NSE4 Security Profiles Practice Test 12 — 15 Questions

Question 1

Which TWO are valid types of SSL/TLS inspection available on FortiGate?

Accepted Answer

Full SSL Deep Inspection. FortiGate supports two primary SSL/TLS inspection methods: Certificate Inspection, which validates certificates without decrypting traffic, and Full SSL Deep Inspection, which decrypts, inspects, and re-encrypts traffic to apply security profiles. Option C is correct because Full SSL Deep Inspection is the only method that allows the FortiGate to inspect the payload of encrypted sessions for threats like malware or data leakage.

Answer

Off-box SSL Inspection

Answer

Proxy SSL Inspection

Answer

Passive SSL Inspection

Question 2

A FortiGate admin is troubleshooting email filtering. Legitimate emails from a specific external domain are being marked as spam. Which THREE steps should the admin take to resolve this?

Accepted Answer

Check the spam filter logs to see why the email was flagged. Options A, C, and E are correct. The admin should first check the spam filter logs (A) to understand why the email was flagged. If it's a false positive, adding the sender domain to the email filter allowlist (C) can prevent future false positives. Verifying the sender’s domain reputation on FortiGuard (E) helps determine if the domain is legitimate. Option B is incorrect because disabling the spam filter entirely would stop all spam filtering, which is not a good practice. Option D is incorrect because enabling deep inspection for SMTP traffic is not directly related to email filtering false positives; it is used for content inspection but not specifically for allowlisting domains.

Answer

Disable the spam filter entirely

Answer

Enable deep inspection for SMTP traffic

Question 3

An administrator wants to inspect SSL traffic to a specific finance application that uses a custom port (9443) and a self-signed certificate. Which configuration is required?

Accepted Answer

Use deep inspection and add the application's self-signed certificate to the FortiGate's trusted CA list.. Deep inspection is required to decrypt and inspect SSL traffic using a self-signed certificate on a non-standard port. The FortiGate must trust the application's self-signed certificate by adding it to the trusted CA list; otherwise, the deep inspection proxy will fail to validate the certificate and drop the connection. Certificate inspection (Option A) only checks the certificate metadata without decrypting the payload, so it cannot inspect the actual application traffic.

Answer

Configure certificate inspection on the policy.

Answer

Disable SSL inspection for that application.

Answer

Use flow-based inspection with certificate inspection.

Question 4

Which TWO web filtering features can be used to block access to malicious websites? (Choose two.)

Accepted Answer

FortiGuard category-based filtering. FortiGuard category-based filtering (C) is correct because it leverages FortiGuard's cloud-based web rating database to categorize URLs and block access to known malicious sites, such as those hosting malware or phishing. Web rating override (D) is correct because it allows administrators to manually override the FortiGuard rating for specific URLs, enabling them to block a site that may not yet be categorized as malicious by FortiGuard. Both features directly control access to malicious websites based on URL reputation.

Answer

Static URL filtering

Answer

Application control

Answer

DNS filter

Question 5

A company with 500 employees uses FortiGate as their internet gateway. They recently enabled SSL deep inspection using the built-in CA certificate. After deployment, many users report that they cannot access their online banking websites. The error message in the browser says 'The certificate is not trusted'. The administrator has already pushed the FortiGate CA certificate to all domain-joined computers via Group Policy. However, the problem persists for banking sites. The administrator also notices that banking sites load fine on mobile devices that do not have the CA certificate installed. What is the most likely cause and solution?

Accepted Answer

Banking websites use certificate pinning. Exempt them from deep inspection using an SSL inspection exemption list.. Banking websites often use HTTP Public Key Pinning (HPKP) or certificate pinning, where the browser expects a specific certificate or public key from the server. When FortiGate performs SSL deep inspection, it re-signs the server's certificate with its own CA, breaking the pinning validation. This causes the 'certificate not trusted' error even when the FortiGate CA is trusted, because the browser detects that the presented certificate does not match the pinned certificate. The correct solution is to exempt banking sites from deep inspection using an SSL inspection exemption list, allowing the original server certificate to pass through.

Answer

Disable SSL inspection entirely to avoid certificate issues.

Answer

The CA certificate is not properly installed on all computers. Re-deploy via Group Policy.

Answer

Use certificate inspection instead of deep inspection for all traffic.

Question 6

A network administrator notices that an IPS sensor is generating excessive false positives for a specific signature. The administrator wants to exclude traffic from a trusted internal server (IP 10.1.1.100) from inspection for that signature only, while keeping other signatures active. Which configuration change should the administrator apply?

Accepted Answer

Create an IPS filter that excludes the server's source IP address from the signature.. An IPS filter allows the administrator to define a rule that excludes traffic from a specific source IP address (10.1.1.100) from inspection for a particular signature, while leaving all other signatures active. This granular approach ensures that false positives for that signature are reduced without disabling the signature entirely or affecting other traffic.

Answer

Set the signature action to 'pass' and use an application control profile to bypass the server.

Answer

Disable the signature in the IPS sensor configuration.

Answer

Add the server's IP to the exempt list in the IPS sensor.

Question 7

An administrator has configured the policy shown in the exhibit. Traffic to the web server at 10.0.1.10 over HTTPS is allowed, but users complain that they cannot access the web server's login page. The IPS sensor 'High_Security_Sensor' has a signature that blocks SQL injection attempts. The application list 'Block_Social_Media' blocks Facebook and Twitter. What is the most likely cause of the issue?

Accepted Answer

The application control profile is blocking the web application.. The policy explicitly allows HTTPS traffic to 10.0.1.10, but the application control profile 'Block_Social_Media' is applied. This profile blocks Facebook and Twitter, which are web-based applications. If the web server's login page is served over HTTPS and is incorrectly classified by the FortiGate as a social media application (e.g., due to shared CDN or similar traffic patterns), the application control profile will block it, preventing user access despite the firewall policy allowing the service.

Answer

The IPS sensor is blocking the login page due to a false positive.

Answer

The firewall policy action is set to 'deny' but the exhibit shows 'accept'.

Answer

The HTTPS service is not correctly defined and blocking the traffic.

Question 8

Which THREE of the following are valid methods to exclude certain HTTPS traffic from SSL inspection on a FortiGate?

Accepted Answer

Adding the domain to the 'SSL Exempt Domains' list in the SSL/SSH inspection profile.. The 'SSL Exempt Domains' list in the SSL/SSH inspection profile allows you to specify domain names (e.g., *.example.com) that will bypass SSL inspection entirely. When FortiGate matches the SNI field in the ClientHello or the certificate CN/SAN against this list, it skips decryption and passes the traffic through without inspection, reducing overhead for trusted or non-critical domains.

Answer

Setting the firewall policy action to 'accept' with no inspection.

Answer

Using a web filter category exemption.

Question 9

A company wants to block all peer-to-peer (P2P) traffic using Application Control on their FortiGate. They have enabled the application control profile, but users can still download files via BitTorrent. What is the most likely reason?

Accepted Answer

The application control profile does not have SSL inspection enabled.. BitTorrent traffic is often encrypted, so without SSL inspection, the FortiGate cannot inspect the payload of the encrypted sessions to identify the application. Application Control relies on deep packet inspection (DPI) to match traffic against application signatures; if SSL inspection is not enabled, the FortiGate only sees encrypted packets and cannot detect BitTorrent, allowing the traffic to pass unchecked.

Answer

The FortiGate is operating in Transparent mode.

Answer

The application control profile is applied to the outgoing policy, but BitTorrent traffic is incoming.

Answer

The default application signatures do not include BitTorrent.

Question 10

An administrator has configured an IPS sensor to block critical-severity attacks. However, after a week, they notice that a known exploit (CVE-2021-44228) is still getting through. Which configuration change should be made to improve detection?

Accepted Answer

Enable the specific IPS signature for the exploit in the sensor.. The IPS sensor must have the specific signature for CVE-2021-44228 (Log4Shell) enabled to detect and block it. Even if the sensor is set to block critical-severity attacks, the signature for this exploit may be disabled by default in the sensor's signature database. Enabling the specific signature ensures the sensor inspects traffic for the exploit's unique patterns and applies the configured action.

Answer

Set the IPS sensor severity filter to 'low' and above.

Answer

Change the IPS sensor action from 'default' to 'block' for all signatures.

Answer

Create a custom IPS signature for the exploit.

Question 11

A company is implementing SSL/TLS inspection on a FortiGate to monitor encrypted traffic. They want to ensure that traffic to high-risk categories is blocked, while traffic to financial sites is inspected but not blocked. The administrator creates an SSL inspection profile that deep-inspects all traffic except traffic to financial sites. However, users report that they cannot access financial websites. What is the most likely cause?

Accepted Answer

The web filter profile is configured to block financial websites, overriding the SSL inspection exemption.. The most likely cause is that the web filter profile applied in the same firewall policy is configured to block financial websites. Even though the SSL inspection profile exempts financial sites from deep inspection, the web filter profile operates independently and can block traffic based on URL category. Since the web filter is evaluated after SSL inspection, it will block the decrypted or even non-decrypted traffic to financial sites if the category is set to block, overriding the SSL inspection exemption.

Answer

The SSL inspection profile should be set to certificate-inspection instead of deep-inspection for financial sites.

Answer

The SSL inspection profile must be applied after the web filter profile in the firewall policy.

Answer

The SSL inspection profile should have deep-inspection disabled for all categories except financial.

Question 12

A company is deploying FortiGate for outbound web filtering. They want to block users from accessing social media sites during business hours, but still allow access to cloud-based productivity tools like Office 365. Which approach should the administrator use to meet this requirement?

Accepted Answer

Configure an application control profile with rules to block social media applications and allow Office 365 applications.. Application control is the correct approach because it can identify and control applications like social media and Office 365 based on their unique signatures, regardless of the ports or protocols they use. Unlike URL filtering or port blocking, application control can differentiate between Office 365 traffic and social media traffic even when both use HTTPS on TCP 443, allowing the administrator to block social media while permitting cloud productivity tools.

Answer

Create a firewall policy to block all traffic to ports commonly used by social media (e.g., TCP 443).

Answer

Use a web filter profile to block URLs containing 'facebook' or 'twitter'.

Answer

Implement a DNS filter to block DNS queries for social media domains.

Question 13

A network administrator notices that some users can access blocked web categories despite a web filter profile applied to the policy. The admin runs 'diagnose debug rating' and sees 'rating not allow' for the category. What is the MOST likely cause?

Accepted Answer

The web filter profile has an 'override' configured for those users. The 'rating not allow' message in the 'diagnose debug rating' output indicates that the FortiGate's rating engine correctly identified the category as blocked by the web filter profile. However, if an 'override' is configured for specific users or groups, it allows them to bypass the blocked category. This explains why some users can access the site despite the profile blocking it, as the override takes precedence over the profile's default action.

Answer

The policy is not using the correct web filter profile

Answer

DNS filter is allowing the domain

Answer

The FortiGuard web filter database is outdated

Question 14

An administrator wants to block users from uploading sensitive documents through webmail. Which security profile should be configured on the FortiGate to achieve this goal?

Accepted Answer

Data Leak Prevention (DLP). Data Leak Prevention (DLP) is the correct security profile because it is specifically designed to inspect content (e.g., file names, patterns, or keywords) in traffic such as webmail uploads and block sensitive data from leaving the network. DLP sensors can be configured with rules to match patterns like credit card numbers, social security numbers, or custom keywords, and then take action such as blocking or logging the session.

Answer

Antivirus

Answer

Application control

Answer

Web filter

Question 15

A FortiGate in flow-based mode is configured with an antivirus profile to block infected files. A user downloads a .zip file containing a known virus, but the download is allowed and the file is not quarantined. What is the MOST likely reason?

Accepted Answer

Flow-based inspection does not decompress archives by default. In flow-based inspection mode, FortiGate does not decompress archive files (such as .zip) by default. This means the antivirus engine cannot inspect the contents of the compressed file, so even if a known virus is inside, it will not be detected or blocked. To inspect archives in flow-based mode, you must enable 'deep archive inspection' in the antivirus profile.

Answer

The antivirus profile is not set to 'block' for virus outbreaks

Answer

The virus definition database is outdated

Answer

Flow-based inspection does not support antivirus for .zip archives