FCP_FGT_AD-7.6 · Question #89
Refer to the exhibit. What can you conclude from the log shown in the exhibit?
The correct answer is B. The IPS socket buffer is full and IPS engine needs more memory to create new sessions. The log message IPS session scan paused, enter fail open mode indicates that the IPS socket buffer is full, meaning the IPS engine does not have enough memory to process new sessions. As a result, FortiGate switches to fail-open mode, allowing traffic to pass (or temporarily…
Question
Refer to the exhibit. What can you conclude from the log shown in the exhibit?
Options
- AThe IPS scan is paused by the IPS diagnostic command with bypass mode option 5.
- BThe IPS socket buffer is full and IPS engine needs more memory to create new sessions.
- CThe IPS session scan is paused and reevaluating the packet because of a dirty flag.
- DThe IPS socket buffer is full and IPS engine cannot decode a packet.
How the community answered
(29 responses)- A3% (1)
- B93% (27)
- C3% (1)
Explanation
The log message IPS session scan paused, enter fail open mode indicates that the IPS socket buffer is full, meaning the IPS engine does not have enough memory to process new sessions. As a result, FortiGate switches to fail-open mode, allowing traffic to pass (or temporarily dropping it) without full IPS scanning.
Topics
Community Discussion
No community discussion yet for this question.