Configure Antivirus Scanning Modes to Neutralize Malware Threats NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 6)

Questions 26–29

1. 26foundation · easy

   What information is typically included in an antivirus event log entry?

   • AThe source and destination IP addresses, the virus name, and the action taken.
   • BThe full content of the infected file.
   • CThe user's password hash.
   • DThe FortiGate's serial number and firmware version.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An administrator is investigating a report of a malware infection on a user's computer. They want to determine if the FortiGate detected and blocked the malware when the user downloaded it. Where should they look to find this information?

   • AUse the 'diagnose antivirus' command to view historical detections.
   • BReview the firewall traffic logs for the user's IP address.
   • CCheck the FortiGate's system event log for antivirus updates.
   • DCheck the antivirus event logs for the user's IP address and the file name.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An administrator is reviewing antivirus logs and notices that a particular virus was detected multiple times from the same source IP, but the action taken was 'Monitor' instead of 'Block'. The users are still able to access the files. What should the administrator do to ensure that this malware is blocked in the future?

   • AUpdate the antivirus database to ensure the signature is current.
   • BAdd the source IP to a block list in the firewall policy.
   • CChange the antivirus action to 'Block' in the antivirus profile.
   • DEnable 'Log all traffic' to capture more details about the detections.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security administrator is configuring antivirus scanning in flow mode for a large enterprise. They want to minimize false positives while ensuring that known malware is blocked. They have received complaints from users about legitimate files being blocked. What should they do to reduce false positives without compromising security?

   • AAdd exceptions for the files that are being falsely blocked.
   • BAdjust the heuristic sensitivity level in the antivirus profile to a lower setting.
   • CDisable heuristic detection entirely to eliminate false positives.
   • DSwitch to proxy mode to reduce false positives.
   Reveal Solution Discussion Select an answer first