NSE4 Security Profiles Practice Test 13 — 15 Questions

Question 1

An administrator configures SSL deep inspection with a CA certificate. Users accessing an internal site (internal.company.com) receive a certificate error. The administrator wants to avoid the error without disabling deep inspection. What should be done?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add internal.company.com to the SSL/SSH inspection exemption list. Adding internal.company.com to the SSL/SSH inspection exemption list tells the FortiGate to bypass deep inspection for that specific site, allowing the internal CA certificate to be used without triggering a certificate error. This avoids the error while keeping deep inspection enabled for all other traffic, which is the administrator's goal.

Answer

Replace the CA certificate with a self-signed one

Answer

Use certificate inspection instead of deep inspection

Answer

Disable certificate validation in the deep inspection profile

Question 2

What is the difference between certificate inspection and full SSL deep inspection on a FortiGate?

Accepted Answer

Certificate inspection only validates the server certificate; deep inspection decrypts and inspects the content. Certificate inspection only validates the server certificate's authenticity and checks for revocation, but does not decrypt the traffic payload. Full SSL deep inspection (also called SSL inspection) decrypts the entire SSL/TLS session, allowing the FortiGate to inspect the content for threats like malware, data leaks, or policy violations. This is why option B is correct: certificate inspection validates the certificate, while deep inspection decrypts and inspects the content.

Answer

Certificate inspection decrypts traffic; deep inspection does not

Answer

Deep inspection is faster than certificate inspection

Answer

Both provide the same level of security

Question 3

A FortiGate administrator is troubleshooting an issue where users cannot access a legitimate website that is categorized as 'Pornography' by FortiGuard. The web filter profile is configured to block that category. The administrator wants to allow access for a specific user group without modifying the global web filter profile. What is the BEST approach?

Accepted Answer

Create a separate firewall policy for that user group with a web filter profile that allows the category. It allows the administrator to create a separate firewall policy for the specific user group that uses a web filter profile configured to allow the 'Pornography' category. This approach overrides the global web filter profile for that group without modifying the original profile, leveraging FortiGate's policy-based security profile assignment.

Answer

Change the FortiGuard category rating for the website to 'Unrated'

Answer

Create a URL filter exemption for the website in the same web filter profile

Answer

Disable web filtering for that website in the global settings

Question 4

A FortiGate administrator is configuring SSL deep inspection for a firewall policy that handles traffic to multiple internal servers. Some servers have self-signed certificates. The administrator wants to avoid certificate errors for users. What configuration is recommended?

Accepted Answer

Add the server certificates to the FortiGate's trusted CA store. Adding the self-signed server certificates to the FortiGate's trusted CA store allows the FortiGate to validate those certificates during SSL deep inspection. This prevents certificate errors for users, as the FortiGate will trust the self-signed certificates and generate a valid signed certificate for the client, avoiding browser warnings.

Answer

Configure the firewall policy to accept invalid certificates

Answer

Use certificate inspection instead of deep inspection

Answer

Disable deep inspection for those servers

Question 5

An administrator has configured an IPS profile with an anomaly detection sensor for 'tcp_syn_flood'. After applying the profile to a firewall policy, users report intermittent connectivity issues. The administrator runs 'diagnose ips anomaly list' and sees entries for 'tcp_syn_flood' with action 'pass'. What is the MOST likely cause of the connectivity issues?

Accepted Answer

The anomaly sensor is not actually applied; the list shows default entries. The 'diagnose ips anomaly list' command shows default entries for 'tcp_syn_flood' with action 'pass' only when no custom anomaly sensor is applied to the policy. The administrator configured an IPS profile with an anomaly detection sensor, but if the profile is not correctly attached to the firewall policy or the sensor is not enabled, the firewall falls back to default anomaly entries that are set to 'pass' (i.e., no blocking). The intermittent connectivity issues are therefore not caused by the anomaly sensor blocking traffic, but by another misconfiguration or unrelated network problem.

Answer

The anomaly sensor is set to 'block' but the action is overridden by the policy

Answer

The anomaly sensor is using a different action than expected; it might be set to 'block' for some other sensor

Answer

The anomaly sensor is set to 'pass' but the threshold is too low, causing false positives

Question 6

A FortiGate administrator has configured a firewall policy with SSL deep inspection using a forward trust CA certificate. When users access an HTTPS website with a valid certificate, they still receive a certificate warning. What is the MOST likely reason?

Accepted Answer

The forward trust CA certificate is not installed on the users' devices. When SSL deep inspection is configured, the FortiGate generates a new certificate for each HTTPS session, signed by the forward trust CA. If the forward trust CA certificate is not installed in the trusted root store on the users' devices, the browser will not trust the generated certificate and will display a certificate warning. This is the most common cause of such warnings even when the original website certificate is valid.

Answer

The website certificate is expired

Answer

The firewall policy is set to certificate inspection instead of deep inspection

Answer

The FortiGate's CA certificate is not trusted by the browser

Question 7

A FortiGate administrator is configuring a data leak prevention (DLP) profile to prevent the leakage of social security numbers (SSNs) via email. Which TWO settings must be configured in the DLP profile?

Accepted Answer

Enable SSL deep inspection on the firewall policy. FortiGate's DLP profiles inspect traffic at the application layer, and without SSL deep inspection, encrypted email traffic (e.g., SMTP over TLS) cannot be decrypted for pattern matching. Enabling SSL deep inspection on the firewall policy allows the DLP sensor to see the plaintext content of emails, including SSNs. This is a prerequisite for DLP to function on encrypted sessions.

Answer

Set the email filter to quarantine

Answer

Configure IPS to block SSN patterns

Answer

Enable FortiSandbox integration

Question 8

A FortiGate administrator has configured an Application Control profile to block 'P2P' applications. However, users are still able to use BitTorrent. What is the MOST likely reason?

Accepted Answer

The firewall policy does not have SSL deep inspection enabled, and BitTorrent is using encryption. BitTorrent often uses encryption (e.g., MSE/PE protocol encryption) to evade detection. Without SSL deep inspection, the FortiGate cannot decrypt the traffic to inspect the application payload, so Application Control signatures for BitTorrent may not match the encrypted flows. Enabling SSL deep inspection on the firewall policy allows the FortiGate to decrypt the traffic and apply the 'Block' action effectively.

Answer

The Application Control profile is configured in 'Monitor' mode instead of 'Block'

Answer

The BitTorrent signatures are not included in the FortiGate firmware

Answer

The Application Control profile is applied to the wrong direction

Question 9

An administrator wants to prevent data leakage by blocking outbound emails that contain credit card numbers. Which security profile should be configured?

Accepted Answer

DLP profile. DLP (Data Loss Prevention) profiles are specifically designed to inspect content such as credit card numbers in outbound emails and block them to prevent data leakage. While other profiles handle spam, web access, or malware, only DLP can perform pattern-based content inspection on email bodies and attachments.

Answer

Email Filter profile

Answer

Web Filter profile

Answer

Antivirus profile

Question 10

A FortiGate administrator wants to block spam emails sent to the company's mail server. The mail server is behind the FortiGate. Which THREE configurations should be applied?

Accepted Answer

Enable FortiGuard spam filtering in the Email Filter profile. FortiGate's Email Filter profile integrates with FortiGuard's antispam service to block spam at the gateway. This profile uses real-time signature-based and heuristic analysis to identify and reject spam before it reaches the internal mail server.

Answer

Enable DLP to filter spam

Answer

Configure Application Control to block email applications

Question 11

A network administrator notices that HTTP traffic to a specific website is being blocked by the web filter profile, but the website is categorized as 'General – Personal' in FortiGuard, which is allowed. What could cause this block?

Accepted Answer

A URL filter entry is blocking the specific website. A URL filter entry can explicitly block a specific website regardless of its FortiGuard category. Even if the category 'General – Personal' is allowed in the web filter profile, a more specific URL filter rule with a higher priority (lower order number) can override the category-based action. This is a common scenario where an administrator creates a custom URL block for a particular domain or URL pattern, which takes precedence over the FortiGuard category lookup.

Answer

The web filter profile has an incorrect FortiGuard category override

Answer

The antivirus profile is blocking the website

Answer

DNS filter is blocking the domain

Question 12

A FortiGate administrator configures SSL deep inspection on a policy using a self-signed CA certificate. Users report that they see a certificate warning in their browsers when accessing HTTPS sites. What is the most effective solution to eliminate these warnings?

Accepted Answer

Install the FortiGate's CA certificate on all client machines in the trusted root store. The certificate warning occurs because the browser does not trust the FortiGate's self-signed CA certificate. By installing the FortiGate's CA certificate into the trusted root store on each client machine, the browser will trust certificates signed by that CA, eliminating the warning. This is the standard approach for self-signed CA certificates in SSL deep inspection environments.

Answer

Use a publicly trusted CA certificate for the FortiGate

Answer

Disable deep inspection and use certificate inspection only

Answer

Add the websites to the exemption list in the SSL/SSH profile

Question 13

What is the primary difference between flow-based and proxy-based Antivirus inspection on a FortiGate?

Accepted Answer

Proxy-based inspection reassembles the file before scanning, while flow-based scans as the file passes through. The primary difference is that proxy-based antivirus inspection fully reassembles the file in memory before scanning, allowing for more thorough detection of threats like polymorphic viruses and archives. Flow-based inspection scans data as it passes through the FortiGate in a single pass, using pattern matching without full file reassembly, which reduces latency but may miss threats that require file-level analysis.

Answer

Flow-based inspection is only available on hardware models with CP8

Answer

Proxy-based inspection uses fewer resources than flow-based

Answer

Flow-based inspection supports virus outbreak detection, but proxy-based does not

Question 14

An administrator runs the following CLI command and sees the output: 'diagnose sys session list | grep -A 5 10.1.1.100' and finds a session with 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate about the session?

Accepted Answer

The session has been active for 3600 seconds. The 'duration' field in Fortinet session output indicates the actual time the session has been alive (session age), while 'expire' indicates the remaining time before timeout. Here, duration=3600 means the session has been active for 3600 seconds (1 hour). expire=3599 is just slightly less than the duration, but the key is that duration is the age. Therefore, option C is correct.

Answer

The session is about to expire

Answer

The session has been active for approximately 1 second

Answer

The session is using UDP protocol

Question 15

A FortiGate configured with IPS anomaly detection is generating false positives for the 'tcp_syn_flood' anomaly. The administrator wants to reduce the false positives without completely disabling the detection. Which action should the administrator take?

Accepted Answer

Increase the threshold value. Increasing the threshold value reduces false positives by requiring a higher rate of TCP SYN packets per second before the 'tcp_syn_flood' anomaly triggers an alert or action. This allows legitimate traffic bursts to pass without being flagged, while still detecting genuine SYN flood attacks. The threshold defines the sensitivity of the anomaly detection; raising it makes the detection less sensitive to low-volume spikes.

Answer

Disable the anomaly and use a custom IPS signature

Answer

Decrease the threshold value

Answer

Set the action to 'pass'