NSE4 · Question #228
Examine the Exhibits shown below, then answer the question that follows. Review the following DLP Sensor (Exhibit 1): Review the following File Filter list for rule #1 (Exhibit 2): Review the…
The correct answer is A. The file will be detected by rule #1 as an `Audio (mp3)', a log entry will be created and it will be. FortiGate's DLP performs true file type detection, identifying the MP3 content regardless of its renamed extension or ZIP container, and then blocks it according to the matching rule #1.
Question
Examine the Exhibits shown below, then answer the question that follows. Review the following DLP Sensor (Exhibit 1):
Review the following File Filter list for rule #1 (Exhibit 2):
Review the following File Filter list for rule #2 (Exhibit 3):
Review the following File Filter list for rule #3 (Exhibit 4):
An MP3 file is renamed to `workbook.exe' and put into a ZIP archive. It is then sent through the FortiGate device over HTTP. It is intercepted and processed by the configuration shown in the above Exhibits 1-4. Assuming the file is not too large for the File scanning threshold, what action will the FortiGate unit take?
Exhibits
Options
- AThe file will be detected by rule #1 as an `Audio (mp3)', a log entry will be created and it will be
- BThe file will be detected by rule #2 as a "*.exe", a log entry will be created and the interface that
- CThe file will be detected by rule #3 as an Archive(zip), blocked, and a log entry will be created.
- DNothing, the file will go undetected.
How the community answered
(64 responses)- A83% (53)
- B3% (2)
- C5% (3)
- D9% (6)
Why each option
FortiGate's DLP performs true file type detection, identifying the MP3 content regardless of its renamed extension or ZIP container, and then blocks it according to the matching rule #1.
FortiGate's Data Leak Prevention (DLP) engine performs true file type detection, inspecting the actual content of a file rather than just its extension. Even when an MP3 is renamed to `.exe` and placed in a ZIP archive, the FortiGate will correctly identify its internal content as 'Audio (mp3)', triggering rule #1 to block the file and create a log entry.
The file's actual content is MP3, not an executable, so rule #2 for '*.exe' files will not be triggered by true file type detection.
While the file is in a ZIP archive, FortiGate's DLP often unpacks archives for deeper inspection. The specific rule for the internal content (MP3) would typically take precedence or be detected, leading to a block by rule #1, not necessarily rule #3 for the archive itself.
The file will be detected because FortiGate's true file type detection will identify the MP3 content, leading to it being blocked by rule #1.
Concept tested: DLP true file type detection and rule processing
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/33917/data-leak-prevention
Topics
Community Discussion
No community discussion yet for this question.