CCNA Security Profiles Questions

Option C is correct because IPS with custom signatures can detect and block traffic based on protocol anomalies or patterns, even without a pre-defined application signature.

DLP sensors operate on traffic that has been decrypted if necessary. If the email is sent over TLS, the FortiGate needs SSL deep inspection to see the email content. Also, the DLP sensor needs to be applied to the correct direction (e.g., both send and receive).

Options B and C are correct: Safe search enforcement is done via web filter options or URL filter add-ons. DNS filter can also reroute search queries to enforce safe search.

In FortiGate, to allow a specific site that is blocked by a category, you add a URL filter entry with the action 'Allow' above the category block. URL filter entries are evaluated first and can override the category action.

IPS signatures can be set to 'block' but the actual action in the firewall policy's IPS profile may be overridden by the policy's inspection mode or the IPS profile's configuration. Additionally, the signature's action must not be set to 'monitor' or 'pass' at the sensor level.

IPS protocol decoders are enabled per protocol. For HTTP, you need to enable the HTTP decoder. Additionally, if the traffic is HTTPS, SSL deep inspection must be enabled to decrypt the traffic so the decoder can analyze it.

The threshold determines the number of SYN packets per second that trigger an alarm. Increasing the threshold will require more SYN packets to trigger, reducing false positives while still detecting heavy floods.

Option B is correct. Proxy-based inspection reassembles the entire file in memory before scanning, which can detect threats that flow-based might miss, but at the cost of higher latency.

Option B is correct. The proto=6 indicates TCP, and proto_state=01 indicates a TCP session in the SYN_SENT state (i.e., the three-way handshake is not complete). The long duration suggests these are half-open sessions, possibly indicating a SYN flood attack.

To block P2P and allow File Sharing, the administrator needs to create an application control profile that blocks P2P category and allows File Sharing category. This profile must be applied to a firewall policy that has deep inspection enabled for encrypted traffic. Proxy-based inspection might be needed for granular control, but flow-based also works with deep inspection.

Common CLI commands used for troubleshooting and management.

FortiGate's Web Filtering profile with FortiGuard categories is the correct feature because it allows administrators to block access to websites based on URL categories, including those known to host malware. FortiGuard maintains a continuously updated database of malicious URLs, and applying a web filtering profile that blocks the 'Malicious Websites' category directly prevents users from accessing such sites. This is the most straightforward and effective method for blocking malware-hosting websites at the proxy or flow-based inspection level.

Option C is correct. DLP (Data Leak Prevention) profiles can inspect content for sensitive data patterns like credit card numbers and block or quarantine the traffic.

Option C is correct. Certificate inspection only validates the server certificate's Common Name (CN) and expiration; it does not decrypt the traffic payload, so the antivirus and IPS cannot inspect encrypted content.

In flow-based IPS, sessions can be bypassed when the IPS engine determines that further inspection is unnecessary, for example, if the session is considered low-risk or to reduce CPU load. This is normal behavior in flow-based mode.

FortiGate supports two inspection modes: flow-based and proxy-based. Flow-based is more efficient with lower latency, while proxy-based offers deeper inspection and more features like content archiving.

Option A is correct because IPS sensors are applied directly to individual firewall policies, allowing granular control over which traffic is inspected for intrusions. This enables administrators to enforce different IPS profiles for different traffic flows, such as applying a stricter sensor to internet-bound traffic and a lighter one to internal traffic.

High Availability modes and features in FortiGate.

Options A and B are correct. FortiGate supports certificate inspection (examining certificates) and full deep inspection (decrypting and scanning content).

Option D is correct because if the Application Control signatures are outdated, the FortiGate may not recognize the latest Fortnite traffic patterns or encrypted handshakes, allowing the game to bypass the block. Even though the policy has UTM enabled and the profile is applied, stale signatures cannot match new application variants or updates. Regularly updating the IPS/Application Control database via FortiGuard is essential to maintain effective blocking.

The email filter profile is applied to a firewall policy that matches SMTP traffic. It can perform spam filtering based on FortiGuard IP reputation and other heuristics.

Policy actions determine how FortiGate handles matching traffic.

The correct answers are A, B, and C. Installing the CA, exempting the server, or switching to certificate-inspection can all resolve certificate errors.

Option A is correct. FortiGate can be configured as an SMTP proxy in the email filter profile to intercept and filter email.

Application control rules in FortiGate use actions to determine how matched traffic is handled. 'Block' is a valid action that drops the application traffic and can optionally send a reset or log the event. 'Allow' is also a valid action that permits the application traffic to pass through the firewall.

Option A is correct. If the Firewall policy does not have 'Deep Inspection' enabled for HTTPS, encrypted P2P traffic cannot be inspected by Application Control, and the application may not be detected.

Option A is correct. The FortiGate needs connectivity to FortiGuard servers for real-time rating; without it, blocking may fail.

FortiSandbox integration is configured within the Antivirus profile (and optionally with other profiles) to submit suspicious files for behavioral analysis. The license enables the FortiSandbox connection.

When SSL inspection is enabled, the FortiGate acts as a man-in-the-middle and validates the server's certificate. If the certificate is invalid (e.g., expired, self-signed, or mismatched), the FortiGate can block the session based on the 'certificate-validation-failed' action in the SSL inspection profile. Even if the URL belongs to an allowed web filter category, a failed certificate validation will cause the traffic to be blocked before the web filter policy is applied.

A DLP sensor with a custom pattern for SSNs is needed to detect the data. SSL deep inspection is required to decrypt email traffic (SMTP over TLS) so DLP can inspect the content. FortiSandbox and IPS do not directly handle DLP.

DLP scanning requires deep inspection if the traffic is encrypted. If SMTP traffic is encrypted with TLS (SMTPS), the FortiGate needs SSL deep inspection to decrypt and inspect the content. Without it, DLP cannot see the credit card numbers.

Option A is correct because the most likely cause is that the CA certificate used for SSL inspection is not trusted by the clients. Even if the firewall policy allows the traffic and the certificate is trusted on the clients, if the CA certificate used to generate the inspection certificate is not trusted, the clients will not trust the certificate presented by the firewall, resulting in HTTPS access failures.

Option B is correct: Email filter profile provides anti-spam capabilities using FortiGuard, custom rules, and integration with FortiMail.

Option A is correct because the web filter must have the rating lookup set to 'FortiGuard' to use the cloud-based category database. If it's set to 'Local' or disabled, FortiGuard categories won't be enforced.

Option A is correct because web filtering profiles and application control profiles operate independently at different layers of the FortiGate security fabric. Web filtering inspects HTTP/HTTPS traffic against URL categories and ratings, while application control identifies and controls application-level traffic (e.g., Facebook, Skype) using deep packet inspection. They can be applied together in a single security policy to provide layered protection without conflict.

Option A is correct because when the SSL/SSH profile has 'untrusted-caname' set to 'Fortinet_CA_SSL' (an untrusted CA), the FortiGate cannot re-sign certificates from untrusted servers with a trusted CA. This causes HTTPS websites to fail as the client receives an untrusted certificate warning or connection error. Setting 'untrusted-caname' to a trusted CA certificate ensures that even untrusted server certificates are re-signed with a certificate the client trusts.

Application control relies on inspecting the content of traffic to identify applications. When traffic is encrypted with HTTPS, the firewall cannot inspect the payload without decrypting it first. Therefore, SSL inspection must be configured and applied to the firewall policy to allow the FortiGate to decrypt the traffic and match it against application control signatures.

Application control requires the firewall policy to be set to 'proxy-based inspection' for HTTPS traffic. Even with deep inspection enabled, if the policy is flow-based, application control may not inspect HTTPS traffic correctly.

Options A and C are correct. A DNS filter profile must be created with categories, and the firewall policy for DNS traffic must reference that profile.

Option C is correct: The session has been active for 3600 seconds and will expire in 3599 seconds (almost fresh start). 'proto_state=01' indicates TCP three-way handshake completion.

For deep inspection, the FortiGate's CA certificate must be installed and trusted on client devices. Otherwise, browsers will show a warning that the connection is not private because the certificate is issued by an untrusted authority.

DLP scanning of HTTPS traffic requires SSL deep inspection to decrypt the traffic. Additionally, the firewall policy must have deep inspection enabled and the DLP profile must be applied. The inspection mode (flow vs proxy) may affect performance but both can work.

Phase 1 establishes the secure channel; key parameters include remote gateway, PSK, IKE version, and encryption.

Option D is correct. The session state '01' indicates a TCP session in the SYN_SENT state, meaning the session is still in the process of being established. The short duration and expire time suggest it is a new session.

Option B is correct because SSL deep inspection is required to decrypt HTTPS traffic so the firewall can inspect the content of encrypted uploads for sensitive data like credit card numbers. Without decryption, the DLP profile cannot see the payload of encrypted sessions, rendering the DLP sensor ineffective.

Option B is correct because FortiGate application control policies are evaluated in order, and the first matching rule is applied. If a higher-priority rule (or an implicit allow rule) permits Zoom traffic before the block rule is reached, Zoom will be allowed. The engineer likely placed the block rule after an allow rule or the default implicit allow policy is permitting Zoom traffic.

Option A is correct because the FortiGate acts as a certificate authority (CA) for SSL inspection. If the FortiGate's CA certificate has expired, any server certificate it generates and signs for intercepted HTTPS sessions will be considered invalid by client browsers. Browsers will display a certificate error because the signing CA (the FortiGate) is no longer trusted due to expiration, even if the client has the CA certificate installed.

Even though the administrator installed the CA certificate on the client, the browser uses its own trusted root store, which is separate from the operating system's certificate store. If the CA certificate is not specifically added to the browser's trusted root store (e.g., Chrome uses the system store but Firefox maintains its own), the browser will still flag the certificate as untrusted. This is a common misconfiguration when deploying SSL inspection with FortiGate.

When deep-inspection is used, the FortiGate decrypts the client-to-server traffic, inspects the content, and then re-encrypts it before forwarding to the client. If the web server uses a cipher suite that the FortiGate does not support for re-encryption (e.g., an obsolete or non-standard cipher), the FortiGate cannot complete the SSL handshake with the client, causing certificate errors or connection failures. This is the most likely reason because the firewall policy is correct and the CA certificate is valid.

Application control uses application signatures to identify traffic. If the signatures are not up to date, new versions of BitTorrent may not be recognized. Also, if the traffic is encrypted and uses non-standard ports, application control may not detect it if the signatures are not comprehensive.

Option B is correct. Safe search enforces content filtering on supported search engines like Google, Bing, and YouTube to block explicit results.

When deep SSL inspection is enabled, the FortiGate acts as a man-in-the-middle by decrypting HTTPS traffic using a local CA certificate. For clients to trust the decrypted connections, the FortiGate's CA certificate must be installed in the Trusted Root Certification Authorities store on each client machine. If it is missing, the browser will display a certificate trust error and may block the site, causing the reported loading failures.

Using a separate firewall policy with a different web filter profile allows granular control for specific user groups. URL filter exemption would apply to all users using that profile, not just the specific group.

In proxy-based inspection, the FortiGate acts as a proxy for the protocol. If SMTP inspection is not enabled in the proxy options, the traffic bypasses scanning.

Application Control is the correct feature because it is specifically designed to identify and block peer-to-peer (P2P) file-sharing applications by inspecting traffic patterns and signatures, regardless of the port or protocol used. Unlike port-based blocking, Application Control uses deep packet inspection (DPI) to recognize P2P protocols such as BitTorrent, eDonkey, and Gnutella, even when they attempt to evade detection by using non-standard ports or encryption.

When an IPS sensor with a 'block' action logs 'pass' for matching traffic, it indicates that another security profile is overriding the IPS action. In FortiOS, if an application control profile is set to 'allow' for the application, it can bypass the IPS block because application control processing occurs before IPS inspection. The traffic is permitted by the application control profile, so the IPS engine does not enforce the block action, resulting in a 'pass' log entry.

Option D is correct. The admin should verify that DNS traffic (port 53) is matching the firewall policy with the DNS filter applied. If DNS queries bypass the policy (e.g., they are allowed by a different policy), the DNS filter will not be applied.

The issue could be due to policy order, category not being blocked for that specific user, or SSL inspection exemptions.

Option B is correct: Flow-based inspection uses less resources and may not perform full file reassembly or unpacking that proxy-based does, allowing some viruses to evade detection.

To block HTTP (port 80) while allowing HTTPS (port 443), no SSL inspection is needed because the firewall can distinguish traffic by port number alone. SSL inspection is only required when you need to examine the encrypted payload of HTTPS traffic, not to permit or deny it based on the protocol. Therefore, 'No inspection' is correct for this access control requirement.

Option C is correct. Anomaly signatures are dynamic; they only appear in the anomaly list when traffic triggers them. Empty output means no thresholds have been exceeded.

If the application control profile is set to 'Monitor All', it will only log but not block unlisted applications. To block all except allowed, the profile should be set to 'Block All' with exceptions for allowed applications.

Application control is the correct approach because it can identify and control applications like social media and Office 365 based on their unique signatures, regardless of the ports or protocols they use. Unlike URL filtering or port blocking, application control can differentiate between Office 365 traffic and social media traffic even when both use HTTPS on TCP 443, allowing the administrator to block social media while permitting cloud productivity tools.

Option A is correct. Safe search is a web filtering feature that redirects search engine queries to use safe search mode, blocking explicit content. It can be enforced through FortiGate.

Certificate inspection checks the certificate chain but does not decrypt the content.

Option D is correct. Data Leak Prevention (DLP) profiles are designed to detect and block transmission of sensitive data based on patterns or predefined data types.