NSE4 Security Profiles Practice Test 4 — 15 Questions

Question 1

What is the purpose of the 'safe search' option in a FortiGate web filter profile?

Accepted Answer

It enforces Google SafeSearch, Bing SafeSearch, and YouTube Restricted Mode on supported search engines.. The 'safe search' option in a FortiGate web filter profile enforces SafeSearch on supported search engines — it forces Google SafeSearch, Bing SafeSearch, and YouTube Restricted Mode so that explicit content is filtered from search results. This is applied by rewriting or redirecting search queries to the safe-search-enabled versions of those engines.

Answer

It logs all search queries made by users.

Answer

It blocks access to all search engines except Google.

Answer

It redirects search queries to a secure HTTPS connection.

Question 2

A FortiGate administrator configures an IPS sensor with a signature that has a 'pass' action. The sensor is applied to a firewall policy. When traffic matches this signature, what will happen?

Accepted Answer

The traffic is allowed but a log message is generated.. When an IPS signature with a 'pass' action is matched, the firewall allows the traffic to proceed normally, but a log message is generated to record the event. This is because the 'pass' action explicitly permits the traffic while still enabling logging if the signature is configured with logging enabled. In FortiGate, the 'pass' action overrides the default block behavior of IPS, ensuring the session continues without interruption.

Answer

The traffic is allowed without any logging.

Answer

The traffic is reset and a log is generated.

Answer

The traffic is blocked and logged.

Question 3

An organization wants to implement data leak prevention (DLP) to detect when credit card numbers are sent via email (SMTP) and webmail (HTTPS). The FortiGate is using proxy-based inspection. Which THREE configurations are necessary? (Choose three.)

Accepted Answer

Create a DLP sensor with a rule to match credit card patterns.. Option C is correct because a DLP sensor must be created with a rule that matches credit card number patterns (e.g., using a predefined or custom data pattern/regex) so the FortiGate can identify the sensitive data. Option D is correct because the DLP sensor only takes effect when it is applied to a firewall policy that processes the SMTP and HTTPS traffic, enabling inspection of those sessions. Option E is correct because HTTPS/webmail traffic is encrypted, so SSL/TLS deep inspection must be enabled on the firewall policy to decrypt and inspect the content for credit card numbers. Option A is incorrect because proxy-based inspection is required for DLP, and switching to flow-based inspection would not support the needed DLP inspection. Option B is incorrect because an antivirus profile scanning email attachments does not detect credit card numbers in email or webmail content; DLP, not antivirus, handles data pattern matching.

Answer

Set the inspection mode to flow-based for better performance.

Answer

Configure the antivirus profile to scan email attachments.

Question 4

What is the difference between 'certificate inspection' and 'full SSL deep inspection' on a FortiGate?

Accepted Answer

Certificate inspection only validates the server certificate, while deep inspection decrypts and inspects the entire TLS session content.. Certificate inspection only validates the server certificate's authenticity (e.g., checking the certificate chain, expiration, and revocation status) without decrypting the actual TLS session. In contrast, full SSL deep inspection performs a man-in-the-middle decryption by re-encrypting traffic with a FortiGate-generated certificate, allowing the firewall to inspect the entire payload for threats like malware or data leakage. This distinction is critical for understanding how FortiGate applies security profiles to encrypted traffic.

Answer

Certificate inspection decrypts the traffic but does not check the certificate.

Answer

Deep inspection is less secure than certificate inspection.

Answer

Both methods provide the same level of inspection.

Question 5

A FortiGate administrator wants to create a web filter profile that blocks access to social networking sites during work hours but allows them during lunch breaks. Additionally, the administrator wants to ensure that HTTPS social networking sites are blocked. Which TWO configurations are required? (Choose two.)

Accepted Answer

Apply the web filter profile to a firewall policy that uses a schedule for work hours.. Option B is correct because a web filter profile only takes effect when it is referenced by a firewall policy, and the firewall policy's schedule is what actually enforces the work-hours versus lunch-break timing for the traffic being filtered. Option C is correct because HTTPS traffic is encrypted, so the FortiGate cannot inspect the URL or FortiGuard category of an HTTPS social networking site unless SSL deep inspection is enabled to decrypt the traffic (with the FortiGate CA certificate installed on clients). Option A is not required because the time-based enforcement is achieved through the firewall policy schedule, not by setting a schedule inside the web filter profile itself. Option D is not needed because a FortiGuard category filter already covers social networking sites without manually listing each URL. Option E is incorrect because a DNS filter blocks domain resolution and does not provide the category-based, schedule-driven HTTPS inspection required here.

Answer

Create a web filter profile with a FortiGuard category filter that blocks the 'Social Networking' category and set a time-based schedule.

Answer

Use a URL filter to manually list all social networking sites.

Answer

Configure DNS filter to block social networking domains.

Question 6

An administrator configures an IPS sensor with a signature that is triggered by traffic to a specific server. The signature is set to 'Block' but the traffic is not being blocked. The administrator verifies that the IPS sensor is applied to the correct firewall policy and that the signature is enabled. Which TWO additional checks should the administrator perform? (Choose two.)

Accepted Answer

Verify that the signature's 'Action' is not overridden by a higher-priority rule in the IPS sensor.

Answer

Ensure that the antivirus profile is not interfering with IPS.

Answer

Check if the destination server is in the 'Local-in' policy, which may bypass IPS.

Answer

Confirm that the signature has a valid CVE ID.

Question 7

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. FortiGate cannot inspect encrypted HTTPS traffic without SSL/TLS deep inspection enabled. Even if antivirus is enabled on the policy, the traffic remains encrypted, so the antivirus engine cannot scan the payload. Enabling deep inspection allows FortiGate to decrypt, scan, and re-encrypt the traffic.

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The FortiGuard antivirus subscription has expired

Question 8

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session has been active for 1 hour and will expire in about 1 hour. The output shows `duration=3600` (seconds), meaning the session has been active for 1 hour, and `expire=3599` (seconds), meaning the session will expire in about 1 hour (3600 seconds minus 1 second already elapsed). The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to an established TCP session. Therefore, option A is correct.

Answer

The session is blocked by the firewall

Answer

The session is using UDP protocol

Answer

The session is in a half-open state

Question 9

A network admin is configuring a security policy for outbound HTTP traffic. The requirements are: (1) block access to known malicious websites, (2) prevent users from downloading executable files, (3) detect and block C2 traffic. Which THREE security profiles should be applied to the policy?

Accepted Answer

Antivirus. Option B (Web Filtering) is correct because it enforces URL/category-based policies that block access to known malicious or otherwise disallowed websites, satisfying requirement 1. Option A (Antivirus) is correct because it scans HTTP downloads and blocks malicious or unwanted executable files, satisfying requirement 2. Option D (IPS) is correct because it inspects traffic for known attack signatures and command-and-control (C2) patterns, detecting and blocking C2 traffic per requirement 3. Option C (Application Control) is not needed here since the requirements target web content, file downloads, and C2 detection rather than identifying or limiting specific applications. Option E (DNS Filter) is not required because the policy is for outbound HTTP traffic inspection, not DNS-layer filtering.

Answer

Application Control

Answer

DNS Filter

Question 10

A FortiGate admin is troubleshooting email filtering. Legitimate emails from a specific external domain are being marked as spam. Which THREE steps should the admin take to resolve this?

Accepted Answer

Check the spam filter logs to see why the email was flagged. Option A is correct because the FortiGate spam filter logs (under Log & Report > Email Filter, or via the antispam log entries) record the exact FortiGuard spam signature or DNSBL/RBL hit that caused the message to be classified as spam, which is the essential first diagnostic step. Option C is correct because adding the legitimate sender domain to the email filter allowlist (an antispam profile entry with the sender pattern set to 'Clear' or an allowlist entry in the email filter) ensures future messages from that domain bypass the spam scanning action. Option E is correct because FortiGuard maintains the antispam signature and IP/domain reputation database, so verifying the sender domain's reputation on FortiGuard confirms whether the false positive originates from an outdated or misclassified FortiGuard rating that may need a re-evaluation request. Option B is wrong because disabling the spam filter entirely removes all protection and is not a targeted remediation. Option D is wrong because deep inspection for SMTP traffic is unrelated to spam classification; it is used for SSL/TLS inspection of encrypted sessions, not for resolving antispam false positives.

Answer

Disable the spam filter entirely

Answer

Enable deep inspection for SMTP traffic

Question 11

An administrator is configuring a web filter profile on a FortiGate to block access to specific websites based on their content. The administrator wants to ensure that the web filter can inspect HTTPS traffic and enforce categories for both HTTP and HTTPS. Which two actions must be taken to achieve this? (Choose two.)

Accepted Answer

Apply a certificate for SSL inspection to the firewall policy.. To inspect HTTPS traffic and enforce web filter categories, the firewall policy must have SSL inspection enabled, which requires a deep-inspection profile and an SSL inspection certificate. The certificate is used to re-sign the traffic so the FortiGate can decrypt and inspect it. Without both, HTTPS traffic cannot be fully inspected, and category enforcement may be limited to SNI-based filtering.

Answer

Configure the web filter profile to use the 'deep-inspection' mode.

Answer

Enable 'https' in the web filter profile's protocol settings.

Answer

Set the web filter profile to block categories that are not explicitly allowed.

Question 12

A network administrator wants to prevent users from downloading files that contain malware from the Internet. The administrator configures antivirus scanning on the FortiGate. Users complain that some files are still being downloaded and executed on their computers without being blocked, even though the files are known malware. What is the most likely reason the antivirus profile is not blocking these files?

Accepted Answer

The antivirus profile is configured to monitor instead of block.. The correct answer is that the antivirus profile is configured to monitor instead of block. In monitor mode, the FortiGate logs the detection but allows the file to pass. This is often used for testing. To block malware, the action must be set to block. Administrators should verify the profile action and ensure it is applied to the correct firewall policy.

Answer

The files are being downloaded over HTTPS and SSL inspection is not enabled.

Answer

The FortiGate's antivirus signature database is out of date.

Answer

The antivirus profile does not support scanning of the protocol used for the download.

Question 13

An administrator configures a new antivirus profile on a FortiGate to scan outbound HTTPS traffic. After applying the profile to a firewall policy, users report that large file downloads are extremely slow and some downloads fail. The administrator checks the profile and sees that the default settings are used. Which action should the administrator take to improve performance while maintaining malware protection?

Accepted Answer

Configure the antivirus profile to use 'Flow-based' inspection and enable 'Scan with FortiSandbox' only for suspicious files.. Flow-based antivirus inspection on FortiGate processes files in a streaming fashion, which is much faster than proxy-based inspection for large downloads. By enabling FortiSandbox only for suspicious files, the FortiGate avoids sending every file to sandbox, reducing overhead. This combination maintains robust malware protection while alleviating the performance degradation experienced by users.

Answer

Disable 'Scan with FortiSandbox' and enable 'Block Malicious URLs'.

Answer

Set 'Inspect Content' to 'Flow-based' and enable 'Allow Session Pickup'.

Answer

Enable 'Treat Windows Executables in Email' and set 'Inspect Content' to 'Proxy'.

Question 14

An administrator configures an antivirus profile with the 'block' action for HTTP and applies it to a firewall policy. Users report that when they download a file containing a virus, the download is blocked, but they can still access the file if they rename it with a different extension. Which antivirus inspection mode should the administrator enable to prevent this bypass?

Accepted Answer

Content disarm and reconstruction (CDR). Content disarm and reconstruction (CDR) sanitizes files by removing active content, so even if a user renames a malicious file, the reconstructed file is harmless. This prevents the bypass because detection no longer depends on file extension or signature. CDR is an antivirus feature that can be enabled in the profile to ensure files are safe regardless of naming.

Answer

FortiSandbox inline inspection

Answer

Proxy-based inspection

Answer

Flow-based inspection

Question 15

An administrator wants to prevent users from accessing known malicious websites while allowing access to all other sites. The FortiGate is already configured with a web filter profile that uses FortiGuard categories. Which configuration change is required to achieve this?

Accepted Answer

Set the action for the 'Malicious Websites' category to 'Block' and set all other categories to 'Allow'.. FortiGuard web filtering categorizes websites, and the 'Malicious Websites' category specifically lists sites known for malware or phishing. To block only these, the action for that category must be 'Block', and all other categories should be explicitly set to 'Allow' to prevent unintended restrictions from default actions. This ensures users can access legitimate sites while being protected from malicious ones.

Answer

Enable 'Block Invalid URLs' and set the 'Malicious Websites' category to 'Allow'.

Answer

Set the action for the 'Malicious Websites' category to 'Monitor' and set all other categories to 'Block'.

Answer

Set the action for the 'Malicious Websites' category to 'Block' and leave all other categories at their default actions.