NSE4 Security Profiles Practice Question
A network administrator notices that an IPS sensor is generating excessive false positives for a specific signature. The administrator wants to exclude traffic from a trusted internal server (IP 10.1.1.100) from inspection for that signature only, while keeping other signatures active. Which configuration change should the administrator apply?
⚠ Common exam trap
Candidates often confuse the 'exempt list' (which bypasses all IPS inspection for a host) with an 'IPS filter' (which can exclude traffic from a specific signature only), leading them to choose option C incorrectly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IPS filter that excludes the server's source IP address from the signature.
An IPS filter allows the administrator to define a rule that excludes traffic from a specific source IP address (10.1.1.100) from inspection for a particular signature, while leaving all other signatures active. This granular approach ensures that false positives for that signature are reduced without disabling the signature entirely or affecting other traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the signature action to 'pass' and use an application control profile to bypass the server.
Why it's wrong here
Setting the signature action to 'pass' globally changes the behavior for all traffic matching that signature, so the false positive for the trusted server is allowed, but so is every other instance of that same attack pattern across the network. An application control profile is an unrelated mechanism—it identifies traffic by application characteristics (e.g., web vs. mail), not by IPS vulnerability signatures—and cannot be used to bypass a specific server for a specific IPS signature. The correct way to apply 'pass' selectively would be an IPS filter, not an application control profile.
- ✗
Disable the signature in the IPS sensor configuration.
Why it's wrong here
Disabling the signature in the IPS sensor configuration removes that signature from the detection engine entirely, meaning no host on any interface or VLAN will be inspected for that vulnerability. This is far broader than the administrator's goal of ignoring a false positive from a single trusted server while still detecting the same attack from other sources. It would silently open the entire network to exploitation through that vector, so it is not a valid solution.
- ✗
Add the server's IP to the exempt list in the IPS sensor.
Why it's wrong here
The exempt list in an IPS sensor is an all-or-nothing bypass: when you add the server's IP, the sensor skips all IPS signatures for that source IP, not just the one generating the false positive. This leaves the server unprotected against every other attack vector, including unrelated critical signatures that may be newly added. The requirement is to suppress a single signature for that server, so a source-based exemption is too broad and also prevents the sensor from inspecting other malicious traffic from the same host.
- ✓
Create an IPS filter that excludes the server's source IP address from the signature.
Why this is correct
An IPS filter allows you to create a conditional override for a specific signature based on attributes such as the source IP address. In Fortinet, you can set the signature's action to 'pass' or 'monitor' only when the source IP matches the trusted server, leaving the default (typically 'block') intact for all other sources. This gives exactly the required selectivity: the false positive is silently allowed, while the signature remains fully active for the rest of the network.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.