NSE7 Advanced Threat Protection Practice Question
An IPS administrator wants to detect a new custom attack that sends malformed HTTP headers. The attack pattern is a specific sequence of bytes that is not covered by existing signatures. What is the BEST way to detect this attack on FortiGate?
⚠ Common exam trap
Many exam-takers confuse protocol anomaly detection (which catches generic RFC violations) with the ability to detect a specific, custom byte sequence, leading them to choose Option B instead of understanding that custom signatures are required for precise pattern matching.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom IPS signature
Custom IPS signatures allow you to define a specific byte sequence or pattern (e.g., via a regular expression or hex pattern) that matches the malformed HTTP header. FortiGate's IPS engine can then inspect HTTP traffic at the application layer and trigger an alert or block when the custom pattern is found, even if no existing signature covers it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an automation stitch to block traffic with unusual headers
Why it's wrong here
Automation stitches react to logs, not detect inline patterns.
- ✗
Enable protocol anomaly detection in the IPS sensor
Why it's wrong here
Protocol anomaly detects deviations from standards, not specific byte sequences.
- ✗
Deploy FortiWeb as a reverse proxy
Why it's wrong here
FortiWeb can help but is not the best method to define a custom signature on FortiGate.
- ✓
Create a custom IPS signature
Why this is correct
Custom signatures match specific content patterns defined by the administrator.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.