Advanced Threat Protection →mediumMultiple ChoiceObjective-mapped

NSE7 Advanced Threat Protection Practice Question

Exhibit

Refer to the exhibit.

config firewall policy
    edit 1
        set name "Web Access"
        set srcintf "port1"
        set dstintf "port2"
        set srcaddr "10.0.1.0/24"
        set dstaddr "10.0.2.0/24"
        set action accept
        set schedule "always"
        set service "HTTP" "HTTPS"
        set utm-status enable
        set profile-protocol-options "default"
        set ssl-ssh-profile "deep-inspection"
        set av-profile "default"
        set ips-profile "default"
        set application-list "default"
    next
end

Refer to the exhibit. A user reports that accessing a legitimate HTTPS website is blocked. The FortiGate logs show that the connection was denied by the antivirus profile. What is the most likely cause?

⚠ Common exam trap

It's easy for candidates to confuse the security profile that generated the log entry (antivirus) with other profiles (application control, IPS, protocol options) that could also block HTTPS traffic, but the log's explicit attribution to the AV profile eliminates those possibilities.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The antivirus profile detected a false positive in the encrypted traffic

The antivirus (AV) profile on FortiGate performs deep inspection of HTTPS traffic by decrypting it, scanning the content, and re-encrypting it. If the AV signature database contains a false positive for a legitimate website's content (e.g., a benign JavaScript file matching a malware signature), the connection will be denied. The log explicitly states the denial was by the AV profile, not by any other security profile, making a false positive in encrypted traffic the most likely cause.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The antivirus profile detected a false positive in the encrypted traffic
Why this is correct
Deep inspection decrypts traffic, and antivirus may incorrectly flag legitimate content.
✗
The application list blocked the HTTPS application
Why it's wrong here
Application control does not block individual websites unless the app is blocked.
✗
The IPS profile blocked a vulnerability in the website
Why it's wrong here
IPS would block exploit attempts, not normal access.
✗
The protocol options profile blocked the SSL handshake
Why it's wrong here
Protocol options control protocol behavior, not block websites.

Go deeper

NSE7 Advanced Threat Protection Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question