NSE4 Security Profiles Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure anomaly detection for SQL traffic

  Why it's wrong here

  Anomaly detection in FortiGate IPS uses statistical baselines to identify suspicious behavior, such as an unusual spike in traffic volume or a protocol violation, rather than examining payload content for known attack strings. SQL injection is a content-based threat that manifests as specific payload patterns, like ' OR 1=1, which require signature-based IPS rules to detect reliably. Configuring anomaly detection alone would not inspect those payload patterns, so it would not catch SQL injection; thus, that action is wrong.

• ✓

  Update the IPS signature database

  Why this is correct

  Updating the FortiGuard IPS signature database is the core step because SQL injection detection depends on signature patterns that recognize specific attack syntax and variations. Signature packages are regularly updated with new and refined rules for recent SQL injection techniques, such as union-based or time-based blind injection. If the database is outdated, the IPS engine lacks those rules, and the policy may silently ignore crafted SQL payloads. Therefore, to detect SQL injection effectively, an administrator must ensure the IPS database is current.

• ✗

  Disable flow-based inspection and use proxy-based only

  Why it's wrong here

  Flow-based and proxy-based inspection are two alternative modes on FortiGate; IPS can operate in either, and flow-based generally provides adequate signature matching with low latency. Disabling flow-based to force proxy-only is unnecessary and potentially harmful to performance, because it changes the processing path without addressing the detection capability. SQL injection is detected through signature and decoder application, which works in both modes. Thus, making this switch does not improve SQL injection detection and could degrade throughput; it is not a valid corrective action.

• ✓

  Enable protocol decoders for HTTP and SQL

  Why this is correct

  Protocol decoders in FortiGate IPS parse application-layer protocols like HTTP and SQL, allowing the engine to see through encoding, compression, or fragmented transmission and correctly match signatures. For SQL injection, the HTTP decoder normalizes request headers and parameters, while the SQL decoder interprets the query structure so that malicious SQL commands can be identified even if obfuscated. Enabling these decoders is a direct way to increase visibility and detection accuracy for SQL injection. This action is correct because it addresses the traffic context needed for signature matching.

• ✗

  Enable SSL deep inspection on the policy

  Why it's wrong here

  SSL deep inspection decrypts HTTPS traffic so the IPS can examine the plaintext payload; it is essential if the SQL injection occurs inside a TLS session, but it does not itself detect the attack. Without it, encrypted requests would be opaque to the IPS, but the question does not indicate whether the traffic is encrypted. Moreover, enabling SSL inspection requires configuring CA certificates and can impact performance; it is an additional network-security measure, not a primary step for SQL injection detection. Therefore, it is wrong to assume SSL inspection alone is needed or sufficient; it only matters conditionally.