Refer to the exhibit. Review the intrusion prevention system (IPS) profile signature settings shown in the exhibit. What do you conclude when adding the FTP.Login.Failed signature to the IPS sensor…

Question

Exhibit

Options

• ATraffic matching the signature will be allowed and logged.
• BThe signature setting uses a custom rating threshold.
• CThe signature setting includes a group of other signatures.
• DTraffic matching the signature will be silently dropped and logged.

• A
  4% (1)
• C
  7% (2)
• D
  89% (24)

Explanation

In an IPS sensor profile, each signature has an assigned action. The exhibit shows FTP.Login.Failed with a 'Block' action. In FortiGate IPS terminology, 'Block' means the matching traffic is silently dropped-no TCP RST or ICMP unreachable is sent to the client-and the event is logged. This differs from 'Reset' (which sends a TCP RST) and 'Monitor' (which logs but allows traffic). The signature is a single predefined signature, not a group, and it uses the default FortiGuard severity/rating rather than a custom threshold.

No community discussion yet for this question.