NSE4 Security Profiles Practice Test 6 — 15 Questions

Question 1

A FortiGate receives a file via SMTP that contains a virus. The antivirus profile is set to 'Block' for viruses and the action is set to 'Quarantine'. However, the email is delivered to the user with the infected attachment. What could be the reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The antivirus profile is using flow-based inspection and the SMTP scan is not enabled. B is correct because when an antivirus profile uses flow-based inspection, it must have SMTP scanning explicitly enabled in the profile settings. If SMTP scan is not enabled, the FortiGate will not inspect SMTP traffic for viruses, allowing infected attachments to pass through regardless of the antivirus action set to 'Block' and 'Quarantine'. Proxy-based inspection, by contrast, scans all protocols by default, but flow-based requires per-protocol enablement.

Answer

The email filter profile is overriding the antivirus action

Answer

The antivirus signatures are outdated

Answer

The file is larger than the FortiGate's virus database can handle

Question 2

Which FortiGate security profile is BEST suited for blocking DNS queries to known malicious domains?

Accepted Answer

DNS Filter profile. DNS Filter profile can block DNS queries based on FortiGuard categories or custom domain lists, preventing users from resolving malicious domains.

Answer

Web Filter profile

Answer

IPS profile

Answer

Application Control profile

Question 3

An administrator wants to allow users to override a blocked category (e.g., Social Networking) by entering an administrator-defined password. Which of the following must be configured?

Accepted Answer

Enable 'Override' in the Web Filter profile and configure an authentication scheme. To allow users to override a blocked web category by entering an administrator-defined password, you must enable the 'Override' feature within the Web Filter profile and configure an authentication scheme (e.g., using a local user or LDAP group). This allows users to bypass the block temporarily after authenticating with the defined password, rather than permanently changing the policy or filter mode.

Answer

Configure a DNS filter to bypass the block

Answer

Create a separate firewall policy with a higher priority that permits the traffic

Answer

Set the web filter profile to 'Monitor' mode instead of 'Block'

Question 4

A FortiGate is configured with an IPS profile that includes a signature with a 'Pass' action. The firewall policy uses this IPS profile. What will happen when traffic matching that signature is detected?

Accepted Answer

The traffic is allowed without logging. When a signature with a 'Pass' action is triggered in an IPS profile applied to a firewall policy, FortiGate allows the traffic to pass through without any further inspection or logging for that specific signature. The 'Pass' action explicitly overrides the default IPS behavior, meaning the traffic is permitted and no log entry is generated for that signature match, as logging is only performed when the action is set to 'Block' or 'Reset'.

Answer

The traffic is allowed, but the session is reset

Answer

The traffic is blocked and logged

Answer

The traffic is blocked and the session is reset

Question 5

A FortiGate is configured with a firewall policy that applies an Application Control profile and a Web Filter profile. The administrator wants to log all traffic blocked by the Web Filter profile. Which TWO configurations are required?

Accepted Answer

Enable 'Log All Blocked Sites' in the Web Filter profile. The Web Filter profile has a specific setting called 'Log All Blocked Sites' that, when enabled, generates log entries for all traffic that the web filter blocks. This is the direct mechanism to log blocked web traffic at the profile level. Option D is also correct because the firewall policy itself must have logging enabled—either 'Log All Traffic' or 'Log Violation Traffic'—to ensure that the log entries generated by the Web Filter profile are actually recorded and sent to the FortiGate's log system.

Answer

Set the global 'Logging' setting to 'Verbose'

Answer

Configure the Application Control profile to log blocked traffic

Answer

Enable 'Log All Allowed Sites' in the Web Filter profile

Question 6

An administrator needs to ensure that all HTTPS traffic to a critical server is inspected by the IPS. The server uses a valid certificate from a public CA. Which THREE steps are required to achieve this?

Accepted Answer

Apply an IPS profile to the same firewall policy. Options A, C, and D are required. SSL deep inspection must be enabled on the firewall policy (D), an IPS profile must be applied to the same policy (A), and the FortiGate's CA certificate must be installed on client browsers (C) to prevent certificate warnings. Option E is unnecessary because the FortiGate does not need the server's private certificate; it can re-sign the server's certificate with its own CA.

Answer

Set the Antivirus profile to 'Deep Inspection'

Answer

Upload the server's certificate to the FortiGate

Question 7

An administrator wants to block all traffic to websites in the 'Pornography' category but allow an exception for a specific research site that falls under that category. The FortiGuard category is set to block. How should the administrator configure the exception?

Accepted Answer

Add a URL filter entry with the site's domain set to 'Allow'. In FortiGate, to allow a specific site that is blocked by a category, you add a URL filter entry with the action 'Allow' above the category block. URL filter entries are evaluated first and can override the category action.

Answer

Set the FortiGuard category to 'Monitor' and create a URL filter to block all other sites

Answer

Use the DNS filter to allow the site's FQDN

Answer

Add the site to the FortiGuard category override list with action 'Allow'

Question 8

Which security profile type requires a FortiSandbox license to enable advanced detection features?

Accepted Answer

Antivirus. The Antivirus security profile (Option C) is correct because FortiGate's advanced antivirus features, such as outbreak prevention and cloud-based pattern matching, require a FortiSandbox license to offload suspicious files for dynamic analysis. Without this license, the antivirus engine relies solely on local signatures and cannot leverage sandboxing for zero-day threat detection.

Answer

Application Control

Answer

DNS Filter

Answer

Web Filter

Question 9

A FortiGate administrator wants to block spam emails destined for internal users. The FortiGate receives SMTP traffic on port 25. What is the most effective way to filter spam using the email filter profile?

Accepted Answer

Apply an email filter profile to a firewall policy that allows SMTP traffic. An email filter profile is specifically designed to inspect SMTP traffic and apply anti-spam techniques such as RBL, MIME header checks, and heuristic analysis. By applying the email filter profile to a firewall policy that allows SMTP traffic on port 25, the FortiGate can intercept and filter spam before it reaches internal users.

Answer

Enable spam filtering in the antivirus profile

Answer

Use a DNS filter to block spam domains

Answer

Configure a web filter to block webmail

Question 10

An administrator configures a DLP sensor to detect credit card numbers in traffic. However, the sensor is not detecting any credit card numbers even though they are present in emails. What could be the reason?

Accepted Answer

Email traffic is encrypted and SSL deep inspection is not enabled. DLP sensors inspect traffic content. If the traffic is encrypted (e.g., via TLS), the sensor cannot see the plaintext unless SSL deep inspection is enabled to decrypt the traffic first.

Answer

The DLP sensor is applied to the wrong policy

Answer

The credit card regular expression is incorrect

Answer

The DLP sensor is in 'Monitor' mode

Question 11

Which of the following best describes the function of FortiGuard web filtering categories?

Accepted Answer

They categorize websites to allow granular control over access based on content type. FortiGuard categories classify websites into groups (e.g., Social Networking, Pornography) so administrators can define actions (allow, block, monitor) for each group in the web filter profile.

Answer

They are used to quarantine infected files

Answer

They block specific IP addresses known for hosting malware

Answer

They provide a list of allowed websites only

Question 12

An administrator wants to ensure that search engine results from Google, Bing, and Yahoo are filtered to exclude explicit content when users perform searches. Which feature should the administrator configure in the web filter profile?

Accepted Answer

Safe search. Safe search is a feature within FortiGate's web filter profile that enforces search engine providers (Google, Bing, Yahoo) to filter explicit content from search results. It works by appending specific parameters to search URLs or using HTTPS inspection to inject the safe search cookie, ensuring compliance with content filtering policies.

Answer

FortiGuard category filter

Answer

URL filter

Answer

DNS filter

Question 13

An administrator wants to prevent sensitive data (e.g., credit card numbers) from being sent out of the network via email. Which THREE components must be configured to achieve this?

Accepted Answer

A firewall policy that allows email traffic and applies the email filter profile. A firewall policy must be configured to allow email traffic (e.g., SMTP, SMTPS) and to apply the email filter profile. Without this policy, the traffic would be blocked or bypass the security inspection, rendering the DLP controls ineffective.

Answer

SSL deep inspection to decrypt email traffic if encrypted

Answer

An application control profile to block email applications

Question 14

A FortiGate administrator is configuring IPS to protect against a known exploit targeting a web server. The administrator wants to ensure that the IPS engine can decode the HTTP protocol. Which TWO actions are necessary?

Accepted Answer

Enable the HTTP protocol decoder in the IPS sensor. The HTTP protocol decoder must be enabled in the IPS sensor because the IPS engine uses protocol decoders to normalize traffic and apply signatures correctly. Without the HTTP decoder, the IPS engine cannot parse HTTP headers, methods, or URIs, making it blind to web-based exploits. This is a prerequisite for any HTTP-specific IPS inspection.

Answer

Configure an IP pool for the web server

Answer

Set the IPS action to 'block'

Answer

Disable the FTP protocol decoder

Question 15

An administrator configures an application control profile to block 'Facebook' and 'Twitter' using application signatures. Users can still access Facebook via HTTPS. The administrator has enabled deep inspection. What is missing?

Accepted Answer

The firewall policy must have inspection mode set to 'proxy-based' for application control to work with HTTPS. Application control requires the firewall policy to be set to 'proxy-based inspection' for HTTPS traffic. Even with deep inspection enabled, if the policy is flow-based, application control may not inspect HTTPS traffic correctly.

Answer

The application control profile must be applied to both ingress and egress policies

Answer

The application signatures need to be updated to the latest version

Answer

The web filter profile must be set to 'authenticate' for the connection