IPS Anomaly Shows 'Pass' Action: Sensor May Not Be Applied
An administrator has configured an IPS profile with an anomaly detection sensor for 'tcp_syn_flood'. After applying the profile to a firewall policy, users report intermittent connectivity issues. The administrator runs 'diagnose ips anomaly list' and sees entries for 'tcp_syn_flood' with action 'pass'. What is the MOST likely cause of the connectivity issues?
Quick Answer
The answer is that the anomaly sensor is not actually applied, and the 'pass' action shown in the 'diagnose ips anomaly list' output indicates default entries rather than the configured sensor. This is correct because when a custom IPS anomaly sensor for 'tcp_syn_flood' is properly attached to a firewall policy, the action for that anomaly should reflect the administrator's configuration—typically 'block'—not the default 'pass'. The connectivity issues reported are likely unrelated to IPS, and the administrator should first verify the sensor is actually applied to the policy, as the list only shows built-in defaults. On the Fortinet NSE 4 exam, this question tests your understanding of how IPS anomaly sensors are applied and how to verify their activation using CLI diagnostics; a common trap is assuming any entry in the anomaly list means the sensor is active. Remember the memory tip: "If it shows 'pass', the sensor didn't last"—meaning a 'pass' action in the anomaly list usually means the custom sensor hasn't been applied.
⚠ Common exam trap
A common mix-up: candidates assume the 'diagnose ips anomaly list' output reflects the configured sensor action, when in fact it shows the active entries in the IPS engine, which may be defaults if the custom sensor is not applied, leading them to misinterpret the cause of connectivity issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The anomaly sensor is not actually applied; the list shows default entries
The 'diagnose ips anomaly list' command shows default entries for 'tcp_syn_flood' with action 'pass' only when no custom anomaly sensor is applied to the policy. The administrator configured an IPS profile with an anomaly detection sensor, but if the profile is not correctly attached to the firewall policy or the sensor is not enabled, the firewall falls back to default anomaly entries that are set to 'pass' (i.e., no blocking). The intermittent connectivity issues are therefore not caused by the anomaly sensor blocking traffic, but by another misconfiguration or unrelated network problem.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator runs 'diagnose ips anomaly list' and sees many 'tcp_syn_flood' entries. The IPS profile has anomaly detection enabled with action 'pass'. The administrator wants to block such attacks. What change is required?
hard- A.Increase the threshold for the anomaly
- B.Enable flow-based inspection on the policy
- C.Add a DoS policy from the same source
- ✓ D.Change the action for the anomaly from 'pass' to 'block'
Why D: The 'pass' action in the IPS anomaly detection configuration instructs the FortiGate to only log the detected anomaly without taking any blocking action. Changing the action to 'block' ensures that when the 'tcp_syn_flood' anomaly is detected, the FortiGate will actively drop the offending packets, thereby mitigating the SYN flood attack.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.