NSE4 Security Profiles Practice Test 6 — 15 Questions

Question 1

An administrator runs the CLI command: 'diagnose sys session list | grep -i dns' and sees sessions with dst port 53. The administrator has configured a DNS filter profile on the firewall policy. However, DNS requests are not being filtered. What is the MOST likely cause?

Accepted Answer

DNS filtering requires proxy-based inspection mode on the policy. DNS filtering in FortiOS requires proxy-based inspection mode. If the policy is set to flow-based, DNS filtering will not work. The administrator should change the inspection mode to proxy.

Answer

The DNS filter profile is applied to the wrong policy direction

Answer

The DNS filter profile has no rules defined

Answer

The FortiGate is in transparent mode

Question 2

Which of the following security profiles is used to prevent malicious files from being downloaded via HTTP, FTP, or email by inspecting the content of the traffic?

Accepted Answer

Antivirus. Antivirus profiles scan files transferred over HTTP, FTP, and email for malware. Web filter controls URL access, application control identifies applications, and IPS detects network-based attacks.

Answer

Application Control

Answer

Web Filter

Answer

Intrusion Prevention System (IPS)

Question 3

A FortiGate administrator is troubleshooting an issue where users cannot access a legitimate website that is categorized as 'Pornography' by FortiGuard. The web filter profile is configured to block that category. The administrator wants to allow access for a specific user group without modifying the global web filter profile. What is the BEST approach?

Accepted Answer

Create a separate firewall policy for that user group with a web filter profile that allows the category. Using a separate firewall policy with a different web filter profile allows granular control for specific user groups. URL filter exemption would apply to all users using that profile, not just the specific group.

Answer

Change the FortiGuard category rating for the website to 'Unrated'

Answer

Create a URL filter exemption for the website in the same web filter profile

Answer

Disable web filtering for that website in the global settings

Question 4

An administrator wants to prevent employees from uploading sensitive credit card numbers via web forms. Which security profile feature is MOST appropriate to achieve this?

Accepted Answer

Data Leak Prevention (DLP) with a credit card number sensor. DLP can inspect traffic content for patterns like credit card numbers and block or log the transmission. Antivirus handles malware, application control identifies apps, and web filter blocks URLs.

Answer

Antivirus with FortiSandbox integration

Answer

Web Filter to block all upload sites

Answer

Application Control to block web forms

Question 5

What is the PRIMARY purpose of enabling 'Safe Search' in a web filter profile?

Accepted Answer

To enforce safe search settings on supported search engines like Google and Bing. Safe Search enforces the safe search feature of popular search engines (e.g., Google, Bing) to filter explicit content from search results. It does not block search engines or HTTPS.

Answer

To block all search engines

Answer

To prevent users from using HTTPS search engines

Answer

To log all search queries

Question 6

A FortiGate administrator is configuring SSL deep inspection for a firewall policy that handles traffic to multiple internal servers. Some servers have self-signed certificates. The administrator wants to avoid certificate errors for users. What configuration is recommended?

Accepted Answer

Add the server certificates to the FortiGate's trusted CA store. Adding the self-signed server certificates to the FortiGate's trusted CA store allows the FortiGate to trust them during deep inspection, preventing certificate errors for users. Disabling deep inspection or using certificate inspection would not inspect payloads.

Answer

Configure the firewall policy to accept invalid certificates

Answer

Use certificate inspection instead of deep inspection

Answer

Disable deep inspection for those servers

Question 7

Which of the following best describes the difference between flow-based and proxy-based inspection for antivirus scanning?

Accepted Answer

Flow-based inspection uses pattern matching and anomaly detection with low latency, while proxy-based provides full content reassembly and higher detection rates. Flow-based inspection is faster using pattern matching and anomaly detection, while proxy-based provides full content reassembly and can detect more sophisticated threats. Both can use SSL inspection.

Answer

Flow-based inspection reassembles the entire file before scanning, while proxy-based scans packets on the fly

Answer

Flow-based inspection scans first packet and allows, while proxy-based buffers the entire session

Answer

Flow-based inspection requires SSL deep inspection, while proxy-based does not

Question 8

An administrator has configured an IPS profile with an anomaly detection sensor for 'tcp_syn_flood'. After applying the profile to a firewall policy, users report intermittent connectivity issues. The administrator runs 'diagnose ips anomaly list' and sees entries for 'tcp_syn_flood' with action 'pass'. What is the MOST likely cause of the connectivity issues?

Accepted Answer

The anomaly sensor is not actually applied; the list shows default entries. The 'diagnose ips anomaly list' output shows default anomaly entries. If the sensor were properly applied, the action would be 'block' as configured. The connectivity issues may be unrelated to IPS; the administrator should verify the sensor is attached to the policy.

Answer

The anomaly sensor is set to 'block' but the action is overridden by the policy

Answer

The anomaly sensor is using a different action than expected; it might be set to 'block' for some other sensor

Answer

The anomaly sensor is set to 'pass' but the threshold is too low, causing false positives

Question 9

Which FortiGate security feature can be used to block outgoing emails that contain specific keywords, such as confidential information?

Accepted Answer

Email Filter. Email Filter profiles can scan SMTP, POP3, and IMAP traffic for keywords and patterns in email content. Antivirus scans for malware, web filter for URLs, application control for apps.

Answer

Web Filter

Answer

Application Control

Answer

Antivirus

Question 10

A FortiGate administrator has configured a firewall policy with SSL deep inspection using a forward trust CA certificate. When users access an HTTPS website with a valid certificate, they still receive a certificate warning. What is the MOST likely reason?

Accepted Answer

The forward trust CA certificate is not installed on the users' devices. For deep inspection, the FortiGate's CA certificate must be installed and trusted on client devices. Otherwise, browsers will show a warning that the connection is not private because the certificate is issued by an untrusted authority.

Answer

The website certificate is expired

Answer

The firewall policy is set to certificate inspection instead of deep inspection

Answer

The FortiGate's CA certificate is not trusted by the browser

Question 11

An administrator wants to integrate FortiSandbox with a FortiGate to analyze suspicious files. Which security profile must be configured to send files to FortiSandbox?

Accepted Answer

Antivirus profile with FortiSandbox enabled. FortiSandbox integration is configured within the antivirus profile. When enabled, files that trigger certain conditions are sent to FortiSandbox for advanced analysis. Other profiles do not directly support FortiSandbox submission.

Answer

Application Control profile with FortiSandbox enabled

Answer

IPS profile with FortiSandbox enabled

Answer

Web Filter profile with FortiSandbox enabled

Question 12

A FortiGate administrator is configuring a data leak prevention (DLP) profile to prevent the leakage of social security numbers (SSNs) via email. Which TWO settings must be configured in the DLP profile?

Accepted Answer

Enable SSL deep inspection on the firewall policy. A DLP sensor with a custom pattern for SSNs is needed to detect the data. SSL deep inspection is required to decrypt email traffic (SMTP over TLS) so DLP can inspect the content. FortiSandbox and IPS do not directly handle DLP.

Answer

Set the email filter to quarantine

Answer

Configure IPS to block SSN patterns

Answer

Enable FortiSandbox integration

Question 13

An administrator wants to block all peer-to-peer (P2P) file sharing applications such as BitTorrent and eMule on the network. Which THREE steps should the administrator take?

Accepted Answer

Enable deep inspection on the firewall policy to detect encrypted P2P traffic. Blocking P2P requires application control with the P2P category blocked, deep inspection to detect encrypted P2P traffic, and applying the profile to the firewall policy. Web filter only blocks URLs, not the application traffic itself. Antivirus does not block protocols.

Answer

Configure a web filter profile to block P2P websites

Answer

Enable antivirus to block P2P protocols

Question 14

Which TWO types of inspection can be used for HTTPS traffic in a FortiGate security policy?

Accepted Answer

Deep inspection. FortiGate offers two modes for inspecting HTTPS: certificate inspection (which checks certificate validity but does not decrypt content) and deep inspection (which decrypts and inspects the content). Flow-based and proxy-based refer to the inspection mode for other security profiles, not specifically for HTTPS inspection type.

Answer

Full inspection

Answer

Flow-based inspection

Answer

Proxy-based inspection

Question 15

A network administrator notices that users can access websites categorized as 'Pornography' despite a web filter profile blocking that category. The firewall policy uses the web filter profile and is applied to the users' traffic. What is the MOST likely cause?

Accepted Answer

The FortiGate cannot reach the FortiGuard servers. Option C is correct because if the FortiGate cannot reach the FortiGuard servers, web filtering will fail open by default, allowing all web traffic. The administrator should verify FortiGuard connectivity.

Answer

The web filter profile is applied to the wrong policy

Answer

The users are bypassing the FortiGate using a proxy

Answer

The web filter profile has the 'Override' feature enabled