NSE4 Security Profiles Practice Question
A FortiGate administrator runs the following command and sees: 'diagnose ips anomaly list' returns no entries, but the IPS sensor is configured with anomaly signatures. What is the MOST likely reason the signatures are not appearing?
⚠ Common exam trap
Candidates often assume 'diagnose ips anomaly list' shows all configured anomaly signatures, but it only shows those that have been triggered by exceeding thresholds, leading them to incorrectly suspect a configuration or policy issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The anomaly signatures have not triggered any events yet because traffic thresholds have not been exceeded.
The 'diagnose ips anomaly list' command displays only anomaly signatures that have been triggered and are currently in a state where thresholds have been exceeded. If no entries appear, it means the configured anomaly signatures have not yet detected traffic surpassing their defined thresholds (e.g., packets per second, connections per second). Anomaly signatures are threshold-based and only become active when the monitored traffic exceeds the configured limits, at which point they would appear in the list.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IPS sensor is configured in 'passive' mode, which suppresses anomaly detection.
Why it's wrong here
Passive mode in an IPS sensor instructs FortiGate to detect and log intrusions without blocking them, but it does not disable anomaly detection or its logging. Anomaly signatures continue to evaluate traffic and populate the list whenever a threshold is crossed. Thus, passive mode would still show anomaly entries, so it cannot explain an empty list.
- ✓
The anomaly signatures have not triggered any events yet because traffic thresholds have not been exceeded.
Why this is correct
Anomaly signatures in FortiOS are rate-based detectors that only generate an event when traffic exceeds a configured threshold, such as packets per second or concurrent connections. The command output lists only triggered anomalies, not configured ones. If no traffic has exceeded the threshold, the list remains completely empty, which is a normal operational state.
- ✗
Anomaly signatures are not displayed by 'diagnose ips anomaly list'; they require a different command.
Why it's wrong here
The FortiOS command 'diagnose ips anomaly list' is specifically designed to display current anomaly detection events and their occurrence counts. There is no separate command required to view anomaly signatures; other 'diagnose ips' subcommands show configuration or statistics, but this one shows the list. Therefore, using this command is correct, and an empty output indicates no anomalies have been recorded.
- ✗
The IPS sensor is not enabled on any firewall policy.
Why it's wrong here
An IPS sensor must be attached to a firewall policy for its inspection engine to process live traffic, but the anomaly list is a runtime output of events, not a status check of policy assignment. Even if the sensor is not enabled on any policy, the list would still be empty only because no traffic was inspected; however, the direct and most plausible cause of an empty list is that no threshold has been exceeded. The absence of policy attachment would require confirmation via policy configuration, not from the anomaly list output.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.