NSE4 Security Profiles Practice Test 13 — 15 Questions

Question 1

An administrator needs to block all traffic from an application that uses a proprietary protocol not recognized by any application signature. Which security profile method should be used to block this traffic?

Accepted Answer

Use an IPS profile with a custom signature based on protocol anomalies. Option C is correct because IPS with custom signatures can detect and block traffic based on protocol anomalies or patterns, even without a pre-defined application signature.

Answer

Create an application control profile and add a custom application signature

Answer

Use a web filter profile to block by URL

Answer

Use a data leak prevention (DLP) profile to match on data patterns

Question 2

An administrator runs 'diagnose ips anomaly list' and sees many 'tcp_syn_flood' entries. The IPS profile has anomaly detection enabled with action 'pass'. The administrator wants to block such attacks. What change is required?

Accepted Answer

Change the action for the anomaly from 'pass' to 'block'. Option B is correct because anomaly detection in IPS profiles uses a threshold-based mechanism; to block, the action must be set to 'block' (or 'reset' for TCP). Setting the action to 'pass' allows the traffic.

Answer

Increase the threshold for the anomaly

Answer

Enable flow-based inspection on the policy

Answer

Add a DoS policy from the same source

Question 3

What is the purpose of enabling 'DNS filter' in a security profile?

Accepted Answer

To block DNS queries to known malicious domains. Option A is correct: DNS filter blocks malicious domains based on FortiGuard category or custom lists by inspecting DNS queries and responses.

Answer

To cache DNS responses for faster browsing

Answer

To prevent DNS tunneling attacks

Answer

To enforce safe search on search engines

Question 4

A FortiGate is configured for SSL deep inspection using a CA certificate. Users report that some websites show certificate errors. The administrator wants to allow these sites without inspection. Which setting should be used?

Accepted Answer

Add the websites to the SSL/SSH exemption list. Option D is correct: SSL/SSH exemption list allows specific destinations to bypass deep inspection, while still applying other security profiles.

Answer

Disable certificate validation in the SSL inspection profile

Answer

Create a separate firewall policy without SSL inspection

Answer

Set the action for invalid certificates to 'allow'

Question 5

Which security profile is used to detect and prevent spam email messages?

Accepted Answer

Email filter profile. Option B is correct: Email filter profile provides anti-spam capabilities using FortiGuard, custom rules, and integration with FortiMail.

Answer

DLP profile

Answer

Web filter profile

Answer

Antivirus profile

Question 6

An administrator configures an application control profile to block 'Facebook' and 'Twitter' using application signatures. Users can still access Facebook via HTTPS. The firewall policy has application control enabled and SSL deep inspection is not configured. Why is Facebook not blocked?

Accepted Answer

HTTPS traffic is encrypted and cannot be inspected without SSL deep inspection. Option A is correct: Without SSL deep inspection, FortiGate cannot see the encrypted application payload to match application signatures for HTTPS traffic. Application control requires decryption for encrypted applications.

Answer

The application signature for Facebook is not updated

Answer

The application control profile is configured in monitor-only mode

Answer

Facebook uses a non-standard port that application control does not monitor

Question 7

A FortiGate with antivirus in flow-based inspection mode is not detecting a known virus in HTTP traffic. The same virus is detected when using proxy-based inspection. What is the most likely reason?

Accepted Answer

Flow-based inspection does not reassemble files or unpack archives, so it misses some viruses. Option B is correct: Flow-based inspection uses less resources and may not perform full file reassembly or unpacking that proxy-based does, allowing some viruses to evade detection.

Answer

Flow-based inspection requires FortiSandbox integration to detect viruses

Answer

The antivirus signature database is outdated for flow-based inspection

Answer

Flow-based inspection only scans on explicit proxy policies

Question 8

What is the function of an IPS 'protocol decoder'?

Accepted Answer

Parse and normalize protocol traffic to improve detection accuracy. Option D is correct: Protocol decoders parse application layer protocols to normalize traffic before signature matching, enabling detection of evasion techniques.

Answer

Encode traffic to prevent attacks

Answer

Rate-limit traffic based on protocol

Answer

Decrypt SSL traffic for inspection

Question 9

An administrator wants to block upload of files containing credit card numbers via web forms. Which security profile should be used?

Accepted Answer

Data leak prevention (DLP) profile. Option A is correct: DLP (Data Leak Prevention) profile can inspect content for sensitive data patterns like credit card numbers and block uploads.

Answer

Antivirus profile

Answer

Web filter profile

Answer

Application control profile

Question 10

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session has been established for 3600 seconds and will expire in 3599 seconds. Option C is correct: The session has been active for 3600 seconds and will expire in 3599 seconds (almost fresh start). 'proto_state=01' indicates TCP three-way handshake completion.

Answer

The session is using UDP protocol

Answer

The session is blocked by the firewall policy

Answer

The session is in SYN-SENT state

Question 11

A FortiGate administrator wants to ensure that all DNS queries to known malware domains are blocked. The firewall policy allows DNS traffic. Which security profile must be applied?

Accepted Answer

DNS filter profile. Option B is correct: DNS filter is specifically designed to inspect DNS queries and block based on FortiGuard categories or custom lists.

Answer

Web filter profile

Answer

Antivirus profile

Answer

Application control profile

Question 12

A network admin wants to block all traffic from the BitTorrent application. The admin has enabled application control on the firewall policy. Which TWO steps are necessary to achieve this?

Accepted Answer

Add the BitTorrent application signature to the application control profile and set action to block. Option A and C are correct: The application control profile must include the BitTorrent signature and be configured to block it. Additionally, if BitTorrent uses random high ports or encryption, SSL deep inspection may be needed to identify the traffic.

Answer

Add a DNS filter profile to block BitTorrent tracker domains

Answer

Set the application control inspection mode to proxy-based

Answer

Enable 'deep inspection' in the application control profile

Question 13

An administrator receives alerts about a possible data breach. Sensitive data (credit card numbers) might be leaving the network via email. The admin wants to detect and block such emails. Which THREE security profiles should be combined?

Accepted Answer

SSL deep inspection profile. Options B, D, and E are correct: DLP detects credit card numbers in content; email filter processes SMTP traffic; SSL deep inspection is needed if email uses TLS.

Answer

Web filter profile

Answer

Antivirus profile

Question 14

A FortiGate admin wants to enforce safe search on Google and Bing for all users. The firewall policy has web filtering enabled. Which TWO configurations are required?

Accepted Answer

Configure a URL filter to rewrite search URLs to include safe search parameters. Options B and C are correct: Safe search enforcement is done via web filter options or URL filter add-ons. DNS filter can also reroute search queries to enforce safe search.

Answer

Install a custom CA certificate on client browsers

Answer

Use an application control profile to block non-safe search applications

Answer

Enable SSL deep inspection

Question 15

A network administrator notices that traffic from a specific internal host is not being inspected by the application control profile applied to the firewall policy. The policy is configured with proxy-based inspection and the application control profile includes a rule to block 'Facebook'. The administrator confirms the host can still access Facebook. What is the MOST likely cause?

Accepted Answer

The host is accessing Facebook over HTTPS and the policy does not have SSL/TLS deep inspection enabled.. Option D is correct because Facebook uses HTTPS. Without SSL deep inspection, FortiGate cannot see the application layer inside the encrypted tunnel, so application control cannot block Facebook.

Answer

The firewall policy is using flow-based inspection instead of proxy-based.

Answer

The application control profile is configured with 'deep inspection' disabled.

Answer

The application control profile is applied only to outgoing traffic, but the host is using a proxy.