NSE4 Security Profiles Practice Test 11 — 15 Questions

Question 1

What is the purpose of enabling 'Safe Search' in a web filter profile on a FortiGate?

Accepted Answer

It forces search engines to filter explicit content from search results.. Safe Search in a FortiGate web filter profile forces supported search engines (e.g., Google, Bing, Yahoo) to filter explicit content from search results by appending specific URL parameters (e.g., `&safe=active` for Google) to search queries. This ensures that when users perform searches, the search engine's own safe search setting is enforced at the network level, preventing access to adult or inappropriate material regardless of the user's browser settings.

Answer

It blocks all searches containing the word 'safe'.

Answer

It redirects users to a safe landing page when a blocked site is accessed.

Answer

It encrypts search queries to protect user privacy.

Question 2

A FortiGate administrator wants to integrate with FortiSandbox to analyze suspicious files detected by antivirus. The administrator configures the FortiSandbox settings under Security Fabric. However, files are not being sent to FortiSandbox. The antivirus profile is set to 'flow-based' inspection. What could be the reason?

Accepted Answer

Flow-based inspection does not support FortiSandbox integration; proxy-based inspection is required.

Answer

The antivirus profile is set to 'Monitor' instead of 'Block'.

Answer

The firewall policy is using NAT, which interferes with FortiSandbox connectivity.

Answer

The FortiGate does not have a valid FortiSandbox license.

Question 3

A school district uses a FortiGate to filter web traffic for students. The administrator wants to enforce that Google searches are filtered for explicit content. Which configuration should be applied?

Accepted Answer

Enable 'Google Safe Search' in the web filter profile under 'FortiGuard Categories' -> 'Safe Search'.. The correct method is to enable 'Google Safe Search' in the web filter profile under 'FortiGuard Categories' -> 'Safe Search'. This setting forces FortiGate to append the Google safe search parameter (&safe=active) to all Google search requests, ensuring that explicit content is filtered out at the browser level. Option B (blocking the Google Search application) would prevent all Google searches, which is overly restrictive and does not allow filtered searches. Option C (URL filtering for keywords) is ineffective because Google search URLs do not necessarily contain those keywords. Option D (blocking the entire 'Search Engines' category) would block all search engines, including legitimate educational ones, and does not provide granular control.

Answer

Use an application control profile to block the 'Google Search' application.

Answer

Create a URL filter to block URLs containing 'porn' or 'adult'.

Answer

Block the URL category 'Search Engines' and allow only approved search engines.

Question 4

What is the purpose of the 'DNS Filter' feature on a FortiGate?

Accepted Answer

To block DNS queries to malicious domains based on FortiGuard category and allow/block lists.

Answer

To cache DNS queries for faster resolution.

Answer

To encrypt DNS traffic to prevent eavesdropping.

Answer

To filter the content of DNS responses from legitimate servers.

Question 5

A FortiGate is configured with an IPS profile to protect a web server. The administrator notices that some attacks are not being detected. The IPS signature database is up to date. What should the administrator check first?

Accepted Answer

Ensure the IPS profile is applied to the firewall policy that handles traffic to the web server.

Answer

Increase the severity level of the IPS sensor.

Answer

Disable flow-based inspection and enable proxy-based inspection.

Answer

Change the IPS signature action from 'default' to 'block'.

Question 6

A FortiGate administrator is configuring intrusion prevention (IPS) for a web server. The administrator wants to both block known exploits and detect anomalous traffic patterns. Which TWO features should be enabled? (Choose two.)

Accepted Answer

IPS signatures. IPS signatures (A) are correct because they contain predefined patterns of known exploits, allowing the FortiGate to match and block malicious traffic against a web server. Anomaly detection (D) is correct because it establishes a baseline of normal traffic and alerts on deviations, enabling detection of zero-day or unusual patterns that signatures may miss.

Answer

Web filter

Answer

Antivirus

Answer

Application control

Question 7

An organization uses FortiMail for email filtering and FortiGate for web filtering. The administrator wants to ensure that email traffic is filtered for spam and malware before reaching the internal mail server. Which TWO steps should be taken? (Choose two.)

Accepted Answer

Configure FortiMail to scan incoming emails and then forward them to the internal mail server.. FortiMail is specifically designed to scan incoming emails for spam and malware. By configuring FortiMail to receive emails, scan them, and then forward them to the internal mail server, the administrator ensures that all email traffic is filtered before delivery. To guarantee that all incoming email traffic passes through FortiMail, the FortiGate must also be configured to route SMTP traffic to FortiMail (e.g., via policy-based routing or a VIP). This ensures the traffic is inspected by FortiMail before reaching the internal mail server.

Answer

Apply an antivirus profile to the firewall policy that handles SMTP traffic.

Answer

Apply an email filter profile to the firewall policy that handles SMTP traffic.

Answer

Disable SMTP inspection on the FortiGate to avoid double scanning.

Question 8

A FortiGate administrator needs to prevent data leakage by blocking the upload of files containing credit card numbers via web traffic. Which THREE components must be configured? (Choose three.)

Accepted Answer

DLP profile with a rule to detect credit card numbers. A DLP (Data Loss Prevention) profile is specifically designed to inspect content for sensitive data patterns, such as credit card numbers, using predefined or custom data patterns. When configured with a rule to detect credit card numbers, the DLP profile can block or log the upload of files containing such data over web traffic.

Answer

Application control profile to block file upload applications

Answer

Antivirus profile to scan the files for malware

Question 9

A FortiGate administrator wants to create a web filter profile that blocks access to social networking sites during work hours but allows them during lunch breaks. Additionally, the administrator wants to ensure that HTTPS social networking sites are blocked. Which TWO configurations are required? (Choose two.)

Accepted Answer

Apply the web filter profile to a firewall policy that uses a schedule for work hours.. A web filter profile with a FortiGuard category filter can block the 'Social Networking' category. To restrict the block to work hours only, the profile must be applied to a firewall policy that uses a schedule defining work hours. During lunch, another policy (or policy schedule) would allow traffic without the web filter. Option C is required because HTTPS traffic is encrypted; without SSL deep inspection, FortiGate cannot inspect HTTPS content, so the category filter would be ineffective for encrypted social networking sites.

Answer

Create a web filter profile with a FortiGuard category filter that blocks the 'Social Networking' category and set a time-based schedule.

Answer

Use a URL filter to manually list all social networking sites.

Answer

Configure DNS filter to block social networking domains.

Question 10

An administrator configures an IPS sensor with a signature that is triggered by traffic to a specific server. The signature is set to 'Block' but the traffic is not being blocked. The administrator verifies that the IPS sensor is applied to the correct firewall policy and that the signature is enabled. Which TWO additional checks should the administrator perform? (Choose two.)

Accepted Answer

Verify that the signature's 'Action' is not overridden by a higher-priority rule in the IPS sensor.

Answer

Ensure that the antivirus profile is not interfering with IPS.

Answer

Check if the destination server is in the 'Local-in' policy, which may bypass IPS.

Answer

Confirm that the signature has a valid CVE ID.

Question 11

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. HTTPS uses TLS encryption. Without SSL/TLS deep inspection enabled on the policy, FortiGate cannot decrypt and inspect the content of HTTPS traffic. The antivirus profile will only scan unencrypted traffic or traffic where deep inspection has decrypted it first.

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The FortiGuard antivirus subscription has expired

Question 12

An administrator wants to block access to websites that host malware. Which FortiGate feature should be configured to achieve this goal?

Accepted Answer

Web Filtering profile with FortiGuard categories. FortiGate's Web Filtering profile with FortiGuard categories is the correct feature because it allows administrators to block access to websites based on URL categories, including those known to host malware. FortiGuard maintains a continuously updated database of malicious URLs, and applying a web filtering profile that blocks the 'Malicious Websites' category directly prevents users from accessing such sites. This is the most straightforward and effective method for blocking malware-hosting websites at the proxy or flow-based inspection level.

Answer

IPS profile

Answer

DNS Filter profile

Answer

Application Control profile

Question 13

A network admin is configuring a security policy for outbound HTTP traffic. The requirements are: (1) block access to known malicious websites, (2) prevent users from downloading executable files, (3) detect and block C2 traffic. Which THREE security profiles should be applied to the policy?

Accepted Answer

Antivirus. Options A, B, and D are correct. Web filtering (B) blocks access to known malicious websites; Antivirus (A) prevents users from downloading executable files by scanning HTTP downloads; IPS (D) detects and blocks C2 traffic by inspecting network traffic for command-and-control signatures.

Answer

Application Control

Answer

DNS Filter

Question 14

A security administrator wants to ensure that all DNS queries from internal users are filtered to block access to known malicious domains. Which TWO configurations must be applied?

Accepted Answer

Apply the DNS Filter profile to the firewall policy that allows DNS traffic. The correct answers are B and D. A DNS Filter profile must first be created (D) to define the categories or domains to block. Then, this profile must be applied to the firewall policy that permits DNS traffic from internal users to the DNS server (B). Options A and C are incorrect because deep inspection is not needed for DNS filtering, and DNS inspection is part of the DNS filter profile, not the SSL/SSH inspection profile.

Answer

Enable deep inspection on the firewall policy

Answer

Enable DNS inspection on the SSL/SSH inspection profile

Answer

Configure a DNS server on the FortiGate

Question 15

An administrator has configured an IPS profile to detect SQL injection attacks. However, some SQL injection attempts are still reaching the web server. Which TWO actions should the administrator take to improve detection?

Accepted Answer

Update the IPS signature database. IPS signatures are the primary mechanism for detecting known SQL injection patterns. If attacks are reaching the web server, the signature database is likely outdated or missing recent attack vectors. Updating the signature database ensures the IPS has the latest patterns to match against SQL injection attempts.

Answer

Configure anomaly detection for SQL traffic

Answer

Disable flow-based inspection and use proxy-based only

Answer

Enable SSL deep inspection on the policy