NSE4 Security Profiles Practice Test 4 — 15 Questions

Question 1

Match each FortiGate CLI command to its function.

Accepted Answer

get system status: Displays system information such as firmware version, uptime, and serial number.. Common FortiGate CLI commands: 'get system status' shows system info, 'diagnose debug application' enables debugging, 'execute ping' tests connectivity, and 'show full-configuration' displays the config. The distractors confuse these functions.

Answer

get system status: Enables debugging for a specific application.

Answer

execute ping: Displays the entire running configuration.

Question 2

Match each Fortinet HA mode to its description.

Accepted Answer

Active-Passive HA: One FortiGate handles traffic while the other is on standby.. Common FortiGate HA modes: Active-Passive (primary/standby) and Active-Active (both active). Distractors swap the definitions.

Answer

Active-Passive HA: Both FortiGates handle traffic simultaneously.

Answer

Active-Active HA: One FortiGate handles traffic while the other is on standby.

Question 3

Match each FortiGate NAT type to its description.

Accepted Answer

Source NAT: Translates source IP addresses of packets originating from a private network.. Source NAT modifies source IP of outgoing packets; Destination NAT modifies destination IP of incoming packets; Static NAT provides one-to-one mapping; PAT enables many-to-one translation via ports. Distractors swap the descriptions of Source and Destination NAT.

Answer

Source NAT: Translates destination IP addresses of incoming packets.

Answer

Destination NAT: Translates source IP addresses of outgoing packets.

Question 4

Match each FortiGate firewall policy action to its result.

Accepted Answer

ACCEPT: Allows traffic that matches the policy. The correct matches are ACCEPT for allowing traffic and DENY for silently dropping traffic. Common confusions include mixing ACCEPT with REJECT (which sends a reset) and assuming DENY logs traffic.

Answer

ACCEPT: Drops traffic and sends a TCP reset

Answer

DENY: Allows traffic and logs it

Question 5

What is the primary purpose of FortiSandbox integration with FortiGate antivirus?

Accepted Answer

To detect zero-day malware by analyzing file behavior in a sandbox environment. FortiSandbox integration with FortiGate antivirus is designed to detect zero-day malware by analyzing file behavior in a sandbox environment. This allows FortiGate to forward suspicious files that evade signature-based detection to FortiSandbox for dynamic analysis, where behavioral patterns are examined to identify unknown threats. The integration enhances the existing antivirus engine rather than replacing it, providing a layered defense against advanced persistent threats.

Answer

To replace the local antivirus scanning engine

Answer

To perform SSL deep inspection

Answer

To cache antivirus signatures locally

Question 6

An administrator configures an IPS profile to block SQL injection attacks. However, SQL injection traffic is still passing through the FortiGate. The administrator confirms the IPS profile is applied to the correct policy. What is the most likely reason?

Accepted Answer

IPS signatures for SQL injection are disabled in the profile. IPS profiles in FortiGate consist of a set of IPS signatures that can be individually enabled or disabled. If the administrator configured an IPS profile to block SQL injection attacks but the specific SQL injection signatures are disabled within that profile, the FortiGate will not inspect or block that traffic, even if the profile is correctly applied to the policy.

Answer

The firewall policy is in proxy-based mode

Answer

The IPS profile is configured for anomaly detection only

Answer

Deep inspection is required for IPS to work

Question 7

A FortiGate administrator wants to block outgoing DNS requests to known malware domains. Which security profile should be used?

Accepted Answer

DNS filter. DNS Filter is the correct security profile because it is specifically designed to inspect and block DNS queries based on domain names, IP addresses, or categories. By configuring a DNS filter policy with a custom list of known malware domains, the FortiGate can intercept outgoing DNS requests and drop those matching the malicious entries, preventing the resolution of malware domains.

Answer

Application control

Answer

Web filter

Answer

IPS

Question 8

An administrator is configuring email filtering on FortiGate to block spam. Which of the following is required for FortiGate to filter inbound email directly?

Accepted Answer

The FortiGate must be configured as an SMTP proxy. FortiGate can filter inbound email directly only when it is configured as an SMTP proxy, which allows it to intercept and inspect SMTP traffic at the application layer. This proxy mode enables the FortiGate to apply email filtering profiles, including anti-spam and antivirus, to SMTP sessions without requiring a separate appliance.

Answer

FortiMail must be deployed as a separate appliance

Answer

SSL deep inspection must be enabled for SMTP traffic

Answer

The email filtering profile must be applied to a policy covering port 110

Question 9

A FortiGate administrator runs the command 'diagnose application urlfilter 0 status' and sees 'status: enable' but users report that some malicious URLs are not blocked. The web filter profile uses FortiGuard categories with 'block' action. What should the administrator check next?

Accepted Answer

The FortiGuard web filter rating service is reachable. The 'diagnose application urlfilter 0 status' command shows that the URL filter process is enabled locally, but if the FortiGate cannot reach the FortiGuard rating service, it cannot retrieve category ratings for URLs. Without a valid rating, the device may allow malicious URLs by default (depending on the 'unrated' action), even if the profile is set to block certain categories. Option B is correct because checking the reachability of the FortiGuard web filter rating service is the logical next step to diagnose why categories are not being enforced.

Answer

The antivirus profile is blocking URL filtering

Answer

The DNS filter is overriding the web filter

Answer

The firewall policy is set to 'accept' without inspection

Question 10

An administrator wants to apply a safe search policy to enforce strict search results on Google, Bing, and Yahoo. Which security profile feature should be used?

Accepted Answer

Web filter safe search enforcement. Web filter safe search enforcement is the correct feature because it directly integrates with search engines (Google, Bing, Yahoo) to force the use of their built-in safe search parameters (e.g., Google's 'safe=active' parameter appended to URLs). This ensures that explicit content is filtered at the source, regardless of the user's browser settings or search engine choice.

Answer

Application control to block search engines

Answer

DNS filter to block search engine domains

Answer

Web filter URL filter with keyword blocking

Question 11

A network administrator configures an application control profile to block social media applications. Users can still access Facebook through a web browser. What is the MOST likely reason?

Accepted Answer

Application control is not enabled for HTTPS traffic without deep inspection. Application control relies on deep inspection (SSL/TLS decryption) to identify applications within encrypted HTTPS traffic. Without deep inspection enabled, the FortiGate can only see the encrypted tunnel and cannot inspect the payload to determine that the traffic is Facebook, even if the application control profile is correctly applied. Option B is correct because HTTPS traffic must be decrypted via deep inspection for application control to function.

Answer

The application signatures are outdated

Answer

The firewall policy is in proxy-based mode

Answer

The application control profile is not applied to the correct policy

Question 12

An administrator needs to block users from uploading files containing credit card numbers to external websites. Which TWO actions must be configured? (Choose two.)

Accepted Answer

Enable SSL deep inspection on the firewall policy. SSL deep inspection is required to decrypt HTTPS traffic so the firewall can inspect the content of encrypted uploads for sensitive data like credit card numbers. Without decryption, the DLP profile cannot see the payload of encrypted sessions, rendering the DLP sensor ineffective.

Answer

Apply an antivirus profile to the policy

Answer

Configure application control to block file transfer applications

Answer

Use a web filter to block all upload websites

Question 13

A FortiGate is configured with an IPS profile to detect and block anomalous network behavior. Which THREE types of detection does IPS anomaly detection include? (Choose three.)

Accepted Answer

Port scan detection. Port scan detection is a type of anomaly detection in FortiGate's IPS profile that identifies reconnaissance attempts by monitoring for multiple connection attempts to different ports from a single source. This behavior deviates from normal traffic patterns and is flagged as anomalous, allowing the IPS to block potential scanning activity before an attack progresses.

Answer

Protocol decoding

Answer

Signature-based detection

Question 14

An administrator wants to ensure that all DNS traffic from internal users is filtered by the FortiGate to block malicious domains. Which TWO configurations are necessary? (Choose two.)

Accepted Answer

Apply the DNS filter profile to a firewall policy that matches DNS traffic. A DNS filter profile must be applied to a firewall policy that matches DNS traffic for the filtering to take effect. Without this policy-level binding, the DNS filter profile is not enforced, even if it is configured. This ensures that all DNS queries from internal users are inspected by the FortiGate.

Answer

Set DNS server to FortiGate's IP

Answer

Enable sinkhole on the DNS filter profile

Answer

Configure SSL deep inspection for DNS over HTTPS

Question 15

A network administrator wants to allow employees to access a specific web application but block all other application traffic. The administrator creates a firewall policy with an application control profile that allows the desired application. However, employees can still access other applications. What is the MOST likely reason?

Accepted Answer

The application control profile is set to 'Monitor All' rather than 'Block All'. If the application control profile is set to 'Monitor All', it only logs or monitors traffic without actively blocking any applications. To block all other applications except the desired one, the profile must be configured with a default action of 'Block All' and then explicitly allow the specific application. The 'Monitor All' setting is often used for initial observation and does not enforce blocking, which explains why employees can still access other applications.

Answer

The application control profile is applied to the wrong firewall policy

Answer

The firewall policy has SSL inspection disabled

Answer

The application signatures are outdated