NSE4 Security Profiles Practice Test 3 — 15 Questions

Question 1

An administrator configures an IPS profile with a signature that has a 'block' action. However, traffic matching the signature is only being logged and not blocked. What is the most likely reason?

Accepted Answer

The signature's action is set to 'monitor' in the IPS sensor. IPS signatures can be set to 'block' but the actual action in the firewall policy's IPS profile may be overridden by the policy's inspection mode or the IPS profile's configuration. Additionally, the signature's action must not be set to 'monitor' or 'pass' at the sensor level.

Answer

The IPS profile is applied to the inbound policy only

Answer

The firewall policy is set to 'accept' but logging is disabled

Answer

The FortiGate is operating in flow-based inspection mode

Question 2

A FortiGate administrator wants to prevent users from downloading executable files via HTTP from the internet. Which TWO security profile features can be used together to achieve this? (Choose two.)

Accepted Answer

Antivirus profile with a file filter to block 'exe' files. Option A is correct because a FortiGate antivirus profile includes a file filter feature that can match file types by extension, so configuring it to block 'exe' files prevents executable downloads over HTTP (and other inspected protocols). Option B is correct because a web filter profile's URL filter can match URL patterns such as '*.exe', blocking HTTP requests whose URL ends in that extension before the file is retrieved. These two features are complementary: the URL filter blocks the request based on the URL, while the file filter blocks the file based on its detected type/extension, together covering executable downloads via HTTP. Option C is not correct because DNS filtering only blocks domain resolution and cannot identify or block specific file types such as executables. Option D is not correct because application control identifies and blocks applications or application categories, not individual file extensions like 'exe'. Option E is not correct because SSL deep inspection is an inspection enabler for encrypted traffic, not a blocking feature that prevents executable downloads.

Answer

DNS filter to block domains that host executable files

Answer

Application control profile to block HTTP file transfer applications

Answer

SSL deep inspection to allow inspection of encrypted traffic

Question 3

A FortiGate administrator receives reports that users cannot access a legitimate website that uses HTTPS. The web filtering profile is configured with strict FortiGuard categories and 'monitor all' for unknown sites. The firewall policy has an SSL/SSH inspection profile set to 'deep-inspection'. What is the most likely cause of the issue?

Accepted Answer

The website uses a self-signed certificate which is not trusted by the FortiGate CA bundle. The most likely cause is that the website uses a self-signed certificate, which is not included in the FortiGate's trusted CA bundle. When deep inspection is enabled, the FortiGate acts as a man-in-the-middle and must validate the server's certificate against its CA store; a self-signed certificate fails this validation, causing the connection to be blocked. This is a common issue with strict inspection profiles that require trusted certificates.

Answer

The antivirus profile is blocking a file on the website

Answer

The DNS filter is blocking the domain

Answer

The website's FortiGuard category is set to 'block'

Question 4

An administrator configures a data leak prevention (DLP) profile to detect credit card numbers in outgoing emails. However, no violations are logged. The email filter profile is applied with the DLP profile on the same policy. What is the most likely cause?

Accepted Answer

The SSL inspection profile on the policy is set to 'certificate-inspection' only. DLP inspection on FortiGate requires the traffic to be decrypted so the engine can inspect payloads for patterns like credit card numbers. If the SSL inspection profile is set to 'certificate-inspection' only, FortiGate sees only certificate metadata (CN, SNI) and cannot read the encrypted email body or attachments, so no DLP match occurs. Full deep inspection (man-in-the-middle) is required for DLP to scan content.

Answer

The credit card numbers are being sent in PDF attachments, which are not scanned

Answer

The DLP profile is not applied to SMTP traffic

Answer

The FortiGate needs a FortiSandbox license for DLP to work

Question 5

An administrator sees the following CLI output when checking an IPS sensor: 'config ips sensor edit test config entries edit 1 set severity medium set action block set target default end'. However, attacks with severity medium are still passing. The IPS sensor is applied to a policy with flow-based inspection. What is the likely issue?

Accepted Answer

The IPS sensor rule has 'target' set to 'default' which may not apply to the traffic direction. The 'set target default' command in the IPS sensor configuration means the rule is applied to traffic that matches the default target, which is typically the 'client-to-server' direction. If the attack traffic is flowing in the opposite direction (server-to-client), the rule will not trigger. This is a common misconfiguration when using flow-based inspection, where the target direction must match the actual traffic flow for the action to be enforced.

Answer

The IPS sensor is not enabled in the policy

Answer

The FortiGate needs a FortiSandbox for IPS to work

Answer

The severity level is set too high

Question 6

An administrator wants to detect and prevent malware outbreaks. The FortiGate is integrated with FortiSandbox. Which TWO actions should be taken to ensure files are sent to FortiSandbox for analysis?

Accepted Answer

Enable FortiSandbox in the antivirus profile settings. Option B is correct because FortiSandbox inspection is enabled inside the antivirus security profile: you must turn on the FortiSandbox setting (and select the FortiSandbox appliance/cloud) in the AV profile, otherwise files matching the profile are scanned only by the local AV engine and never submitted for sandbox analysis. Option E is correct because FortiSandbox file submission requires proxy-based inspection mode on the firewall policy; in flow-based mode the FortiGate does not buffer and forward files to FortiSandbox, so the sandbox action cannot occur. Option A is wrong because flow-based inspection is precisely the mode that does not support sending files to FortiSandbox. Option C is wrong because deep inspection for HTTPS only enables SSL/TLS content inspection; it is not the mechanism that submits files to FortiSandbox and is not required for the sandbox integration itself. Option D is wrong because disabling the antivirus profile removes the AV/FortiSandbox scanning entirely, so no files would be sent for analysis.

Answer

Set the firewall policy inspection mode to flow-based

Answer

Enable deep inspection for HTTPS traffic

Answer

Disable the antivirus profile on the policy

Question 7

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. FortiGate cannot inspect HTTPS traffic for antivirus without SSL/TLS deep inspection enabled on the firewall policy, because the traffic is encrypted end-to-end. Without deep inspection, the firewall only sees encrypted bytes and cannot scan the payload for malware. Enabling deep inspection allows FortiGate to decrypt, scan, and re-encrypt the traffic, applying the antivirus profile effectively.

Answer

The FortiGuard antivirus subscription has expired

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Question 8

An admin has configured an application control profile to block 'Facebook' and 'Twitter' using application signatures. Users can still access these sites via HTTPS. The firewall policy has SSL deep inspection enabled and the application control profile is applied. What is the MOST likely cause?

Accepted Answer

The application signatures for Facebook and Twitter are outdated. The most likely cause is that the application signatures for Facebook and Twitter are outdated. FortiGate application control relies on regularly updated signatures to identify applications. If the signatures are not current, the FortiGate may not recognize the application traffic, especially for frequently changing services like social media. While SSL deep inspection is enabled, correct signatures are still required to identify the application by host header or SNI. Options such as the application control profile having insufficient inspection settings or users using IP addresses are less likely because SSL inspection is enabled and the profile is applied.

Answer

The application control profile does not have deep inspection enabled for HTTPS traffic

Answer

Users are accessing the sites via IP address instead of domain name

Answer

The firewall policy is using a proxy policy instead of an explicit policy

Question 9

A FortiGate is configured to use a DNS filter profile to block access to malicious domains. However, users can still reach a known malicious domain. The DNS filter profile is applied to the firewall policy. Which step should the admin take FIRST to troubleshoot?

Accepted Answer

Check if DNS traffic is matching the correct firewall policy. The first step is to verify that DNS traffic is matching the correct firewall policy, because if the DNS filter profile is not applied to the policy handling the DNS queries, the filter will not take effect. This is a fundamental troubleshooting step to ensure the policy is correctly configured and that DNS traffic is not bypassing the filter.

Answer

Enable DNS inspection logging to see if the domain is being flagged

Answer

Check if the FortiGuard DNS filter database is up to date

Answer

Verify that the domain is in the FortiGuard DNS category list

Question 10

A network administrator configures a web filtering profile to block access to the 'Social Networking' FortiGuard category. However, users can still access Facebook. The firewall policy has web filtering enabled. What is the MOST likely reason?

Accepted Answer

The web filter options are not set to use FortiGuard rating lookup. The web filtering profile must have its rating lookup option set to 'FortiGuard' to use the FortiGuard category database. If it is set to 'Local' or 'Disabled', the FortiGuard categories are not enforced, allowing access to sites like Facebook even though the category is blocked.

Answer

The Facebook URL is cached in the user's browser

Answer

The FortiGuard web filter database is outdated

Answer

The firewall policy does not have SSL deep inspection enabled

Question 11

An administrator needs to block all traffic from an application that uses a proprietary protocol not recognized by any application signature. Which security profile method should be used to block this traffic?

Accepted Answer

Use an IPS profile with a custom signature based on protocol anomalies. An IPS profile with a custom signature allows the administrator to define a pattern or anomaly that matches the proprietary protocol's behavior, even if no pre-built application signature exists. IPS signatures operate at the network and transport layers, inspecting packet contents and protocol headers, so they can detect and block traffic based on custom logic. This is the only option that provides a flexible, signature-based method to identify and block unknown or proprietary protocols.

Answer

Create an application control profile and add a custom application signature

Answer

Use a web filter profile to block by URL

Answer

Use a data leak prevention (DLP) profile to match on data patterns

Question 12

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session has been established for 3600 seconds and will expire in 3599 seconds. The output shows 'duration=3600' and 'expire=3599', which means the session has been active for 3600 seconds and will expire in 3599 seconds. The 'proto=6' indicates TCP, and 'proto_state=01' indicates the session is in the established state. Therefore, the session is established and has a remaining lifetime of 3599 seconds.

Answer

The session is using UDP protocol

Answer

The session is blocked by the firewall policy

Answer

The session is in SYN-SENT state

Question 13

A FortiGate admin wants to enforce safe search on Google and Bing for all users. The firewall policy has web filtering enabled. Which TWO configurations are required?

Accepted Answer

Configure a URL filter to rewrite search URLs to include safe search parameters. Safe search enforcement on FortiGate can be achieved either by enabling the 'Safe Search' option within the web filter profile's FortiGuard settings (option E) which automatically appends safe search parameters to search URLs, or by configuring a URL filter (option D) to manually rewrite search queries to include safe search parameters (e.g., &safe=active for Google). SSL deep inspection (option C) is not required for this functionality because the URL rewrite occurs at the proxy level and FortiGuard safe search works with both HTTP and HTTPS traffic without deep inspection. Option A (custom CA certificate) is unnecessary as no decryption is needed, and option B (application control) is not the primary method for enforcing safe search.

Answer

Install a custom CA certificate on client browsers

Answer

Use an application control profile to block non-safe search applications

Answer

Enable SSL deep inspection

Question 14

A network administrator notices that traffic from a specific internal host is not being inspected by the application control profile applied to the firewall policy. The policy is configured with proxy-based inspection and the application control profile includes a rule to block 'Facebook'. The administrator confirms the host can still access Facebook. What is the MOST likely cause?

Accepted Answer

The host is accessing Facebook over HTTPS and the policy does not have SSL/TLS deep inspection enabled.. The most likely cause is that the host is accessing Facebook over HTTPS, and the firewall policy does not have SSL/TLS deep inspection enabled. Without deep inspection, the firewall cannot decrypt the HTTPS traffic to inspect the application layer payload, so the application control profile cannot identify or block 'Facebook' traffic. Proxy-based inspection requires decryption to match application signatures for encrypted traffic.

Answer

The firewall policy is using flow-based inspection instead of proxy-based.

Answer

The application control profile is configured with 'deep inspection' disabled.

Answer

The application control profile is applied only to outgoing traffic, but the host is using a proxy.

Question 15

An organization wants to prevent users from downloading files with extensions such as .exe and .scr via HTTP and HTTPS. The FortiGate already has a web filter profile applied to the relevant policy. Which web filter feature should be configured to achieve this?

Accepted Answer

Content filtering with a block rule for the file extensions. Content filtering inspects HTTP response bodies and can block file downloads by extension. For HTTPS, SSL deep inspection must be enabled.

Answer

FortiGuard category filtering set to block 'Malicious Websites'

Answer

A static URL filter block rule for the file extensions

Answer

URL filter with a block rule for *\.exe and *\.scr patterns