nerdexam
Fortinet

NSE4 · Question #234

Review the CLI configuration below for an IPS sensor and identify the correct statements regarding this configuration from the choices below. (Select all that apply.) config ips sensor edit…

The correct answer is B. The sensor will include a PCAP file with a trace of the matching packets in the log message of E. The sensor only filters which IPS signatures to apply to the selected firewall policy. The IPS sensor configured to detect Linux server attacks will include a PCAP file in logs due to log-packet enable and filters signatures based on attributes like OS and location.

Submitted by cyberguy42· Apr 18, 2026Security Profiles and Content Inspection

Question

Review the CLI configuration below for an IPS sensor and identify the correct statements regarding this configuration from the choices below. (Select all that apply.) config ips sensor edit "LINUX_SERVER" set comment '' set replacemsg-group '' set log enable config entries edit 1 set action default set application all set location server set log enable set log-packet enable set os Linux set protocol all set quarantine none set severity all set status default next end next end

Options

  • AThe sensor will log all server attacks for all operating systems.
  • BThe sensor will include a PCAP file with a trace of the matching packets in the log message of
  • CThe sensor will match all traffic from the address object `LINUX_SERVER'.
  • DThe sensor will reset all connections that match these signatures.
  • EThe sensor only filters which IPS signatures to apply to the selected firewall policy.

How the community answered

(29 responses)
  • A
    14% (4)
  • B
    76% (22)
  • C
    7% (2)
  • D
    3% (1)

Why each option

The IPS sensor configured to detect Linux server attacks will include a PCAP file in logs due to `log-packet enable` and filters signatures based on attributes like OS and location.

AThe sensor will log all server attacks for all operating systems.

The `set os Linux` command restricts the sensor entry to only match signatures targeting the Linux operating system, not 'all operating systems'.

BThe sensor will include a PCAP file with a trace of the matching packets in the log message ofCorrect

The `set log-packet enable` command explicitly configures the IPS sensor to capture packet traces as PCAP files and include them with the corresponding log messages when a signature match occurs.

CThe sensor will match all traffic from the address object `LINUX_SERVER'.

The sensor name `LINUX_SERVER` does not imply matching an address object; `set location server` means the *target* of the attack is a server, and IPS matches traffic based on policy flow and signature conditions.

DThe sensor will reset all connections that match these signatures.

The `set action default` command means the sensor will use the default action defined for the matched signature, which is not necessarily 'reset' and could be 'pass' or 'block' depending on the signature's default behavior.

EThe sensor only filters which IPS signatures to apply to the selected firewall policy.Correct

An IPS sensor acts as a filter, allowing administrators to select which specific IPS signatures are applied based on criteria such as operating system (`set os Linux`), application, protocol, severity, and attack location (`set location server`), when the sensor is attached to a firewall policy.

Concept tested: FortiGate IPS sensor configuration and functionality

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/526786/intrusion-prevention

Topics

#IPS Sensor#Security Profiles#CLI Configuration#Logging

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice