The answer is to enable the specific IPS signature for the exploit in the sensor. This is correct because an IPS sensor configured to block all critical-severity attacks will only apply actions to signatures that are actively enabled in its database; a known exploit like CVE-2021-44228 (Log4Shell) may have its signature disabled by default, even if it is rated critical, so the sensor never inspects traffic for its unique patterns. On the Fortinet NSE 4 exam, this tests your understanding that signature-based detection requires explicit activation—a common trap is assuming a broad severity filter catches all threats. Remember the memory tip: "Default off means no block—enable the signature to stop the shock."
NSE4 Security Profiles Practice Question
This NSE4 practice question tests your understanding of security profiles. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An administrator has configured an IPS sensor to block critical-severity attacks. However, after a week, they notice that a known exploit (CVE-2021-44228) is still getting through. Which configuration change should be made to improve detection?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the specific IPS signature for the exploit in the sensor.
Option D is correct because the IPS sensor must have the specific signature for CVE-2021-44228 (Log4Shell) enabled to detect and block it. Even if the sensor is set to block critical-severity attacks, the signature for this exploit may be disabled by default in the sensor's signature database. Enabling the specific signature ensures the sensor inspects traffic for the exploit's unique patterns and applies the configured action.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Set the IPS sensor severity filter to 'low' and above.
Why it's wrong here
Lowering severity would increase false positives, not ensure detection of critical attacks.
✗
Change the IPS sensor action from 'default' to 'block' for all signatures.
Why it's wrong here
The action setting doesn't enable disabled signatures; it only sets the action for enabled ones.
✗
Create a custom IPS signature for the exploit.
Why it's wrong here
The signature already exists; creating a custom one is unnecessary and may not match correctly.
✓
Enable the specific IPS signature for the exploit in the sensor.
Why this is correct
The signature may be present but disabled; enabling it allows detection.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume setting the severity filter to 'critical' or changing the action to 'block' globally will catch all critical exploits, but they forget that individual signatures must be explicitly enabled in the sensor to be evaluated.
Detailed technical explanation
How to think about this question
FortiGate IPS sensors use a signature database where each signature has an enabled/disabled state and a default action (e.g., 'block', 'pass', or 'default'). Even if the sensor's severity filter is set to 'critical', a disabled signature will never trigger. Enabling the specific signature activates its inspection engine, which uses pattern matching (e.g., regex for ${jndi:ldap}) to detect the exploit. In real-world scenarios, administrators often overlook that new critical CVEs may have signatures shipped in a disabled state to avoid false positives until verified.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security Profiles — This question tests Security Profiles — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Enable the specific IPS signature for the exploit in the sensor. — Option D is correct because the IPS sensor must have the specific signature for CVE-2021-44228 (Log4Shell) enabled to detect and block it. Even if the sensor is set to block critical-severity attacks, the signature for this exploit may be disabled by default in the sensor's signature database. Enabling the specific signature ensures the sensor inspects traffic for the exploit's unique patterns and applies the configured action.
What should I do if I get this NSE4 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator configures an IPS profile to block SQL injection attacks. However, SQL injection traffic is still passing through the FortiGate. The administrator confirms the IPS profile is applied to the correct policy. What is the most likely reason?
medium
A.The firewall policy is in proxy-based mode
B.The IPS profile is configured for anomaly detection only
✓ C.IPS signatures for SQL injection are disabled in the profile
D.Deep inspection is required for IPS to work
Why C: Option A is correct. The administrator must verify that the relevant IPS signatures are enabled and set to an action like 'block' or 'reset'.
Variation 2. An administrator has configured an IPS profile to detect SQL injection attacks. However, some SQL injection attempts are still reaching the web server. Which TWO actions should the administrator take to improve detection?
hard
A.Configure anomaly detection for SQL traffic
✓ B.Update the IPS signature database
C.Disable flow-based inspection and use proxy-based only
✓ D.Enable protocol decoders for HTTP and SQL
E.Enable SSL deep inspection on the policy
Why B: Options A and B are correct. Protocol decoders allow IPS to parse database protocols, and updating signatures ensures the latest attacks are detected.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.