NSE4 Security Profiles Practice Test 7 — 15 Questions

Question 1

An administrator enables deep inspection for HTTPS traffic. Users report that they cannot access some websites because of certificate errors. The administrator wants to override these errors and allow access. What should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the websites to the 'SSL/SSH exemption' list in the deep inspection profile. In FortiOS, deep inspection can generate certificate errors for sites with self-signed or mismatched certificates. To allow access despite errors, the administrator can add the affected domains to the 'SSL/SSH exemption' list in the deep inspection profile. This exempts those sites from deep inspection, avoiding the certificate error.

Answer

Disable certificate verification in the deep inspection profile

Answer

Add the websites to the 'FortiGuard category' allow list

Answer

Configure the web filter to allow these websites

Question 2

What is the purpose of the 'safe search' option in a FortiGate web filter profile?

Accepted Answer

It filters explicit content from search engine results. The 'safe search' option in a FortiGate web filter profile forces supported search engines (such as Google, Bing, and Yahoo) to filter explicit content from search results. This is achieved by appending specific parameters to the search engine URLs (e.g., &safe=active for Google), ensuring that adult or offensive material is suppressed regardless of the user's individual search settings.

Answer

It enforces the use of HTTPS for search engines

Answer

It allows users to bypass URL filters during safe search

Answer

It blocks all search engine traffic

Question 3

Which two inspection modes are available for antivirus scanning on a FortiGate?

Accepted Answer

Flow-based and proxy-based. FortiGate offers two distinct inspection modes for antivirus scanning: flow-based and proxy-based. Flow-based inspection uses a single-pass, low-latency engine that examines traffic as it passes through, while proxy-based inspection buffers and reassembles the entire file before scanning, providing deeper analysis at the cost of higher latency. Both modes are configured within the antivirus security profile to match different performance and security requirements.

Answer

Stateful and stateless

Answer

Inline and passive

Answer

Kernel-based and user-based

Question 4

An administrator configures an application control profile to block 'BitTorrent'. Users are still able to download files using BitTorrent. The administrator has enabled deep inspection and the policy is set to proxy-based. What is the most likely reason the application is not being blocked?

Accepted Answer

The application signatures are out of date. Application control uses application signatures to identify traffic. If the signatures are not up to date, new versions of BitTorrent may not be recognized. Also, if the traffic is encrypted and uses non-standard ports, application control may not detect it if the signatures are not comprehensive.

Answer

BitTorrent uses randomized ports that bypass application control

Answer

The application control profile is not applied to the correct policy

Answer

The policy is set to flow-based instead of proxy-based

Question 5

A FortiGate administrator is troubleshooting why antivirus scanning is not working for HTTPS traffic. Which TWO steps should be verified?

Accepted Answer

Ensure the firewall policy has SSL/TLS deep inspection enabled. HTTPS traffic is encrypted, so the FortiGate must decrypt it using SSL/TLS deep inspection before the antivirus engine can scan the payload. Without deep inspection, the antivirus profile sees only encrypted packets and cannot detect threats within the HTTPS stream.

Answer

Ensure the antivirus profile is set to proxy-based inspection

Answer

Confirm that the web filter profile is also applied

Answer

Check that the FortiSandbox is online for advanced scanning

Question 6

An administrator wants to block all traffic from the 'P2P' application category but allow traffic from 'File Sharing' applications like Dropbox. Which THREE configurations are required to achieve this?

Accepted Answer

Create an application control profile that sets 'P2P' category to 'block' and 'File Sharing' category to 'allow'. An application control profile directly manages application categories, allowing you to set 'P2P' to 'block' and 'File Sharing' to 'allow'. This profile is then applied to a firewall policy to enforce the desired traffic filtering. Without this profile, the firewall cannot differentiate between these application categories.

Answer

Set the firewall policy inspection mode to proxy-based

Answer

Apply a web filter profile to override the application control

Question 7

An administrator configures a DLP profile to detect Social Security numbers in outbound traffic. The profile is applied to an outbound HTTP policy. Which TWO additional configurations are necessary for the DLP to inspect HTTPS traffic?

Accepted Answer

Enable SSL/TLS deep inspection on the firewall policy. DLP inspection of HTTPS traffic requires the firewall to decrypt the encrypted payload. Enabling SSL/TLS deep inspection on the firewall policy allows FortiGate to perform man-in-the-middle decryption, re-encrypt, and then inspect the decrypted content for sensitive data like Social Security numbers. Without deep inspection, the DLP engine sees only encrypted traffic and cannot match patterns.

Answer

Set the firewall policy inspection mode to proxy-based

Answer

Add an SSL exemption for the destination servers

Answer

Configure a web filter profile to allow the traffic

Question 8

A FortiGate administrator wants to block access to gambling websites using web filtering. Which FortiGuard category should be blocked?

Accepted Answer

Gambling. FortiGuard web filtering uses pre-defined categories to classify websites. To block gambling sites, the administrator must select the 'Gambling' category in the web filter profile. This category specifically includes domains and URLs related to online betting, casinos, and other gambling activities.

Answer

Spam

Answer

Malware

Answer

Pornography

Question 9

Which IPS detection method analyzes traffic patterns over time to identify attacks that are characterized by a threshold of events?

Accepted Answer

Rate-based detection. Rate-based detection (also known as threshold-based detection) monitors traffic patterns over a defined time window and triggers an alert when the number of events (e.g., connection attempts, SYN packets) exceeds a predefined threshold. This method is specifically designed to identify attacks that are characterized by a threshold of events, such as DoS/DDoS floods or brute-force login attempts, rather than relying on static signatures or protocol anomalies.

Answer

Protocol decoder-based detection

Answer

Signature-based detection

Answer

Anomaly-based detection

Question 10

An administrator wants to allow access to a specific website that is blocked by the FortiGuard web filter category 'Social Networking'. The administrator creates a URL filter override to allow the site. After applying, the site is still blocked. What should the administrator check?

Accepted Answer

Ensure the URL filter rule is placed above the FortiGuard category block in the web filter profile. URL filter overrides take precedence over FortiGuard categories only if the URL filter action is set appropriately and the override is applied before the FortiGuard check. Additionally, the order of rules matters: URL filter rules are evaluated before FortiGuard categories, but the action must be 'allow' and the override must be enabled.

Answer

Disable the FortiGuard category rating for Social Networking

Answer

Ensure the URL filter rule is set to 'exempt' instead of 'allow'

Answer

Set the web filter profile to use 'monitor' for the Social Networking category

Question 11

Which security profile component is specifically designed to prevent data exfiltration by inspecting outgoing traffic for sensitive data patterns?

Accepted Answer

Data Leak Prevention (DLP). Data Leak Prevention (DLP) is the security profile component specifically designed to inspect outgoing traffic for sensitive data patterns, such as credit card numbers, social security numbers, or custom regex patterns. It uses deep packet inspection (DPI) to analyze content in emails, web uploads, and file transfers, blocking or alerting on matches to prevent unauthorized data exfiltration.

Answer

Application Control

Answer

Antivirus

Answer

Web Filter

Question 12

An administrator configures an IPS profile with a signature that has a 'block' action. However, traffic matching the signature is only being logged and not blocked. What is the most likely reason?

Accepted Answer

The signature's action is set to 'monitor' in the IPS sensor. IPS signatures can be set to 'block' but the actual action in the firewall policy's IPS profile may be overridden by the policy's inspection mode or the IPS profile's configuration. Additionally, the signature's action must not be set to 'monitor' or 'pass' at the sensor level.

Answer

The IPS profile is applied to the inbound policy only

Answer

The firewall policy is set to 'accept' but logging is disabled

Answer

The FortiGate is operating in flow-based inspection mode

Question 13

A network administrator wants to ensure that all users are blocked from accessing websites categorized as 'Pornography' and 'Hacking' on a FortiGate. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Apply the web filter profile to the firewall policy that governs outbound internet traffic. A web filter profile must be applied to a firewall policy to enforce web filtering on outbound internet traffic. Without this association, the profile's settings (including category blocks) are not activated. The firewall policy is the enforcement point where security profiles are linked to traffic flows.

Answer

Create a URL filter to block all URLs containing 'pornography' and 'hacking'

Answer

Enable DNS filter and block the categories there

Answer

Enable SSL deep inspection to ensure the categories can be identified

Question 14

An administrator is troubleshooting why an application control profile is not detecting a custom application that uses a non-standard port. The administrator wants to ensure the application is properly identified. Which THREE steps should the administrator take? (Choose three.)

Accepted Answer

Add a custom application signature based on the traffic pattern. Application control relies on signatures that may require specific settings like 'deep inspection' for encrypted traffic, adding custom signatures, or ensuring the traffic is not bypassing the FortiGate. Additionally, using an application group can help organize custom signatures.

Answer

Set the application control action to 'block' for the application

Answer

Disable flow-based inspection and use proxy-based only

Question 15

A FortiGate administrator wants to prevent users from downloading executable files via HTTP from the internet. Which TWO security profile features can be used together to achieve this? (Choose two.)

Accepted Answer

Antivirus profile with a file filter to block 'exe' files. To prevent users from downloading executable files via HTTP, two complementary security profile features can be deployed together. Option A, an antivirus profile with a file filter, can block files based on extension (e.g., .exe) as they are inspected by the antivirus engine. Option B, a web filter profile with a URL filter, can block access to URLs that end with '.exe', preventing the download request before it reaches the client. While antivirus focuses on the content after download, web filter can enforce policy at the URL level. Using both provides layered defense. Options C, D, and E are incorrect: DNS filter blocks at the domain level, not file-specific; application control can block applications but not specific file downloads in this context; SSL deep inspection is a prerequisite for inspecting HTTPS traffic but not a blocking mechanism itself.

Answer

DNS filter to block domains that host executable files

Answer

Application control profile to block HTTP file transfer applications

Answer

SSL deep inspection to allow inspection of encrypted traffic