Integrate IPS to Perform Security Checks in Enterprise Networks NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which technique can be used to optimize IPS performance on a Fortinet firewall?

   • AEnabling hardware acceleration for IPS processing
   • BIncreasing the number of firewall policies
   • CUsing a larger subnet mask for internal networks
   • DDisabling all IPS sensors to reduce load
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An administrator notices that a specific IPS signature is generating a high number of false positives on a particular server. The signature is part of the 'all' signature set in the sensor. The administrator wants to stop the false positives without disabling the signature for the entire sensor. What is the most appropriate action?

   • ACreate a custom IPS sensor that excludes the specific signature and apply it to the policy for that server.
   • BIncrease the sensitivity of the signature to reduce false positives.
   • CDisable the signature in the 'all' signature set, which will affect all sensors using that set.
   • DChange the signature's action to 'pass' in the global IPS settings.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How is an IPS sensor typically applied to inspect traffic in a Fortinet enterprise firewall?

   • ABy assigning it to a firewall policy that matches the traffic to be inspected
   • BBy installing it as a separate software package on the firewall
   • CBy configuring it as a global setting that applies to all interfaces automatically
   • DBy enabling it on the physical port where traffic enters the firewall
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A FortiGate is experiencing high latency on a link that carries both VoIP and bulk file transfers. The administrator wants to apply IPS to both types of traffic but minimize the impact on VoIP. Which approach is most effective?

   • ADisable IPS on the VoIP policy to avoid latency.
   • BCreate two IPS sensors: one with a 'protect' profile for VoIP and one with an 'extreme' profile for file transfers, and apply them to separate policies.
   • CUse a single IPS sensor with the 'protect' profile and enable hardware acceleration.
   • DUse a single IPS sensor with the 'extreme' profile for both types of traffic.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A large enterprise has a FortiGate cluster in active-passive mode. They are enabling IPS on a policy that carries traffic for a critical application. The administrator wants to ensure that IPS inspection continues if the active unit fails. What is the most important consideration?

   • AEnsure that the IPS sensor and its configuration are synchronized between the cluster units.
   • BDisable IPS on the passive unit to save resources.
   • CEnable 'session failover' to maintain IPS inspection during failover.
   • DUse a separate IPS sensor on each unit to avoid conflicts.
   Reveal Solution Discussion Select an answer first