NSE4 Security Profiles Practice Test 2 — 15 Questions

Question 1

A school uses FortiGate for web filtering. They want to block social media sites for students during class hours (8 AM to 3 PM) but allow access for teachers at all times. The network has a single internet connection and all users are in the same subnet. The administrator created a firewall policy for students (source IP range 192.168.1.100-200) and another for teachers (source IP range 192.168.1.10-50). The student policy has a web filter profile that blocks social media. However, teachers are also being blocked from social media during class hours. What is the most likely cause?

Accepted Answer

The student policy is placed before the teacher policy in the policy list.. FortiGate processes firewall policies in sequential order from top to bottom, and the first matching policy is applied. Since the student policy (source IP range 192.168.1.100-200) is placed before the teacher policy (source IP range 192.168.1.10-50), traffic from teachers whose source IP falls within the student range (e.g., 192.168.1.50) will match the student policy first, causing them to be subject to the web filter profile that blocks social media. This is the most likely cause of teachers being blocked during class hours.

Answer

The web filter profile is applied globally.

Answer

The teacher policy has a schedule that restricts access.

Answer

The student policy is placed after the teacher policy.

Question 2

A network administrator notices that an IPS sensor is generating excessive false positives for a specific signature. The administrator wants to exclude traffic from a trusted internal server (IP 10.1.1.100) from inspection for that signature only, while keeping other signatures active. Which configuration change should the administrator apply?

Accepted Answer

Create an IPS filter that excludes the server's source IP address from the signature.. Option D is correct because an IPS filter allows the administrator to define a rule that excludes traffic from a specific source IP address (10.1.1.100) from inspection for a particular signature, while leaving all other signatures active. This granular approach ensures that false positives for that signature are reduced without disabling the signature entirely or affecting other traffic.

Answer

Set the signature action to 'pass' and use an application control profile to bypass the server.

Answer

Disable the signature in the IPS sensor configuration.

Answer

Add the server's IP to the exempt list in the IPS sensor.

Question 3

A security engineer is designing an application control policy for a corporate network. The goal is to allow Microsoft Teams for business use but block personal use of other collaboration apps like Zoom and Slack. The engineer configures an application control profile with a rule to 'monitor' Microsoft Teams and 'block' Zoom and Slack. However, users report that Zoom is still working. What is the most likely reason?

Accepted Answer

There is an implicit allow rule or a higher-priority rule that allows Zoom before the block rule is evaluated.. Option B is correct because FortiGate application control policies are evaluated in order, and the first matching rule is applied. If a higher-priority rule (or an implicit allow rule) permits Zoom traffic before the block rule is reached, Zoom will be allowed. The engineer likely placed the block rule after an allow rule or the default implicit allow policy is permitting Zoom traffic.

Answer

Application control profiles can only have one rule.

Answer

The 'monitor' rule for Teams overrides the 'block' rule for Zoom.

Answer

Application control uses port-based inspection and Zoom uses a non-standard port.

Question 4

A company wants to block all peer-to-peer file sharing applications on the network. Which FortiGate feature should be used to achieve this goal?

Accepted Answer

Application Control. Application Control is the correct feature because it is specifically designed to identify and block peer-to-peer (P2P) file-sharing applications by inspecting traffic patterns and signatures, regardless of the port or protocol used. Unlike port-based blocking, Application Control uses deep packet inspection (DPI) to recognize P2P protocols such as BitTorrent, eDonkey, and Gnutella, even when they attempt to evade detection by using non-standard ports or encryption.

Answer

Web Filter

Answer

DNS Filter

Answer

Intrusion Prevention System (IPS)

Question 5

During a security audit, an administrator finds that an IPS sensor configured with a 'block' action for a critical vulnerability signature is not blocking the associated traffic. The traffic matches the signature, but the action appears as 'pass' in the logs. The IPS sensor is applied to a firewall policy that also has application control enabled. What is the most likely cause?

Accepted Answer

Application control profile is set to 'allow' for the application associated with the traffic, overriding the IPS block action.. When an IPS sensor with a 'block' action logs 'pass' for matching traffic, it indicates that another security profile is overriding the IPS action. In FortiOS, if an application control profile is set to 'allow' for the application, it can bypass the IPS block because application control processing occurs before IPS inspection. The traffic is permitted by the application control profile, so the IPS engine does not enforce the block action, resulting in a 'pass' log entry.

Answer

The IPS engine is bypassed because the traffic matches a fast-path rule.

Answer

The IPS sensor is not enabled in the firewall policy.

Answer

The IPS sensor is configured with 'monitor' action instead of 'block'.

Question 6

A company recently deployed FortiGate with application control to manage cloud application usage. They want to allow Google Drive for business but block personal Google accounts. Which application control configuration approach is most effective?

Accepted Answer

Use application control with specific signatures for 'Google Drive Business' and 'Google Drive Personal' and apply appropriate actions.. Option C is correct because FortiGate's application control uses application signatures to distinguish between different versions of the same application, such as 'Google Drive Business' and 'Google Drive Personal'. By configuring specific signatures with appropriate actions (allow for business, block for personal), you can enforce granular control over cloud application usage without affecting legitimate business traffic.

Answer

Use web filtering to block the URL of personal Google Drive.

Answer

Configure IPS to block personal Google Drive traffic.

Answer

Create a rule to block all Google Drive applications.

Question 7

An administrator needs to ensure that IPS signatures are updated automatically on the FortiGate. Which configuration should be verified?

Accepted Answer

The FortiGuard service is enabled and the signature update schedule is configured.. Option D is correct because automatic IPS signature updates require the FortiGuard service to be enabled and a signature update schedule to be configured. Without a schedule, updates occur only manually; without the service enabled, the FortiGate cannot connect to FortiGuard distribution servers to retrieve new signatures.

Answer

The IPS engine is upgraded to the latest version.

Answer

The intrusion prevention profile is applied to the firewall policy.

Answer

The application control profile is set to 'monitor' for all applications.

Question 8

A network administrator is troubleshooting why certain web-based applications are not being identified by application control. The applications are accessed over HTTPS. What is the most likely missing configuration?

Accepted Answer

SSL inspection is not configured and applied to the firewall policy.. Application control relies on inspecting the content of traffic to identify applications. When traffic is encrypted with HTTPS, the firewall cannot inspect the payload without decrypting it first. Therefore, SSL inspection must be configured and applied to the firewall policy to allow the FortiGate to decrypt the traffic and match it against application control signatures.

Answer

Web filter profile is not applied to the firewall policy.

Answer

Deep packet inspection is not enabled on the firewall policy.

Answer

IPS is not enabled on the firewall policy.

Question 9

Which TWO statements about IPS in FortiGate are true?

Accepted Answer

IPS can be applied to individual firewall policies via IPS sensors.. Option A is correct because IPS sensors are applied directly to individual firewall policies, allowing granular control over which traffic is inspected for intrusions. This enables administrators to enforce different IPS profiles for different traffic flows, such as applying a stricter sensor to internet-bound traffic and a lighter one to internal traffic.

Answer

An IPS sensor can only be applied to one firewall policy.

Answer

IPS is not supported in transparent mode.

Answer

IPS only works in flow-based inspection mode.

Question 10

Which TWO are valid actions for an application control rule?

Accepted Answer

block. Application control rules in FortiGate use actions to determine how matched traffic is handled. 'Block' is a valid action that drops the application traffic and can optionally send a reset or log the event. 'Allow' is also a valid action that permits the application traffic to pass through the firewall.

Answer

quarantine

Answer

redirect

Answer

monitor

Question 11

Which THREE factors should be considered when tuning IPS to reduce false positives?

Accepted Answer

Excluding trusted source IP addresses from certain signatures.. Option A is correct because excluding trusted source IP addresses from certain signatures prevents the IPS from generating alerts for traffic that is known to be legitimate, directly reducing false positives. This is a common tuning technique in FortiGate IPS where you can create exceptions for specific sources or destinations to avoid unnecessary alerts from benign traffic.

Answer

Enabling hardware acceleration for IPS processing.

Answer

Increasing the sensitivity of signatures to catch more attacks.

Question 12

An administrator has configured the policy shown in the exhibit. Traffic to the web server at 10.0.1.10 over HTTPS is allowed, but users complain that they cannot access the web server's login page. The IPS sensor 'High_Security_Sensor' has a signature that blocks SQL injection attempts. The application list 'Block_Social_Media' blocks Facebook and Twitter. What is the most likely cause of the issue?

Accepted Answer

The application control profile is blocking the web application.. The policy explicitly allows HTTPS traffic to 10.0.1.10, but the application control profile 'Block_Social_Media' is applied. This profile blocks Facebook and Twitter, which are web-based applications. If the web server's login page is served over HTTPS and is incorrectly classified by the FortiGate as a social media application (e.g., due to shared CDN or similar traffic patterns), the application control profile will block it, preventing user access despite the firewall policy allowing the service.

Answer

The IPS sensor is blocking the login page due to a false positive.

Answer

The firewall policy action is set to 'deny' but the exhibit shows 'accept'.

Answer

The HTTPS service is not correctly defined and blocking the traffic.

Question 13

An administrator runs the command shown in the exhibit and sees anomalies detected from 10.1.1.100 to 10.2.2.200. The IPS sensor's anomaly settings are configured with the default actions. What will be the default action for the ICMP Flood anomaly?

Accepted Answer

Block. The correct answer is B because, by default, FortiGate IPS sensors set the action for ICMP Flood anomalies to 'Block'. This default action is defined in the IPS sensor configuration and is applied when the anomaly threshold is exceeded, as indicated by the detected anomalies from 10.1.1.100 to 10.2.2.200.

Answer

Monitor

Answer

Pass

Answer

Quarantine

Question 14

A mid-sized company has a FortiGate 100F running FortiOS 7.2. They have two internal networks: Trusted (10.1.1.0/24) for employees and Guest (10.2.2.0/24) for visitors. The Guest network has a firewall policy that allows internet access only, with an application control profile that blocks all peer-to-peer and gaming applications. Recently, users on the Guest network have been able to play online games (e.g., Fortnite) despite the block. The administrator checks the application control profile and confirms that 'Fortnite' is listed as blocked. There are no other policies allowing Guest traffic. The administrator also notices that the Guest policy has 'set utm-status enable' and the application control profile is applied. What is the most likely reason that Fortnite is not being blocked?

Accepted Answer

The application control signatures are outdated and do not include the latest Fortnite signatures.. Option D is correct because if the Application Control signatures are outdated, the FortiGate may not recognize the latest Fortnite traffic patterns or encrypted handshakes, allowing the game to bypass the block. Even though the policy has UTM enabled and the profile is applied, stale signatures cannot match new application variants or updates. Regularly updating the IPS/Application Control database via FortiGuard is essential to maintain effective blocking.

Answer

The firewall policy is missing 'set deep-inspection enable' for application control to work.

Answer

SSL inspection is required to block encrypted game traffic, and it is not enabled.

Answer

The application control profile is not applied to the correct policy.

Question 15

A company uses deep SSL inspection to filter traffic. Users report that some HTTPS sites are not loading. The administrator checks the FortiGate and sees that the certificate for the sites is not trusted on the client machines. What is the most likely cause?

Accepted Answer

The FortiGate's CA certificate is not installed in the Trusted Root Certification Authorities store on the clients.. When deep SSL inspection is enabled, the FortiGate acts as a man-in-the-middle by decrypting HTTPS traffic using a local CA certificate. For clients to trust the decrypted connections, the FortiGate's CA certificate must be installed in the Trusted Root Certification Authorities store on each client machine. If it is missing, the browser will display a certificate trust error and may block the site, causing the reported loading failures.

Answer

The FortiGate is using a self-signed certificate for the SSL inspection policy.

Answer

The SSL inspection policy is set to 'no-inspection' for the affected sites.

Answer

The FortiGate's web filter profile is blocking the certificate.