NSE4 Security Profiles Practice Test 2 — 15 Questions

Question 1

During a security audit, an administrator finds that an IPS sensor configured with a 'block' action for a critical vulnerability signature is not blocking the associated traffic. The traffic matches the signature, but the action appears as 'pass' in the logs. The IPS sensor is applied to a firewall policy that also has application control enabled. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application control profile is set to 'allow' for the application associated with the traffic, overriding the IPS block action.. When an IPS sensor with a 'block' action logs 'pass' for matching traffic, it indicates that another security profile is overriding the IPS action. In FortiOS, if an application control profile is set to 'allow' for the application, it can bypass the IPS block because application control processing occurs before IPS inspection. The traffic is permitted by the application control profile, so the IPS engine does not enforce the block action, resulting in a 'pass' log entry.

Answer

The IPS engine is bypassed because the traffic matches a fast-path rule.

Answer

The IPS sensor is not enabled in the firewall policy.

Answer

The IPS sensor is configured with 'monitor' action instead of 'block'.

Question 2

A company recently deployed FortiGate with application control to manage cloud application usage. They want to allow Google Drive for business but block personal Google accounts. Which application control configuration approach is most effective?

Accepted Answer

Use application control with specific signatures for 'Google Drive Business' and 'Google Drive Personal' and apply appropriate actions.. FortiGate's application control uses application signatures to distinguish between different versions of the same application, such as 'Google Drive Business' and 'Google Drive Personal'. By configuring specific signatures with appropriate actions (allow for business, block for personal), you can enforce granular control over cloud application usage without affecting legitimate business traffic.

Answer

Use web filtering to block the URL of personal Google Drive.

Answer

Configure IPS to block personal Google Drive traffic.

Answer

Create a rule to block all Google Drive applications.

Question 3

An administrator needs to ensure that IPS signatures are updated automatically on the FortiGate. Which configuration should be verified?

Accepted Answer

The FortiGuard service is enabled and the signature update schedule is configured.. Automatic IPS signature updates require the FortiGuard service to be enabled and a signature update schedule to be configured. Without a schedule, updates occur only manually; without the service enabled, the FortiGate cannot connect to FortiGuard distribution servers to retrieve new signatures.

Answer

The IPS engine is upgraded to the latest version.

Answer

The intrusion prevention profile is applied to the firewall policy.

Answer

The application control profile is set to 'monitor' for all applications.

Question 4

A network administrator is troubleshooting why certain web-based applications are not being identified by application control. The applications are accessed over HTTPS. What is the most likely missing configuration?

Accepted Answer

SSL inspection is not configured and applied to the firewall policy.. Application control relies on inspecting the content of traffic to identify applications. When traffic is encrypted with HTTPS, the firewall cannot inspect the payload without decrypting it first. Therefore, SSL inspection must be configured and applied to the firewall policy to allow the FortiGate to decrypt the traffic and match it against application control signatures.

Answer

Web filter profile is not applied to the firewall policy.

Answer

Deep packet inspection is not enabled on the firewall policy.

Answer

IPS is not enabled on the firewall policy.

Question 5

Which TWO statements about IPS in FortiGate are true?

Accepted Answer

IPS can be applied to individual firewall policies via IPS sensors.. IPS sensors are applied directly to individual firewall policies, allowing granular control over which traffic is inspected for intrusions. This enables administrators to enforce different IPS profiles for different traffic flows, such as applying a stricter sensor to internet-bound traffic and a lighter one to internal traffic.

Answer

An IPS sensor can only be applied to one firewall policy.

Answer

IPS is not supported in transparent mode.

Answer

IPS only works in flow-based inspection mode.

Question 6

Which TWO are valid actions for an application control rule?

Accepted Answer

block. Application control rules in FortiGate have two valid actions: 'block' (which drops the traffic and can optionally send a reset or log the event) and 'allow' (which permits the traffic). 'Monitor' is not a valid action for application control rules; it is used in features like web filtering. 'Quarantine' is used in IPS or antivirus, and 'redirect' is not an application control action.

Answer

quarantine

Answer

redirect

Answer

monitor

Question 7

Which THREE factors should be considered when tuning IPS to reduce false positives?

Accepted Answer

Excluding trusted source IP addresses from certain signatures.. Excluding trusted source IP addresses from certain signatures prevents the IPS from generating alerts for traffic that is known to be legitimate, directly reducing false positives. This is a common tuning technique in FortiGate IPS where you can create exceptions for specific sources or destinations to avoid unnecessary alerts from benign traffic.

Answer

Enabling hardware acceleration for IPS processing.

Answer

Increasing the sensitivity of signatures to catch more attacks.

Question 8

An administrator runs the command shown in the exhibit and sees anomalies detected from 10.1.1.100 to 10.2.2.200. The IPS sensor's anomaly settings are configured with the default actions. What will be the default action for the ICMP Flood anomaly?

Accepted Answer

Block. By default, FortiGate IPS sensors set the action for ICMP Flood anomalies to 'Block'. This default action is defined in the IPS sensor configuration and is applied when the anomaly threshold is exceeded, as indicated by the detected anomalies from 10.1.1.100 to 10.2.2.200.

Answer

Monitor

Answer

Pass

Answer

Quarantine

Question 9

A mid-sized company has a FortiGate 100F running FortiOS 7.2. They have two internal networks: Trusted (10.1.1.0/24) for employees and Guest (10.2.2.0/24) for visitors. The Guest network has a firewall policy that allows internet access only, with an application control profile that blocks all peer-to-peer and gaming applications. Recently, users on the Guest network have been able to play online games (e.g., Fortnite) despite the block. The administrator checks the application control profile and confirms that 'Fortnite' is listed as blocked. There are no other policies allowing Guest traffic. The administrator also notices that the Guest policy has 'set utm-status enable' and the application control profile is applied. What is the most likely reason that Fortnite is not being blocked?

Accepted Answer

The application control signatures are outdated and do not include the latest Fortnite signatures.. If the Application Control signatures are outdated, the FortiGate may not recognize the latest Fortnite traffic patterns or encrypted handshakes, allowing the game to bypass the block. Even though the policy has UTM enabled and the profile is applied, stale signatures cannot match new application variants or updates. Regularly updating the IPS/Application Control database via FortiGuard is essential to maintain effective blocking.

Answer

The firewall policy is missing 'set deep-inspection enable' for application control to work.

Answer

SSL inspection is required to block encrypted game traffic, and it is not enabled.

Answer

The application control profile is not applied to the correct policy.

Question 10

A company uses deep SSL inspection to filter traffic. Users report that some HTTPS sites are not loading. The administrator checks the FortiGate and sees that the certificate for the sites is not trusted on the client machines. What is the most likely cause?

Accepted Answer

The FortiGate's CA certificate is not installed in the Trusted Root Certification Authorities store on the clients.. When deep SSL inspection is enabled, the FortiGate acts as a man-in-the-middle by decrypting HTTPS traffic using a local CA certificate. For clients to trust the decrypted connections, the FortiGate's CA certificate must be installed in the Trusted Root Certification Authorities store on each client machine. If it is missing, the browser will display a certificate trust error and may block the site, causing the reported loading failures.

Answer

The FortiGate is using a self-signed certificate for the SSL inspection policy.

Answer

The SSL inspection policy is set to 'no-inspection' for the affected sites.

Answer

The FortiGate's web filter profile is blocking the certificate.

Question 11

An administrator notices that traffic to a specific HTTPS website is being blocked. The FortiGate has SSL inspection enabled, and the web filter profile is set to monitor all categories. The URL is not in any blocked category. What should the administrator check next?

Accepted Answer

Review the SSL/SSH inspection profile's certificate revocation check settings.. When SSL inspection is enabled and a specific HTTPS site is blocked despite not being in a blocked category, the issue often lies in the SSL/SSH inspection profile's certificate revocation check. If the FortiGate cannot verify the server's certificate revocation status (e.g., via OCSP or CRL), it may block the connection as a security precaution, even if the web filter category allows the URL. Option B directly addresses this by suggesting a review of the revocation check settings.

Answer

Check if the SSL inspection policy is using certificate inspection instead of full SSL inspection.

Answer

Ensure that the FortiGate has the latest web filter database.

Answer

Verify that the web filter has the correct rating for the URL.

Question 12

A company wants to block all HTTP traffic but allow HTTPS. Which SSL inspection method should be used on the firewall policy?

Accepted Answer

No inspection. To block HTTP (port 80) while allowing HTTPS (port 443), no SSL inspection is needed because the firewall can distinguish traffic by port number alone. SSL inspection is only required when you need to examine the encrypted payload of HTTPS traffic, not to permit or deny it based on the protocol. Therefore, 'No inspection' is correct for this access control requirement.

Answer

Deep inspection

Answer

Full SSL inspection

Answer

Certificate inspection

Question 13

An administrator configures a web filter profile to block the 'Phishing' category. Users still report receiving phishing emails with links that bypass the filter. What is the most likely reason?

Accepted Answer

The web filter profile is not applied to the firewall policy governing email traffic.. Web filtering in FortiOS only applies to HTTP/HTTPS traffic and is only enforced when the web filter profile is explicitly applied to a firewall policy. Email messages are not web traffic, so the web filter profile cannot block links inside emails regardless of SSL inspection. The most likely reason the phishing links bypass the filter is that the web filter profile is not applied to the firewall policy governing the users' internet web access.

Answer

The users are accessing the phishing sites via IP address, not URL.

Answer

The email traffic is not subject to SSL inspection, so URLs in encrypted emails are not filtered.

Answer

The FortiGate's URL database is outdated.

Question 14

A FortiGate is configured with SSL inspection and web filtering. The administrator notices that some HTTPS traffic is being blocked even though the URL is in an allowed category. What could be the cause?

Accepted Answer

The SSL inspection profile has 'certificate-validation-failed' action set to 'block'.. When SSL inspection is enabled, the FortiGate acts as a man-in-the-middle and validates the server's certificate. If the certificate is invalid (e.g., expired, self-signed, or mismatched), the FortiGate can block the session based on the 'certificate-validation-failed' action in the SSL inspection profile. Even if the URL belongs to an allowed web filter category, a failed certificate validation will cause the traffic to be blocked before the web filter policy is applied.

Answer

The FortiGate's DNS server is not resolving the domain correctly.

Answer

The web filter's 'allow' list is misconfigured.

Answer

The web filter profile has 'safe-search' enabled.

Question 15

Which TWO of the following are required for full SSL inspection to work correctly?

Accepted Answer

The FortiGate's CA certificate installed in the Trusted Root Certification Authorities store on client machines.. For full SSL inspection, the FortiGate must generate a session certificate on-the-fly for each HTTPS connection after decrypting it. This requires a CA certificate on the FortiGate to sign those session certificates. Additionally, client machines must trust this CA certificate, so it must be installed in their Trusted Root Certification Authorities store; otherwise, browsers will show certificate warnings and block the connection.

Answer

The private key of each server certificate that will be inspected.

Answer

An intermediate CA certificate imported from the enterprise PKI.

Answer

A certificate signed by a public CA installed on the FortiGate.