NSE4 Security Profiles Practice Question
A FortiGate is configured with flow-based inspection and an IPS profile. The administrator runs 'diagnose ips session list' and sees many sessions with 'state=bypass'. What does this indicate?
⚠ Common exam trap
The trap here is that candidates often misinterpret 'bypass' as a failure or misconfiguration, when in fact it is a normal operational state for hardware-accelerated sessions in flow-based mode.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The sessions are being offloaded to the NPU and are not inspected by IPS
When a FortiGate uses flow-based inspection, sessions that are offloaded to the Network Processor Unit (NPU) are not inspected by the IPS engine. The 'state=bypass' in the 'diagnose ips session list' output indicates that these sessions are being hardware-accelerated and bypassing the IPS inspection, which is normal behavior for traffic that meets offload criteria.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IPS profile is configured with 'pass' action for all signatures
Why it's wrong here
Setting an IPS profile to 'pass' for all signatures does not create a 'bypass' session state. 'Pass' still means the IPS engine inspects the traffic in the data path, matches signatures, and simply forwards packets because the action tells it not to block. In contrast, a 'bypass' state indicates the session was never sent to the IPS engine at all, typically due to NPU offload. Thus, the session table would not show 'bypass' merely because the configured action is pass.
- ✗
The IPS signatures have expired and are not being applied
Why it's wrong here
Expired IPS signatures do not cause a session to be marked as 'bypass'. When signatures are outdated, the FortiGate still runs the IPS engine and attempts to inspect traffic against whatever signatures are available; it may generate an alert about the signature database version, but the engine remains in the data path. The 'bypass' state specifically means the CPU and IPS engine were bypassed altogether, which is a hardware offload decision independent of signature validity.
- ✗
The FortiGate is under DoS attack and is dropping sessions
Why it's wrong here
A DoS attack may cause the FortiGate to drop sessions or apply DoS policies, but the session state for those sessions will typically be 'drop' or they may never appear as established. The 'bypass' state is not a result of attack mitigation; it indicates that the NPU offloaded the session and forwarded packets without CPU-based IPS inspection. Drops and bypass are distinct session outcomes, and a DoS situation would not label sessions as 'bypass'.
- ✓
The sessions are being offloaded to the NPU and are not inspected by IPS
Why this is correct
In flow-based inspection mode, the FortiGate offloads many sessions to the NPU for high-throughput processing. When a session is offloaded, packets traverse the NPU and are not sent to the CPU, so the IPS engine never inspects them; the session is then marked as 'bypass'. This is expected behavior for traffic that is not explicitly selected for deep inspection, and it explains why the IPS engine reports no inspection. Admins can confirm this by checking the session table via 'diagnose sys session list'.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.