View all questions & answers for the NSE 7 - Enterprise Firewall 7.6 Administrator Exam Materials exam
Question 31 Discussion
Comments
Selected Answers: C
Selected Answers: C
Explanation:
- Intrusion Prevention System (IPS) on FortiGate uses protocol decoders and application signatures to detect and block malicious traffic patterns.
- By default, IPS inspection may only occur on well-known ports. Enabling "Inspect All Ports" ensures that IPS can analyze traffic across all ports, which is crucial for detecting threats that use non-standard ports or evade traditional port-based filtering.
- This setting works in flow mode, which is optimized for performance while still providing deep inspection.
A. DNS filter: Focuses on domain-based filtering, not IPS protocol decoders.
B. Application control: Controls application usage but does not directly leverage IPS protocol decoders.
D. SD-WAN rules: These are for traffic steering and performance, not IPS threat detection.
Selected Answers: B
Why it’s B (and not C)
Application Control is the feature designed to identify applications by signatures/behavior, and it relies on protocol decoders (the same decoding logic used by IPS) to recognize apps even when they use non-standard ports. Once the application is identified, Application Control can block it directly with an Application Control profile/sensor.
That matches the wording: “protocol decoders… transmission patterns… application signatures” → Application Control.
C. “Inspect all ports in flow mode” is not the blocking mechanism the question is describing.
It’s an inspection scope setting: it tells the inspection engine to look beyond default ports so traffic can’t evade detection by switching ports. It can help detection, but it doesn’t specifically mean blocking traffic based on application signatures via protocol decoders. The question is asking for the feature/action that performs that signature-based blocking, which is Application Control.
In one line:
true. B blocks by application signature/decoder detection.
false. C only broadens inspection to all ports; it’s not the specific “block by app signature” control.
Selected Answers: B
"Application control operates solely with flow-based inspection and identifies applications through their transmission patterns, using application signatures and protocol decoders, as well as rate-based IPS signatures to spot anomalies."
"flow-based inspections assess all ports, regardless of protocol port-mapping settings"
Selected Answers: B
B
Selected Answers: B
Which action can you take on FortiGate to block traffic using intrusion prevention system (IPS) protocol decoders, focusing on network transmission patterns and application signatures? (Choose one answer)
Brave-Dump Clients Votes