NSE4 Security Profiles Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. An administrator has configured the SSL/SSH profile shown. However, users are unable to access HTTPS websites. What is the most likely cause?

Accepted Answer

The 'untrusted-caname' should be set to a trusted CA certificate to handle untrusted server certificates.. When the SSL/SSH profile has 'untrusted-caname' set to 'Fortinet_CA_SSL' (an untrusted CA), the FortiGate cannot re-sign certificates from untrusted servers with a trusted CA. This causes HTTPS websites to fail as the client receives an untrusted certificate warning or connection error. Setting 'untrusted-caname' to a trusted CA certificate ensures that even untrusted server certificates are re-signed with a certificate the client trusts.

Answer

The port is set to 443, but HTTPS also uses port 8443.

Answer

The 'caname' is set to 'Fortinet_CA_SSL', which is not a valid certificate name.

Answer

The 'whitelist-mode' is disabled, which prevents inspection.

Question 2

A company with 500 users has a FortiGate 1000D running FortiOS 7.2. They have configured full SSL inspection and web filtering to block malware and phishing sites. The administrator receives complaints that some users cannot access a legitimate business website (https://vendor.example.com). The administrator checks the FortiGate logs and sees that the connection is allowed by the firewall policy and web filter. However, the user's browser shows 'ERR_CERT_AUTHORITY_INVALID'. The administrator verifies that the FortiGate's CA certificate is installed on all client machines. Further investigation reveals that the vendor's website uses a certificate signed by a private CA that is not trusted by the FortiGate. The administrator wants to resolve the issue without disabling SSL inspection for the whole website or compromising security. What should the administrator do?

Accepted Answer

Import the vendor's private CA certificate into the FortiGate's trusted root CA store.. The FortiGate cannot validate the vendor's certificate because its private CA is not in the FortiGate's trusted root store. By importing that CA certificate into the FortiGate's trusted root CA store, the FortiGate will trust the vendor's certificate chain, allowing full SSL inspection to proceed without errors. This resolves the ERR_CERT_AUTHORITY_INVALID error while maintaining security inspection for the domain.

Answer

Create an SSL exemption for the vendor's domain in the SSL inspection profile.

Answer

Change the SSL inspection profile to certificate inspection only.

Answer

Install the vendor's CA certificate on the client machines.

Question 3

A network administrator notices that a FortiGate IPS sensor is not detecting any attacks, even though there is known malicious traffic on the network. Which initial troubleshooting step should the administrator take?

Accepted Answer

Verify that the IPS engine is running and signatures are up to date.. The first step in troubleshooting a non-functional IPS sensor is to verify that the IPS engine is running and that the IPS signatures are up to date. If the engine is stopped or signatures are outdated, the sensor cannot detect known malicious traffic regardless of other configurations. This foundational check ensures the detection mechanism itself is operational before investigating policy or mode settings.

Answer

Ensure the firewall policy is set to flow-based inspection.

Answer

Disable any DoS policies that might be blocking traffic.

Answer

Check that the FortiGate is configured in NAT mode.

Question 4

An organization uses Application Control to allow only business-critical applications and block social media. The administrator has configured the profile to block Facebook and Twitter, but users can still access Facebook. The firewall policy applies the profile correctly. What is the most likely cause?

Accepted Answer

SSL inspection is not enabled on the firewall policy.. Application Control relies on SSL inspection to identify applications like Facebook that use HTTPS. Without SSL inspection enabled on the firewall policy, FortiGate can only see encrypted traffic as generic SSL/TLS flows and cannot match the application signatures for Facebook. Enabling SSL inspection (deep inspection or certificate-based inspection) allows the FortiGate to decrypt the traffic and apply the application control profile correctly.

Answer

The application control profile is applied to the wrong direction.

Answer

Facebook is not included in the default application signatures.

Answer

The FortiGate is in flow-based inspection mode.

Question 5

Which TWO of the following are best practices when configuring IPS on a FortiGate in a high-throughput environment?

Accepted Answer

Enable only relevant signatures based on the network environment.. Enabling only relevant signatures based on the network environment reduces false positives and unnecessary processing overhead, ensuring that IPS resources are focused on threats that actually apply to the traffic traversing the FortiGate. Option E is correct because flow-based inspection uses a single-pass, pattern-matching engine that offers higher throughput and lower latency compared to proxy-based inspection, making it ideal for high-throughput environments.

Answer

Set all signatures to block action to maximize security.

Answer

Set the IPS severity filter to high and above only.

Answer

Disable all custom signatures to simplify management.

Question 6

Given the above IPS sensor configuration, what will happen when traffic matching a high-severity IPS signature is detected?

Accepted Answer

The traffic will be allowed because no entry exists for high severity.. The IPS sensor configuration shown does not include an entry for high-severity signatures. Without a specific action defined for high severity, the sensor defaults to allowing the traffic while still generating a log entry. This is a common behavior in FortiGate IPS where only explicitly configured severity levels have defined actions.

Answer

The traffic will be logged but not blocked.

Answer

The traffic will be blocked only if the signature is enabled globally.

Answer

The traffic will be blocked because the sensor has a block action.

Question 7

A large enterprise uses a FortiGate 600E in NAT mode to protect its internal network. The security team has implemented an Application Control profile that categorizes applications and allows only 'Business' and 'General-Interest' categories. They have also applied an IPS sensor with default settings and enabled SSL inspection for outbound traffic. Recently, the helpdesk has received reports that some users cannot access a critical cloud-based CRM application, while others can. The CRM uses HTTPS on port 443. The Application Control profile is applied to the firewall policy for outbound traffic. The IPS sensor is also applied. The FortiGate is not configured for load balancing. Which of the following is the most likely cause of the issue?

Accepted Answer

The CRM application is not categorized in the Application Control database.. The Application Control profile is configured to allow only 'Business' and 'General-Interest' categories. If the CRM application is not categorized in FortiGuard's Application Control database, or if it falls under a different category (e.g., 'Uncategorized' or 'Unknown'), the FortiGate will block the traffic by default. This explains why some users can access the CRM (if they are using a different path or the application is categorized differently) while others cannot, as the FortiGate enforces the profile based on the application signature match.

Answer

The IPS sensor is detecting and blocking the CRM traffic as an attack.

Answer

The FortiGate is performing load balancing and some users are directed to a different path.

Answer

SSL inspection is blocking the CRM traffic due to certificate validation failure.

Question 8

An administrator is configuring web filtering on a FortiGate. Which TWO statements about web filtering profiles are correct?

Accepted Answer

Web filtering profiles can be used together with application control profiles.. Web filtering profiles and application control profiles operate independently at different layers of the FortiGate security fabric. Web filtering inspects HTTP/HTTPS traffic against URL categories and ratings, while application control identifies and controls application-level traffic (e.g., Facebook, Skype) using deep packet inspection. They can be applied together in a single security policy to provide layered protection without conflict.

Answer

Web filtering profiles can only be applied to users who are authenticated.

Answer

Web filtering profiles are applied globally by default.

Answer

Web filtering profiles are used to configure SSL certificate inspection.

Question 9

Refer to the exhibit. An administrator is troubleshooting why SSL inspection is not working for web traffic. The policy shown is the only policy matching the traffic. What is the most likely reason SSL inspection is failing?

Accepted Answer

The policy is missing the 'set inspection-mode proxy' command.. The policy is missing the 'set inspection-mode proxy' command. FortiGate requires proxy-based inspection mode to perform SSL/TLS interception; flow-based inspection cannot decrypt or re-encrypt HTTPS traffic. Without this command, the policy defaults to flow-based mode, causing SSL inspection to fail even if the ssl-ssh-profile is set to deep-inspection.

Answer

The ssl-ssh-profile is set to 'deep-inspection' but the policy is using flow-based inspection.

Answer

The source interface is 'wan1' but the traffic is coming from 'internal'.

Answer

The policy has 'set action deny' instead of 'set action accept'.

Question 10

An administrator is configuring an IPS profile on FortiGate to detect and block SQL injection attacks. The profile must be applied to inbound traffic to a web server. Which TWO settings should the administrator enable to achieve this goal? (Choose two.)

Accepted Answer

Add the 'SQL.Injection' signature to the IPS sensor and set action to 'block'.. SQL injection attacks are identified by specific IPS signatures, and adding 'SQL.Injection' to an IPS sensor with the action set to 'block' directly instructs FortiGate to detect and block those attacks. Option E is correct because an IPS sensor must be enabled within a firewall policy to apply its inspection to the traffic passing through that policy, ensuring the profile is active on inbound traffic to the web server.

Answer

Create a DoS policy to limit the number of connections per second.

Answer

Enable the HTTP protocol decoder in the application control profile.

Answer

Configure the IPS sensor to bypass traffic from trusted IP addresses.

Question 11

Refer to the exhibit. An administrator has configured the SSL/SSH profile shown. However, users are unable to access HTTPS websites. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The packet will be allowed (pass).. The IPS sensor in the exhibit defines rules only for severity 'medium' and 'critical', both with action 'block'. When a packet triggers a signature with severity 'low', it does not match any entry in the sensor. Therefore, the default action for unmatched signatures is to allow (pass) the traffic. FortiGate IPS sensors apply actions only to explicitly configured severity levels; unlisted severities are not affected.

Answer

The packet will be logged and a session will be created.

Answer

The packet will be blocked if the signature severity is 'low' or 'high'.

Answer

The packet will be blocked because the sensor is enabled.

Question 12

Drag and drop the steps to configure IPsec VPN phase 1 settings on FortiGate into the correct order.

Accepted Answer

Set remote gateway, then pre-shared key, then IKE version, then encryption algorithm.. Phase 1 establishes the secure channel; key parameters include remote gateway, PSK, IKE version, and encryption.

Answer

Set pre-shared key, then remote gateway, then IKE version, then encryption algorithm.

Answer

Set remote gateway, then IKE version, then pre-shared key, then encryption algorithm.

Answer

Set IKE version, then remote gateway, then pre-shared key, then encryption algorithm.

Question 13

Drag and drop the steps to capture traffic on a FortiGate interface using the CLI into the correct order.

Accepted Answer

Step 1: Specify the interface, Step 2: Specify the filter, Step 3: Specify the verbose level, Step 4: Specify the count. The sniffer command syntax is diagnose sniffer packet .

Answer

Step 1: Specify the filter, Step 2: Specify the interface, Step 3: Specify the verbose level, Step 4: Specify the count

Answer

Step 1: Specify the interface, Step 2: Specify the verbose level, Step 3: Specify the filter, Step 4: Specify the count

Answer

Step 1: Specify the count, Step 2: Specify the verbose level, Step 3: Specify the filter, Step 4: Specify the interface

Question 14

Drag and drop the steps to perform a factory reset on FortiGate via CLI into the correct order.

Accepted Answer

Connect to CLI, run execute factoryreset, confirm, wait for reboot.. Factory reset is done with execute factoryreset, then confirm; device reboots to defaults.

Answer

Connect to CLI, confirm, run execute factoryreset, wait for reboot.

Answer

Connect to CLI, run execute factoryreset, wait for reboot, confirm.

Answer

Connect to CLI, reboot, run execute factoryreset, confirm.

Question 15

Drag and drop the steps to configure a VLAN interface on FortiGate into the correct order.

Accepted Answer

Create VLAN interface, then configure parent interface and VLAN ID, then assign IP address, then enable administrative access.. VLAN interfaces require a physical parent, VLAN ID, IP address, and optional administrative access.

Answer

Assign IP address, then create VLAN interface, then configure parent interface and VLAN ID, then enable administrative access.

Answer

Create VLAN interface, then assign IP address, then configure parent interface and VLAN ID, then enable administrative access.

Answer

Configure parent interface and VLAN ID, then create VLAN interface, then assign IP address, then enable administrative access.