NSE4 Security Profiles Practice Test 5 — 15 Questions

Question 1

An administrator needs to block outbound SMTP traffic that contains credit card numbers. The FortiGate is configured with a DLP profile, but the administrator notices that some emails are not being blocked. The emails are sent using TLS encryption. What should the administrator do to ensure DLP inspection works for these emails?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the DLP profile to use proxy-based inspection and enable SMTP inspection.. To inspect encrypted SMTP traffic for DLP, the FortiGate must decrypt the session. This requires proxy-based inspection with SMTP inspection enabled. Proxy-based inspection allows the FortiGate to act as a man-in-the-middle, decrypt TLS, and scan the email content for sensitive data like credit card numbers. Thus, configuring the DLP profile with proxy-based inspection and SMTP inspection is necessary.

Answer

Enable SSL deep inspection on the firewall policy that handles SMTP traffic.

Answer

Use a certificate-based authentication for SMTP.

Answer

Enable flow-based inspection and set the DLP profile to block.

Question 2

Which FortiGate feature allows you to block access to specific URL categories such as 'Social Media' or 'Gambling'?

Accepted Answer

Web Filtering. FortiGate's Web Filtering feature uses URL rating and category databases (e.g., FortiGuard) to block access to entire categories like 'Social Media' or 'Gambling' based on the destination URL. This is distinct from content inspection; it operates at the HTTP/HTTPS request level by matching the requested URL against predefined or custom category lists.

Answer

Antivirus

Answer

Intrusion Prevention System (IPS)

Answer

Application Control

Question 3

An administrator configured SSL inspection with 'deep-inspection' profile. Users report that some websites fail to load with certificate errors. The firewall policy is correct. What is the most likely reason?

Accepted Answer

The web server uses a cipher that the FortiGate cannot re-encrypt.. When deep-inspection is used, the FortiGate decrypts the client-to-server traffic, inspects the content, and then re-encrypts it before forwarding to the client. If the web server uses a cipher suite that the FortiGate does not support for re-encryption (e.g., an obsolete or non-standard cipher), the FortiGate cannot complete the SSL handshake with the client, causing certificate errors or connection failures. This is the most likely reason because the firewall policy is correct and the CA certificate is valid.

Answer

The CA certificate has expired.

Answer

The user's browser is outdated.

Answer

The firewall needs a policy to allow DNS traffic.

Question 4

When configuring SSL inspection, which type of inspection decrypts and inspects all HTTPS traffic including applications using non-standard ports?

Accepted Answer

Full SSL Inspection (Deep Inspection). Full SSL Inspection (Deep Inspection) is the correct answer because it performs a man-in-the-middle decryption and re-encryption of all HTTPS traffic, regardless of the port used. This allows the FortiGate to inspect the payload of encrypted sessions, including those on non-standard ports, for threats and policy violations.

Answer

SSL Offloading

Answer

Certificate Inspection

Answer

Flow-based Inspection

Question 5

After enabling SSL inspection, a user receives a warning 'The certificate is not trusted' in the browser. The administrator has installed the CA certificate on the client. What else could be the cause?

Accepted Answer

The CA certificate is not added to the browser's trusted root store.. Even though the administrator installed the CA certificate on the client, the browser uses its own trusted root store, which is separate from the operating system's certificate store. If the CA certificate is not specifically added to the browser's trusted root store (e.g., Chrome uses the system store but Firefox maintains its own), the browser will still flag the certificate as untrusted. This is a common misconfiguration when deploying SSL inspection with FortiGate.

Answer

The firewall policy denies the traffic.

Answer

The FortiGate is not decrypting the traffic.

Answer

The web server's certificate has expired.

Question 6

Which of the following is a prerequisite for SSL deep inspection to work correctly on FortiGate?

Accepted Answer

A firewall policy that has SSL inspection enabled.. SSL deep inspection requires a firewall policy with SSL inspection enabled to intercept and decrypt HTTPS traffic. Without such a policy, the FortiGate cannot apply the CA certificate to re-encrypt traffic for inspection, making deep inspection non-functional.

Answer

A dedicated HTTPS firewall policy.

Answer

The FortiGate must be operating in proxy mode.

Answer

An active FortiCare license.

Question 7

A user reports that a legitimate website is being blocked by FortiGate web filtering. The administrator checks and finds that the URL category is 'Unrated'. What is the most likely cause?

Accepted Answer

The website is new and not yet categorized by FortiGuard.. When a website is categorized as 'Unrated' in FortiGate web filtering, it means FortiGuard's web filtering database has not yet assigned a category to that URL. This commonly occurs for newly registered or recently launched websites that have not been crawled and classified by FortiGuard's rating infrastructure. The correct answer is B because the 'Unrated' status directly indicates the site is new and not yet categorized.

Answer

The DNS server is not resolving the domain.

Answer

The web filter is configured to block all unrated sites.

Answer

The website is in the 'Blocked' category.

Question 8

Which TWO actions can cause SSL inspection to fail with certificate errors on client browsers? (Choose two.)

Accepted Answer

The FortiGate's CA certificate has expired.. The FortiGate acts as a certificate authority (CA) for SSL inspection. If the FortiGate's CA certificate has expired, any server certificate it generates and signs for intercepted HTTPS sessions will be considered invalid by client browsers. Browsers will display a certificate error because the signing CA (the FortiGate) is no longer trusted due to expiration, even if the client has the CA certificate installed.

Answer

The firewall policy allows the traffic.

Answer

The web server's certificate is signed by a public CA.

Answer

The client browser has the FortiGate CA certificate installed.

Question 9

Which THREE steps are necessary when configuring SSL deep inspection on FortiGate? (Choose three.)

Accepted Answer

Create an SSL inspection profile defining the inspection mode.. An SSL inspection profile defines how FortiGate handles encrypted traffic, including the inspection mode (e.g., full or certificate-inspection). This profile is a mandatory component for deep inspection, as it specifies whether to decrypt, re-encrypt, or simply examine certificates.

Answer

Add a static route to the internet.

Answer

Configure a forward proxy server.

Question 10

Refer to the exhibit. A FortiGate SSL VPN user is unable to connect. The debug output shows the above error. What is the most likely cause?

Accepted Answer

The CA that issued the SSL VPN certificate is not trusted by the client.. The debug output indicates an SSL/TLS handshake failure, specifically that the client does not trust the server's certificate. This occurs when the Certificate Authority (CA) that issued the SSL VPN certificate is not in the client's trusted root store. Option B correctly identifies this as the most likely cause because the error is a certificate trust issue, not an expiration or authentication problem.

Answer

The SSL VPN certificate has expired.

Answer

The user's password is incorrect.

Answer

The firewall policy is blocking the SSL VPN port.

Question 11

A company with 500 employees uses FortiGate as their internet gateway. They recently enabled SSL deep inspection using the built-in CA certificate. After deployment, many users report that they cannot access their online banking websites. The error message in the browser says 'The certificate is not trusted'. The administrator has already pushed the FortiGate CA certificate to all domain-joined computers via Group Policy. However, the problem persists for banking sites. The administrator also notices that banking sites load fine on mobile devices that do not have the CA certificate installed. What is the most likely cause and solution?

Accepted Answer

Banking websites use certificate pinning. Exempt them from deep inspection using an SSL inspection exemption list.. Banking websites often use HTTP Public Key Pinning (HPKP) or certificate pinning, where the browser expects a specific certificate or public key from the server. When FortiGate performs SSL deep inspection, it re-signs the server's certificate with its own CA, breaking the pinning validation. This causes the 'certificate not trusted' error even when the FortiGate CA is trusted, because the browser detects that the presented certificate does not match the pinned certificate. The correct solution is to exempt banking sites from deep inspection using an SSL inspection exemption list, allowing the original server certificate to pass through.

Answer

Disable SSL inspection entirely to avoid certificate issues.

Answer

The CA certificate is not properly installed on all computers. Re-deploy via Group Policy.

Answer

Use certificate inspection instead of deep inspection for all traffic.

Question 12

A network administrator notices that an IPS sensor is generating excessive false positives for a specific signature. The administrator wants to exclude traffic from a trusted internal server (IP 10.1.1.100) from inspection for that signature only, while keeping other signatures active. Which configuration change should the administrator apply?

Accepted Answer

Create an IPS filter that excludes the server's source IP address from the signature.. An IPS filter allows the administrator to define a rule that excludes traffic from a specific source IP address (10.1.1.100) from inspection for a particular signature, while leaving all other signatures active. This granular approach ensures that false positives for that signature are reduced without disabling the signature entirely or affecting other traffic.

Answer

Set the signature action to 'pass' and use an application control profile to bypass the server.

Answer

Disable the signature in the IPS sensor configuration.

Answer

Add the server's IP to the exempt list in the IPS sensor.

Question 13

A company wants to block all peer-to-peer file sharing applications on the network. Which FortiGate feature should be used to achieve this goal?

Accepted Answer

Application Control. Application Control is the correct feature because it is specifically designed to identify and block peer-to-peer (P2P) file-sharing applications by inspecting traffic patterns and signatures, regardless of the port or protocol used. Unlike port-based blocking, Application Control uses deep packet inspection (DPI) to recognize P2P protocols such as BitTorrent, eDonkey, and Gnutella, even when they attempt to evade detection by using non-standard ports or encryption.

Answer

Web Filter

Answer

DNS Filter

Answer

Intrusion Prevention System (IPS)

Question 14

A company recently deployed FortiGate with application control to manage cloud application usage. They want to allow Google Drive for business but block personal Google accounts. Which application control configuration approach is most effective?

Accepted Answer

Use application control with specific signatures for 'Google Drive Business' and 'Google Drive Personal' and apply appropriate actions.. FortiGate's application control uses application signatures to distinguish between different versions of the same application, such as 'Google Drive Business' and 'Google Drive Personal'. By configuring specific signatures with appropriate actions (allow for business, block for personal), you can enforce granular control over cloud application usage without affecting legitimate business traffic.

Answer

Use web filtering to block the URL of personal Google Drive.

Answer

Configure IPS to block personal Google Drive traffic.

Answer

Create a rule to block all Google Drive applications.

Question 15

An administrator needs to ensure that IPS signatures are updated automatically on the FortiGate. Which configuration should be verified?

Accepted Answer

The FortiGuard service is enabled and the signature update schedule is configured.. Automatic IPS signature updates require the FortiGuard service to be enabled and a signature update schedule to be configured. Without a schedule, updates occur only manually; without the service enabled, the FortiGate cannot connect to FortiGuard distribution servers to retrieve new signatures.

Answer

The IPS engine is upgraded to the latest version.

Answer

The intrusion prevention profile is applied to the firewall policy.

Answer

The application control profile is set to 'monitor' for all applications.