NSE4 Security Profiles Practice Test 15 — 15 Questions

Question 1

An administrator configures a web filter profile to block the URL category 'Pornography'. The profile is applied to a policy for the sales department. Users report they can still access some sites that should be blocked. The administrator verifies that the FortiGuard web filter service is licensed and the FortiGate has internet connectivity. What should the administrator check next?

Accepted Answer

Ensure the web filter profile has 'FortiGuard category based filter' enabled and the action for 'Pornography' is set to 'Block'.

Answer

Verify that the antivirus profile is not interfering with web filtering.

Answer

Check if the sales department policy is using NAT that might bypass the FortiGate.

Answer

Confirm that the FortiGate has a static route to the FortiGuard servers.

Question 2

A FortiGate administrator needs to prevent employees from using peer-to-peer file sharing applications such as BitTorrent. The administrator creates an application control profile with a rule to block the 'Peer-to-Peer' application category. After applying the profile to the firewall policy, users can still use BitTorrent. What is the most likely cause?

Accepted Answer

The application control profile is set to 'Monitor' instead of 'Block' for the Peer-to-Peer category.

Answer

The application control profile is applied to the outbound policy but not to the inbound policy.

Answer

BitTorrent is not a recognized application in the FortiGuard application control database.

Answer

The firewall policy has SSL inspection set to certificate inspection, so the FortiGate cannot see the application.

Question 3

What is the purpose of enabling 'Safe Search' in a web filter profile on a FortiGate?

Accepted Answer

It forces search engines to filter explicit content from search results.

Answer

It blocks all searches containing the word 'safe'.

Answer

It redirects users to a safe landing page when a blocked site is accessed.

Answer

It encrypts search queries to protect user privacy.

Question 4

A FortiGate administrator wants to integrate with FortiSandbox to analyze suspicious files detected by antivirus. The administrator configures the FortiSandbox settings under Security Fabric. However, files are not being sent to FortiSandbox. The antivirus profile is set to 'flow-based' inspection. What could be the reason?

Accepted Answer

Flow-based inspection does not support FortiSandbox integration; proxy-based inspection is required.

Answer

The antivirus profile is set to 'Monitor' instead of 'Block'.

Answer

The firewall policy is using NAT, which interferes with FortiSandbox connectivity.

Answer

The FortiGate does not have a valid FortiSandbox license.

Question 5

An administrator runs 'diagnose ips anomaly list' and sees the following output:
List of anomaly events:
 ID: 1, Type: tcp_syn_flood, Status: triggered, Count: 1500, Threshold: 1000
What does this indicate?

Accepted Answer

The FortiGate is experiencing a TCP SYN flood attack and has triggered rate-based detection.

Answer

The IPS anomaly sensor is configured to block all TCP traffic.

Answer

The FortiGate has detected a single TCP SYN packet and is logging it.

Answer

The FortiGate is performing a TCP SYN flood attack.

Question 6

A school district uses a FortiGate to filter web traffic for students. The administrator wants to enforce that Google searches are filtered for explicit content. Which configuration should be applied?

Accepted Answer

Enable 'Google Safe Search' in the web filter profile under 'FortiGuard Categories' -> 'Safe Search'.

Answer

Use an application control profile to block the 'Google Search' application.

Answer

Create a URL filter to block URLs containing 'porn' or 'adult'.

Answer

Block the URL category 'Search Engines' and allow only approved search engines.

Question 7

What is the purpose of the 'DNS Filter' feature on a FortiGate?

Accepted Answer

To block DNS queries to malicious domains based on FortiGuard category and allow/block lists.

Answer

To cache DNS queries for faster resolution.

Answer

To encrypt DNS traffic to prevent eavesdropping.

Answer

To filter the content of DNS responses from legitimate servers.

Question 8

A FortiGate is configured with an IPS profile to protect a web server. The administrator notices that some attacks are not being detected. The IPS signature database is up to date. What should the administrator check first?

Accepted Answer

Ensure the IPS profile is applied to the firewall policy that handles traffic to the web server.

Answer

Increase the severity level of the IPS sensor.

Answer

Disable flow-based inspection and enable proxy-based inspection.

Answer

Change the IPS signature action from 'default' to 'block'.

Question 9

What is the difference between 'certificate inspection' and 'full SSL deep inspection' on a FortiGate?

Accepted Answer

Certificate inspection only validates the server certificate, while deep inspection decrypts and inspects the entire TLS session content.

Answer

Certificate inspection decrypts the traffic but does not check the certificate.

Answer

Deep inspection is less secure than certificate inspection.

Answer

Both methods provide the same level of inspection.

Question 10

A FortiGate administrator is configuring intrusion prevention (IPS) for a web server. The administrator wants to both block known exploits and detect anomalous traffic patterns. Which TWO features should be enabled? (Choose two.)

Accepted Answer

IPS signatures

Answer

Web filter

Answer

Antivirus

Answer

Application control

Question 11

An organization uses FortiMail for email filtering and FortiGate for web filtering. The administrator wants to ensure that email traffic is filtered for spam and malware before reaching the internal mail server. Which TWO steps should be taken? (Choose two.)

Accepted Answer

Configure FortiMail to scan incoming emails and then forward them to the internal mail server.

Answer

Apply an antivirus profile to the firewall policy that handles SMTP traffic.

Answer

Apply an email filter profile to the firewall policy that handles SMTP traffic.

Answer

Disable SMTP inspection on the FortiGate to avoid double scanning.

Question 12

A FortiGate administrator needs to prevent data leakage by blocking the upload of files containing credit card numbers via web traffic. Which THREE components must be configured? (Choose three.)

Accepted Answer

DLP profile with a rule to detect credit card numbers

Answer

Application control profile to block file upload applications

Answer

Antivirus profile to scan the files for malware

Question 13

A FortiGate administrator wants to create a web filter profile that blocks access to social networking sites during work hours but allows them during lunch breaks. Additionally, the administrator wants to ensure that HTTPS social networking sites are blocked. Which TWO configurations are required? (Choose two.)

Accepted Answer

Create a web filter profile with a FortiGuard category filter that blocks the 'Social Networking' category and set a time-based schedule.

Answer

Apply the web filter profile to a firewall policy that uses a schedule for work hours.

Answer

Use a URL filter to manually list all social networking sites.

Answer

Configure DNS filter to block social networking domains.

Question 14

An administrator configures an IPS sensor with a signature that is triggered by traffic to a specific server. The signature is set to 'Block' but the traffic is not being blocked. The administrator verifies that the IPS sensor is applied to the correct firewall policy and that the signature is enabled. Which TWO additional checks should the administrator perform? (Choose two.)

Accepted Answer

Verify that the signature's 'Action' is not overridden by a higher-priority rule in the IPS sensor.

Answer

Ensure that the antivirus profile is not interfering with IPS.

Answer

Check if the destination server is in the 'Local-in' policy, which may bypass IPS.

Answer

Confirm that the signature has a valid CVE ID.

Question 15

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. Option B is correct because HTTPS uses TLS encryption. Without SSL deep inspection enabled on the policy, FortiGate cannot decrypt and inspect the content of HTTPS traffic. The antivirus profile will only scan unencrypted traffic or traffic where deep inspection has decrypted it first.

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The FortiGuard antivirus subscription has expired