NSE4 Security Profiles Practice Test 9 — 15 Questions

Question 1

Which security profile type is used to prevent sensitive data such as credit card numbers from being sent out of the network via email or web traffic?

Accepted Answer

DLP profile. A DLP (Data Loss Prevention) profile is specifically designed to inspect content in transit (e.g., email, web traffic) and block or alert on sensitive data patterns such as credit card numbers, Social Security numbers, or other regulated data. Unlike other security profiles, DLP uses predefined or custom data identifiers and pattern matching to enforce data protection policies, making it the correct choice for preventing sensitive data exfiltration.

Answer

Email filter profile

Answer

Antivirus profile

Answer

Web filter profile

Question 2

An administrator has configured an SSL deep inspection profile with 'certificate inspection' for a firewall policy. Users report that they receive certificate errors when accessing HTTPS sites. What is the MOST likely reason?

Accepted Answer

The web server uses a self-signed certificate which is blocked by the inspection profile. With 'certificate inspection' mode, the FortiGate does not decrypt traffic or present its own certificate to clients. It only inspects the server certificate during the SSL handshake. If the inspection profile is configured to block invalid certificates (e.g., self-signed, expired, untrusted CA), and the web server uses a self-signed certificate, the FortiGate will drop the connection. Users may then see a certificate error or connection failure in their browsers. Option C is incorrect because certificate inspection never involves the FortiGate's CA certificate; that is only used in full SSL inspection when re-signing certificates.

Answer

The certificate installed on the FortiGate for SSL inspection is expired

Answer

The users' browsers do not trust the FortiGate's CA certificate

Answer

The FortiGate is not configured to re-sign certificates with its own CA certificate

Question 3

A FortiGate is configured to integrate with FortiSandbox for advanced threat detection. The antivirus profile is set to send files to FortiSandbox when a virus is detected. What action does FortiGate take on the file while it is being analyzed by FortiSandbox?

Accepted Answer

Blocks the file until a verdict is received from FortiSandbox. When FortiGate sends a file to FortiSandbox for analysis, the default action is to block the file until a verdict is received. This ensures that potentially malicious files are not allowed to pass through the network while they are being inspected. Option B correctly describes this behavior.

Answer

Quarantines the file on the FortiGate

Answer

Immediately blocks the file and logs the event

Answer

Allows the file to pass through and logs the event

Question 4

Which security profile is used to detect and prevent network-based attacks by analyzing traffic patterns and comparing them against known attack signatures?

Accepted Answer

IPS profile. The Intrusion Prevention System (IPS) profile is specifically designed to detect and prevent network-based attacks by inspecting traffic patterns and comparing them against a database of known attack signatures. Unlike other security profiles that focus on content or application-layer threats, the IPS profile operates at the network and transport layers to identify malicious patterns such as exploit attempts, buffer overflows, and denial-of-service attacks.

Answer

DLP profile

Answer

Web filter profile

Answer

Antivirus profile

Question 5

An administrator configures an email filter profile to block spam. Users complain that legitimate emails from a specific partner are being blocked. The admin wants to allow emails from that partner's domain without disabling spam filtering for other domains. What is the BEST approach?

Accepted Answer

Add the partner's domain to the IP allowlist in the email filter profile. Adding the partner's domain to the IP allowlist in the email filter profile is the best approach because it creates a specific exception for that domain while keeping spam filtering active for all other traffic. The allowlist overrides the spam detection engine for matching senders, ensuring legitimate emails are not blocked without weakening the overall security posture.

Answer

Increase the spam threshold until the emails pass

Answer

Disable spam filtering for the entire firewall policy

Answer

Create a separate firewall policy for the partner's traffic without email filtering

Question 6

A FortiGate administrator notices that some users can bypass the web filter to access prohibited categories. The web filter profile is applied to the firewall policy. Which TWO actions should the admin take to determine why the filter is being bypassed? (Choose two.)

Accepted Answer

Check if the firewall policy that the traffic matches has the web filter profile applied. To determine why the web filter is being bypassed, the administrator should first verify that the web filter profile is correctly applied to the firewall policy that the traffic matches (option B). Without proper policy assignment, the filter will not be enforced. Additionally, enabling SSL deep inspection (option D) is crucial because the web filter relies on inspecting HTTPS traffic to see the actual hostnames; without it, encrypted traffic can bypass the filter. Options A and C are incorrect: connectivity to FortiGuard is needed for URL categorization but not the direct cause of bypass, and DNS filter is separate. Option E is client-side and not the root cause.

Answer

Ensure that the FortiGate has connectivity to FortiGuard

Answer

Verify that the DNS filter is also applied to the same policy

Answer

Examine the client's browser proxy settings

Question 7

An administrator wants to configure a DNS filter to block access to known malicious domains and also enforce safe search on search engines. Which THREE settings are required in the DNS filter profile? (Choose three.)

Accepted Answer

Add entries to the static domain blocklist. Adding entries to the static domain blocklist allows the administrator to manually specify known malicious domains that should be blocked regardless of FortiGuard category ratings. This provides a hard-coded block for domains that may not yet be categorized or that the administrator wants to ensure are always blocked.

Answer

Configure a DNS sinkhole IP address

Answer

Specify external DNS servers for resolution

Question 8

A FortiGate is configured with an application control profile to allow only 'business-approved' applications. Users are still able to use Skype for Business. The admin wants to ensure that only Skype for Business is allowed and other Skype variants are blocked. Which THREE steps should the admin take? (Choose three.)

Accepted Answer

Identify the exact application signatures for Skype for Business. The admin must first identify the exact application signatures for Skype for Business to distinguish it from other Skype variants. FortiGate's application control uses predefined signatures to classify traffic, and without knowing the specific signature IDs (e.g., 'Skype.For.Business'), the admin cannot selectively allow or block applications in the profile.

Answer

Enable logging for all traffic to verify the application being used

Answer

Create a custom application signature for Skype for Business

Question 9

A network administrator configures a web filtering profile to block access to the 'Social Networking' FortiGuard category. However, users can still access Facebook. The firewall policy has web filtering enabled. What is the MOST likely reason?

Accepted Answer

The web filter options are not set to use FortiGuard rating lookup. The web filtering profile must have its rating lookup option set to 'FortiGuard' to use the FortiGuard category database. If it is set to 'Local' or 'Disabled', the FortiGuard categories are not enforced, allowing access to sites like Facebook even though the category is blocked.

Answer

The Facebook URL is cached in the user's browser

Answer

The FortiGuard web filter database is outdated

Answer

The firewall policy does not have SSL deep inspection enabled

Question 10

An administrator needs to block all traffic from an application that uses a proprietary protocol not recognized by any application signature. Which security profile method should be used to block this traffic?

Accepted Answer

Use an IPS profile with a custom signature based on protocol anomalies. IPS with custom signatures can detect and block traffic based on protocol anomalies or patterns, even without a pre-defined application signature.

Answer

Create an application control profile and add a custom application signature

Answer

Use a web filter profile to block by URL

Answer

Use a data leak prevention (DLP) profile to match on data patterns

Question 11

An administrator runs 'diagnose ips anomaly list' and sees many 'tcp_syn_flood' entries. The IPS profile has anomaly detection enabled with action 'pass'. The administrator wants to block such attacks. What change is required?

Accepted Answer

Change the action for the anomaly from 'pass' to 'block'. The 'pass' action in the IPS anomaly detection configuration instructs the FortiGate to only log the detected anomaly without taking any blocking action. Changing the action to 'block' ensures that when the 'tcp_syn_flood' anomaly is detected, the FortiGate will actively drop the offending packets, thereby mitigating the SYN flood attack.

Answer

Increase the threshold for the anomaly

Answer

Enable flow-based inspection on the policy

Answer

Add a DoS policy from the same source

Question 12

What is the purpose of enabling 'DNS filter' in a security profile?

Accepted Answer

To block DNS queries to known malicious domains. The primary purpose of DNS filter is to block DNS queries to known malicious domains, leveraging threat intelligence feeds like FortiGuard to prevent users from reaching malicious sites. Option A is incorrect: DNS filter does not cache responses; caching is handled by a DNS resolver or forwarder. Option B is incorrect: while DNS filter can help detect some tunneling patterns, its main function is not specifically to prevent DNS tunneling; that typically requires advanced inspection like deep packet inspection or anomaly detection. Option C is incorrect: enforcing safe search is a separate feature often implemented via web filter or search engine policies, not DNS filter.

Answer

To cache DNS responses for faster browsing

Answer

To prevent DNS tunneling attacks

Answer

To enforce safe search on search engines

Question 13

Which security profile is used to detect and prevent spam email messages?

Accepted Answer

Email filter profile. The Email Filter profile is specifically designed to detect and prevent spam by analyzing SMTP traffic, applying techniques such as DNS-based Blackhole Lists (DNSBL), email reputation filtering, and heuristic analysis to identify unsolicited bulk email. Unlike other security profiles, it operates at the application layer for email protocols (SMTP, POP3, IMAP) to enforce anti-spam policies.

Answer

DLP profile

Answer

Web filter profile

Answer

Antivirus profile

Question 14

A FortiGate with antivirus in flow-based inspection mode is not detecting a known virus in HTTP traffic. The same virus is detected when using proxy-based inspection. What is the most likely reason?

Accepted Answer

Flow-based inspection does not reassemble files or unpack archives, so it misses some viruses. Flow-based inspection processes traffic as a stream without performing full file reassembly or unpacking archives that proxy-based inspection performs. This allows some viruses to evade detection.

Answer

Flow-based inspection requires FortiSandbox integration to detect viruses

Answer

The antivirus signature database is outdated for flow-based inspection

Answer

Flow-based inspection only scans on explicit proxy policies

Question 15

An administrator wants to block upload of files containing credit card numbers via web forms. Which security profile should be used?

Accepted Answer

Data leak prevention (DLP) profile. DLP (Data Leak Prevention) profile can inspect content for sensitive data patterns like credit card numbers and block uploads.

Answer

Antivirus profile

Answer

Web filter profile

Answer

Application control profile