NSE4 Security Profiles Practice Question
A network administrator wants to prevent users from downloading files with .exe extensions via HTTP and HTTPS. Which security profile feature should be used?
⚠ Common exam trap
Candidates often confuse URL filtering (which blocks sites) with file extension filtering (which blocks specific file types within allowed sites), leading them to choose the web filter profile option instead of the antivirus profile.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Antivirus profile with 'block' action for file pattern matching .exe
The Antivirus profile in FortiGate can be configured with a file pattern matching rule to block files based on their extension, such as .exe. This feature operates at the application layer, inspecting HTTP and HTTPS traffic (via SSL inspection) to identify and block executable files before they reach the user. Option C is correct because it directly uses the antivirus engine's file pattern matching capability to enforce this policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Web filter profile with URL filter to block .exe sites
Why it's wrong here
A web filter profile uses FortiGuard URL categorization or custom URL patterns to control which websites users may visit; it does not inspect the content of downloads. Blocking '.exe' sites only blocks URLs containing '.exe' in the path, which is unreliable because many legitimate sites serve executable files from opaque URLs or via HTTPS where the full path is hidden from inspection. Even with a strict URL block, files can be renamed or hosted on allowed domains, so this approach fails to prevent the actual download of executable content.
- ✗
Application control profile to block file transfer applications
Why it's wrong here
Application control identifies and controls network traffic based on application signatures, typically for peer-to-peer, instant messaging, or file-transfer applications like FTP or BitTorrent. It does not evaluate the file type of content being transferred by a web browser; HTTP/HTTPS traffic from a browser is treated as the browser application, not as a file-transfer utility. Since the goal is to block any .exe file downloaded via HTTP, application control cannot be used for file extension filtering and would not prevent a browser from downloading an executable from a website.
- ✓
Antivirus profile with 'block' action for file pattern matching .exe
Why this is correct
The antivirus profile in FortiOS includes a file filter (or file pattern) capability that can match filenames, file extensions, or MIME types during protocol decoding. By configuring a file pattern for '.exe' and setting the action to 'block', FortiGate inspects the file's extension as it passes through HTTP (or HTTPS when deep inspection is enabled) and discards the file before it reaches the user. This is the correct method because the antivirus engine works at the content layer, not at the URL or application layer, and can enforce file-type blocking regardless of the website hosting the file.
- ✗
IPS profile to block executable file transfers
Why it's wrong here
An IPS profile uses attack signatures and anomaly detection to identify network intrusions, exploits, and malicious traffic patterns, but it is not designed to enforce file-policy rules. While some IPS signatures might flag specific malware executables, they cannot generically block all .exe files, especially legitimate ones that carry no exploit signature. Relying on IPS for file extension blocking would require continuous signature updates for every possible executable and still would miss modified or unknown files, making it an unsuitable alternative for this requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.