NSE4 Security Profiles Practice Question
Exhibit
Refer to the exhibit.
config ips sensor
edit "sensor1"
config entries
edit 1
set severity medium
set action block
next
end
next
endGiven the above IPS sensor configuration, what will happen when traffic matching a high-severity IPS signature is detected?
⚠ Common exam trap
Many exam-takers assume high-severity signatures are automatically blocked by default, but FortiGate requires explicit action configuration per severity level, and the default action is to allow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The traffic will be allowed because no entry exists for high severity.
The IPS sensor configuration shown does not include an entry for high-severity signatures. Without a specific action defined for high severity, the sensor defaults to allowing the traffic while still generating a log entry. This is a common behavior in FortiGate IPS where only explicitly configured severity levels have defined actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The traffic will be logged but not blocked.
Why it's wrong here
This is incorrect because a sensor with no high-severity entry has no action or log rule associated with that severity. In FortiGate IPS, logging is a distinct action that must be explicitly enabled for a signature or severity level; it does not occur by default when traffic is simply allowed. Without a high-severity signature entry or a log override, the traffic is silently passed.
- ✗
The traffic will be blocked only if the signature is enabled globally.
Why it's wrong here
This is incorrect because global signature enablement does not override or influence the sensor's per-severity action configuration. An IPS sensor defines its own actions for signatures or severity levels; if high severity is omitted, the sensor will pass that traffic regardless of whether the underlying signature is globally enabled. The absence of a high-severity entry in the sensor is the decisive factor.
- ✗
The traffic will be blocked because the sensor has a block action.
Why it's wrong here
This is incorrect because the sensor's block action is scoped to medium severity signatures only, as shown in the configuration. A block action configured for one severity level does not automatically apply to other severity levels; each severity (low, medium, high) must be explicitly listed in the sensor to have a specific action. Since high severity has no entry, the block action does not extend to it.
- ✓
The traffic will be allowed because no entry exists for high severity.
Why this is correct
This is correct because the IPS sensor contains no entry for high-severity signatures, and an unmatched signature in FortiGate IPS results in an implicit pass. The sensor only applies actions (block, reset, or log) to traffic that matches a defined signature or severity override. With no high-severity rule in the sensor, the traffic is allowed and forwarded without inspection-based action.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.