An administrator is deploying IPS on a FortiGate that handles a mix of traffic, including high-throughput file transfers and latency-sensitive VoIP. They want to minimize the performance impact of IPS while still providing protection. Which approach is most effective?

Use the 'extreme' profile to ensure maximum protection, even if it impacts performance.

Disable IPS on the policy that carries VoIP traffic to avoid latency.

Use a single IPS sensor with the 'protect' profile and enable hardware acceleration.

Enable 'flow-based' inspection and set the sensor to 'monitor' mode.

A company uses a proprietary application that sends a specific pattern of bytes in the payload to authenticate. Security analysts have identified a malicious variant that sends a slightly different pattern. The default IPS signatures do not detect this variant. What is the best way to detect this threat?

Enable the 'extreme' database in the IPS sensor to catch the variant.

Create a custom IPS signature that matches the malicious pattern and add it to an IPS sensor.

Use a protocol decoder to identify the malicious pattern.

Configure the firewall to block all traffic to the application's server.

A FortiGate is using an IPS sensor with the 'protect' profile. The administrator wants to reduce false positives while maintaining a good level of security. What is the most appropriate action?

Enable the 'extreme' profile to include more signatures.

Adjust the sensor's 'severity' threshold to 'high' to only trigger on high-severity signatures.

Disable the sensor and rely on antivirus.

Set the sensor's 'action' to 'pass' for all signatures.

A FortiGate is using IPS with the 'protect' profile on a high-throughput link. The administrator notices that the CPU usage is consistently above 80%. They want to reduce CPU usage without significantly reducing security. Which action is most appropriate?

Disable IPS on the policy with the highest traffic volume.

Change the sensor's 'action' to 'pass' for all signatures.

Increase the 'severity' threshold to 'critical' to reduce the number of signatures.

Enable hardware acceleration and consider using a more selective signature set.

A FortiGate is experiencing high CPU usage due to IPS inspection on a busy link. The administrator wants to reduce the CPU load while maintaining a reasonable level of security. Which action is most appropriate?

Enable IPS acceleration and consider using a more selective signature set.

Disable IPS on the policy with the highest traffic volume.

Set the IPS sensor to 'monitor' mode to reduce CPU usage.

Increase the IPS sensor's 'severity' threshold to 'high' to reduce the number of signatures.

FortinetNSE 7 - Enterprise Firewall Administrator

Domain 3Objective 3

Integrate IPS to Perform Security Checks in Enterprise Networks NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR Practice Questions (Page 3)

Part of the Security Profiles domain, which makes up ~23% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

4concepts

Questions 11–15

11application · medium
An administrator is deploying IPS on a FortiGate that handles a mix of traffic, including high-throughput file transfers and latency-sensitive VoIP. They want to minimize the performance impact of IPS while still providing protection. Which approach is most effective?
Select an answer first
12application · medium
A company uses a proprietary application that sends a specific pattern of bytes in the payload to authenticate. Security analysts have identified a malicious variant that sends a slightly different pattern. The default IPS signatures do not detect this variant. What is the best way to detect this threat?
Select an answer first
13application · medium
A FortiGate is using an IPS sensor with the 'protect' profile. The administrator wants to reduce false positives while maintaining a good level of security. What is the most appropriate action?
Select an answer first
14expert · hard
A FortiGate is using IPS with the 'protect' profile on a high-throughput link. The administrator notices that the CPU usage is consistently above 80%. They want to reduce CPU usage without significantly reducing security. Which action is most appropriate?
Select an answer first
15application · medium
A FortiGate is experiencing high CPU usage due to IPS inspection on a busy link. The administrator wants to reduce the CPU load while maintaining a reasonable level of security. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR” is a trademark of its owner, used for identification only.