NSE4 Security Profiles Practice Test 15 — 15 Questions

Question 1

A network admin wants to block all traffic from the BitTorrent application. The admin has enabled application control on the firewall policy. Which step is necessary to achieve this?

Accepted Answer

Add the BitTorrent application signature to the application control profile and set action to block. To block BitTorrent traffic, the admin must add the BitTorrent application signature to the application control profile and set the action to block (option B). Application control can detect BitTorrent even though it uses proprietary encryption—FortiGate uses protocol decoders and signature matching on unencrypted handshake data. SSL deep inspection (option E) is not required because BitTorrent does not use SSL/TLS encryption; enabling deep inspection would not help and would add unnecessary overhead. Options A, C, and D are also unnecessary: DNS filter does not block the application itself, proxy-based inspection is not mandatory, and deep inspection (in the profile) is not the correct setting.

Answer

Add a DNS filter profile to block BitTorrent tracker domains

Answer

Set the application control inspection mode to proxy-based

Answer

Enable 'deep inspection' in the application control profile

Answer

Enable SSL deep inspection on the firewall policy

Question 2

An administrator receives alerts about a possible data breach. Sensitive data (credit card numbers) might be leaving the network via email. The admin wants to detect and block such emails. Which THREE security profiles should be combined?

Accepted Answer

SSL deep inspection profile. B is correct because SSL deep inspection is required to decrypt SSL/TLS-encrypted email traffic (e.g., SMTP over TLS) so that the FortiGate can inspect the content for sensitive data like credit card numbers. Without decryption, the DLP and email filter profiles cannot see the payload of encrypted emails, rendering them ineffective.

Answer

Web filter profile

Answer

Antivirus profile

Question 3

Which inspection mode allows FortiGate to perform virus scanning by reassembling the entire file in memory before scanning, providing better detection but potentially higher latency?

Accepted Answer

Proxy-based inspection. Proxy-based inspection is the FortiGate mode where the full file is buffered and reassembled in memory before the security profile (AV, IPS, etc.) inspects it. This allows complete-file scanning, so detection of threats that span multiple packets or require the whole file is far better, at the cost of added latency and memory usage. Flow-based inspection, by contrast, scans packets as they stream through, which is faster but can miss threats that only appear once the file is fully assembled.

Answer

Fast-path inspection

Answer

Deep inspection

Answer

Flow-based inspection

Question 4

A FortiGate administrator runs the following command and sees: 'diagnose ips anomaly list' returns no entries, but the IPS sensor is configured with anomaly signatures. What is the MOST likely reason the signatures are not appearing?

Accepted Answer

The anomaly signatures have not triggered any events yet because traffic thresholds have not been exceeded.. The 'diagnose ips anomaly list' command displays only anomaly signatures that have been triggered and are currently in a state where thresholds have been exceeded. If no entries appear, it means the configured anomaly signatures have not yet detected traffic surpassing their defined thresholds (e.g., packets per second, connections per second). Anomaly signatures are threshold-based and only become active when the monitored traffic exceeds the configured limits, at which point they would appear in the list.

Answer

The IPS sensor is configured in 'passive' mode, which suppresses anomaly detection.

Answer

Anomaly signatures are not displayed by 'diagnose ips anomaly list'; they require a different command.

Answer

The IPS sensor is not enabled on any firewall policy.

Question 5

A FortiGate administrator needs to ensure that all outbound DNS queries from internal clients are inspected for malicious domains. The administrator has a DNS filter profile configured. What additional configuration is required on the firewall policy to make the DNS filter effective?

Accepted Answer

Apply the DNS filter profile to a firewall policy that matches DNS traffic (UDP/TCP port 53). A DNS filter profile must be explicitly applied to a firewall policy that matches DNS traffic (UDP/TCP port 53) to be effective. Without this association, the FortiGate will not inspect DNS queries against the configured DNS filter profile, even if the profile is defined globally or under Security Profiles.

Answer

Enable SSL deep inspection on the policy

Answer

Configure FortiGuard DNS filtering service on the FortiGate

Answer

Set the inspection mode to proxy-based

Question 6

A FortiGate is configured with SSL deep inspection using a locally generated CA certificate. A user reports that they cannot access https://www.example.com and receive a certificate error. The administrator checks the firewall policy and sees that the SSL inspection profile is set to 'certificate-inspection' instead of 'deep-inspection'. What is the MOST likely effect?

Accepted Answer

The FortiGate does not decrypt the traffic, so the original server certificate is presented to the client, which may be valid; the error is unrelated.. When the SSL inspection profile is set to 'certificate-inspection', the FortiGate does not decrypt the traffic; it only checks the certificate's validity (e.g., expiry, revocation). Therefore, the original server certificate from www.example.com is passed directly to the client. Since the client receives the actual server certificate (which is likely valid), the reported certificate error is unrelated to the FortiGate's configuration. Option B correctly identifies that the error is not caused by the FortiGate's inspection profile.

Answer

The FortiGate decrypts the traffic but does not re-sign, causing mismatch errors.

Answer

The FortiGate blocks the connection because certificate-inspection cannot handle deep inspection profiles.

Answer

The user will see a warning about the certificate but will be able to proceed after accepting it.

Question 7

Which FortiGate feature allows the administrator to scan SMTP, IMAP, and POP3 traffic for spam and apply actions such as tagging or discarding?

Accepted Answer

Email filter profile. The Email Filter profile is the correct feature because it is specifically designed to scan SMTP, IMAP, and POP3 traffic for spam and phishing content. It allows administrators to apply actions such as tagging the subject line, discarding the email, or quarantining based on spam scores, blacklists, and heuristics.

Answer

Application control profile

Answer

Antivirus profile

Answer

Web filter profile

Question 8

An organization uses FortiSandbox to analyze suspicious files. The FortiGate is configured to send files to FortiSandbox for analysis when the antivirus scan fails to reach a verdict. Which antivirus inspection mode must be used on the firewall policy for this integration to work?

Accepted Answer

Proxy-based inspection. Proxy-based inspection buffers the file and can hold the connection until FortiSandbox returns a verdict. Flow-based does not support this hold-and-wait mechanism.

Answer

Both flow and proxy modes support FortiSandbox equally

Answer

Deep inspection

Answer

Flow-based inspection

Question 9

An administrator has configured DLP sensors to detect credit card numbers in outgoing traffic. However, the administrator notices that traffic containing credit card numbers is still passing through undetected. The firewall policy uses flow-based inspection. What is the MOST likely reason DLP is not detecting the data?

Accepted Answer

DLP requires proxy-based inspection to perform data leakage detection.. DLP requires proxy-based inspection to buffer and analyze the content. Flow-based inspection does not support DLP.

Answer

The DLP sensor is not applied to the correct firewall policy.

Answer

The DLP sensor is configured with the wrong regular expression.

Answer

The credit card numbers are encrypted by SSL and deep inspection is not enabled.

Question 10

What is the primary function of protocol decoders in the FortiGate IPS engine?

Accepted Answer

They normalize traffic for specific protocols to enable signature matching.. Protocol decoders in the FortiGate IPS engine analyze and normalize traffic for specific protocols (e.g., HTTP, DNS, SMTP) by parsing the protocol fields and reconstructing the data stream. This normalization allows IPS signatures to match against a consistent representation of the traffic, regardless of evasion techniques like fragmentation or encoding. Thus, their primary function is to enable accurate signature matching.

Answer

They block malicious IP addresses based on reputation.

Answer

They rate-limit traffic to prevent DoS attacks.

Answer

They decrypt SSL/TLS traffic for inspection.

Question 11

A FortiGate administrator wants to block access to Facebook for all internal users. However, the administrator must ensure that the CEO's computer (IP 10.0.0.100) is exempted. Which TWO steps should the administrator take? (Choose two.)

Accepted Answer

Create an application control profile with a rule to block 'Facebook' and apply it to the firewall policy for all users.. Option C is correct because the administrator must first create an application control profile containing a rule that blocks the Facebook application (Facebook is recognized as an application signature, not merely a URL), and then apply that profile to the firewall policy covering all internal users so the block is enforced. Option D is correct because FortiGate evaluates firewall policies top-down, so placing a policy above the blocking policy that permits traffic sourced from the CEO's IP 10.0.0.100 and does not reference the application control profile ensures the CEO's traffic is matched and allowed before the blocking policy is reached. Option A is incorrect because application control profiles in FortiOS do not provide an 'exempt IP' list; exemptions are achieved through policy ordering, not profile-level IP exceptions. Option B is incorrect for the same reason—there is no per-IP exemption setting inside an application control profile. Option E is incorrect because a web filter URL block for facebook.com would not reliably block the Facebook application (which can use multiple domains and non-HTTP traffic) and does not address the CEO exemption requirement.

Answer

Add the CEO's IP to the application control profile's 'exempt IP' list.

Answer

Configure an IP exemption in the application control profile.

Answer

Use a web filter profile with a URL block for 'facebook.com' instead of application control.

Question 12

A FortiGate administrator is troubleshooting an issue where a user receives a certificate error when accessing a web server. The administrator has configured SSL deep inspection with a custom CA certificate. The error indicates the certificate is not trusted. Which THREE actions could resolve this issue? (Choose three.)

Accepted Answer

Install the FortiGate's CA certificate on the client devices.. Option A is correct because with SSL deep inspection the FortiGate re-signs the server certificate using its custom CA, so that CA certificate must be imported into the client's trust store (e.g., Windows Certificate Manager or browser trust store) for the re-signed certificate to validate without an untrusted-CA error. Option D is correct because switching the profile to certificate-inspection means the FortiGate only inspects the certificate metadata (SNI, CN, validity) and does not re-sign the server certificate, so the client sees the original, publicly trusted server certificate and no trust error occurs. Option E is correct because adding the web server to the SSL exemption list in the inspection profile bypasses deep inspection for that destination, again letting the client receive the original trusted certificate. Option B is not the intended fix because disabling SSL inspection entirely removes security inspection rather than resolving the trust problem while preserving inspection. Option C is not relevant because a firmware update does not make the client trust the FortiGate's custom CA certificate or change the re-signing behavior.

Answer

Disable SSL inspection on the firewall policy entirely.

Answer

Update the FortiGate firmware to the latest version.

Question 13

A network administrator notices that HTTP traffic is being scanned by the antivirus profile, but HTTPS traffic to the same web server is not being scanned. The firewall policy has the antivirus profile applied and SSL inspection is set to 'certificate-inspection'. What is the most likely reason HTTPS traffic is not being scanned?

Accepted Answer

Certificate inspection does not decrypt the traffic, so the antivirus scanner cannot inspect the payload.. Certificate inspection only validates the SSL/TLS certificate without decrypting the traffic. Since the antivirus scanner requires access to the plaintext payload to detect threats, it cannot scan HTTPS traffic when only certificate inspection is configured. This is why HTTP traffic is scanned but HTTPS traffic is not.

Answer

The antivirus profile is configured in flow mode, which does not support scanning HTTPS traffic.

Answer

The web server is not using a cipher supported by the FortiGate.

Answer

The FortiGate is using proxy-based inspection, which does not support HTTPS scanning.

Question 14

An administrator configures a web filter profile to block the URL category 'Pornography'. The profile is applied to a policy for the sales department. Users report they can still access some sites that should be blocked. The administrator verifies that the FortiGuard web filter service is licensed and the FortiGate has internet connectivity. What should the administrator check next?

Accepted Answer

Ensure the web filter profile has 'FortiGuard category based filter' enabled and the action for 'Pornography' is set to 'Block'.. In FortiOS, a web filter profile only enforces FortiGuard category blocking if the 'FortiGuard category based filter' toggle is enabled within the profile and the specific category (e.g., Pornography) has its action set to 'Block'. If the toggle is off, or the category action is left at 'Allow' or 'Monitor', the profile will not block those sites even though the FortiGuard license is valid and connectivity is fine. This is the most common misconfiguration when categories appear to be ignored.

Answer

Verify that the antivirus profile is not interfering with web filtering.

Answer

Check if the sales department policy is using NAT that might bypass the FortiGate.

Answer

Confirm that the FortiGate has a static route to the FortiGuard servers.

Question 15

A FortiGate administrator needs to prevent employees from using peer-to-peer file sharing applications such as BitTorrent. The administrator creates an application control profile with a rule to block the 'Peer-to-Peer' application category. After applying the profile to the firewall policy, users can still use BitTorrent. What is the most likely cause?

Accepted Answer

The application control profile is set to 'Monitor' instead of 'Block' for the Peer-to-Peer category.. In FortiGate application control, each application category can be set to 'Block', 'Monitor', or 'Allow'. If the administrator creates a profile with a rule for the 'Peer-to-Peer' category but leaves the action as 'Monitor' (the default in some cases), the FortiGate will only log the traffic and not block it. Therefore, users can still use BitTorrent. The most likely cause is that the action is set to Monitor instead of Block.

Answer

The application control profile is applied to the outbound policy but not to the inbound policy.

Answer

BitTorrent is not a recognized application in the FortiGuard application control database.

Answer

The firewall policy has SSL inspection set to certificate inspection, so the FortiGate cannot see the application.