NSE4 Security Profiles Practice Test 9 — 15 Questions

Question 1

A FortiGate is configured with flow-based antivirus and an IPS profile on a policy. The administrator runs 'diagnose ips packet-list' and sees that packets are being forwarded without inspection. What is the most likely reason?

Accepted Answer

The session is offloaded to the NPU and is not being sent to the IPS engine. Flow-based inspection offloads traffic to the network processor (NPU) for forwarding without sending all packets to the CPU for inspection. The IPS diagnostic output showing packets forwarded without inspection indicates flow-based mode is skipping inspection for non-TCP traffic or when a session is offloaded.

Answer

The antivirus profile is set to proxy-based, conflicting with flow-based IPS

Answer

The IPS profile is configured with 'monitor' mode instead of 'protect'

Answer

The traffic is UDP and flow-based inspection does not inspect UDP

Question 2

A network administrator wants to prevent users from downloading files with .exe extensions via HTTP and HTTPS. Which security profile feature should be used?

Accepted Answer

Antivirus profile with 'block' action for file pattern matching .exe. An antivirus profile can block files by file extension for both HTTP and HTTPS traffic, but only if SSL deep inspection is enabled for HTTPS. The file pattern filter is part of the antivirus profile.

Answer

Web filter profile with URL filter to block .exe sites

Answer

Application control profile to block file transfer applications

Answer

IPS profile to block executable file transfers

Question 3

An administrator configures an application control profile to block 'Facebook' and 'Twitter' using application signatures. Users can still access Facebook via HTTPS. The administrator has enabled deep inspection. What is missing?

Accepted Answer

The firewall policy must have inspection mode set to 'proxy-based' for application control to work with HTTPS. Application control requires the firewall policy to be set to 'proxy-based inspection' for HTTPS traffic. Even with deep inspection enabled, if the policy is flow-based, application control may not inspect HTTPS traffic correctly.

Answer

The application control profile must be applied to both ingress and egress policies

Answer

The application signatures need to be updated to the latest version

Answer

The web filter profile must be set to 'authenticate' for the connection

Question 4

A FortiGate administrator receives reports that some users are receiving spam emails despite an email filter profile being applied to the SMTP traffic. The email filter profile has 'spam' action set to 'discard'. What is the most likely reason spam is still reaching users?

Accepted Answer

The internal email server receives email directly from the internet without passing through the FortiGate. Email filter profiles scan email traffic that passes through the FortiGate. If users are receiving spam from external mail servers that connect directly to the internal mail server without passing through the FortiGate, the email filter will not inspect that traffic.

Answer

The spam dictionary is not updated with latest spam signatures

Answer

The email filter profile is not configured to scan outbound emails

Answer

The email filter profile is applied to the wrong policy direction (inbound vs outbound)

Question 5

An administrator enables deep inspection for HTTPS traffic. Users report that they cannot access some websites because of certificate errors. The administrator wants to override these errors and allow access. What should be configured?

Accepted Answer

Add the websites to the 'SSL/SSH exemption' list in the deep inspection profile. In FortiOS, deep inspection can generate certificate errors for sites with self-signed or mismatched certificates. To allow access despite errors, the administrator can add the affected domains to the 'SSL/SSH exemption' list in the deep inspection profile. This exempts those sites from deep inspection, avoiding the certificate error.

Answer

Disable certificate verification in the deep inspection profile

Answer

Add the websites to the 'FortiGuard category' allow list

Answer

Configure the web filter to allow these websites

Question 6

What is the purpose of the 'safe search' option in a FortiGate web filter profile?

Accepted Answer

It filters explicit content from search engine results. Safe search enforces strict filtering on search engines to block explicit content in search results. It works by redirecting search queries to the safe search versions of supported search engines (Google, Bing, YouTube, etc.) when enabled.

Answer

It enforces the use of HTTPS for search engines

Answer

It allows users to bypass URL filters during safe search

Answer

It blocks all search engine traffic

Question 7

An administrator configured a DLP profile to detect credit card numbers in outgoing emails. The profile is applied to an outbound SMTP policy. Users report that emails with credit card numbers are still being sent successfully. What is the most likely cause?

Accepted Answer

The SMTP traffic is encrypted and deep inspection is not enabled. DLP scanning requires deep inspection if the traffic is encrypted. If SMTP traffic is encrypted with TLS (SMTPS), the FortiGate needs SSL deep inspection to decrypt and inspect the content. Without it, DLP cannot see the credit card numbers.

Answer

The DLP profile is set to 'monitor' instead of 'block'

Answer

The DLP profile is not applied to the correct policy

Answer

The credit card number pattern is not correctly defined

Question 8

A FortiGate is configured with flow-based inspection and an IPS profile. The administrator runs 'diagnose ips session list' and sees many sessions with 'state=bypass'. What does this indicate?

Accepted Answer

The sessions are being offloaded to the NPU and are not inspected by IPS. In flow-based IPS, sessions can be bypassed when the IPS engine determines that further inspection is unnecessary, for example, if the session is considered low-risk or to reduce CPU load. This is normal behavior in flow-based mode.

Answer

The IPS profile is configured with 'pass' action for all signatures

Answer

The IPS signatures have expired and are not being applied

Answer

The FortiGate is under DoS attack and is dropping sessions

Question 9

Which two inspection modes are available for antivirus scanning on a FortiGate?

Accepted Answer

Flow-based and proxy-based. FortiGate supports two inspection modes: flow-based and proxy-based. Flow-based is more efficient with lower latency, while proxy-based offers deeper inspection and more features like content archiving.

Answer

Stateful and stateless

Answer

Inline and passive

Answer

Kernel-based and user-based

Question 10

An administrator configures an application control profile to block 'BitTorrent'. Users are still able to download files using BitTorrent. The administrator has enabled deep inspection and the policy is set to proxy-based. What is the most likely reason the application is not being blocked?

Accepted Answer

The application signatures are out of date. Application control uses application signatures to identify traffic. If the signatures are not up to date, new versions of BitTorrent may not be recognized. Also, if the traffic is encrypted and uses non-standard ports, application control may not detect it if the signatures are not comprehensive.

Answer

BitTorrent uses randomized ports that bypass application control

Answer

The application control profile is not applied to the correct policy

Answer

The policy is set to flow-based instead of proxy-based

Question 11

An administrator wants to block users from uploading files to cloud storage services like Google Drive via HTTPS. Which security profile combination is required?

Accepted Answer

Application control profile to block cloud storage applications, with deep inspection enabled. To block file uploads to HTTPS sites, deep inspection must be enabled to decrypt traffic. Then, application control can be used to identify cloud storage applications, and a DLP or file filter can block uploads. However, the most direct method is to use an antivirus profile with file pattern blocking, but that requires deep inspection. Alternatively, use application control to block the application entirely.

Answer

IPS profile to block file uploads to cloud services

Answer

DNS filter to block Google Drive domain

Answer

Web filter profile with URL filter to block Google Drive

Question 12

A FortiGate administrator is troubleshooting why antivirus scanning is not working for HTTPS traffic. Which TWO steps should be verified?

Accepted Answer

Ensure the firewall policy has SSL/TLS deep inspection enabled. For antivirus to scan HTTPS traffic, deep inspection must be enabled on the firewall policy, and the antivirus profile must be configured with the appropriate inspection mode. Both are required.

Answer

Ensure the antivirus profile is set to proxy-based inspection

Answer

Confirm that the web filter profile is also applied

Answer

Check that the FortiSandbox is online for advanced scanning

Question 13

An administrator wants to block all traffic from the 'P2P' application category but allow traffic from 'File Sharing' applications like Dropbox. Which THREE configurations are required to achieve this?

Accepted Answer

Create an application control profile that sets 'P2P' category to 'block' and 'File Sharing' category to 'allow'. To block P2P and allow File Sharing, the administrator needs to create an application control profile that blocks P2P category and allows File Sharing category. This profile must be applied to a firewall policy that has deep inspection enabled for encrypted traffic. Proxy-based inspection might be needed for granular control, but flow-based also works with deep inspection.

Answer

Set the firewall policy inspection mode to proxy-based

Answer

Apply a web filter profile to override the application control

Question 14

An administrator configures a DLP profile to detect Social Security numbers in outbound traffic. The profile is applied to an outbound HTTP policy. Which TWO additional configurations are necessary for the DLP to inspect HTTPS traffic?

Accepted Answer

Enable SSL/TLS deep inspection on the firewall policy. DLP scanning of HTTPS traffic requires SSL deep inspection to decrypt the traffic. Additionally, the firewall policy must have deep inspection enabled and the DLP profile must be applied. The inspection mode (flow vs proxy) may affect performance but both can work.

Answer

Set the firewall policy inspection mode to proxy-based

Answer

Add an SSL exemption for the destination servers

Answer

Configure a web filter profile to allow the traffic

Question 15

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. Option B is correct because HTTPS uses TLS encryption. Without SSL deep inspection enabled on the policy, FortiGate cannot decrypt and inspect the content of HTTPS traffic. The antivirus profile will only scan unencrypted traffic or traffic where deep inspection has decrypted it first.

Answer

The FortiGuard antivirus subscription has expired

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based