NSE4 Security Profiles Practice Test 5 — 15 Questions

Question 1

An administrator runs the CLI command: 'diagnose sys session list | grep -i dns' and sees sessions with dst port 53. The administrator has configured a DNS filter profile on the firewall policy. However, DNS requests are not being filtered. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS filtering requires proxy-based inspection mode on the policy. DNS filtering on FortiGate requires proxy-based inspection mode because it needs to reassemble and inspect the full DNS transaction (request and response) to apply filtering rules. Flow-based inspection only examines individual packets and cannot perform the deep application-layer analysis needed for DNS filtering. Therefore, even if the DNS filter profile is correctly applied to the policy, it will not work unless the policy's inspection mode is set to proxy-based.

Answer

The DNS filter profile is applied to the wrong policy direction

Answer

The DNS filter profile has no rules defined

Answer

The FortiGate is in transparent mode

Question 2

Which of the following security profiles is used to prevent malicious files from being downloaded via HTTP, FTP, or email by inspecting the content of the traffic?

Accepted Answer

Antivirus. Antivirus (option A) is the correct security profile because it performs deep content inspection of files transferred via HTTP, FTP, or email protocols. It uses signature-based detection and heuristics to identify and block malicious files (e.g., executables, scripts, or archives) before they reach the user, directly preventing malware downloads.

Answer

Application Control

Answer

Web Filter

Answer

Intrusion Prevention System (IPS)

Question 3

An administrator wants to prevent employees from uploading sensitive credit card numbers via web forms. Which security profile feature is MOST appropriate to achieve this?

Accepted Answer

Data Leak Prevention (DLP) with a credit card number sensor. Data Leak Prevention (DLP) with a credit card number sensor is the most appropriate feature because it uses pattern matching (e.g., Luhn algorithm) to detect and block sensitive credit card numbers in HTTP POST requests, preventing data exfiltration via web forms. Unlike other security profiles, DLP is specifically designed to inspect content for sensitive data patterns and enforce policy actions such as blocking or logging.

Answer

Antivirus with FortiSandbox integration

Answer

Web Filter to block all upload sites

Answer

Application Control to block web forms

Question 4

What is the PRIMARY purpose of enabling 'Safe Search' in a web filter profile?

Accepted Answer

To enforce safe search settings on supported search engines like Google and Bing. Safe Search enforces the safe search feature of popular search engines (e.g., Google, Bing) to filter explicit content from search results. It does not block search engines or HTTPS.

Answer

To block all search engines

Answer

To prevent users from using HTTPS search engines

Answer

To log all search queries

Question 5

Which of the following best describes the difference between flow-based and proxy-based inspection for antivirus scanning?

Accepted Answer

Flow-based inspection uses pattern matching and anomaly detection with low latency, while proxy-based provides full content reassembly and higher detection rates. Flow-based inspection uses pattern matching and anomaly detection to scan traffic with low latency, while proxy-based inspection fully reassembles files and content, enabling deeper analysis and higher detection rates. In Fortinet's FortiOS, flow-based mode is optimized for performance, whereas proxy-based mode provides more thorough inspection by buffering and reconstructing the entire data stream before scanning.

Answer

Flow-based inspection reassembles the entire file before scanning, while proxy-based scans packets on the fly

Answer

Flow-based inspection scans first packet and allows, while proxy-based buffers the entire session

Answer

Flow-based inspection requires SSL deep inspection, while proxy-based does not

Question 6

Which FortiGate security feature can be used to block outgoing emails that contain specific keywords, such as confidential information?

Accepted Answer

Email Filter. Email Filter is the correct answer because it is the FortiGate security profile specifically designed to inspect SMTP, POP3, and IMAP traffic for content violations. It can block outgoing emails based on keyword patterns, such as 'confidential', by matching against defined filter rules in the email filter profile, which operates at the application layer.

Answer

Web Filter

Answer

Application Control

Answer

Antivirus

Question 7

An administrator wants to integrate FortiSandbox with a FortiGate to analyze suspicious files. Which security profile must be configured to send files to FortiSandbox?

Accepted Answer

Antivirus profile with FortiSandbox enabled. FortiSandbox integration with FortiGate requires the Antivirus profile to be configured with FortiSandbox enabled. This is because FortiSandbox is designed to analyze suspicious files that are typically detected by the antivirus engine, and the Antivirus profile is the only security profile that can forward files to FortiSandbox for advanced threat detection. The Antivirus profile uses the 'fortisandbox' option under 'scan-mode' to send files that cannot be conclusively determined as clean or malicious.

Answer

Application Control profile with FortiSandbox enabled

Answer

IPS profile with FortiSandbox enabled

Answer

Web Filter profile with FortiSandbox enabled

Question 8

An administrator wants to block all peer-to-peer (P2P) file sharing applications such as BitTorrent and eMule on the network. Which THREE steps should the administrator take?

Accepted Answer

Enable deep inspection on the firewall policy to detect encrypted P2P traffic. Enabling deep inspection on the firewall policy allows the FortiGate to decrypt and inspect encrypted P2P traffic, such as BitTorrent or eMule using TLS/SSL. Without deep inspection, the firewall cannot see inside encrypted packets to identify P2P signatures, making application control ineffective for encrypted flows.

Answer

Configure a web filter profile to block P2P websites

Answer

Enable antivirus to block P2P protocols

Question 9

Which TWO types of inspection can be used for HTTPS traffic in a FortiGate security policy?

Accepted Answer

Deep inspection. FortiGate security policies can inspect HTTPS traffic using either deep inspection or certificate inspection. Deep inspection decrypts the SSL/TLS session, inspects the full payload for threats like malware or data leakage, and re-encrypts the traffic, while certificate inspection only validates the server certificate without decrypting the content, checking for certificate validity and revocation.

Answer

Full inspection

Answer

Flow-based inspection

Answer

Proxy-based inspection

Question 10

A network administrator notices that users can access websites categorized as 'Pornography' despite a web filter profile blocking that category. The firewall policy uses the web filter profile and is applied to the users' traffic. What is the MOST likely cause?

Accepted Answer

The FortiGate cannot reach the FortiGuard servers. The most likely cause is that the FortiGate cannot reach the FortiGuard servers. Web filter profiles rely on FortiGuard's cloud-based URL categorization to block categories like 'Pornography'. If the FortiGate loses connectivity to the FortiGuard servers (e.g., due to firewall rules, DNS issues, or proxy settings), it cannot retrieve the category rating for requested URLs, and the default action (often 'allow' if not explicitly set to block) will permit the traffic.

Answer

The web filter profile is applied to the wrong policy

Answer

The users are bypassing the FortiGate using a proxy

Answer

The web filter profile has the 'Override' feature enabled

Question 11

You run the following CLI command on a FortiGate:
diagnose sys session filter dport 443
diagnose sys session list
The output shows many sessions with 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate about the traffic?

Accepted Answer

The sessions are in the SYN_SENT state and have not completed the three-way handshake. The proto=6 indicates TCP, and proto_state=01 indicates a TCP session in the SYN_SENT state (i.e., the three-way handshake is not complete). The long duration suggests these are half-open sessions, possibly indicating a SYN flood attack.

Answer

The sessions are fully established and idle

Answer

The sessions are for UDP traffic

Answer

The sessions are being inspected by SSL deep inspection

Question 12

A FortiGate administrator wants to block all traffic to websites that are categorized as 'Malware' and 'Phishing'. Which security profile should be configured to achieve this goal?

Accepted Answer

Web Filter profile. Web Filter profiles use FortiGuard categories to block access to malicious websites, such as those categorized as 'Malware' and 'Phishing'. DNS Filter profiles block domains based on DNS queries but do not directly block by web category on FortiGate.

Answer

DNS Filter profile

Answer

IPS profile

Answer

Application Control profile

Question 13

An organization uses FortiSandbox to detect advanced threats. The administrator wants to ensure that files downloaded from the internet are sent to FortiSandbox for analysis before being delivered to users. Which Antivirus profile setting should be configured?

Accepted Answer

Enable 'Inline Scan' for FortiSandbox. To ensure files downloaded from the internet are sent to FortiSandbox for analysis before delivery to users, the 'Inline Scan' option for FortiSandbox must be enabled in the Antivirus profile. This setting causes the FortiGate to hold the file, send it to FortiSandbox, and only deliver it to the user after receiving a verdict (e.g., clean or malicious). Without inline scanning, files are delivered first and scanned asynchronously, which defeats the 'before delivery' requirement.

Answer

Enable 'FortiSandbox Monitoring'

Answer

Enable 'FortiSandbox Quarantine'

Answer

Set 'Scan Mode' to 'Quick'

Question 14

A FortiGate is configured with an SSL deep inspection profile that uses 'Certificate Inspection' (not 'Full SSL Inspection'). Which of the following is TRUE about this configuration?

Accepted Answer

The FortiGate can block HTTPS connections based on the certificate's CN. Certificate Inspection only examines the SSL/TLS certificate presented during the handshake, without decrypting the traffic. Because the FortiGate can read the certificate's Common Name (CN) or Subject Alternative Name (SAN), it can block HTTPS connections based on that information, such as by using a URL filter or application control rule that matches the certificate's CN. This is the only deep inspection action possible without full decryption.

Answer

Deep inspection can still see client certificates

Answer

The antivirus profile can scan the HTTPS payload

Answer

IPS can still inspect the application layer of HTTPS traffic

Question 15

An administrator wants to block the use of social media applications like Facebook and Twitter on the company network. Which security profile should be used?

Accepted Answer

Application Control profile. The Application Control profile is designed to identify and block specific applications, including social media platforms like Facebook and Twitter, regardless of the port or protocol they use. Unlike web filtering, which relies on URL categorization, application control inspects traffic patterns and signatures to enforce granular policies on application usage.

Answer

DNS Filter profile

Answer

Web Filter profile

Answer

IPS profile