NSE4 Security Profiles Practice Test 12 — 15 Questions

Question 1

An administrator wants to block all traffic from the 'P2P' application category but allow traffic from 'File Sharing' applications like Dropbox. Which THREE configurations are required to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an application control profile that sets 'P2P' category to 'block' and 'File Sharing' category to 'allow'. An application control profile directly manages application categories, allowing you to set 'P2P' to 'block' and 'File Sharing' to 'allow'. This profile is then applied to a firewall policy to enforce the desired traffic filtering. Without this profile, the firewall cannot differentiate between these application categories.

Answer

Set the firewall policy inspection mode to proxy-based

Answer

Apply a web filter profile to override the application control

Question 2

An administrator configures a DLP profile to detect Social Security numbers in outbound traffic. The profile is applied to an outbound HTTP policy. Which TWO additional configurations are necessary for the DLP to inspect HTTPS traffic?

Accepted Answer

Enable SSL/TLS deep inspection on the firewall policy. DLP inspection of HTTPS traffic requires the firewall to decrypt the encrypted payload. Enabling SSL/TLS deep inspection on the firewall policy allows FortiGate to perform man-in-the-middle decryption, re-encrypt, and then inspect the decrypted content for sensitive data like Social Security numbers. Without deep inspection, the DLP engine sees only encrypted traffic and cannot match patterns.

Answer

Set the firewall policy inspection mode to proxy-based

Answer

Add an SSL exemption for the destination servers

Answer

Configure a web filter profile to allow the traffic

Question 3

A FortiGate administrator wants to block access to gambling websites using web filtering. Which FortiGuard category should be blocked?

Accepted Answer

Gambling. FortiGuard web filtering uses pre-defined categories to classify websites. To block gambling sites, the administrator must select the 'Gambling' category in the web filter profile. This category specifically includes domains and URLs related to online betting, casinos, and other gambling activities.

Answer

Spam

Answer

Malware

Answer

Pornography

Question 4

An administrator runs the CLI command 'diagnose debug rating' and sees that all FortiGuard web filter requests are timing out. What is the most likely cause?

Accepted Answer

The DNS server configured on the FortiGate is not resolving the FortiGuard FQDN. The 'diagnose debug rating' command shows real-time FortiGuard web filter request status. When all requests are timing out, it indicates that the FortiGate cannot reach the FortiGuard servers. The most common cause is a DNS resolution failure, where the FortiGate cannot resolve the FortiGuard FQDN (e.g., service.fortiguard.net) due to an incorrect or unreachable DNS server configuration. Without proper DNS, the FortiGate cannot establish the necessary HTTPS connections to query the FortiGuard rating service.

Answer

The web filter profile has an incorrect action configured

Answer

The web filter is set to 'monitor all' which causes all requests to timeout

Answer

The FortiGuard web filtering license has expired

Question 5

A FortiGate is configured with SSL deep inspection using a self-signed CA certificate. Users report that they see a certificate warning in their browser when accessing HTTPS sites. The admin wants to eliminate these warnings. What should the admin do?

Accepted Answer

Install the FortiGate's CA certificate on each client device's trusted root certificate store. When FortiGate performs SSL deep inspection, it decrypts HTTPS traffic by acting as a man-in-the-middle, using its own CA certificate to re-encrypt the connection. If the FortiGate's self-signed CA certificate is not trusted by the client, the browser will display a certificate warning because the issuer is not in the client's trusted root store. Installing the FortiGate's CA certificate on each client device's trusted root certificate store establishes trust, eliminating the warnings.

Answer

Disable SSL deep inspection and rely on flow-based antivirus

Answer

Change the SSL inspection mode to certificate inspection only

Answer

Configure an SSL certificate exemption for all HTTPS traffic

Question 6

An administrator wants to block an application named 'Skype' on the network. They create an application control profile and add a rule to block 'Skype'. However, after applying the profile to the policy, users can still use Skype. What is the most likely reason?

Accepted Answer

Skype traffic is encrypted and SSL deep inspection is not enabled. Skype uses proprietary encryption and often relies on peer-to-peer connections that bypass traditional port-based inspection. Without SSL deep inspection (also known as HTTPS inspection or certificate-based decryption), the FortiGate cannot decrypt the encrypted Skype traffic to match it against the application control signature. Application control relies on either protocol decoders or deep packet inspection (DPI) to identify applications; if the traffic is encrypted and not decrypted, the FortiGate sees only encrypted payloads and cannot apply the block rule.

Answer

The application control profile is not enabled on the firewall policy

Answer

The application signature for Skype is outdated

Answer

The application control rule is set to 'monitor' instead of 'block'

Question 7

Which IPS detection method analyzes traffic patterns over time to identify attacks that are characterized by a threshold of events?

Accepted Answer

Rate-based detection. Rate-based detection (also known as threshold-based detection) monitors traffic patterns over a defined time window and triggers an alert when the number of events (e.g., connection attempts, SYN packets) exceeds a predefined threshold. This method is specifically designed to identify attacks that are characterized by a threshold of events, such as DoS/DDoS floods or brute-force login attempts, rather than relying on static signatures or protocol anomalies.

Answer

Protocol decoder-based detection

Answer

Signature-based detection

Answer

Anomaly-based detection

Question 8

A FortiGate administrator configures an email filter profile to block spam. Users report that some legitimate emails are being blocked. The administrator wants to reduce false positives while still blocking spam. What should the administrator do?

Accepted Answer

Increase the spam threshold score. Increasing the spam threshold score raises the bar for what is classified as spam, so only emails with a higher spam score (indicating stronger spam characteristics) are blocked. This reduces false positives because legitimate emails with lower scores will no longer be blocked, while still blocking high-scoring spam.

Answer

Disable the email filter profile

Answer

Decrease the spam threshold score

Answer

Enable the FortiGuard spam filter only

Question 9

An administrator configures a DLP profile to detect credit card numbers in email traffic. The DLP rule uses a regular expression. However, the DLP sensor is not triggering on emails containing credit card numbers. What is a likely reason?

Accepted Answer

SSL deep inspection is not enabled on the policy. DLP sensors inspecting email traffic require SSL deep inspection to decrypt the SMTP traffic if it is encrypted via TLS (STARTTLS). Without SSL deep inspection enabled on the firewall policy, the FortiGate cannot see the plaintext content of encrypted emails, so the DLP regular expression will never match credit card numbers. This is the most likely reason the DLP sensor is not triggering.

Answer

The regular expression is case-sensitive and credit card numbers are lowercase

Answer

The DLP sensor is configured to 'monitor' only

Answer

The DLP profile is applied to the inbound policy only

Question 10

Which security profile component is specifically designed to prevent data exfiltration by inspecting outgoing traffic for sensitive data patterns?

Accepted Answer

Data Leak Prevention (DLP). Data Leak Prevention (DLP) is the security profile component specifically designed to inspect outgoing traffic for sensitive data patterns, such as credit card numbers, social security numbers, or custom regex patterns. It uses deep packet inspection (DPI) to analyze content in emails, web uploads, and file transfers, blocking or alerting on matches to prevent unauthorized data exfiltration.

Answer

Application Control

Answer

Antivirus

Answer

Web Filter

Question 11

An administrator integrates FortiGate with FortiSandbox for advanced threat detection. The FortiGate is configured to send files to FortiSandbox for analysis. Despite correct configuration, files are not being submitted. The administrator runs 'diagnose debug application fortisandbox -1' and sees 'no server configured'. What is the issue?

Accepted Answer

The FortiSandbox server IP address is not configured on the FortiGate. The debug output 'no server configured' explicitly indicates that the FortiGate does not have a FortiSandbox server IP address defined in its configuration. Without the server IP configured under 'config system fortisandbox', the FortiGate cannot establish a connection or submit files, regardless of other settings. This is a prerequisite step before any file submission can occur.

Answer

The FortiSandbox license has expired

Answer

Firewall policies are blocking communication to the FortiSandbox server

Answer

The antivirus profile is not configured to submit files to FortiSandbox

Question 12

A network administrator wants to ensure that all users are blocked from accessing websites categorized as 'Pornography' and 'Hacking' on a FortiGate. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Apply the web filter profile to the firewall policy that governs outbound internet traffic. A web filter profile must be applied to a firewall policy to enforce web filtering on outbound internet traffic. Without this association, the profile's settings (including category blocks) are not activated. The firewall policy is the enforcement point where security profiles are linked to traffic flows.

Answer

Create a URL filter to block all URLs containing 'pornography' and 'hacking'

Answer

Enable DNS filter and block the categories there

Answer

Enable SSL deep inspection to ensure the categories can be identified

Question 13

An administrator is troubleshooting why an application control profile is not detecting a custom application that uses a non-standard port. The administrator wants to ensure the application is properly identified. Which THREE steps should the administrator take? (Choose three.)

Accepted Answer

Add a custom application signature based on the traffic pattern. Option B is correct because application control can only identify a custom application on a non-standard port if a custom application signature is created that matches its traffic pattern, since the default signature database will not recognize it. Option D is correct because an application control profile only takes effect when it is attached to the firewall policy that handles the traffic; if it is applied to the wrong policy, the custom application will never be inspected or detected. Option E is correct because if the custom application's traffic is encrypted with SSL/TLS, the firewall cannot see the application-layer data needed for identification unless SSL deep inspection is enabled to decrypt and inspect it. Option A is incorrect because setting the action to 'block' only controls what happens after identification and does nothing to help the firewall recognize the application. Option C is incorrect because disabling flow-based inspection and using proxy-based only is not a required step for identifying a custom application and may not even be supported or desirable in all deployments.

Answer

Set the application control action to 'block' for the application

Answer

Disable flow-based inspection and use proxy-based only

Question 14

A network administrator wants to prevent users from accessing known malicious websites using FortiGate. Which security profile should be applied to the firewall policy to achieve this goal?

Accepted Answer

Web filtering profile. Web filtering profile. FortiGate's web filtering profile uses URL rating and category-based filtering to block access to known malicious websites by leveraging FortiGuard's real-time threat intelligence. This is the specific security profile designed to control web access based on URL reputation, including blocking malicious URLs.

Answer

Antivirus profile

Answer

Application control profile

Answer

IPS profile

Question 15

An administrator configures an antivirus profile in proxy-based inspection mode on a FortiGate. However, SMTP traffic is not being scanned for viruses. The firewall policy includes the antivirus profile and the FortiGate has a valid FortiGuard subscription. What is the most likely cause?

Accepted Answer

The SMTP protocol is not enabled in the proxy options of the security profile. In proxy-based inspection mode, the antivirus profile relies on the proxy options to determine which protocols to scan. If SMTP is not explicitly enabled in the proxy options of the security profile, the FortiGate will not inspect SMTP traffic for viruses, even if the antivirus profile is applied to the policy and the FortiGuard subscription is valid.

Answer

Flow-based inspection is required for SMTP scanning

Answer

The FortiGate does not have a valid SSL certificate for SMTP inspection

Answer

The antivirus profile is configured to scan only HTTP traffic