What Does the IPS 'Pass' Action Do in FortiGate?
A FortiGate administrator configures an IPS sensor with a signature that has a 'pass' action. The sensor is applied to a firewall policy. When traffic matches this signature, what will happen?
Quick Answer
The answer is that the IPS pass action allows the traffic to proceed while generating a log entry. This is correct because the pass action is specifically designed to let matching traffic through the firewall without blocking or resetting the connection, but it still triggers an event log for monitoring and analysis. On the Fortinet NSE 4 Network Security Professional exam, this concept tests your understanding of IPS action behaviors and how they differ from block or reset actions—a common trap is assuming pass means “ignore completely,” when in fact it still logs the event. Remember the memory tip: “Pass lets it through, but logs what it knew.”
⚠ Common exam trap
A common mix-up: candidates assume 'pass' means no logging occurs, confusing it with a 'monitor' action or forgetting that logging is a separate configuration from the signature action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The traffic is allowed but a log message is generated.
When an IPS signature with a 'pass' action is matched, the firewall allows the traffic to proceed normally, but a log message is generated to record the event. This is because the 'pass' action explicitly permits the traffic while still enabling logging if the signature is configured with logging enabled. In FortiGate, the 'pass' action overrides the default block behavior of IPS, ensuring the session continues without interruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The traffic is allowed without any logging.
Why it's wrong here
Pass action still generates a log entry.
- ✗
The traffic is reset and a log is generated.
Why it's wrong here
Reset action would terminate the session.
- ✓
The traffic is allowed but a log message is generated.
Why this is correct
Pass action allows the traffic and logs the event.
- ✗
The traffic is blocked and logged.
Why it's wrong here
Pass action does not block.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An administrator has created an IPS sensor with two entries. The first entry sets severity 'medium' and action 'block'. The second entry sets severity 'critical' and action 'block'. What will happen when a packet triggers an IPS signature with severity 'low'?
easy- ✓ A.The packet will be allowed (pass).
- B.The packet will be logged and a session will be created.
- C.The packet will be blocked if the signature severity is 'low' or 'high'.
- D.The packet will be blocked because the sensor is enabled.
Why A: The IPS sensor in the exhibit defines rules only for severity 'medium' and 'critical', both with action 'block'. When a packet triggers a signature with severity 'low', it does not match any entry in the sensor. Therefore, the default action for unmatched signatures is to allow (pass) the traffic. FortiGate IPS sensors apply actions only to explicitly configured severity levels; unlisted severities are not affected.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.