Configure an Intrusion Prevention System (IPS) to Protect a Network from Threats and Vulnerabilities NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which FortiOS feature can offload IPS processing to dedicated hardware to reduce CPU load?

   • AIPS bypass
   • BNTurbo
   • CFlow-based inspection
   • DCP8 acceleration
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which FortiOS object is used to define which signatures are inspected and what action is taken when a match occurs?

   • AIPS signature database
   • BSecurity profile group
   • CIPS sensor
   • DFirewall policy
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When implementing IPS for a database server, which approach best balances protection and performance?

   • ADisable IPS on the policy that allows database traffic
   • BEnable signatures relevant to database protocols and set them to monitor initially
   • CEnable all signatures and set them to block immediately
   • DUse a single signature for all database traffic
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A FortiGate is experiencing high CPU usage due to IPS inspection. The administrator has already enabled hardware acceleration, but CPU usage remains high. The sensor uses the 'All_Signatures' set and is applied to a policy that handles all internet-bound traffic. What is the next best step to reduce CPU load while maintaining a reasonable security posture?

   • ACreate a more focused sensor with only the signatures relevant to the traffic types.
   • BRemove the sensor from the policy to stop inspection.
   • CIncrease the sensor's severity threshold to 'high'.
   • DSet the sensor to 'monitor' mode to reduce CPU usage.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A network administrator notices that the IPS sensor is generating false positives on a legacy application that uses a proprietary protocol. The false positives are causing legitimate traffic to be blocked. The administrator wants to stop the blocking while still detecting other threats. What should they do?

   • AChange the sensor's action to 'monitor' for all signatures.
   • BDisable the specific signatures that match the proprietary protocol.
   • CIncrease the sensor's severity threshold to 'high'.
   • DRemove the sensor from the policy to stop inspection.
   Reveal Solution Discussion Select an answer first