Troubleshooting IPS: Enable Specific Signatures for Known Exploits
An administrator has configured an IPS sensor to block critical-severity attacks. However, after a week, they notice that a known exploit (CVE-2021-44228) is still getting through. Which configuration change should be made to improve detection?
Quick Answer
The answer is to enable the specific IPS signature for the exploit in the sensor. This is correct because an IPS sensor configured to block all critical-severity attacks will only apply actions to signatures that are actively enabled in its database; a known exploit like CVE-2021-44228 (Log4Shell) may have its signature disabled by default, even if it is rated critical, so the sensor never inspects traffic for its unique patterns. On the Fortinet NSE 4 exam, this tests your understanding that signature-based detection requires explicit activation—a common trap is assuming a broad severity filter catches all threats. Remember the memory tip: "Default off means no block—enable the signature to stop the shock."
⚠ Common exam trap
Watch out — candidates often assume setting the severity filter to 'critical' or changing the action to 'block' globally will catch all critical exploits, but they forget that individual signatures must be explicitly enabled in the sensor to be evaluated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the specific IPS signature for the exploit in the sensor.
The IPS sensor must have the specific signature for CVE-2021-44228 (Log4Shell) enabled to detect and block it. Even if the sensor is set to block critical-severity attacks, the signature for this exploit may be disabled by default in the sensor's signature database. Enabling the specific signature ensures the sensor inspects traffic for the exploit's unique patterns and applies the configured action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the IPS sensor severity filter to 'low' and above.
Why it's wrong here
Lowering severity would increase false positives, not ensure detection of critical attacks.
- ✗
Change the IPS sensor action from 'default' to 'block' for all signatures.
Why it's wrong here
The action setting doesn't enable disabled signatures; it only sets the action for enabled ones.
- ✗
Create a custom IPS signature for the exploit.
Why it's wrong here
The signature already exists; creating a custom one is unnecessary and may not match correctly.
- ✓
Enable the specific IPS signature for the exploit in the sensor.
Why this is correct
The signature may be present but disabled; enabling it allows detection.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator configures an IPS profile to block SQL injection attacks. However, SQL injection traffic is still passing through the FortiGate. The administrator confirms the IPS profile is applied to the correct policy. What is the most likely reason?
medium- A.The firewall policy is in proxy-based mode
- B.The IPS profile is configured for anomaly detection only
- ✓ C.IPS signatures for SQL injection are disabled in the profile
- D.Deep inspection is required for IPS to work
Why C: IPS profiles in FortiGate consist of a set of IPS signatures that can be individually enabled or disabled. If the administrator configured an IPS profile to block SQL injection attacks but the specific SQL injection signatures are disabled within that profile, the FortiGate will not inspect or block that traffic, even if the profile is correctly applied to the policy.
Variation 2. An administrator has configured an IPS profile to detect SQL injection attacks. However, some SQL injection attempts are still reaching the web server. Which TWO actions should the administrator take to improve detection?
hard- A.Configure anomaly detection for SQL traffic
- ✓ B.Update the IPS signature database
- C.Disable flow-based inspection and use proxy-based only
- ✓ D.Enable protocol decoders for HTTP and SQL
- E.Enable SSL deep inspection on the policy
Why B: IPS signatures are the primary mechanism for detecting known SQL injection patterns. If attacks are reaching the web server, the signature database is likely outdated or missing recent attack vectors. Updating the signature database ensures the IPS has the latest patterns to match against SQL injection attempts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.