NSE4 Security Profiles Practice Test 4 — 15 Questions

Question 1

A company is implementing SSL/TLS inspection on a FortiGate to monitor encrypted traffic. They want to ensure that traffic to high-risk categories is blocked, while traffic to financial sites is inspected but not blocked. The administrator creates an SSL inspection profile that deep-inspects all traffic except traffic to financial sites. However, users report that they cannot access financial websites. What is the most likely cause?

Accepted Answer

The web filter profile is configured to block financial websites, overriding the SSL inspection exemption.. The most likely cause is that the web filter profile applied in the same firewall policy is configured to block financial websites. Even though the SSL inspection profile exempts financial sites from deep inspection, the web filter profile operates independently and can block traffic based on URL category. Since the web filter is evaluated after SSL inspection, it will block the decrypted or even non-decrypted traffic to financial sites if the category is set to block, overriding the SSL inspection exemption.

Answer

The SSL inspection profile should be set to certificate-inspection instead of deep-inspection for financial sites.

Answer

The SSL inspection profile must be applied after the web filter profile in the firewall policy.

Answer

The SSL inspection profile should have deep-inspection disabled for all categories except financial.

Question 2

An administrator is configuring web filtering on a FortiGate. Which TWO statements about web filtering profiles are correct?

Accepted Answer

Web filtering profiles can be used together with application control profiles.. Option A is correct because web filtering profiles and application control profiles operate independently at different layers of the FortiGate security fabric. Web filtering inspects HTTP/HTTPS traffic against URL categories and ratings, while application control identifies and controls application-level traffic (e.g., Facebook, Skype) using deep packet inspection. They can be applied together in a single security policy to provide layered protection without conflict.

Answer

Web filtering profiles can only be applied to users who are authenticated.

Answer

Web filtering profiles are applied globally by default.

Answer

Web filtering profiles are used to configure SSL certificate inspection.

Question 3

Refer to the exhibit. An administrator is troubleshooting why SSL inspection is not working for web traffic. The policy shown is the only policy matching the traffic. What is the most likely reason SSL inspection is failing?

Accepted Answer

The policy is missing the 'set inspection-mode proxy' command.. Option A is correct because the policy is missing the 'set inspection-mode proxy' command. FortiGate requires proxy-based inspection mode to perform SSL/TLS interception; flow-based inspection cannot decrypt or re-encrypt HTTPS traffic. Without this command, the policy defaults to flow-based mode, causing SSL inspection to fail even if the ssl-ssh-profile is set to deep-inspection.

Answer

The ssl-ssh-profile is set to 'deep-inspection' but the policy is using flow-based inspection.

Answer

The source interface is 'wan1' but the traffic is coming from 'internal'.

Answer

The policy has 'set action deny' instead of 'set action accept'.

Question 4

A company is deploying FortiGate for outbound web filtering. They want to block users from accessing social media sites during business hours, but still allow access to cloud-based productivity tools like Office 365. Which approach should the administrator use to meet this requirement?

Accepted Answer

Configure an application control profile with rules to block social media applications and allow Office 365 applications.. Application control is the correct approach because it can identify and control applications like social media and Office 365 based on their unique signatures, regardless of the ports or protocols they use. Unlike URL filtering or port blocking, application control can differentiate between Office 365 traffic and social media traffic even when both use HTTPS on TCP 443, allowing the administrator to block social media while permitting cloud productivity tools.

Answer

Create a firewall policy to block all traffic to ports commonly used by social media (e.g., TCP 443).

Answer

Use a web filter profile to block URLs containing 'facebook' or 'twitter'.

Answer

Implement a DNS filter to block DNS queries for social media domains.

Question 5

An administrator is configuring an IPS profile on FortiGate to detect and block SQL injection attacks. The profile must be applied to inbound traffic to a web server. Which TWO settings should the administrator enable to achieve this goal? (Choose two.)

Accepted Answer

Add the 'SQL.Injection' signature to the IPS sensor and set action to 'block'.. Option A is correct because SQL injection attacks are identified by specific IPS signatures, and adding 'SQL.Injection' to an IPS sensor with the action set to 'block' directly instructs FortiGate to detect and block those attacks. Option E is correct because an IPS sensor must be enabled within a firewall policy to apply its inspection to the traffic passing through that policy, ensuring the profile is active on inbound traffic to the web server.

Answer

Create a DoS policy to limit the number of connections per second.

Answer

Enable the HTTP protocol decoder in the application control profile.

Answer

Configure the IPS sensor to bypass traffic from trusted IP addresses.

Question 6

Refer to the exhibit. An administrator has created an IPS sensor with two entries. The first entry sets severity 'medium' and action 'block'. The second entry sets severity 'critical' and action 'block'. What will happen when a packet triggers an IPS signature with severity 'low'?

Accepted Answer

The packet will be allowed (pass).. The IPS sensor in the exhibit defines rules only for severity 'medium' and 'critical', both with action 'block'. When a packet triggers a signature with severity 'low', it does not match any entry in the sensor. Therefore, the default action for unmatched signatures is to allow (pass) the traffic. FortiGate IPS sensors apply actions only to explicitly configured severity levels; unlisted severities are not affected.

Answer

The packet will be logged and a session will be created.

Answer

The packet will be blocked if the signature severity is 'low' or 'high'.

Answer

The packet will be blocked because the sensor is enabled.

Question 7

Drag and drop the steps to configure IPsec VPN phase 1 settings on FortiGate into the correct order.

Question 8

Drag and drop the steps to capture traffic on a FortiGate interface using the CLI into the correct order.

Question 9

Drag and drop the steps to perform a factory reset on FortiGate via CLI into the correct order.

Question 10

Drag and drop the steps to configure a VLAN interface on FortiGate into the correct order.

Question 11

Match each FortiGate CLI command to its function.

Question 12

Match each Fortinet HA mode to its description.

Question 13

Match each FortiGate NAT type to its description.

Question 14

Match each FortiGate firewall policy action to its result.

Question 15

A network administrator notices that some users can access blocked web categories despite a web filter profile applied to the policy. The admin runs 'diagnose debug rating' and sees 'rating not allow' for the category. What is the MOST likely cause?

Accepted Answer

The web filter profile has an 'override' configured for those users. Option B is correct because the override feature can be used to grant users temporary access to blocked categories, bypassing the web filter rating.

Answer

The policy is not using the correct web filter profile

Answer

DNS filter is allowing the domain

Answer

The FortiGuard web filter database is outdated