NSE4 Security Profiles Practice Test 3 — 15 Questions

Question 1

An administrator notices that traffic to a specific HTTPS website is being blocked. The FortiGate has SSL inspection enabled, and the web filter profile is set to monitor all categories. The URL is not in any blocked category. What should the administrator check next?

Accepted Answer

Review the SSL/SSH inspection profile's certificate revocation check settings.. When SSL inspection is enabled and a specific HTTPS site is blocked despite not being in a blocked category, the issue often lies in the SSL/SSH inspection profile's certificate revocation check. If the FortiGate cannot verify the server's certificate revocation status (e.g., via OCSP or CRL), it may block the connection as a security precaution, even if the web filter category allows the URL. Option B directly addresses this by suggesting a review of the revocation check settings.

Answer

Check if the SSL inspection policy is using certificate inspection instead of full SSL inspection.

Answer

Ensure that the FortiGate has the latest web filter database.

Answer

Verify that the web filter has the correct rating for the URL.

Question 2

A company wants to block all HTTP traffic but allow HTTPS. Which SSL inspection method should be used on the firewall policy?

Accepted Answer

No inspection. To block HTTP (port 80) while allowing HTTPS (port 443), no SSL inspection is needed because the firewall can distinguish traffic by port number alone. SSL inspection is only required when you need to examine the encrypted payload of HTTPS traffic, not to permit or deny it based on the protocol. Therefore, 'No inspection' is correct for this access control requirement.

Answer

Deep inspection

Answer

Full SSL inspection

Answer

Certificate inspection

Question 3

An administrator configures a web filter profile to block the 'Phishing' category. Users still report receiving phishing emails with links that bypass the filter. What is the most likely reason?

Accepted Answer

The email traffic is not subject to SSL inspection, so URLs in encrypted emails are not filtered.. Option B is correct because web filtering operates at the application layer and inspects HTTP/HTTPS URLs. If SSL inspection is not enabled, the FortiGate cannot decrypt the encrypted SMTP or IMAP/POP3 traffic to extract URLs from the body of emails. Without decryption, the web filter profile cannot see the phishing links inside encrypted email messages, so they bypass the filter regardless of the category being blocked.

Answer

The users are accessing the phishing sites via IP address, not URL.

Answer

The web filter profile is not applied to the firewall policy governing email traffic.

Answer

The FortiGate's URL database is outdated.

Question 4

A FortiGate is configured with SSL inspection and web filtering. The administrator notices that some HTTPS traffic is being blocked even though the URL is in an allowed category. What could be the cause?

Accepted Answer

The SSL inspection profile has 'certificate-validation-failed' action set to 'block'.. When SSL inspection is enabled, the FortiGate acts as a man-in-the-middle and validates the server's certificate. If the certificate is invalid (e.g., expired, self-signed, or mismatched), the FortiGate can block the session based on the 'certificate-validation-failed' action in the SSL inspection profile. Even if the URL belongs to an allowed web filter category, a failed certificate validation will cause the traffic to be blocked before the web filter policy is applied.

Answer

The FortiGate's DNS server is not resolving the domain correctly.

Answer

The web filter's 'allow' list is misconfigured.

Answer

The web filter profile has 'safe-search' enabled.

Question 5

Which TWO of the following are required for full SSL inspection to work correctly?

Accepted Answer

The FortiGate's CA certificate installed in the Trusted Root Certification Authorities store on client machines.. For full SSL inspection, the FortiGate must generate a session certificate on-the-fly for each HTTPS connection after decrypting it. This requires a CA certificate on the FortiGate to sign those session certificates. Additionally, client machines must trust this CA certificate, so it must be installed in their Trusted Root Certification Authorities store; otherwise, browsers will show certificate warnings and block the connection.

Answer

The private key of each server certificate that will be inspected.

Answer

An intermediate CA certificate imported from the enterprise PKI.

Answer

A certificate signed by a public CA installed on the FortiGate.

Question 6

Which THREE of the following are valid methods to exclude certain HTTPS traffic from SSL inspection on a FortiGate?

Accepted Answer

Adding the domain to the 'SSL Exempt Domains' list in the SSL/SSH inspection profile.. Option A is correct because the 'SSL Exempt Domains' list in the SSL/SSH inspection profile allows you to specify domain names (e.g., *.example.com) that will bypass SSL inspection entirely. When FortiGate matches the SNI field in the ClientHello or the certificate CN/SAN against this list, it skips decryption and passes the traffic through without inspection, reducing overhead for trusted or non-critical domains.

Answer

Setting the firewall policy action to 'accept' with no inspection.

Answer

Using a web filter category exemption.

Question 7

Refer to the exhibit. An administrator has configured the SSL/SSH profile shown. However, users are unable to access HTTPS websites. What is the most likely cause?

Accepted Answer

The 'untrusted-caname' should be set to a trusted CA certificate to handle untrusted server certificates.. Option A is correct because when the SSL/SSH profile has 'untrusted-caname' set to 'Fortinet_CA_SSL' (an untrusted CA), the FortiGate cannot re-sign certificates from untrusted servers with a trusted CA. This causes HTTPS websites to fail as the client receives an untrusted certificate warning or connection error. Setting 'untrusted-caname' to a trusted CA certificate ensures that even untrusted server certificates are re-signed with a certificate the client trusts.

Answer

The port is set to 443, but HTTPS also uses port 8443.

Answer

The 'caname' is set to 'Fortinet_CA_SSL', which is not a valid certificate name.

Answer

The 'whitelist-mode' is disabled, which prevents inspection.

Question 8

A company with 500 users has a FortiGate 1000D running FortiOS 7.2. They have configured full SSL inspection and web filtering to block malware and phishing sites. The administrator receives complaints that some users cannot access a legitimate business website (https://vendor.example.com). The administrator checks the FortiGate logs and sees that the connection is allowed by the firewall policy and web filter. However, the user's browser shows 'ERR_CERT_AUTHORITY_INVALID'. The administrator verifies that the FortiGate's CA certificate is installed on all client machines. Further investigation reveals that the vendor's website uses a certificate signed by a private CA that is not trusted by the FortiGate. The administrator wants to resolve the issue without disabling SSL inspection for the whole website or compromising security. What should the administrator do?

Accepted Answer

Import the vendor's private CA certificate into the FortiGate's trusted root CA store.. The FortiGate cannot validate the vendor's certificate because its private CA is not in the FortiGate's trusted root store. By importing that CA certificate into the FortiGate's trusted root CA store, the FortiGate will trust the vendor's certificate chain, allowing full SSL inspection to proceed without errors. This resolves the ERR_CERT_AUTHORITY_INVALID error while maintaining security inspection for the domain.

Answer

Create an SSL exemption for the vendor's domain in the SSL inspection profile.

Answer

Change the SSL inspection profile to certificate inspection only.

Answer

Install the vendor's CA certificate on the client machines.

Question 9

A company wants to block all peer-to-peer (P2P) traffic using Application Control on their FortiGate. They have enabled the application control profile, but users can still download files via BitTorrent. What is the most likely reason?

Accepted Answer

The application control profile does not have SSL inspection enabled.. BitTorrent traffic is often encrypted, so without SSL inspection, the FortiGate cannot inspect the payload of the encrypted sessions to identify the application. Application Control relies on deep packet inspection (DPI) to match traffic against application signatures; if SSL inspection is not enabled, the FortiGate only sees encrypted packets and cannot detect BitTorrent, allowing the traffic to pass unchecked.

Answer

The FortiGate is operating in Transparent mode.

Answer

The application control profile is applied to the outgoing policy, but BitTorrent traffic is incoming.

Answer

The default application signatures do not include BitTorrent.

Question 10

An administrator has configured an IPS sensor to block critical-severity attacks. However, after a week, they notice that a known exploit (CVE-2021-44228) is still getting through. Which configuration change should be made to improve detection?

Accepted Answer

Enable the specific IPS signature for the exploit in the sensor.. Option D is correct because the IPS sensor must have the specific signature for CVE-2021-44228 (Log4Shell) enabled to detect and block it. Even if the sensor is set to block critical-severity attacks, the signature for this exploit may be disabled by default in the sensor's signature database. Enabling the specific signature ensures the sensor inspects traffic for the exploit's unique patterns and applies the configured action.

Answer

Set the IPS sensor severity filter to 'low' and above.

Answer

Change the IPS sensor action from 'default' to 'block' for all signatures.

Answer

Create a custom IPS signature for the exploit.

Question 11

A network administrator notices that a FortiGate IPS sensor is not detecting any attacks, even though there is known malicious traffic on the network. Which initial troubleshooting step should the administrator take?

Accepted Answer

Verify that the IPS engine is running and signatures are up to date.. Option C is correct because the first step in troubleshooting a non-functional IPS sensor is to verify that the IPS engine is running and that the IPS signatures are up to date. If the engine is stopped or signatures are outdated, the sensor cannot detect known malicious traffic regardless of other configurations. This foundational check ensures the detection mechanism itself is operational before investigating policy or mode settings.

Answer

Ensure the firewall policy is set to flow-based inspection.

Answer

Disable any DoS policies that might be blocking traffic.

Answer

Check that the FortiGate is configured in NAT mode.

Question 12

An organization uses Application Control to allow only business-critical applications and block social media. The administrator has configured the profile to block Facebook and Twitter, but users can still access Facebook. The firewall policy applies the profile correctly. What is the most likely cause?

Accepted Answer

SSL inspection is not enabled on the firewall policy.. Application Control relies on SSL inspection to identify applications like Facebook that use HTTPS. Without SSL inspection enabled on the firewall policy, FortiGate can only see encrypted traffic as generic SSL/TLS flows and cannot match the application signatures for Facebook. Enabling SSL inspection (deep inspection or certificate-based inspection) allows the FortiGate to decrypt the traffic and apply the application control profile correctly.

Answer

The application control profile is applied to the wrong direction.

Answer

Facebook is not included in the default application signatures.

Answer

The FortiGate is in flow-based inspection mode.

Question 13

Which TWO of the following are best practices when configuring IPS on a FortiGate in a high-throughput environment?

Accepted Answer

Enable only relevant signatures based on the network environment.. Option D is correct because enabling only relevant signatures based on the network environment reduces false positives and unnecessary processing overhead, ensuring that IPS resources are focused on threats that actually apply to the traffic traversing the FortiGate. Option E is correct because flow-based inspection uses a single-pass, pattern-matching engine that offers higher throughput and lower latency compared to proxy-based inspection, making it ideal for high-throughput environments.

Answer

Set all signatures to block action to maximize security.

Answer

Set the IPS severity filter to high and above only.

Answer

Disable all custom signatures to simplify management.

Question 14

Given the above IPS sensor configuration, what will happen when traffic matching a high-severity IPS signature is detected?

Accepted Answer

The traffic will be allowed because no entry exists for high severity.. Option D is correct because the IPS sensor configuration shown does not include an entry for high-severity signatures. Without a specific action defined for high severity, the sensor defaults to allowing the traffic while still generating a log entry. This is a common behavior in FortiGate IPS where only explicitly configured severity levels have defined actions.

Answer

The traffic will be logged but not blocked.

Answer

The traffic will be blocked only if the signature is enabled globally.

Answer

The traffic will be blocked because the sensor has a block action.

Question 15

A large enterprise uses a FortiGate 600E in NAT mode to protect its internal network. The security team has implemented an Application Control profile that categorizes applications and allows only 'Business' and 'General-Interest' categories. They have also applied an IPS sensor with default settings and enabled SSL inspection for outbound traffic. Recently, the helpdesk has received reports that some users cannot access a critical cloud-based CRM application, while others can. The CRM uses HTTPS on port 443. The Application Control profile is applied to the firewall policy for outbound traffic. The IPS sensor is also applied. The FortiGate is not configured for load balancing. Which of the following is the most likely cause of the issue?

Accepted Answer

The CRM application is not categorized in the Application Control database.. The correct answer is B because the Application Control profile is configured to allow only 'Business' and 'General-Interest' categories. If the CRM application is not categorized in FortiGuard's Application Control database, or if it falls under a different category (e.g., 'Uncategorized' or 'Unknown'), the FortiGate will block the traffic by default. This explains why some users can access the CRM (if they are using a different path or the application is categorized differently) while others cannot, as the FortiGate enforces the profile based on the application signature match.

Answer

The IPS sensor is detecting and blocking the CRM traffic as an attack.

Answer

The FortiGate is performing load balancing and some users are directed to a different path.

Answer

SSL inspection is blocking the CRM traffic due to certificate validation failure.