NSE7 Advanced Threat Protection Practice Question
A FortiGate administrator runs 'diagnose ips anomaly list' and sees many entries with 'protocol anomaly - tcp_port_scan'. The administrator wants to reduce false positives. Which action should be taken in the IPS sensor configuration?
⚠ Common exam trap
It's easy for candidates to confuse 'reducing false positives' with 'changing the action to monitor' (Option D), thinking that logging instead of blocking reduces false positives, when in fact the number of alerts remains the same; the correct approach is to adjust the detection sensitivity via threshold tuning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the threshold for the port scan detection in the IPS sensor.
Increasing the threshold for port scan detection in the IPS sensor reduces false positives by requiring a higher number of scan attempts within the detection window before an alert is triggered. The 'diagnose ips anomaly list' output shows 'protocol anomaly - tcp_port_scan' entries, which are generated by the IPS engine's anomaly-based detection; raising the threshold makes the sensor less sensitive to benign network scanning activity, such as legitimate port sweeps by monitoring tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Increase the threshold for the port scan detection in the IPS sensor.
Why this is correct
Increasing the threshold reduces false positives by requiring more ports to be scanned in the time window.
- ✗
Add the trusted server IPs to an exemption list in the IPS sensor.
Why it's wrong here
Exemptions can help but do not address the threshold issue for port scans.
- ✗
Disable the TCP port scan filter entirely.
Why it's wrong here
This would stop detection but is too drastic; better to tune.
- ✗
Change the action from 'block' to 'monitor' for all IPS filters.
Why it's wrong here
This would not reduce false positives, just not block.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.