NSE7 Advanced Threat Protection Practice Question
An administrator is configuring a firewall policy for web traffic to a critical web application. They want to protect against SQL injection and cross-site scripting. Which security profile should they apply?
⚠ Common exam trap
Test-takers frequently confuse the IPS sensor (Option D) with a WAF, assuming that IPS signatures for SQL injection and XSS are sufficient, but the NSE7 exam emphasizes that a WAF profile provides deeper, web-specific inspection that an IPS cannot match.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web Application Firewall (WAF) profile
The Web Application Firewall (WAF) profile is specifically designed to inspect HTTP/HTTPS traffic at the application layer and block common web-based attacks such as SQL injection and cross-site scripting (XSS). It uses signature-based detection and behavioral analysis to identify malicious payloads in request parameters, headers, and body content, making it the correct choice for protecting a critical web application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Antivirus profile with CDR
Why it's wrong here
Antivirus focuses on malware, not web application attacks.
- ✗
Application control profile
Why it's wrong here
Application control manages application usage, not specific attack patterns.
- ✓
Web Application Firewall (WAF) profile
Why this is correct
WAF is built for web application threats including SQL injection and XSS.
- ✗
IPS sensor with pre-defined signatures
Why it's wrong here
IPS can detect some web attacks but WAF is specifically designed for web application layer protection.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.