NSE4 Security Profiles Practice Test 15 — 15 Questions

Question 1

An administrator integrates FortiGate with FortiSandbox for advanced threat detection. The FortiGate is configured to send files to FortiSandbox for analysis. Despite correct configuration, files are not being submitted. The administrator runs 'diagnose debug application fortisandbox -1' and sees 'no server configured'. What is the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The FortiSandbox server IP address is not configured on the FortiGate. The debug output 'no server configured' explicitly indicates that the FortiGate does not have a FortiSandbox server IP address defined in its configuration. Without the server IP configured under 'config system fortisandbox', the FortiGate cannot establish a connection or submit files, regardless of other settings. This is a prerequisite step before any file submission can occur.

Answer

The FortiSandbox license has expired

Answer

Firewall policies are blocking communication to the FortiSandbox server

Answer

The antivirus profile is not configured to submit files to FortiSandbox

Question 2

A network administrator wants to prevent users from accessing known malicious websites using FortiGate. Which security profile should be applied to the firewall policy to achieve this goal?

Accepted Answer

Web filtering profile. Web filtering profile. FortiGate's web filtering profile uses URL rating and category-based filtering to block access to known malicious websites by leveraging FortiGuard's real-time threat intelligence. This is the specific security profile designed to control web access based on URL reputation, including blocking malicious URLs.

Answer

Antivirus profile

Answer

Application control profile

Answer

IPS profile

Question 3

A FortiGate administrator receives reports that users cannot access a legitimate website that uses HTTPS. The web filtering profile is configured with strict FortiGuard categories and 'monitor all' for unknown sites. The firewall policy has an SSL/SSH inspection profile set to 'deep-inspection'. What is the most likely cause of the issue?

Accepted Answer

The website uses a self-signed certificate which is not trusted by the FortiGate CA bundle. The most likely cause is that the website uses a self-signed certificate, which is not included in the FortiGate's trusted CA bundle. When deep inspection is enabled, the FortiGate acts as a man-in-the-middle and must validate the server's certificate against its CA store; a self-signed certificate fails this validation, causing the connection to be blocked. This is a common issue with strict inspection profiles that require trusted certificates.

Answer

The antivirus profile is blocking a file on the website

Answer

The DNS filter is blocking the domain

Answer

The website's FortiGuard category is set to 'block'

Question 4

What is the purpose of the DNS filter security profile on a FortiGate?

Accepted Answer

To block DNS queries to known malicious domains. The DNS filter security profile on a FortiGate is designed to block DNS queries to known malicious domains by comparing the domain names in DNS requests against a regularly updated database of malicious or categorized domains. This prevents users from resolving domains associated with malware, phishing, or command-and-control servers, thereby stopping threats before an IP connection is even established.

Answer

To inspect DNS traffic for virus signatures

Answer

To filter spam emails based on DNS blacklists

Answer

To prevent DNS tunneling attacks

Question 5

An administrator sees the following CLI output when checking an IPS sensor: 'config ips sensor edit test config entries edit 1 set severity medium set action block set target default end'. However, attacks with severity medium are still passing. The IPS sensor is applied to a policy with flow-based inspection. What is the likely issue?

Accepted Answer

The IPS sensor rule has 'target' set to 'default' which may not apply to the traffic direction. The 'set target default' command in the IPS sensor configuration means the rule is applied to traffic that matches the default target, which is typically the 'client-to-server' direction. If the attack traffic is flowing in the opposite direction (server-to-client), the rule will not trigger. This is a common misconfiguration when using flow-based inspection, where the target direction must match the actual traffic flow for the action to be enforced.

Answer

The IPS sensor is not enabled in the policy

Answer

The FortiGate needs a FortiSandbox for IPS to work

Answer

The severity level is set too high

Question 6

An administrator receives reports that some internal users can access Facebook despite a web filtering profile that blocks the 'Social Networking' category. The policy is configured with deep inspection. Which THREE checks should the administrator perform to troubleshoot this issue?

Accepted Answer

Check if the users are using HTTPS and if the SSL inspection profile has an exemption for Facebook. The troubleshooting should focus on three main areas: (A) SSL inspection exemption – if users access Facebook via HTTPS and the SSL inspection profile exempts Facebook traffic, it bypasses the web filter; (C) SSL VPN bypass – traffic through an SSL VPN tunnel may not match the policy if the tunnel interface is not covered; (D) policy application and order – the web filtering profile must be applied to the correct policy and the policy order must be such that this policy is enforced before any conflicting policy. Option E is a valid check, but since the category is already set to 'Block' in the profile, the issue is more likely related to the other three.

Answer

Ensure that the antivirus profile is enabled on the policy

Answer

Confirm that the 'Social Networking' category is not set to 'Monitor' instead of 'Block'

Question 7

Which inspection mode in the antivirus profile processes traffic by buffering the entire file before scanning, allowing more thorough detection but potentially increasing latency?

Accepted Answer

Proxy-based inspection. Proxy-based inspection in the antivirus profile buffers the entire file in memory before scanning, enabling thorough detection of threats like polymorphic malware or embedded exploits. This mode reassembles the full data stream, allowing the FortiGate to perform deep content analysis, but it introduces higher latency due to the buffering and reassembly process.

Answer

Deep inspection

Answer

DNS inspection

Answer

Flow-based inspection

Question 8

Which web filtering feature allows an administrator to force web search engines to filter explicit content in search results, regardless of the user's browser settings?

Accepted Answer

Safe search. Safe search is a web filtering feature that forces supported search engines (e.g., Google, Bing, Yahoo) to filter explicit content from search results by appending specific query parameters (such as `safe=active` for Google) to the search request. This enforcement occurs at the FortiGate proxy level, overriding the user's browser settings and ensuring compliance with acceptable use policies.

Answer

DNS filter

Answer

URL filter

Answer

Application control

Question 9

A FortiGate is configured for SSL deep inspection using a CA certificate. Users report that some websites show certificate errors. The administrator wants to allow these sites without inspection. Which setting should be used?

Accepted Answer

Add the websites to the SSL/SSH exemption list. The SSL/SSH exemption list allows administrators to specify websites that should bypass SSL deep inspection entirely, preventing certificate errors for sites that use self-signed, expired, or otherwise untrusted certificates. This is the intended mechanism in FortiOS to exclude specific destinations from inspection while maintaining inspection for all other traffic.

Answer

Disable certificate validation in the SSL inspection profile

Answer

Create a separate firewall policy without SSL inspection

Answer

Set the action for invalid certificates to 'allow'

Question 10

An administrator configures an application control profile to block 'Facebook' and 'Twitter' using application signatures. Users can still access Facebook via HTTPS. The firewall policy has application control enabled and SSL deep inspection is not configured. Why is Facebook not blocked?

Accepted Answer

HTTPS traffic is encrypted and cannot be inspected without SSL deep inspection. Without SSL deep inspection, the FortiGate cannot decrypt HTTPS traffic to inspect the application-layer payload. Application control relies on inspecting unencrypted traffic or using SSL inspection to identify applications within encrypted sessions. Since Facebook uses HTTPS, the encrypted traffic passes through without being matched against the application signature, so the block action is not enforced.

Answer

The application signature for Facebook is not updated

Answer

The application control profile is configured in monitor-only mode

Answer

Facebook uses a non-standard port that application control does not monitor

Question 11

What is the function of an IPS 'protocol decoder'?

Accepted Answer

Parse and normalize protocol traffic to improve detection accuracy. An IPS protocol decoder parses and normalizes traffic for a specific protocol (e.g., HTTP, SMB, DNS) to reconstruct the application-layer data stream. This normalization strips away evasion techniques like chunked encoding or whitespace obfuscation, allowing the IPS to match attack signatures against the true payload, which significantly improves detection accuracy.

Answer

Encode traffic to prevent attacks

Answer

Rate-limit traffic based on protocol

Answer

Decrypt SSL traffic for inspection

Question 12

A network admin wants to block all traffic from the BitTorrent application. The admin has enabled application control on the firewall policy. Which step is necessary to achieve this?

Accepted Answer

Add the BitTorrent application signature to the application control profile and set action to block. To block BitTorrent traffic, the admin must add the BitTorrent application signature to the application control profile and set the action to block (option B). Application control can detect BitTorrent even though it uses proprietary encryption—FortiGate uses protocol decoders and signature matching on unencrypted handshake data. SSL deep inspection (option E) is not required because BitTorrent does not use SSL/TLS encryption; enabling deep inspection would not help and would add unnecessary overhead. Options A, C, and D are also unnecessary: DNS filter does not block the application itself, proxy-based inspection is not mandatory, and deep inspection (in the profile) is not the correct setting.

Answer

Add a DNS filter profile to block BitTorrent tracker domains

Answer

Set the application control inspection mode to proxy-based

Answer

Enable 'deep inspection' in the application control profile

Answer

Enable SSL deep inspection on the firewall policy

Question 13

A network administrator notices that traffic from a specific internal host is not being inspected by the application control profile applied to the firewall policy. The policy is configured with proxy-based inspection and the application control profile includes a rule to block 'Facebook'. The administrator confirms the host can still access Facebook. What is the MOST likely cause?

Accepted Answer

The host is accessing Facebook over HTTPS and the policy does not have SSL/TLS deep inspection enabled.. The most likely cause is that the host is accessing Facebook over HTTPS, and the firewall policy does not have SSL/TLS deep inspection enabled. Without deep inspection, the firewall cannot decrypt the HTTPS traffic to inspect the application layer payload, so the application control profile cannot identify or block 'Facebook' traffic. Proxy-based inspection requires decryption to match application signatures for encrypted traffic.

Answer

The firewall policy is using flow-based inspection instead of proxy-based.

Answer

The application control profile is configured with 'deep inspection' disabled.

Answer

The application control profile is applied only to outgoing traffic, but the host is using a proxy.

Question 14

A FortiGate administrator runs the following command and sees: 'diagnose ips anomaly list' returns no entries, but the IPS sensor is configured with anomaly signatures. What is the MOST likely reason the signatures are not appearing?

Accepted Answer

The anomaly signatures have not triggered any events yet because traffic thresholds have not been exceeded.. The 'diagnose ips anomaly list' command displays only anomaly signatures that have been triggered and are currently in a state where thresholds have been exceeded. If no entries appear, it means the configured anomaly signatures have not yet detected traffic surpassing their defined thresholds (e.g., packets per second, connections per second). Anomaly signatures are threshold-based and only become active when the monitored traffic exceeds the configured limits, at which point they would appear in the list.

Answer

The IPS sensor is configured in 'passive' mode, which suppresses anomaly detection.

Answer

Anomaly signatures are not displayed by 'diagnose ips anomaly list'; they require a different command.

Answer

The IPS sensor is not enabled on any firewall policy.

Question 15

A FortiGate administrator needs to ensure that all outbound DNS queries from internal clients are inspected for malicious domains. The administrator has a DNS filter profile configured. What additional configuration is required on the firewall policy to make the DNS filter effective?

Accepted Answer

Apply the DNS filter profile to a firewall policy that matches DNS traffic (UDP/TCP port 53). A DNS filter profile must be explicitly applied to a firewall policy that matches DNS traffic (UDP/TCP port 53) to be effective. Without this association, the FortiGate will not inspect DNS queries against the configured DNS filter profile, even if the profile is defined globally or under Security Profiles.

Answer

Enable SSL deep inspection on the policy

Answer

Configure FortiGuard DNS filtering service on the FortiGate

Answer

Set the inspection mode to proxy-based