NSE4 Security Profiles Practice Test 14 — 15 Questions

Question 1

An administrator notices that a specific application (e.g., Skype) is not being detected by the application control profile. The profile includes the 'Skype' application signature but traffic is passing through without being logged as Skype. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSL deep inspection is not enabled on the firewall policy. The most likely reason is that SSL deep inspection is not enabled on the firewall policy. When Skype traffic is encrypted (which is common for modern Skype versions), the FortiGate cannot inspect the payload to match the application signature. Without SSL deep inspection, the firewall sees only encrypted packets and cannot identify the application as Skype, even if the signature is present in the profile.

Answer

The application control profile is set to 'Monitor' mode

Answer

The traffic is using a non-standard port

Answer

The application signature is outdated

Question 2

A FortiGate administrator is troubleshooting an issue where users cannot access an internal HTTPS server (10.10.10.10:443) after enabling SSL deep inspection. The administrator sees that the server's certificate is self-signed. Which TWO actions should the administrator take to allow access while maintaining inspection?

Accepted Answer

Import the server's self-signed certificate into FortiGate's trusted CA list. Importing the server's self-signed certificate into FortiGate's trusted CA list allows the FortiGate to trust the certificate during SSL deep inspection, preventing certificate validation errors. Option E is correct because adding the server's IP to the SSL/SSH profile's exemption list bypasses inspection for that specific server, allowing access without deep inspection while still applying other security profiles.

Answer

Disable deep inspection on the policy

Answer

Change the policy action to DENY

Answer

Disable certificate validation in the SSL/SSH profile

Question 3

An administrator configures a web filter profile with FortiGuard category blocking and URL filter to allow example.com. Users report that example.com is still blocked. What is the most likely cause?

Accepted Answer

The FortiGuard category action is set to 'block' and takes precedence over the URL filter allow rule. When both FortiGuard category blocking and a URL filter are configured in the same web filter profile, the FortiGuard category action (e.g., 'block') is evaluated first and takes precedence over any URL filter allow rule. This is because FortiGate processes web filter rules in a specific order: FortiGuard category blocking is applied before URL filter entries. Therefore, even if a URL filter explicitly allows example.com, the FortiGuard category block will prevent access.

Answer

The URL filter requires deep inspection to be enabled

Answer

The URL filter entry is placed after the FortiGuard category in the policy

Answer

The DNS filter is blocking example.com before the web filter is evaluated

Question 4

A FortiGate is configured with flow-based antivirus and an IPS profile on a policy. The administrator runs 'diagnose ips packet-list' and sees that packets are being forwarded without inspection. What is the most likely reason?

Accepted Answer

The session is offloaded to the NPU and is not being sent to the IPS engine. When a FortiGate offloads a session to the NPU (Network Processor Unit), the traffic bypasses the CPU and therefore does not reach the IPS engine for inspection. The 'diagnose ips packet-list' command shows packets forwarded without inspection because the NPU handles them directly, and flow-based inspection requires the session to be processed by the IPS engine on the CPU. This is the most likely reason when the administrator observes packets bypassing inspection despite having flow-based antivirus and IPS profiles applied.

Answer

The antivirus profile is set to proxy-based, conflicting with flow-based IPS

Answer

The IPS profile is configured with 'monitor' mode instead of 'protect'

Answer

The traffic is UDP and flow-based inspection does not inspect UDP

Question 5

A network administrator wants to prevent users from downloading files with .exe extensions via HTTP and HTTPS. Which security profile feature should be used?

Accepted Answer

Antivirus profile with 'block' action for file pattern matching .exe. The Antivirus profile in FortiGate can be configured with a file pattern matching rule to block files based on their extension, such as .exe. This feature operates at the application layer, inspecting HTTP and HTTPS traffic (via SSL inspection) to identify and block executable files before they reach the user. Option C is correct because it directly uses the antivirus engine's file pattern matching capability to enforce this policy.

Answer

Web filter profile with URL filter to block .exe sites

Answer

Application control profile to block file transfer applications

Answer

IPS profile to block executable file transfers

Question 6

A FortiGate administrator receives reports that some users are receiving spam emails despite an email filter profile being applied to the SMTP traffic. The email filter profile has 'spam' action set to 'discard'. What is the most likely reason spam is still reaching users?

Accepted Answer

The internal email server receives email directly from the internet without passing through the FortiGate. If the internal email server receives email directly from the internet without passing through the FortiGate, the email filter profile applied to SMTP traffic on the FortiGate will never inspect those messages. The FortiGate can only filter traffic that actually traverses it; any email routed around the FortiGate bypasses all security profiles entirely.

Answer

The spam dictionary is not updated with latest spam signatures

Answer

The email filter profile is not configured to scan outbound emails

Answer

The email filter profile is applied to the wrong policy direction (inbound vs outbound)

Question 7

An administrator configured a DLP profile to detect credit card numbers in outgoing emails. The profile is applied to an outbound SMTP policy. Users report that emails with credit card numbers are still being sent successfully. What is the most likely cause?

Accepted Answer

The SMTP traffic is encrypted and deep inspection is not enabled. FortiGate DLP inspection requires the firewall to decrypt SSL/TLS-encrypted SMTP traffic before it can match patterns like credit card numbers. If deep inspection (SSL/SSH inspection) is not enabled on the outbound SMTP policy, the DLP profile will only see encrypted data and cannot detect the credit card numbers, allowing the emails to pass through successfully.

Answer

The DLP profile is set to 'monitor' instead of 'block'

Answer

The DLP profile is not applied to the correct policy

Answer

The credit card number pattern is not correctly defined

Question 8

A FortiGate is configured with flow-based inspection and an IPS profile. The administrator runs 'diagnose ips session list' and sees many sessions with 'state=bypass'. What does this indicate?

Accepted Answer

The sessions are being offloaded to the NPU and are not inspected by IPS. When a FortiGate uses flow-based inspection, sessions that are offloaded to the Network Processor Unit (NPU) are not inspected by the IPS engine. The 'state=bypass' in the 'diagnose ips session list' output indicates that these sessions are being hardware-accelerated and bypassing the IPS inspection, which is normal behavior for traffic that meets offload criteria.

Answer

The IPS profile is configured with 'pass' action for all signatures

Answer

The IPS signatures have expired and are not being applied

Answer

The FortiGate is under DoS attack and is dropping sessions

Question 9

An administrator wants to block users from uploading files to cloud storage services like Google Drive via HTTPS. Which security profile combination is required?

Accepted Answer

Application control profile to block cloud storage applications, with deep inspection enabled. To block file uploads to cloud storage services like Google Drive over HTTPS, an application control profile is required because it can identify and control specific application actions (e.g., file uploads) within encrypted traffic. Deep inspection must be enabled to decrypt the HTTPS traffic, allowing the FortiGate to inspect the application-layer payload and enforce the upload blocking rule.

Answer

IPS profile to block file uploads to cloud services

Answer

DNS filter to block Google Drive domain

Answer

Web filter profile with URL filter to block Google Drive

Question 10

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. HTTPS traffic is encrypted with SSL/TLS, so the FortiGate cannot inspect the payload for viruses unless SSL/TLS deep inspection is enabled to decrypt the traffic. Even with an antivirus profile applied, the FortiGate can only scan the outer headers of encrypted sessions without deep inspection, leaving the actual content unscanned. Option C correctly identifies that deep inspection must be explicitly enabled on the firewall policy to allow the antivirus profile to scan decrypted HTTPS traffic.

Answer

The FortiGuard antivirus subscription has expired

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Question 11

An administrator runs the CLI command 'diagnose debug rating' and sees that all FortiGuard web filter requests are timing out. What is the most likely cause?

Accepted Answer

The DNS server configured on the FortiGate is not resolving the FortiGuard FQDN. The 'diagnose debug rating' command shows real-time FortiGuard web filter request status. When all requests are timing out, it indicates that the FortiGate cannot reach the FortiGuard servers. The most common cause is a DNS resolution failure, where the FortiGate cannot resolve the FortiGuard FQDN (e.g., service.fortiguard.net) due to an incorrect or unreachable DNS server configuration. Without proper DNS, the FortiGate cannot establish the necessary HTTPS connections to query the FortiGuard rating service.

Answer

The web filter profile has an incorrect action configured

Answer

The web filter is set to 'monitor all' which causes all requests to timeout

Answer

The FortiGuard web filtering license has expired

Question 12

A FortiGate is configured with SSL deep inspection using a self-signed CA certificate. Users report that they see a certificate warning in their browser when accessing HTTPS sites. The admin wants to eliminate these warnings. What should the admin do?

Accepted Answer

Install the FortiGate's CA certificate on each client device's trusted root certificate store. When FortiGate performs SSL deep inspection, it decrypts HTTPS traffic by acting as a man-in-the-middle, using its own CA certificate to re-encrypt the connection. If the FortiGate's self-signed CA certificate is not trusted by the client, the browser will display a certificate warning because the issuer is not in the client's trusted root store. Installing the FortiGate's CA certificate on each client device's trusted root certificate store establishes trust, eliminating the warnings.

Answer

Disable SSL deep inspection and rely on flow-based antivirus

Answer

Change the SSL inspection mode to certificate inspection only

Answer

Configure an SSL certificate exemption for all HTTPS traffic

Question 13

An administrator wants to block an application named 'Skype' on the network. They create an application control profile and add a rule to block 'Skype'. However, after applying the profile to the policy, users can still use Skype. What is the most likely reason?

Accepted Answer

Skype traffic is encrypted and SSL deep inspection is not enabled. Skype uses proprietary encryption and often relies on peer-to-peer connections that bypass traditional port-based inspection. Without SSL deep inspection (also known as HTTPS inspection or certificate-based decryption), the FortiGate cannot decrypt the encrypted Skype traffic to match it against the application control signature. Application control relies on either protocol decoders or deep packet inspection (DPI) to identify applications; if the traffic is encrypted and not decrypted, the FortiGate sees only encrypted payloads and cannot apply the block rule.

Answer

The application control profile is not enabled on the firewall policy

Answer

The application signature for Skype is outdated

Answer

The application control rule is set to 'monitor' instead of 'block'

Question 14

A FortiGate administrator configures an email filter profile to block spam. Users report that some legitimate emails are being blocked. The administrator wants to reduce false positives while still blocking spam. What should the administrator do?

Accepted Answer

Increase the spam threshold score. Increasing the spam threshold score raises the bar for what is classified as spam, so only emails with a higher spam score (indicating stronger spam characteristics) are blocked. This reduces false positives because legitimate emails with lower scores will no longer be blocked, while still blocking high-scoring spam.

Answer

Disable the email filter profile

Answer

Decrease the spam threshold score

Answer

Enable the FortiGuard spam filter only

Question 15

An administrator configures a DLP profile to detect credit card numbers in email traffic. The DLP rule uses a regular expression. However, the DLP sensor is not triggering on emails containing credit card numbers. What is a likely reason?

Accepted Answer

SSL deep inspection is not enabled on the policy. DLP sensors inspecting email traffic require SSL deep inspection to decrypt the SMTP traffic if it is encrypted via TLS (STARTTLS). Without SSL deep inspection enabled on the firewall policy, the FortiGate cannot see the plaintext content of encrypted emails, so the DLP regular expression will never match credit card numbers. This is the most likely reason the DLP sensor is not triggering.

Answer

The regular expression is case-sensitive and credit card numbers are lowercase

Answer

The DLP sensor is configured to 'monitor' only

Answer

The DLP profile is applied to the inbound policy only