NSE4 Security Profiles Practice Test 7 — 15 Questions

Question 1

An organization uses Application Control to allow only business-critical applications and block social media. The administrator has configured the profile to block Facebook and Twitter, but users can still access Facebook. The firewall policy applies the profile correctly. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSL inspection is not enabled on the firewall policy.. Application Control relies on SSL inspection to identify applications like Facebook that use HTTPS. Without SSL inspection enabled on the firewall policy, FortiGate can only see encrypted traffic as generic SSL/TLS flows and cannot match the application signatures for Facebook. Enabling SSL inspection (deep inspection or certificate-based inspection) allows the FortiGate to decrypt the traffic and apply the application control profile correctly.

Answer

The application control profile is applied to the wrong direction.

Answer

Facebook is not included in the default application signatures.

Answer

The FortiGate is in flow-based inspection mode.

Question 2

Which TWO of the following are best practices when configuring IPS on a FortiGate in a high-throughput environment?

Accepted Answer

Enable only relevant signatures based on the network environment.. Enabling only relevant signatures based on the network environment reduces false positives and unnecessary processing overhead, ensuring that IPS resources are focused on threats that actually apply to the traffic traversing the FortiGate. Option E is correct because flow-based inspection uses a single-pass, pattern-matching engine that offers higher throughput and lower latency compared to proxy-based inspection, making it ideal for high-throughput environments.

Answer

Set all signatures to block action to maximize security.

Answer

Set the IPS severity filter to high and above only.

Answer

Disable all custom signatures to simplify management.

Question 3

Given the above IPS sensor configuration, what will happen when traffic matching a high-severity IPS signature is detected?

Accepted Answer

The traffic will be allowed because no entry exists for high severity.. The IPS sensor configuration shown does not include an entry for high-severity signatures. Without a specific action defined for high severity, the sensor defaults to allowing the traffic while still generating a log entry. This is a common behavior in FortiGate IPS where only explicitly configured severity levels have defined actions.

Answer

The traffic will be logged but not blocked.

Answer

The traffic will be blocked only if the signature is enabled globally.

Answer

The traffic will be blocked because the sensor has a block action.

Question 4

A large enterprise uses a FortiGate 600E in NAT mode to protect its internal network. The security team has implemented an Application Control profile that categorizes applications and allows only 'Business' and 'General-Interest' categories. They have also applied an IPS sensor with default settings and enabled SSL inspection for outbound traffic. Recently, the helpdesk has received reports that some users cannot access a critical cloud-based CRM application, while others can. The CRM uses HTTPS on port 443. The Application Control profile is applied to the firewall policy for outbound traffic. The IPS sensor is also applied. The FortiGate is not configured for load balancing. Which of the following is the most likely cause of the issue?

Accepted Answer

The CRM application is not categorized in the Application Control database.. The Application Control profile is configured to allow only 'Business' and 'General-Interest' categories. If the CRM application is not categorized in FortiGuard's Application Control database, or if it falls under a different category (e.g., 'Uncategorized' or 'Unknown'), the FortiGate will block the traffic by default. This explains why some users can access the CRM (if they are using a different path or the application is categorized differently) while others cannot, as the FortiGate enforces the profile based on the application signature match.

Answer

The IPS sensor is detecting and blocking the CRM traffic as an attack.

Answer

The FortiGate is performing load balancing and some users are directed to a different path.

Answer

SSL inspection is blocking the CRM traffic due to certificate validation failure.

Question 5

A company is implementing SSL/TLS inspection on a FortiGate to monitor encrypted traffic. They want to ensure that traffic to high-risk categories is blocked, while traffic to financial sites is inspected but not blocked. The administrator creates an SSL inspection profile that deep-inspects all traffic except traffic to financial sites. However, users report that they cannot access financial websites. What is the most likely cause?

Accepted Answer

The web filter profile is configured to block financial websites, overriding the SSL inspection exemption.. The most likely cause is that the web filter profile applied in the same firewall policy is configured to block financial websites. Even though the SSL inspection profile exempts financial sites from deep inspection, the web filter profile operates independently and can block traffic based on URL category. Since the web filter is evaluated after SSL inspection, it will block the decrypted or even non-decrypted traffic to financial sites if the category is set to block, overriding the SSL inspection exemption.

Answer

The SSL inspection profile should be set to certificate-inspection instead of deep-inspection for financial sites.

Answer

The SSL inspection profile must be applied after the web filter profile in the firewall policy.

Answer

The SSL inspection profile should have deep-inspection disabled for all categories except financial.

Question 6

An administrator is configuring web filtering on a FortiGate. Which TWO statements about web filtering profiles are correct?

Accepted Answer

Web filtering profiles can be used together with application control profiles.. Web filtering profiles and application control profiles operate independently at different layers of the FortiGate security fabric. Web filtering inspects HTTP/HTTPS traffic against URL categories and ratings, while application control identifies and controls application-level traffic (e.g., Facebook, Skype) using deep packet inspection. They can be applied together in a single security policy to provide layered protection without conflict.

Answer

Web filtering profiles can only be applied to users who are authenticated.

Answer

Web filtering profiles are applied globally by default.

Answer

Web filtering profiles are used to configure SSL certificate inspection.

Question 7

A company is deploying FortiGate for outbound web filtering. They want to block users from accessing social media sites during business hours, but still allow access to cloud-based productivity tools like Office 365. Which approach should the administrator use to meet this requirement?

Accepted Answer

Configure an application control profile with rules to block social media applications and allow Office 365 applications.. Application control is the correct approach because it can identify and control applications like social media and Office 365 based on their unique signatures, regardless of the ports or protocols they use. Unlike URL filtering or port blocking, application control can differentiate between Office 365 traffic and social media traffic even when both use HTTPS on TCP 443, allowing the administrator to block social media while permitting cloud productivity tools.

Answer

Create a firewall policy to block all traffic to ports commonly used by social media (e.g., TCP 443).

Answer

Use a web filter profile to block URLs containing 'facebook' or 'twitter'.

Answer

Implement a DNS filter to block DNS queries for social media domains.

Question 8

An administrator is configuring an IPS profile on FortiGate to detect and block SQL injection attacks. The profile must be applied to inbound traffic to a web server. Which TWO settings should the administrator enable to achieve this goal? (Choose two.)

Accepted Answer

Add the 'SQL.Injection' signature to the IPS sensor and set action to 'block'.. SQL injection attacks are identified by specific IPS signatures, and adding 'SQL.Injection' to an IPS sensor with the action set to 'block' directly instructs FortiGate to detect and block those attacks. Option E is correct because an IPS sensor must be enabled within a firewall policy to apply its inspection to the traffic passing through that policy, ensuring the profile is active on inbound traffic to the web server.

Answer

Create a DoS policy to limit the number of connections per second.

Answer

Enable the HTTP protocol decoder in the application control profile.

Answer

Configure the IPS sensor to bypass traffic from trusted IP addresses.

Question 9

Refer to the exhibit. An administrator has created an IPS sensor with two entries. The first entry sets severity 'medium' and action 'block'. The second entry sets severity 'critical' and action 'block'. What will happen when a packet triggers an IPS signature with severity 'low'?

Accepted Answer

The packet will be allowed (pass).. The IPS sensor in the exhibit defines rules only for severity 'medium' and 'critical', both with action 'block'. When a packet triggers a signature with severity 'low', it does not match any entry in the sensor. Therefore, the default action for unmatched signatures is to allow (pass) the traffic. FortiGate IPS sensors apply actions only to explicitly configured severity levels; unlisted severities are not affected.

Answer

The packet will be logged and a session will be created.

Answer

The packet will be blocked if the signature severity is 'low' or 'high'.

Answer

The packet will be blocked because the sensor is enabled.

Question 10

Drag and drop the steps to capture traffic on a FortiGate interface using the CLI into the correct order.

Accepted Answer

Step 1: Specify the interface, Step 2: Specify the filter, Step 3: Specify the verbose level, Step 4: Specify the count. The sniffer command syntax is diagnose sniffer packet .

Answer

Step 1: Specify the filter, Step 2: Specify the interface, Step 3: Specify the verbose level, Step 4: Specify the count

Answer

Step 1: Specify the interface, Step 2: Specify the verbose level, Step 3: Specify the filter, Step 4: Specify the count

Answer

Step 1: Specify the count, Step 2: Specify the verbose level, Step 3: Specify the filter, Step 4: Specify the interface

Question 11

Drag and drop the steps to perform a factory reset on FortiGate via CLI into the correct order.

Accepted Answer

Connect to CLI, run execute factoryreset, confirm, wait for reboot.. Factory reset is done with execute factoryreset, then confirm; device reboots to defaults.

Answer

Connect to CLI, confirm, run execute factoryreset, wait for reboot.

Answer

Connect to CLI, run execute factoryreset, wait for reboot, confirm.

Answer

Connect to CLI, reboot, run execute factoryreset, confirm.

Question 12

Drag and drop the steps to configure a VLAN interface on FortiGate into the correct order.

Accepted Answer

Create VLAN interface, then configure parent interface and VLAN ID, then assign IP address, then enable administrative access.. VLAN interfaces require a physical parent, VLAN ID, IP address, and optional administrative access.

Answer

Assign IP address, then create VLAN interface, then configure parent interface and VLAN ID, then enable administrative access.

Answer

Create VLAN interface, then assign IP address, then configure parent interface and VLAN ID, then enable administrative access.

Answer

Configure parent interface and VLAN ID, then create VLAN interface, then assign IP address, then enable administrative access.

Question 13

Match each Fortinet HA mode to its description.

Accepted Answer

Active-Passive HA: One FortiGate handles traffic while the other is on standby.. Common FortiGate HA modes: Active-Passive (primary/standby) and Active-Active (both active). Distractors swap the definitions.

Answer

Active-Passive HA: Both FortiGates handle traffic simultaneously.

Answer

Active-Active HA: One FortiGate handles traffic while the other is on standby.

Question 14

Match each FortiGate NAT type to its description.

Accepted Answer

Source NAT: Translates source IP addresses of packets originating from a private network.. Source NAT modifies source IP of outgoing packets; Destination NAT modifies destination IP of incoming packets; Static NAT provides one-to-one mapping; PAT enables many-to-one translation via ports. Distractors swap the descriptions of Source and Destination NAT.

Answer

Source NAT: Translates destination IP addresses of incoming packets.

Answer

Destination NAT: Translates source IP addresses of outgoing packets.

Question 15

Match each FortiGate firewall policy action to its result.

Accepted Answer

ACCEPT: Allows traffic that matches the policy. The correct matches are ACCEPT for allowing traffic and DENY for silently dropping traffic. Common confusions include mixing ACCEPT with REJECT (which sends a reset) and assuming DENY logs traffic.

Answer

ACCEPT: Drops traffic and sends a TCP reset

Answer

DENY: Allows traffic and logs it