NSE4 Security Profiles Practice Test 8 — 15 Questions

Question 1

An administrator configures an antivirus profile in proxy-based inspection mode on a FortiGate. However, SMTP traffic is not being scanned for viruses. The firewall policy includes the antivirus profile and the FortiGate has a valid FortiGuard subscription. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SMTP protocol is not enabled in the proxy options of the security profile. In proxy-based inspection mode, the antivirus profile relies on the proxy options to determine which protocols to scan. If SMTP is not explicitly enabled in the proxy options of the security profile, the FortiGate will not inspect SMTP traffic for viruses, even if the antivirus profile is applied to the policy and the FortiGuard subscription is valid.

Answer

Flow-based inspection is required for SMTP scanning

Answer

The FortiGate does not have a valid SSL certificate for SMTP inspection

Answer

The antivirus profile is configured to scan only HTTP traffic

Question 2

Which IPS detection method uses a baseline of normal traffic and alerts when deviations exceed a threshold?

Accepted Answer

Anomaly detection. Anomaly detection establishes a baseline of normal network traffic patterns and triggers alerts when observed traffic deviates significantly from that baseline. This method is effective for identifying unknown or zero-day attacks that do not match predefined signatures, as it relies on statistical or behavioral analysis rather than fixed patterns.

Answer

Rate-based detection

Answer

Signature-based detection

Answer

Protocol decode-based detection

Question 3

An administrator configures an application control profile to block social media applications. Users can still access Facebook and Twitter via web browsers. What is the most likely reason?

Accepted Answer

The firewall policy has SSL/SSH inspection set to 'certificate-inspection' instead of 'deep-inspection'. When SSL/SSH inspection is set to 'certificate-inspection' (default), the FortiGate only inspects the certificate handshake and cannot decrypt the encrypted application-layer traffic. Social media applications like Facebook and Twitter use HTTPS, so without deep inspection (full decryption), the application control profile cannot identify and block the application signatures within the encrypted payload. Deep inspection is required to decrypt the traffic and allow the IPS engine to match application signatures.

Answer

The application signatures for Facebook and Twitter are not up to date

Answer

The application control profile is set to 'monitor' instead of 'block'

Answer

The firewall policy is configured with flow-based inspection

Question 4

An administrator runs the command 'diagnose ips anomaly list' and sees many entries for 'tcp_src_session' with high counts. Users report slow internet. What is the most likely issue?

Accepted Answer

A host on the network is infected with malware that is generating many outbound connections. The 'diagnose ips anomaly list' command displays anomalies detected by the IPS engine, and 'tcp_src_session' tracks the number of TCP sessions originating from a single source IP. A high count indicates a single host is initiating an excessive number of outbound TCP connections, which is a classic sign of malware infection (e.g., a botnet client or worm) that is generating numerous outbound connections, consuming bandwidth and causing slow internet for users.

Answer

The IPS signature database is corrupted

Answer

The FortiGate has a hardware failure

Answer

The FortiGate is under a DDoS attack

Question 5

A company policy requires that all web searches by employees use safe search. Which setting should be configured in the web filtering profile?

Accepted Answer

Enable 'Enforce 'Safe Search' on Google, Bing, and Yahoo'. The 'Enforce Safe Search' setting in a FortiGate web filtering profile forces Google, Bing, and Yahoo to use their built-in safe search parameters (e.g., &safe=active for Google). This ensures that all web searches from the network comply with the company policy by appending the required query strings to search URLs, blocking explicit content at the search engine level.

Answer

Enable 'Restrict YouTube Access'

Answer

Create a URL filter to block URLs with 'safe search'

Answer

Set the 'Action' for FortiGuard categories to 'Warning'

Question 6

An administrator configures a data leak prevention (DLP) profile to detect credit card numbers in outgoing emails. However, no violations are logged. The email filter profile is applied with the DLP profile on the same policy. What is the most likely cause?

Accepted Answer

The SSL inspection profile on the policy is set to 'certificate-inspection' only. DLP scanning requires that the traffic be inspected. If the traffic is encrypted and not decrypted, DLP cannot see the content.

Answer

The credit card numbers are being sent in PDF attachments, which are not scanned

Answer

The DLP profile is not applied to SMTP traffic

Answer

The FortiGate needs a FortiSandbox license for DLP to work

Question 7

Which SSL/TLS inspection mode only validates the server certificate without decrypting the traffic?

Accepted Answer

Certificate inspection. Certificate inspection is the correct answer because it validates the server certificate's authenticity and expiration without decrypting the traffic. This mode checks the certificate chain and revocation status using OCSP or CRLs, but the encrypted payload remains untouched, preserving end-to-end encryption.

Answer

Deep inspection

Answer

Flow-based inspection

Answer

Proxy-based inspection

Question 8

An administrator configures an email filter profile to block spam. Despite correct configuration, spam emails still reach users' inboxes. The FortiGate is deployed as a transparent bridge. What is the most likely reason?

Accepted Answer

The firewall policy is using flow-based inspection, which does not support SMTP proxy. In a transparent bridge deployment, FortiGate uses flow-based inspection by default, which does not support SMTP proxy-based email filtering. The email filter profile requires proxy-based inspection to intercept and block spam at the SMTP protocol level. Without enabling proxy-based inspection on the firewall policy, the FortiGate cannot apply the email filter profile effectively, allowing spam to pass through.

Answer

The FortiGate does not have a valid FortiGuard license

Answer

The emails are encrypted with TLS and deep inspection is not enabled

Answer

The email filter profile is set to 'monitor' instead of 'block'

Question 9

A FortiGate administrator needs to configure a policy so that traffic to a specific external server is exempted from SSL deep inspection. Which method should be used?

Accepted Answer

Add the server's address to the 'SSL/SSH Inspection Profile' exemptions list. The SSL/SSH Inspection Profile includes an 'Exemptions' list where you can specify destination addresses that should bypass SSL deep inspection. This allows traffic to a specific external server to be excluded from SSL inspection without creating a separate firewall policy, ensuring that other security profiles (like antivirus, IPS, and web filtering) still apply to that traffic.

Answer

Create a separate firewall policy without SSL inspection for that server

Answer

Disable the IPS sensor on that policy

Answer

Set the antivirus profile to 'monitor' only

Question 10

An administrator wants to detect and prevent malware outbreaks. The FortiGate is integrated with FortiSandbox. Which TWO actions should be taken to ensure files are sent to FortiSandbox for analysis?

Accepted Answer

Enable FortiSandbox in the antivirus profile settings. To leverage FortiSandbox, the antivirus profile must be configured to send files to FortiSandbox, and the inspection mode must be proxy-based for file submission.

Answer

Set the firewall policy inspection mode to flow-based

Answer

Enable deep inspection for HTTPS traffic

Answer

Disable the antivirus profile on the policy

Question 11

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. HTTPS traffic is encrypted with SSL/TLS. Without SSL/TLS deep inspection enabled on the firewall policy, FortiGate cannot decrypt the traffic to scan it for viruses. The antivirus profile can only scan decrypted content, so deep inspection must be enabled for the antivirus to inspect HTTPS traffic.

Answer

The FortiGuard antivirus subscription has expired

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Question 12

An admin has configured an application control profile to block 'Facebook' and 'Twitter' using application signatures. Users can still access these sites via HTTPS. The firewall policy has SSL deep inspection enabled and the application control profile is applied. What is the MOST likely cause?

Accepted Answer

The application signatures for Facebook and Twitter are outdated. The most likely cause is that the application signatures for Facebook and Twitter are outdated. FortiGate application control relies on regularly updated signatures to identify applications. If the signatures are not current, the FortiGate may not recognize the application traffic, especially for frequently changing services like social media. While SSL deep inspection is enabled, correct signatures are still required to identify the application by host header or SNI. Options such as the application control profile having insufficient inspection settings or users using IP addresses are less likely because SSL inspection is enabled and the profile is applied.

Answer

The application control profile does not have deep inspection enabled for HTTPS traffic

Answer

Users are accessing the sites via IP address instead of domain name

Answer

The firewall policy is using a proxy policy instead of an explicit policy

Question 13

A FortiGate is configured to use a DNS filter profile to block access to malicious domains. However, users can still reach a known malicious domain. The DNS filter profile is applied to the firewall policy. Which step should the admin take FIRST to troubleshoot?

Accepted Answer

Check if DNS traffic is matching the correct firewall policy. The admin should verify that DNS traffic (port 53) is matching the firewall policy with the DNS filter applied. If DNS queries bypass the policy (e.g., they are allowed by a different policy), the DNS filter will not be applied.

Answer

Enable DNS inspection logging to see if the domain is being flagged

Answer

Check if the FortiGuard DNS filter database is up to date

Answer

Verify that the domain is in the FortiGuard DNS category list

Question 14

An admin runs the following command on a FortiGate: 'diagnose sys session filter dport 443' and sees output: 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate?

Accepted Answer

The session is in the SYN_SENT state and is not yet fully established. The output shows 'proto=6' (TCP), 'proto_state=01', 'duration=3600', and 'expire=3599'. In FortiGate's session table, proto_state=01 for TCP indicates the SYN_SENT state, meaning the session has sent a SYN but has not yet received the SYN-ACK. This confirms the session is not fully established. Option B correctly identifies this as a half-open session in the SYN_SENT state.

Answer

The session is stuck in a half-open state due to a firewall policy misconfiguration

Answer

The session is fully established and has been active for 3600 seconds

Answer

The session is using UDP protocol

Question 15

A FortiGate administrator wants to block all traffic to a known malicious IP address range using the Intrusion Prevention System (IPS). Which IPS configuration method is most appropriate?

Accepted Answer

Create a custom IPS signature that matches the IP range. FortiGate's IPS allows administrators to create custom signatures that can match specific IP addresses or ranges using the 'source-ip' or 'destination-ip' filter criteria. This is the most direct and precise method to block traffic to a known malicious IP range, as predefined signatures typically target application-layer vulnerabilities or exploit patterns, not arbitrary IP addresses.

Answer

Use a predefined IPS signature for known malicious IPs

Answer

Configure an IPS anomaly detection rule to block the IP range

Answer

Use a local IPS signature database