NSE4 Security Profiles Practice Test 2 — 15 Questions

Question 1

A network administrator wants to allow employees to access a specific web application but block all other application traffic. The administrator creates a firewall policy with an application control profile that allows the desired application. However, employees can still access other applications. What is the MOST likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The application control profile is set to 'Monitor All' rather than 'Block All'. If the application control profile is set to 'Monitor All', it only logs or monitors traffic without actively blocking any applications. To block all other applications except the desired one, the profile must be configured with a default action of 'Block All' and then explicitly allow the specific application. The 'Monitor All' setting is often used for initial observation and does not enforce blocking, which explains why employees can still access other applications.

Answer

The application control profile is applied to the wrong firewall policy

Answer

The firewall policy has SSL inspection disabled

Answer

The application signatures are outdated

Question 2

A FortiGate administrator is troubleshooting an issue where users cannot access a legitimate website that is categorized as 'Pornography' by FortiGuard. The web filter profile is configured to block that category. The administrator wants to allow access for a specific user group without modifying the global web filter profile. What is the BEST approach?

Accepted Answer

Create a separate firewall policy for that user group with a web filter profile that allows the category. It allows the administrator to create a separate firewall policy for the specific user group that uses a web filter profile configured to allow the 'Pornography' category. This approach overrides the global web filter profile for that group without modifying the original profile, leveraging FortiGate's policy-based security profile assignment.

Answer

Change the FortiGuard category rating for the website to 'Unrated'

Answer

Create a URL filter exemption for the website in the same web filter profile

Answer

Disable web filtering for that website in the global settings

Question 3

A FortiGate administrator is configuring SSL deep inspection for a firewall policy that handles traffic to multiple internal servers. Some servers have self-signed certificates. The administrator wants to avoid certificate errors for users. What configuration is recommended?

Accepted Answer

Add the server certificates to the FortiGate's trusted CA store. Adding the self-signed server certificates to the FortiGate's trusted CA store allows the FortiGate to validate those certificates during SSL deep inspection. This prevents certificate errors for users, as the FortiGate will trust the self-signed certificates and generate a valid signed certificate for the client, avoiding browser warnings.

Answer

Configure the firewall policy to accept invalid certificates

Answer

Use certificate inspection instead of deep inspection

Answer

Disable deep inspection for those servers

Question 4

An administrator has configured an IPS profile with an anomaly detection sensor for 'tcp_syn_flood'. After applying the profile to a firewall policy, users report intermittent connectivity issues. The administrator runs 'diagnose ips anomaly list' and sees entries for 'tcp_syn_flood' with action 'pass'. What is the MOST likely cause of the connectivity issues?

Accepted Answer

The anomaly sensor is not actually applied; the list shows default entries. The 'diagnose ips anomaly list' command shows default entries for 'tcp_syn_flood' with action 'pass' only when no custom anomaly sensor is applied to the policy. The administrator configured an IPS profile with an anomaly detection sensor, but if the profile is not correctly attached to the firewall policy or the sensor is not enabled, the firewall falls back to default anomaly entries that are set to 'pass' (i.e., no blocking). The intermittent connectivity issues are therefore not caused by the anomaly sensor blocking traffic, but by another misconfiguration or unrelated network problem.

Answer

The anomaly sensor is set to 'block' but the action is overridden by the policy

Answer

The anomaly sensor is using a different action than expected; it might be set to 'block' for some other sensor

Answer

The anomaly sensor is set to 'pass' but the threshold is too low, causing false positives

Question 5

A FortiGate administrator is configuring a data leak prevention (DLP) profile to prevent the leakage of social security numbers (SSNs) via email. Which TWO settings must be configured in the DLP profile?

Accepted Answer

Enable SSL deep inspection on the firewall policy. Option C is correct because DLP inspection of email traffic that uses HTTPS/SMTPS/TLS requires SSL deep inspection to be enabled on the firewall policy; without it, the FortiGate cannot decrypt and scan the content for SSN patterns. Option E is correct because the DLP sensor must contain a pattern that matches SSNs (for example, a custom regex like \b\d{3}-\d{2}-\d{4}\b or a predefined SSN data type) so the profile can actually detect the sensitive data. Option A is incorrect because quarantine is an action applied after detection, not a required configuration setting for the DLP profile itself. Option B is incorrect because IPS signatures target exploits and vulnerabilities, not data leak content matching. Option D is incorrect because FortiSandbox integration is for malware detonation and is unrelated to DLP pattern detection.

Answer

Set the email filter to quarantine

Answer

Configure IPS to block SSN patterns

Answer

Enable FortiSandbox integration

Question 6

A FortiGate administrator has configured an Application Control profile to block 'P2P' applications. However, users are still able to use BitTorrent. What is the MOST likely reason?

Accepted Answer

The firewall policy does not have SSL deep inspection enabled, and BitTorrent is using encryption. BitTorrent often uses encryption (e.g., MSE/PE protocol encryption) to evade detection. Without SSL deep inspection, the FortiGate cannot decrypt the traffic to inspect the application payload, so Application Control signatures for BitTorrent may not match the encrypted flows. Enabling SSL deep inspection on the firewall policy allows the FortiGate to decrypt the traffic and apply the 'Block' action effectively.

Answer

The Application Control profile is configured in 'Monitor' mode instead of 'Block'

Answer

The BitTorrent signatures are not included in the FortiGate firmware

Answer

The Application Control profile is applied to the wrong direction

Question 7

An administrator wants to block all traffic to websites in the 'Pornography' category but allow an exception for a specific research site that falls under that category. The FortiGuard category is set to block. How should the administrator configure the exception?

Accepted Answer

Add a URL filter entry with the site's domain set to 'Allow'. In FortiGate, when a FortiGuard category is set to block, you can create an exception for a specific site by adding a URL filter entry with the site's domain set to 'Allow'. URL filter entries are evaluated before FortiGuard category actions, so an Allow entry for a specific domain will override the category block for that domain. This is the correct way to allow an exception while still blocking the rest of the category.

Answer

Set the FortiGuard category to 'Monitor' and create a URL filter to block all other sites

Answer

Use the DNS filter to allow the site's FQDN

Answer

Add the site to the FortiGuard category override list with action 'Allow'

Question 8

An administrator notices that a specific application (e.g., Skype) is not being detected by the application control profile. The profile includes the 'Skype' application signature but traffic is passing through without being logged as Skype. What is the most likely reason?

Accepted Answer

SSL deep inspection is not enabled on the firewall policy. The most likely reason is that SSL deep inspection is not enabled on the firewall policy. When Skype traffic is encrypted (which is common for modern Skype versions), the FortiGate cannot inspect the payload to match the application signature. Without SSL deep inspection, the firewall sees only encrypted packets and cannot identify the application as Skype, even if the signature is present in the profile.

Answer

The application control profile is set to 'Monitor' mode

Answer

The traffic is using a non-standard port

Answer

The application signature is outdated

Question 9

A FortiGate administrator is troubleshooting an issue where users cannot access an internal HTTPS server (10.10.10.10:443) after enabling SSL deep inspection. The administrator sees that the server's certificate is self-signed. Which TWO actions should the administrator take to allow access while maintaining inspection?

Accepted Answer

Import the server's self-signed certificate into FortiGate's trusted CA list. Option D is correct because when SSL deep inspection is enabled, the FortiGate validates the server certificate against its trusted CA store; importing the internal server's self-signed certificate into the FortiGate's trusted CA list allows the firewall to trust and successfully inspect the connection. Option E is correct because adding the server's IP address (10.10.10.10) to the SSL/SSH profile's exemption list bypasses deep inspection for that specific destination, allowing users to reach the server while inspection is maintained for other traffic. Option A is incorrect because disabling deep inspection on the policy would stop inspection entirely, violating the requirement to maintain inspection. Option B is incorrect because setting the policy action to DENY would block access rather than allow it. Option C is incorrect because disabling certificate validation in the SSL/SSH profile weakens security and does not properly resolve the self-signed certificate trust issue while maintaining inspection.

Answer

Disable deep inspection on the policy

Answer

Change the policy action to DENY

Answer

Disable certificate validation in the SSL/SSH profile

Question 10

An administrator wants to prevent sensitive data (e.g., credit card numbers) from being sent out of the network via email. Which THREE components must be configured to achieve this?

Accepted Answer

A firewall policy that allows email traffic and applies the email filter profile. Option A is correct because the firewall policy is the enforcement point that permits the email traffic and attaches the email filter profile, so without a policy that allows SMTP/IMAP/POP3 and references the profile, no scanning occurs. Option D is correct because the email filter profile is the container that binds the DLP sensor to email protocols, enabling the firewall to inspect message content and attachments for sensitive data. Option E is correct because the DLP sensor defines the credit card number pattern (e.g., a regex or predefined PCI pattern) that identifies the sensitive data to be blocked or logged. Option B is not required because SSL deep inspection only matters when email is encrypted, and the question does not state that the email traffic is TLS-protected. Option C is not required because application control blocks email applications by category, which is a different control than inspecting message content for credit card numbers.

Answer

SSL deep inspection to decrypt email traffic if encrypted

Answer

An application control profile to block email applications

Question 11

An administrator configures an application control profile to block 'Facebook' and 'Twitter' using application signatures. Users can still access Facebook via HTTPS. The administrator has enabled deep inspection. What is missing?

Accepted Answer

The firewall policy must have inspection mode set to 'proxy-based' for application control to work with HTTPS. Application control requires the firewall policy to be set to 'proxy-based inspection' for HTTPS traffic. Even with deep inspection enabled, if the policy is flow-based, application control may not inspect HTTPS traffic correctly.

Answer

The application control profile must be applied to both ingress and egress policies

Answer

The application signatures need to be updated to the latest version

Answer

The web filter profile must be set to 'authenticate' for the connection

Question 12

An administrator configured a DLP profile to detect credit card numbers in outgoing emails. The profile is applied to an outbound SMTP policy. Users report that emails with credit card numbers are still being sent successfully. What is the most likely cause?

Accepted Answer

The SMTP traffic is encrypted and deep inspection is not enabled. FortiGate DLP inspection requires the firewall to decrypt SSL/TLS-encrypted SMTP traffic before it can match patterns like credit card numbers. If deep inspection (SSL/SSH inspection) is not enabled on the outbound SMTP policy, the DLP profile will only see encrypted data and cannot detect the credit card numbers, allowing the emails to pass through successfully.

Answer

The DLP profile is set to 'monitor' instead of 'block'

Answer

The DLP profile is not applied to the correct policy

Answer

The credit card number pattern is not correctly defined

Question 13

An administrator configures an application control profile to block 'BitTorrent'. Users are still able to download files using BitTorrent. The administrator has enabled deep inspection and the policy is set to proxy-based. What is the most likely reason the application is not being blocked?

Accepted Answer

The application signatures are out of date. The most likely reason BitTorrent is not being blocked is that the application signatures are out of date. FortiGate application control relies on up-to-date signature databases to identify applications like BitTorrent. If signatures are outdated, the firewall may not recognize the traffic as BitTorrent, even with deep inspection and proxy-based policy. Updating signatures is a prerequisite for effective application control.

Answer

BitTorrent uses randomized ports that bypass application control

Answer

The application control profile is not applied to the correct policy

Answer

The policy is set to flow-based instead of proxy-based

Question 14

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. HTTPS traffic is encrypted with SSL/TLS, so the FortiGate cannot inspect the payload for viruses unless SSL/TLS deep inspection is enabled to decrypt the traffic. Even with an antivirus profile applied, the FortiGate can only scan the outer headers of encrypted sessions without deep inspection, leaving the actual content unscanned. Option C correctly identifies that deep inspection must be explicitly enabled on the firewall policy to allow the antivirus profile to scan decrypted HTTPS traffic.

Answer

The FortiGuard antivirus subscription has expired

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Question 15

An administrator wants to allow access to a specific website that is blocked by the FortiGuard web filter category 'Social Networking'. The administrator creates a URL filter override to allow the site. After applying, the site is still blocked. What should the administrator check?

Accepted Answer

Ensure the URL filter rule is placed above the FortiGuard category block in the web filter profile. URL filter overrides take precedence over FortiGuard categories only if the URL filter action is set appropriately and the override is applied before the FortiGuard check. Additionally, the order of rules matters: URL filter rules are evaluated before FortiGuard categories, but the action must be 'allow' and the override must be enabled.

Answer

Disable the FortiGuard category rating for Social Networking

Answer

Ensure the URL filter rule is set to 'exempt' instead of 'allow'

Answer

Set the web filter profile to use 'monitor' for the Social Networking category