NSE4 Security Profiles Practice Test 8 — 15 Questions

Question 1

A network administrator notices that some users can access blocked web categories despite a web filter profile applied to the policy. The admin runs 'diagnose debug rating' and sees 'rating not allow' for the category. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The web filter profile has an 'override' configured for those users. The 'rating not allow' message in the 'diagnose debug rating' output indicates that the FortiGate's rating engine correctly identified the category as blocked by the web filter profile. However, if an 'override' is configured for specific users or groups, it allows them to bypass the blocked category. This explains why some users can access the site despite the profile blocking it, as the override takes precedence over the profile's default action.

Answer

The policy is not using the correct web filter profile

Answer

DNS filter is allowing the domain

Answer

The FortiGuard web filter database is outdated

Question 2

An administrator wants to block users from uploading sensitive documents through webmail. Which security profile should be configured on the FortiGate to achieve this goal?

Accepted Answer

Data Leak Prevention (DLP). Data Leak Prevention (DLP) is the correct security profile because it is specifically designed to inspect content (e.g., file names, patterns, or keywords) in traffic such as webmail uploads and block sensitive data from leaving the network. DLP sensors can be configured with rules to match patterns like credit card numbers, social security numbers, or custom keywords, and then take action such as blocking or logging the session.

Answer

Antivirus

Answer

Application control

Answer

Web filter

Question 3

A FortiGate in flow-based mode is configured with an antivirus profile to block infected files. A user downloads a .zip file containing a known virus, but the download is allowed and the file is not quarantined. What is the MOST likely reason?

Accepted Answer

Flow-based inspection does not decompress archives by default. In flow-based inspection mode, FortiGate does not decompress archive files (such as .zip) by default. This means the antivirus engine cannot inspect the contents of the compressed file, so even if a known virus is inside, it will not be detected or blocked. To inspect archives in flow-based mode, you must enable 'deep archive inspection' in the antivirus profile.

Answer

The antivirus profile is not set to 'block' for virus outbreaks

Answer

The virus definition database is outdated

Answer

Flow-based inspection does not support antivirus for .zip archives

Question 4

What is the primary purpose of FortiSandbox integration with FortiGate antivirus?

Accepted Answer

To detect zero-day malware by analyzing file behavior in a sandbox environment. FortiSandbox integration with FortiGate antivirus is designed to detect zero-day malware by analyzing file behavior in a sandbox environment. This allows FortiGate to forward suspicious files that evade signature-based detection to FortiSandbox for dynamic analysis, where behavioral patterns are examined to identify unknown threats. The integration enhances the existing antivirus engine rather than replacing it, providing a layered defense against advanced persistent threats.

Answer

To replace the local antivirus scanning engine

Answer

To perform SSL deep inspection

Answer

To cache antivirus signatures locally

Question 5

An administrator configures an IPS profile to block SQL injection attacks. However, SQL injection traffic is still passing through the FortiGate. The administrator confirms the IPS profile is applied to the correct policy. What is the most likely reason?

Accepted Answer

IPS signatures for SQL injection are disabled in the profile. IPS profiles in FortiGate consist of a set of IPS signatures that can be individually enabled or disabled. If the administrator configured an IPS profile to block SQL injection attacks but the specific SQL injection signatures are disabled within that profile, the FortiGate will not inspect or block that traffic, even if the profile is correctly applied to the policy.

Answer

The firewall policy is in proxy-based mode

Answer

The IPS profile is configured for anomaly detection only

Answer

Deep inspection is required for IPS to work

Question 6

A FortiGate administrator wants to block outgoing DNS requests to known malware domains. Which security profile should be used?

Accepted Answer

DNS filter. DNS Filter is the correct security profile because it is specifically designed to inspect and block DNS queries based on domain names, IP addresses, or categories. By configuring a DNS filter policy with a custom list of known malware domains, the FortiGate can intercept outgoing DNS requests and drop those matching the malicious entries, preventing the resolution of malware domains.

Answer

Application control

Answer

Web filter

Answer

IPS

Question 7

An administrator configures SSL deep inspection with a CA certificate. Users accessing an internal site (internal.company.com) receive a certificate error. The administrator wants to avoid the error without disabling deep inspection. What should be done?

Accepted Answer

Add internal.company.com to the SSL/SSH inspection exemption list. Adding internal.company.com to the SSL/SSH inspection exemption list tells the FortiGate to bypass deep inspection for that specific site, allowing the internal CA certificate to be used without triggering a certificate error. This avoids the error while keeping deep inspection enabled for all other traffic, which is the administrator's goal.

Answer

Replace the CA certificate with a self-signed one

Answer

Use certificate inspection instead of deep inspection

Answer

Disable certificate validation in the deep inspection profile

Question 8

What is the difference between certificate inspection and full SSL deep inspection on a FortiGate?

Accepted Answer

Certificate inspection only validates the server certificate; deep inspection decrypts and inspects the content. Certificate inspection only validates the server certificate's authenticity and checks for revocation, but does not decrypt the traffic payload. Full SSL deep inspection (also called SSL inspection) decrypts the entire SSL/TLS session, allowing the FortiGate to inspect the content for threats like malware, data leaks, or policy violations. This is why option B is correct: certificate inspection validates the certificate, while deep inspection decrypts and inspects the content.

Answer

Certificate inspection decrypts traffic; deep inspection does not

Answer

Deep inspection is faster than certificate inspection

Answer

Both provide the same level of security

Question 9

An administrator is configuring email filtering on FortiGate to block spam. Which of the following is required for FortiGate to filter inbound email directly?

Accepted Answer

The FortiGate must be configured as an SMTP proxy. FortiGate can filter inbound email directly only when it is configured as an SMTP proxy, which allows it to intercept and inspect SMTP traffic at the application layer. This proxy mode enables the FortiGate to apply email filtering profiles, including anti-spam and antivirus, to SMTP sessions without requiring a separate appliance.

Answer

FortiMail must be deployed as a separate appliance

Answer

SSL deep inspection must be enabled for SMTP traffic

Answer

The email filtering profile must be applied to a policy covering port 110

Question 10

A FortiGate administrator runs the command 'diagnose application urlfilter 0 status' and sees 'status: enable' but users report that some malicious URLs are not blocked. The web filter profile uses FortiGuard categories with 'block' action. What should the administrator check next?

Accepted Answer

The FortiGuard web filter rating service is reachable. The 'diagnose application urlfilter 0 status' command shows that the URL filter process is enabled locally, but if the FortiGate cannot reach the FortiGuard rating service, it cannot retrieve category ratings for URLs. Without a valid rating, the device may allow malicious URLs by default (depending on the 'unrated' action), even if the profile is set to block certain categories. Option B is correct because checking the reachability of the FortiGuard web filter rating service is the logical next step to diagnose why categories are not being enforced.

Answer

The antivirus profile is blocking URL filtering

Answer

The DNS filter is overriding the web filter

Answer

The firewall policy is set to 'accept' without inspection

Question 11

An administrator wants to apply a safe search policy to enforce strict search results on Google, Bing, and Yahoo. Which security profile feature should be used?

Accepted Answer

Web filter safe search enforcement. Web filter safe search enforcement is the correct feature because it directly integrates with search engines (Google, Bing, Yahoo) to force the use of their built-in safe search parameters (e.g., Google's 'safe=active' parameter appended to URLs). This ensures that explicit content is filtered at the source, regardless of the user's browser settings or search engine choice.

Answer

Application control to block search engines

Answer

DNS filter to block search engine domains

Answer

Web filter URL filter with keyword blocking

Question 12

A network administrator configures an application control profile to block social media applications. Users can still access Facebook through a web browser. What is the MOST likely reason?

Accepted Answer

Application control is not enabled for HTTPS traffic without deep inspection. Application control relies on deep inspection (SSL/TLS decryption) to identify applications within encrypted HTTPS traffic. Without deep inspection enabled, the FortiGate can only see the encrypted tunnel and cannot inspect the payload to determine that the traffic is Facebook, even if the application control profile is correctly applied. Option B is correct because HTTPS traffic must be decrypted via deep inspection for application control to function.

Answer

The application signatures are outdated

Answer

The firewall policy is in proxy-based mode

Answer

The application control profile is not applied to the correct policy

Question 13

An administrator needs to block users from uploading files containing credit card numbers to external websites. Which TWO actions must be configured? (Choose two.)

Accepted Answer

Enable SSL deep inspection on the firewall policy. SSL deep inspection is required to decrypt HTTPS traffic so the firewall can inspect the content of encrypted uploads for sensitive data like credit card numbers. Without decryption, the DLP profile cannot see the payload of encrypted sessions, rendering the DLP sensor ineffective.

Answer

Apply an antivirus profile to the policy

Answer

Configure application control to block file transfer applications

Answer

Use a web filter to block all upload websites

Question 14

A FortiGate is configured with an IPS profile to detect and block anomalous network behavior. Which THREE types of detection does IPS anomaly detection include? (Choose three.)

Accepted Answer

Port scan detection. Port scan detection is a type of anomaly detection in FortiGate's IPS profile that identifies reconnaissance attempts by monitoring for multiple connection attempts to different ports from a single source. This behavior deviates from normal traffic patterns and is flagged as anomalous, allowing the IPS to block potential scanning activity before an attack progresses.

Answer

Protocol decoding

Answer

Signature-based detection

Question 15

An administrator wants to ensure that all DNS traffic from internal users is filtered by the FortiGate to block malicious domains. Which TWO configurations are necessary? (Choose two.)

Accepted Answer

Apply the DNS filter profile to a firewall policy that matches DNS traffic. A DNS filter profile must be applied to a firewall policy that matches DNS traffic for the filtering to take effect. Without this policy-level binding, the DNS filter profile is not enforced, even if it is configured. This ensures that all DNS queries from internal users are inspected by the FortiGate.

Answer

Set DNS server to FortiGate's IP

Answer

Enable sinkhole on the DNS filter profile

Answer

Configure SSL deep inspection for DNS over HTTPS