NSE4 Security Profiles Practice Question
A FortiGate is configured with flow-based antivirus and an IPS profile on a policy. The administrator runs 'diagnose ips packet-list' and sees that packets are being forwarded without inspection. What is the most likely reason?
⚠ Common exam trap
Watch out — candidates often assume 'diagnose ips packet-list' always shows all traffic, but they overlook that NPU offloading can bypass the IPS engine entirely, making the command show no inspected packets even when inspection is configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session is offloaded to the NPU and is not being sent to the IPS engine
When a FortiGate offloads a session to the NPU (Network Processor Unit), the traffic bypasses the CPU and therefore does not reach the IPS engine for inspection. The 'diagnose ips packet-list' command shows packets forwarded without inspection because the NPU handles them directly, and flow-based inspection requires the session to be processed by the IPS engine on the CPU. This is the most likely reason when the administrator observes packets bypassing inspection despite having flow-based antivirus and IPS profiles applied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The session is offloaded to the NPU and is not being sent to the IPS engine
Why this is correct
In flow-based inspection, FortiGate ASICs such as the NP6/NP7 processors can offload entire sessions after the initial SYN/connection-setup packets are examined by the CPU. Once offloaded, the IPS engine never sees the remaining packets, so the IPS statistics and logs will show no inspection activity for that flow. This is by design in flow-based mode when the session meets offload criteria, and it does not indicate a misconfiguration or failure.
- ✗
The antivirus profile is set to proxy-based, conflicting with flow-based IPS
Why it's wrong here
A FortiGate security policy can reference both an antivirus profile and an IPS profile, and each profile is applied independently; there is no conflict that would prevent inspection. Furthermore, antivirus inspection mode (proxy-based or flow-based) is configured separately from the IPS inspection mode, and the overall session mode is determined by the first flow-based feature invoked. Even if the AV profile were proxy-based, the IPS engine would still inspect packets in flow-based mode when the session is not offloaded, so this would not explain a complete absence of IPS inspection.
- ✗
The IPS profile is configured with 'monitor' mode instead of 'protect'
Why it's wrong here
Monitor mode in an IPS profile means the sensor will still receive and analyze packets, but instead of dropping malicious traffic it will only generate log messages. Therefore, the IPS engine would still process the session and the inspection would be visible in the session's statistics or logs, just without blocking actions. The observed absence of the IPS engine touching the session cannot be attributed to a monitor versus protect action setting, since both modes require packet inspection to occur.
- ✗
The traffic is UDP and flow-based inspection does not inspect UDP
Why it's wrong here
Flow-based inspection in FortiOS is fully capable of scanning UDP traffic for both IPS and antivirus signatures. UDP sessions are inspected in the same way as TCP sessions when sessions are not offloaded; however, many UDP flows (e.g., DNS, NTP, video streaming) are also candidates for NPU offloading in flow-based mode. Simply being UDP does not exempt the traffic from inspection—it only changes whether the session is offloaded, which depends on the protocol, port, and policy offload settings, not on the inspection engine's protocol support.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.