diagnose ips packet-list' command shows packets forwarded without inspection because the NPU handles them directly, and flow-based inspection requires the session to be processed by the IPS engine on the CPU. This is the most likely reason when the administrator observes packets bypassing inspection despite having flow-based antivirus and IPS profiles applied.

Answer

The antivirus profile is set to proxy-based, conflicting with flow-based IPS

Answer

The IPS profile is configured with 'monitor' mode instead of 'protect'

Answer

The traffic is UDP and flow-based inspection does not inspect UDP

Question 8

A network administrator wants to prevent users from downloading files with .exe extensions via HTTP and HTTPS. Which security profile feature should be used?

Accepted Answer

Antivirus profile with 'block' action for file pattern matching .exe. The Antivirus profile in FortiGate can be configured with a file pattern matching rule to block files based on their extension, such as .exe. This feature operates at the application layer, inspecting HTTP and HTTPS traffic (via SSL inspection) to identify and block executable files before they reach the user. Option C is correct because it directly uses the antivirus engine's file pattern matching capability to enforce this policy.

Answer

Web filter profile with URL filter to block .exe sites

Answer

Application control profile to block file transfer applications

Answer

IPS profile to block executable file transfers

Question 9

A FortiGate administrator receives reports that some users are receiving spam emails despite an email filter profile being applied to the SMTP traffic. The email filter profile has 'spam' action set to 'discard'. What is the most likely reason spam is still reaching users?

Accepted Answer

The internal email server receives email directly from the internet without passing through the FortiGate. If the internal email server receives email directly from the internet without passing through the FortiGate, the email filter profile applied to SMTP traffic on the FortiGate will never inspect those messages. The FortiGate can only filter traffic that actually traverses it; any email routed around the FortiGate bypasses all security profiles entirely.

Answer

The spam dictionary is not updated with latest spam signatures

Answer

The email filter profile is not configured to scan outbound emails

Answer

The email filter profile is applied to the wrong policy direction (inbound vs outbound)

Question 10

An administrator enables deep inspection for HTTPS traffic. Users report that they cannot access some websites because of certificate errors. The administrator wants to override these errors and allow access. What should be configured?

Accepted Answer

Add the websites to the 'SSL/SSH exemption' list in the deep inspection profile. In FortiOS, deep inspection can generate certificate errors for sites with self-signed or mismatched certificates. To allow access despite errors, the administrator can add the affected domains to the 'SSL/SSH exemption' list in the deep inspection profile. This exempts those sites from deep inspection, avoiding the certificate error.

Answer

Disable certificate verification in the deep inspection profile

Answer

Add the websites to the 'FortiGuard category' allow list

Answer

Configure the web filter to allow these websites

Question 11

What is the purpose of the 'safe search' option in a FortiGate web filter profile?

Accepted Answer

It filters explicit content from search engine results. The 'safe search' option in a FortiGate web filter profile forces supported search engines (such as Google, Bing, and Yahoo) to filter explicit content from search results. This is achieved by appending specific parameters to the search engine URLs (e.g., &safe=active for Google), ensuring that adult or offensive material is suppressed regardless of the user's individual search settings.

Answer

It enforces the use of HTTPS for search engines

Answer

It allows users to bypass URL filters during safe search

Answer

It blocks all search engine traffic

Question 12

A FortiGate is configured with flow-based inspection and an IPS profile. The administrator runs 'diagnose ips session list' and sees many sessions with 'state=bypass'. What does this indicate?

Accepted Answer

The sessions are being offloaded to the NPU and are not inspected by IPS. When a FortiGate uses flow-based inspection, sessions that are offloaded to the Network Processor Unit (NPU) are not inspected by the IPS engine. The 'state=bypass' in the 'diagnose ips session list' output indicates that these sessions are being hardware-accelerated and bypassing the IPS inspection, which is normal behavior for traffic that meets offload criteria.

Answer

The IPS profile is configured with 'pass' action for all signatures

Answer

The IPS signatures have expired and are not being applied

Answer

The FortiGate is under DoS attack and is dropping sessions

Question 13

Which two inspection modes are available for antivirus scanning on a FortiGate?

Accepted Answer

Flow-based and proxy-based. FortiGate offers two distinct inspection modes for antivirus scanning: flow-based and proxy-based. Flow-based inspection uses a single-pass, low-latency engine that examines traffic as it passes through, while proxy-based inspection buffers and reassembles the entire file before scanning, providing deeper analysis at the cost of higher latency. Both modes are configured within the antivirus security profile to match different performance and security requirements.

Answer

Stateful and stateless

Answer

Inline and passive

Answer

Kernel-based and user-based

Question 14

An administrator wants to block users from uploading files to cloud storage services like Google Drive via HTTPS. Which security profile combination is required?

Accepted Answer

Application control profile to block cloud storage applications, with deep inspection enabled. To block file uploads to cloud storage services like Google Drive over HTTPS, an application control profile is required because it can identify and control specific application actions (e.g., file uploads) within encrypted traffic. Deep inspection must be enabled to decrypt the HTTPS traffic, allowing the FortiGate to inspect the application-layer payload and enforce the upload blocking rule.

Answer

IPS profile to block file uploads to cloud services

Answer

DNS filter to block Google Drive domain

Answer

Web filter profile with URL filter to block Google Drive

Question 15

A FortiGate administrator is troubleshooting why antivirus scanning is not working for HTTPS traffic. Which TWO steps should be verified?

Accepted Answer

Ensure the firewall policy has SSL/TLS deep inspection enabled. HTTPS traffic is encrypted, so the FortiGate must decrypt it using SSL/TLS deep inspection before the antivirus engine can scan the payload. Without deep inspection, the antivirus profile sees only encrypted packets and cannot detect threats within the HTTPS stream.

Answer

Ensure the antivirus profile is set to proxy-based inspection

Answer

Confirm that the web filter profile is also applied

Answer

Check that the FortiSandbox is online for advanced scanning