NSE4 Security Profiles Practice Test 8 — 15 Questions

Question 1

A FortiGate administrator configures SSL deep inspection on a policy using a self-signed CA certificate. Users report that they see a certificate warning in their browsers when accessing HTTPS sites. What is the most effective solution to eliminate these warnings?

Accepted Answer

Install the FortiGate's CA certificate on all client machines in the trusted root store. To avoid certificate warnings, the FortiGate's CA certificate must be trusted by all clients. Deploying the CA certificate via Group Policy ensures that all domain-joined machines trust certificates signed by the FortiGate.

Answer

Use a publicly trusted CA certificate for the FortiGate

Answer

Disable deep inspection and use certificate inspection only

Answer

Add the websites to the exemption list in the SSL/SSH profile

Question 2

What is the primary difference between flow-based and proxy-based Antivirus inspection on a FortiGate?

Accepted Answer

Proxy-based inspection reassembles the file before scanning, while flow-based scans as the file passes through. Flow-based inspection uses the FortiASIC for accelerated scanning and has lower latency, while proxy-based inspection reassembles the entire content before scanning, allowing for more thorough detection but with higher resource usage.

Answer

Flow-based inspection is only available on hardware models with CP8

Answer

Proxy-based inspection uses fewer resources than flow-based

Answer

Flow-based inspection supports virus outbreak detection, but proxy-based does not

Question 3

An administrator wants to block all traffic to websites in the 'Pornography' category but allow an exception for a specific research site that falls under that category. The FortiGuard category is set to block. How should the administrator configure the exception?

Accepted Answer

Add a URL filter entry with the site's domain set to 'Allow'. In FortiGate, to allow a specific site that is blocked by a category, you add a URL filter entry with the action 'Allow' above the category block. URL filter entries are evaluated first and can override the category action.

Answer

Set the FortiGuard category to 'Monitor' and create a URL filter to block all other sites

Answer

Use the DNS filter to allow the site's FQDN

Answer

Add the site to the FortiGuard category override list with action 'Allow'

Question 4

An administrator runs the following CLI command and sees the output: 'diagnose sys session list | grep -A 5 10.1.1.100' and finds a session with 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate about the session?

Accepted Answer

The session has been active for approximately 1 second. The duration is 3600 seconds and expire is 3599 seconds, meaning the session has been active for only about 1 second out of a 3600-second lifetime. The session is new.

Answer

The session is about to expire

Answer

The session has been active for 3600 seconds

Answer

The session is using UDP protocol

Question 5

A FortiGate configured with IPS anomaly detection is generating false positives for the 'tcp_syn_flood' anomaly. The administrator wants to reduce the false positives without completely disabling the detection. Which action should the administrator take?

Accepted Answer

Increase the threshold value. The threshold determines the number of SYN packets per second that trigger an alarm. Increasing the threshold will require more SYN packets to trigger, reducing false positives while still detecting heavy floods.

Answer

Disable the anomaly and use a custom IPS signature

Answer

Decrease the threshold value

Answer

Set the action to 'pass'

Question 6

Which security profile type requires a FortiSandbox license to enable advanced detection features?

Accepted Answer

Antivirus. FortiSandbox integration is configured within the Antivirus profile (and optionally with other profiles) to submit suspicious files for behavioral analysis. The license enables the FortiSandbox connection.

Answer

Application Control

Answer

DNS Filter

Answer

Web Filter

Question 7

An administrator notices that a specific application (e.g., Skype) is not being detected by the application control profile. The profile includes the 'Skype' application signature but traffic is passing through without being logged as Skype. What is the most likely reason?

Accepted Answer

SSL deep inspection is not enabled on the firewall policy. Application control requires deep inspection for encrypted traffic because it needs to see into the TLS session to match application signatures. If the policy does not have SSL deep inspection, the traffic appears as generic HTTPS and cannot be identified as Skype.

Answer

The application control profile is set to 'Monitor' mode

Answer

The traffic is using a non-standard port

Answer

The application signature is outdated

Question 8

A FortiGate administrator wants to block spam emails destined for internal users. The FortiGate receives SMTP traffic on port 25. What is the most effective way to filter spam using the email filter profile?

Accepted Answer

Apply an email filter profile to a firewall policy that allows SMTP traffic. The email filter profile is applied to a firewall policy that matches SMTP traffic. It can perform spam filtering based on FortiGuard IP reputation and other heuristics.

Answer

Enable spam filtering in the antivirus profile

Answer

Use a DNS filter to block spam domains

Answer

Configure a web filter to block webmail

Question 9

An administrator configures a DLP sensor to detect credit card numbers in traffic. However, the sensor is not detecting any credit card numbers even though they are present in emails. What could be the reason?

Accepted Answer

Email traffic is encrypted and SSL deep inspection is not enabled. DLP sensors inspect traffic content. If the traffic is encrypted (e.g., via TLS), the sensor cannot see the plaintext unless SSL deep inspection is enabled to decrypt the traffic first.

Answer

The DLP sensor is applied to the wrong policy

Answer

The credit card regular expression is incorrect

Answer

The DLP sensor is in 'Monitor' mode

Question 10

Which of the following best describes the function of FortiGuard web filtering categories?

Accepted Answer

They categorize websites to allow granular control over access based on content type. FortiGuard categories classify websites into groups (e.g., Social Networking, Pornography) so administrators can define actions (allow, block, monitor) for each group in the web filter profile.

Answer

They are used to quarantine infected files

Answer

They block specific IP addresses known for hosting malware

Answer

They provide a list of allowed websites only

Question 11

An administrator wants to ensure that search engine results from Google, Bing, and Yahoo are filtered to exclude explicit content when users perform searches. Which feature should the administrator configure in the web filter profile?

Accepted Answer

Safe search. Safe search enforces the search engine's built-in safe search settings (like Google SafeSearch) by appending parameters to the search URL, ensuring explicit content is filtered.

Answer

FortiGuard category filter

Answer

URL filter

Answer

DNS filter

Question 12

A FortiGate administrator is troubleshooting an issue where users cannot access an internal HTTPS server (10.10.10.10:443) after enabling SSL deep inspection. The administrator sees that the server's certificate is self-signed. Which TWO actions should the administrator take to allow access while maintaining inspection?

Accepted Answer

Import the server's self-signed certificate into FortiGate's trusted CA list. To allow inspection of a server with a self-signed certificate, you need to either add the server to the exemption list in the SSL/SSH profile (so it is not inspected) or import the server's CA certificate and add it as a trusted CA so that deep inspection can validate the certificate.

Answer

Disable deep inspection on the policy

Answer

Change the policy action to DENY

Answer

Disable certificate validation in the SSL/SSH profile

Question 13

An administrator wants to prevent sensitive data (e.g., credit card numbers) from being sent out of the network via email. Which THREE components must be configured to achieve this?

Accepted Answer

A firewall policy that allows email traffic and applies the email filter profile. To block sensitive data via email, you need: a DLP sensor to define the data pattern, an email filter profile to apply the DLP sensor to email traffic, and a firewall policy that applies the email filter profile to SMTP/IMAP traffic.

Answer

SSL deep inspection to decrypt email traffic if encrypted

Answer

An application control profile to block email applications

Question 14

A FortiGate administrator is configuring IPS to protect against a known exploit targeting a web server. The administrator wants to ensure that the IPS engine can decode the HTTP protocol. Which TWO actions are necessary?

Accepted Answer

Enable the HTTP protocol decoder in the IPS sensor. IPS protocol decoders are enabled per protocol. For HTTP, you need to enable the HTTP decoder. Additionally, if the traffic is HTTPS, SSL deep inspection must be enabled to decrypt the traffic so the decoder can analyze it.

Answer

Configure an IP pool for the web server

Answer

Set the IPS action to 'block'

Answer

Disable the FTP protocol decoder

Question 15

An administrator configures a web filter profile with FortiGuard category blocking and URL filter to allow example.com. Users report that example.com is still blocked. What is the most likely cause?

Accepted Answer

The FortiGuard category action is set to 'block' and takes precedence over the URL filter allow rule. In FortiOS, the FortiGuard category action takes precedence over URL filter exceptions unless the URL filter is configured with an action of 'allow' and a higher priority order. By default, category blocking overrides individual URL allow rules.

Answer

The URL filter requires deep inspection to be enabled

Answer

The URL filter entry is placed after the FortiGuard category in the policy

Answer

The DNS filter is blocking example.com before the web filter is evaluated