NSE4 Security Profiles Practice Question
A FortiGate configured with IPS anomaly detection is generating false positives for the 'tcp_syn_flood' anomaly. The administrator wants to reduce the false positives without completely disabling the detection. Which action should the administrator take?
⚠ Common exam trap
Watch out — candidates often assume decreasing a threshold makes detection less sensitive (to reduce false positives), but in FortiGate anomaly detection, decreasing the threshold actually increases sensitivity, leading to more false positives.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the threshold value
Increasing the threshold value reduces false positives by requiring a higher rate of TCP SYN packets per second before the 'tcp_syn_flood' anomaly triggers an alert or action. This allows legitimate traffic bursts to pass without being flagged, while still detecting genuine SYN flood attacks. The threshold defines the sensitivity of the anomaly detection; raising it makes the detection less sensitive to low-volume spikes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the anomaly and use a custom IPS signature
Why it's wrong here
Disabling the anomaly removes the threshold-based detection that flags the 'tcp_syn_flood' anomaly, whereas the administrator specifically needs to reduce false positives while keeping detection active. A custom IPS signature detects known attack patterns, not volumetric anomalies, so it cannot adjust the sensitivity of the existing anomaly engine. This option is tempting because custom signatures are a standard method for fine-tuning detection of specific traffic patterns, and would be correct if the false positives stemmed from a particular application behaviour rather than a threshold sensitivity issue.
- ✗
Decrease the threshold value
Why it's wrong here
Decreasing the threshold value lowers the number of SYN packets per second that must be observed before the FortiGate flags a tcp_syn_flood anomaly. Since normal network activity often contains bursts of connection attempts, a lower threshold will more frequently treat legitimate traffic as an attack, increasing false positives. This is the opposite of the administrator's goal and would also increase CPU/alerting load, so it is not a workable remediation.
- ✗
Set the action to 'pass'
Why it's wrong here
Setting the anomaly action to 'pass' would make the FortiGate allow the anomaly-triggering traffic through without blocking, resetting, or quarantining the source. Although this would immediately stop the false positives from disrupting connectivity, it would also eliminate all protection against real SYN floods because the anomaly engine would only log events and never act on them. Since the administrator wants to preserve detection capability, this option sacrifices security rather than solving the threshold mismatch.
- ✓
Increase the threshold value
Why this is correct
Increasing the threshold value adjusts the anomaly's sensitivity so that a significantly larger rate of SYN packets per second is necessary to trigger the tcp_syn_flood anomaly. Legitimate connection bursts will now remain below the alarm level, avoiding false positives, while a genuine flood will still generate enough traffic to exceed the threshold and be blocked. This is the correct tune because it maintains an active defense while suppressing noise from normal traffic patterns.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.