NSE4 Security Profiles Practice Test 7 — 15 Questions

Question 1

You run the following CLI command on a FortiGate:
diagnose sys session filter dport 443
diagnose sys session list
The output shows many sessions with 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate about the traffic?

Accepted Answer

The sessions are in the SYN_SENT state and have not completed the three-way handshake. Option B is correct. The proto=6 indicates TCP, and proto_state=01 indicates a TCP session in the SYN_SENT state (i.e., the three-way handshake is not complete). The long duration suggests these are half-open sessions, possibly indicating a SYN flood attack.

Answer

The sessions are fully established and idle

Answer

The sessions are for UDP traffic

Answer

The sessions are being inspected by SSL deep inspection

Question 2

A FortiGate administrator wants to block all traffic to websites that are categorized as 'Malware' and 'Phishing'. Which security profile should be configured to achieve this goal?

Accepted Answer

Web Filter profile. Option A is correct. Web filtering profiles use FortiGuard categories to block access to malicious websites like malware and phishing sites.

Answer

DNS Filter profile

Answer

IPS profile

Answer

Application Control profile

Question 3

An organization uses FortiSandbox to detect advanced threats. The administrator wants to ensure that files downloaded from the internet are sent to FortiSandbox for analysis before being delivered to users. Which Antivirus profile setting should be configured?

Accepted Answer

Enable 'Inline Scan' for FortiSandbox. Option D is correct. The 'FortiSandbox Inline Scan' option sends files to FortiSandbox and waits for verdict before allowing or blocking the file.

Answer

Enable 'FortiSandbox Monitoring'

Answer

Enable 'FortiSandbox Quarantine'

Answer

Set 'Scan Mode' to 'Quick'

Question 4

A FortiGate is configured with an SSL deep inspection profile that uses 'Certificate Inspection' (not 'Full SSL Inspection'). Which of the following is TRUE about this configuration?

Accepted Answer

The FortiGate can block HTTPS connections based on the certificate's CN. Option C is correct. Certificate inspection only validates the server certificate's Common Name (CN) and expiration; it does not decrypt the traffic payload, so the antivirus and IPS cannot inspect encrypted content.

Answer

Deep inspection can still see client certificates

Answer

The antivirus profile can scan the HTTPS payload

Answer

IPS can still inspect the application layer of HTTPS traffic

Question 5

An administrator wants to block the use of social media applications like Facebook and Twitter on the company network. Which security profile should be used?

Accepted Answer

Application Control profile. Option B is correct. Application control can identify and block specific applications based on signatures, including social media apps.

Answer

DNS Filter profile

Answer

Web Filter profile

Answer

IPS profile

Question 6

A FortiGate administrator has configured an Application Control profile to block 'P2P' applications. However, users are still able to use BitTorrent. What is the MOST likely reason?

Accepted Answer

The firewall policy does not have SSL deep inspection enabled, and BitTorrent is using encryption. Option A is correct. If the Firewall policy does not have 'Deep Inspection' enabled for HTTPS, encrypted P2P traffic cannot be inspected by Application Control, and the application may not be detected.

Answer

The Application Control profile is configured in 'Monitor' mode instead of 'Block'

Answer

The BitTorrent signatures are not included in the FortiGate firmware

Answer

The Application Control profile is applied to the wrong direction

Question 7

An administrator wants to prevent data leakage by blocking outbound emails that contain credit card numbers. Which security profile should be configured?

Accepted Answer

DLP profile. Option C is correct. DLP (Data Leak Prevention) profiles can inspect content for sensitive data patterns like credit card numbers and block or quarantine the traffic.

Answer

Email Filter profile

Answer

Web Filter profile

Answer

Antivirus profile

Question 8

A FortiGate receives a file via SMTP that contains a virus. The antivirus profile is set to 'Block' for viruses and the action is set to 'Quarantine'. However, the email is delivered to the user with the infected attachment. What could be the reason?

Accepted Answer

The antivirus profile is using flow-based inspection and the SMTP scan is not enabled. Option B is correct. If the antivirus profile is configured for flow-based inspection, some email protocols may not be fully inspected unless explicitly configured. Flow-based inspection may skip SMTP depending on the configuration.

Answer

The email filter profile is overriding the antivirus action

Answer

The antivirus signatures are outdated

Answer

The file is larger than the FortiGate's virus database can handle

Question 9

Which FortiGate security profile is BEST suited for blocking DNS queries to known malicious domains?

Accepted Answer

DNS Filter profile. Option D is correct. DNS Filter profile can block DNS queries based on FortiGuard categories or custom domain lists, preventing users from resolving malicious domains.

Answer

Web Filter profile

Answer

IPS profile

Answer

Application Control profile

Question 10

An administrator wants to allow users to override a blocked category (e.g., Social Networking) by entering an administrator-defined password. Which of the following must be configured?

Accepted Answer

Enable 'Override' in the Web Filter profile and configure an authentication scheme. Option A is correct. Web filter override allows users to request access to blocked sites by providing a password. The override must be enabled in the web filter profile and a FortiGate authentication scheme must be set up.

Answer

Configure a DNS filter to bypass the block

Answer

Create a separate firewall policy with a higher priority that permits the traffic

Answer

Set the web filter profile to 'Monitor' mode instead of 'Block'

Question 11

A FortiGate is configured with an IPS profile that includes a signature with a 'Pass' action. The firewall policy uses this IPS profile. What will happen when traffic matching that signature is detected?

Accepted Answer

The traffic is allowed without logging. Option C is correct. A 'Pass' action means the traffic is allowed and not logged (unlike 'Allow' which logs). The signature will generate an event but will not drop or reset the session.

Answer

The traffic is allowed, but the session is reset

Answer

The traffic is blocked and logged

Answer

The traffic is blocked and the session is reset

Question 12

A FortiGate is configured with a firewall policy that applies an Application Control profile and a Web Filter profile. The administrator wants to log all traffic blocked by the Web Filter profile. Which TWO configurations are required?

Accepted Answer

Enable 'Log All Blocked Sites' in the Web Filter profile. Options A and D are correct. Logging of blocked traffic must be enabled in the Web Filter profile (A), and the firewall policy must have logging enabled (D) to capture the logs.

Answer

Set the global 'Logging' setting to 'Verbose'

Answer

Configure the Application Control profile to log blocked traffic

Answer

Enable 'Log All Allowed Sites' in the Web Filter profile

Question 13

An administrator needs to ensure that all HTTPS traffic to a critical server is inspected by the IPS. The server uses a valid certificate from a public CA. Which THREE steps are required to achieve this?

Accepted Answer

Apply an IPS profile to the same firewall policy. Options A, D, and E are correct. SSL deep inspection must be enabled on the policy (A), the IPS profile must be applied in the same policy (D), and the FortiGate's CA certificate must be installed on clients (E) to avoid certificate errors.

Answer

Set the Antivirus profile to 'Deep Inspection'

Answer

Upload the server's certificate to the FortiGate

Question 14

A FortiGate administrator wants to block spam emails sent to the company's mail server. The mail server is behind the FortiGate. Which THREE configurations should be applied?

Accepted Answer

Enable FortiGuard spam filtering in the Email Filter profile. Options B, C, and E are correct. An email filter profile for spam detection (B), a firewall policy that applies the email filter to SMTP traffic (C), and FortiGuard spam filtering enabled (E) are all required.

Answer

Enable DLP to filter spam

Answer

Configure Application Control to block email applications

Question 15

A network administrator notices that HTTP traffic to a specific website is being blocked by the web filter profile, but the website is categorized as 'General – Personal' in FortiGuard, which is allowed. What could cause this block?

Accepted Answer

A URL filter entry is blocking the specific website. The URL filter is applied before FortiGuard categories and can override the category rating. A static URL filter entry blocking the specific website would cause the block even if the category is allowed.

Answer

The web filter profile has an incorrect FortiGuard category override

Answer

The antivirus profile is blocking the website

Answer

DNS filter is blocking the domain