CCNA Security Profiles Questions

Web filter safe search enforcement is the correct feature because it directly integrates with search engines (Google, Bing, Yahoo) to force the use of their built-in safe search parameters (e.g., Google's 'safe=active' parameter appended to URLs). This ensures that explicit content is filtered at the source, regardless of the user's browser settings or search engine choice.

The duration is 3600 seconds and expire is 3599 seconds, meaning the session has been active for only about 1 second out of a 3600-second lifetime. The session is new.

Flow-based inspection is faster using pattern matching and anomaly detection, while proxy-based provides full content reassembly and can detect more sophisticated threats. Both can use SSL inspection.

Web filtering profiles allow administrators to control access to websites based on FortiGuard categories, URL filtering, and DNS filtering.

Option A is correct: DLP (Data Leak Prevention) profile can inspect content for sensitive data patterns like credit card numbers and block uploads.

Option B is correct because HTTPS uses TLS encryption. Without SSL deep inspection enabled on the policy, FortiGate cannot decrypt and inspect the content of HTTPS traffic. The antivirus profile will only scan unencrypted traffic or traffic where deep inspection has decrypted it first.

Full SSL Inspection (Deep Inspection) is the correct answer because it performs a man-in-the-middle decryption and re-encryption of all HTTPS traffic, regardless of the port used. This allows the FortiGate to inspect the payload of encrypted sessions, including those on non-standard ports, for threats and policy violations.

DNS Filter is the correct security profile because it is specifically designed to inspect and block DNS queries based on domain names, IP addresses, or categories. By configuring a DNS filter policy with a custom list of known malware domains, the FortiGate can intercept outgoing DNS requests and drop those matching the malicious entries, preventing the resolution of malware domains.

Option B is correct. Protocol decoders normalize traffic so that IPS signatures can detect attacks within the protocol context.

Option B is correct. FortiSandbox provides advanced threat detection by executing files in a controlled environment.

When deep inspection is enabled, the FortiGate decrypts and re-encrypts traffic. If the website's certificate is not trusted by the FortiGate (e.g., self-signed or issuer not in CA bundle), the connection may fail.

VLAN interfaces require a physical parent, VLAN ID, IP address, and optional administrative access.

The certificate warning appears because the client does not trust the self-signed CA used by FortiGate. To eliminate warnings, the FortiGate's CA certificate must be installed in the trusted root store of each client device.

To allow inspection of a server with a self-signed certificate, you need to either add the server to the exemption list in the SSL/SSH profile (so it is not inspected) or import the server's CA certificate and add it as a trusted CA so that deep inspection can validate the certificate.

The debug output indicates an SSL/TLS handshake failure, specifically that the client does not trust the server's certificate. This occurs when the Certificate Authority (CA) that issued the SSL VPN certificate is not in the client's trusted root store. Option B correctly identifies this as the most likely cause because the error is a certificate trust issue, not an expiration or authentication problem.

Option A is correct: Without SSL deep inspection, FortiGate cannot see the encrypted application payload to match application signatures for HTTPS traffic. Application control requires decryption for encrypted applications.

The correct answer is B because, by default, FortiGate IPS sensors set the action for ICMP Flood anomalies to 'Block'. This default action is defined in the IPS sensor configuration and is applied when the anomaly threshold is exceeded, as indicated by the detected anomalies from 10.1.1.100 to 10.2.2.200.

FortiGuard categorizes websites into many categories. Gambling is a specific category, and blocking it prevents access to those sites.

The debug output indicates that the FortiSandbox server is not configured. Even if the integration settings are present, the FortiGate must have the FortiSandbox server IP and credentials properly configured under Security Fabric > FortiSandbox.

Option B is correct: DNS filter is specifically designed to inspect DNS queries and block based on FortiGuard categories or custom lists.

To block categories, the administrator must configure a web filter profile that blocks the desired categories and apply that profile to the firewall policy handling internet traffic.

Option C is correct. The DNS filter profile must be applied to a firewall policy that matches DNS traffic. Without that, the traffic is not inspected.

Rate-based detection monitors the rate of events (e.g., connections per second) and triggers when a threshold is exceeded. Anomaly detection looks for deviations from a baseline, not specifically thresholds.

DLP can inspect traffic content for patterns like credit card numbers and block or log the transmission. Antivirus handles malware, application control identifies apps, and web filter blocks URLs.

Option D is correct because automatic IPS signature updates require the FortiGuard service to be enabled and a signature update schedule to be configured. Without a schedule, updates occur only manually; without the service enabled, the FortiGate cannot connect to FortiGuard distribution servers to retrieve new signatures.

Option A is correct because SQL injection attacks are identified by specific IPS signatures, and adding 'SQL.Injection' to an IPS sensor with the action set to 'block' directly instructs FortiGate to detect and block those attacks. Option E is correct because an IPS sensor must be enabled within a firewall policy to apply its inspection to the traffic passing through that policy, ensuring the profile is active on inbound traffic to the web server.

FortiGuard category-based filtering (C) is correct because it leverages FortiGuard's cloud-based web rating database to categorize URLs and block access to known malicious sites, such as those hosting malware or phishing. Web rating override (D) is correct because it allows administrators to manually override the FortiGuard rating for specific URLs, enabling them to block a site that may not yet be categorized as malicious by FortiGuard. Both features directly control access to malicious websites based on URL reputation.

Option A is correct because the 'SSL Exempt Domains' list in the SSL/SSH inspection profile allows you to specify domain names (e.g., *.example.com) that will bypass SSL inspection entirely. When FortiGate matches the SNI field in the ClientHello or the certificate CN/SAN against this list, it skips decryption and passes the traffic through without inspection, reducing overhead for trusted or non-critical domains.

Option C is correct because if the FortiGate cannot reach the FortiGuard servers, web filtering will fail open by default, allowing all web traffic. The administrator should verify FortiGuard connectivity.

The correct answer is B because the Application Control profile is configured to allow only 'Business' and 'General-Interest' categories. If the CRM application is not categorized in FortiGuard's Application Control database, or if it falls under a different category (e.g., 'Uncategorized' or 'Unknown'), the FortiGate will block the traffic by default. This explains why some users can access the CRM (if they are using a different path or the application is categorized differently) while others cannot, as the FortiGate enforces the profile based on the application signature match.

Option D is correct because enabling only relevant signatures based on the network environment reduces false positives and unnecessary processing overhead, ensuring that IPS resources are focused on threats that actually apply to the traffic traversing the FortiGate. Option E is correct because flow-based inspection uses a single-pass, pattern-matching engine that offers higher throughput and lower latency compared to proxy-based inspection, making it ideal for high-throughput environments.

Option A is correct. Application control requires deep inspection to identify applications in encrypted traffic.

Option B is correct. Application control can identify and block specific applications based on signatures, including social media apps.

Option C is correct. The email filter profile is designed to scan email traffic for spam and can apply actions like tag, discard, or quarantine.

Antivirus can block file types by signature (e.g., exe), and application control can block file transfer applications or protocols. Additionally, web filter can block specific file extensions, but the most straightforward combination is antivirus and file filter within antivirus.

Option A is correct. The exemption list allows certain domains to bypass deep inspection, preserving trust.

The policy explicitly allows HTTPS traffic to 10.0.1.10, but the application control profile 'Block_Social_Media' is applied. This profile blocks Facebook and Twitter, which are web-based applications. If the web server's login page is served over HTTPS and is incorrectly classified by the FortiGate as a social media application (e.g., due to shared CDN or similar traffic patterns), the application control profile will block it, preventing user access despite the firewall policy allowing the service.

Option D is correct because Facebook uses HTTPS. Without SSL deep inspection, FortiGate cannot see the application layer inside the encrypted tunnel, so application control cannot block Facebook.

Email filter profiles scan email traffic that passes through the FortiGate. If users are receiving spam from external mail servers that connect directly to the internal mail server without passing through the FortiGate, the email filter will not inspect that traffic.

Antivirus profiles scan files transferred over HTTP, FTP, and email for malware. Web filter controls URL access, application control identifies applications, and IPS detects network-based attacks.

Safe search enforces strict filtering on search engines to block explicit content in search results. It works by redirecting search queries to the safe search versions of supported search engines (Google, Bing, YouTube, etc.) when enabled.

Application Control relies on SSL inspection to identify applications like Facebook that use HTTPS. Without SSL inspection enabled on the firewall policy, FortiGate can only see encrypted traffic as generic SSL/TLS flows and cannot match the application signatures for Facebook. Enabling SSL inspection (deep inspection or certificate-based inspection) allows the FortiGate to decrypt the traffic and apply the application control profile correctly.

Option A is correct. An IP allowlist or domain whitelist in the email filter profile can be used to bypass spam filtering for specific senders, while still filtering other emails.

Application control requires deep inspection for encrypted traffic because it needs to see into the TLS session to match application signatures. If the policy does not have SSL deep inspection, the traffic appears as generic HTTPS and cannot be identified as Skype.

Option C is correct. Intrusion Prevention System (IPS) profiles analyze traffic for malicious patterns and can block attacks in real-time.

Options A and B are correct. The DNS filter profile and its application to a firewall policy are necessary.

Option B is correct because HTTPS uses TLS encryption. Without SSL deep inspection enabled on the policy, FortiGate cannot decrypt and inspect the content of HTTPS traffic. The antivirus profile will only scan unencrypted traffic or traffic where deep inspection has decrypted it first.

In FortiOS, the FortiGuard category action takes precedence over URL filter exceptions unless the URL filter is configured with an action of 'allow' and a higher priority order. By default, category blocking overrides individual URL allow rules.

Option D is correct because an IPS filter allows the administrator to define a rule that excludes traffic from a specific source IP address (10.1.1.100) from inspection for a particular signature, while leaving all other signatures active. This granular approach ensures that false positives for that signature are reduced without disabling the signature entirely or affecting other traffic.

Option C is correct because deep inspection is required to decrypt and inspect SSL traffic using a self-signed certificate on a non-standard port. The FortiGate must trust the application's self-signed certificate by adding it to the trusted CA list; otherwise, the deep inspection proxy will fail to validate the certificate and drop the connection. Certificate inspection (Option A) only checks the certificate metadata without decrypting the payload, so it cannot inspect the actual application traffic.

The correct answers are A, B, and C. DLP sensor, SSL inspection for HTTPS, and applying the sensor to the policy are all required.

Options A and B are correct. Protocol decoders allow IPS to parse database protocols, and updating signatures ensures the latest attacks are detected.

If FortiGuard requests time out, the FortiGate cannot reach the FortiGuard servers. This could be due to network connectivity issues, DNS resolution failure, or a proxy configuration problem.

Option B is correct. If the antivirus profile is configured for flow-based inspection, some email protocols may not be fully inspected unless explicitly configured. Flow-based inspection may skip SMTP depending on the configuration.

Option B is correct. Certificate inspection checks the server certificate, while deep inspection decrypts and inspects the entire session.

Option D is correct because the policy uses the service 'HTTPS', which by default only matches TCP port 443. If any HTTPS websites are hosted on non-standard ports (e.g., 8443, 9443), the FortiGate will not apply deep inspection to that traffic, causing the connection to fail when deep inspection is required. The FortiGate CA certificate being installed on clients ensures trust, but the service definition must match the actual destination port for inspection to occur.

Exemptions can be added in the SSL/SSH inspection profile to bypass inspection for specific destinations.

Application control relies on signatures to detect applications. If deep inspection is not enabled, encrypted traffic may not be identified correctly.

Flow-based inspection offloads traffic to the network processor (NPU) for forwarding without sending all packets to the CPU for inspection. The IPS diagnostic output showing packets forwarded without inspection indicates flow-based mode is skipping inspection for non-TCP traffic or when a session is offloaded.

When SSL inspection is enabled and a specific HTTPS site is blocked despite not being in a blocked category, the issue often lies in the SSL/SSH inspection profile's certificate revocation check. If the FortiGate cannot verify the server's certificate revocation status (e.g., via OCSP or CRL), it may block the connection as a security precaution, even if the web filter category allows the URL. Option B directly addresses this by suggesting a review of the revocation check settings.

Options A, B, and C are correct. Web filtering blocks malicious websites; antivirus blocks executable file downloads; IPS detects and blocks C2 traffic.

FortiGate offers two modes for inspecting HTTPS: certificate inspection (which checks certificate validity but does not decrypt content) and deep inspection (which decrypts and inspects the content). Flow-based and proxy-based refer to the inspection mode for other security profiles, not specifically for HTTPS inspection type.

Option D is correct: SSL/SSH exemption list allows specific destinations to bypass deep inspection, while still applying other security profiles.

Port scan detection is a type of anomaly detection in FortiGate's IPS profile that identifies reconnaissance attempts by monitoring for multiple connection attempts to different ports from a single source. This behavior deviates from normal traffic patterns and is flagged as anomalous, allowing the IPS to block potential scanning activity before an attack progresses.

Option B is correct because anomaly detection in IPS profiles uses a threshold-based mechanism; to block, the action must be set to 'block' (or 'reset' for TCP). Setting the action to 'pass' allows the traffic.