NSE4 · Question #234
Review the CLI configuration below for an IPS sensor and identify the correct statements regarding this configuration from the choices below. (Select all that apply.) config ips sensor edit…
The correct answer is B. The sensor will include a PCAP file with a trace of the matching packets in the log message of E. The sensor only filters which IPS signatures to apply to the selected firewall policy. The IPS sensor configured to detect Linux server attacks will include a PCAP file in logs due to log-packet enable and filters signatures based on attributes like OS and location.
Question
Review the CLI configuration below for an IPS sensor and identify the correct statements regarding this configuration from the choices below. (Select all that apply.) config ips sensor edit "LINUX_SERVER" set comment '' set replacemsg-group '' set log enable config entries edit 1 set action default set application all set location server set log enable set log-packet enable set os Linux set protocol all set quarantine none set severity all set status default next end next end
Options
- AThe sensor will log all server attacks for all operating systems.
- BThe sensor will include a PCAP file with a trace of the matching packets in the log message of
- CThe sensor will match all traffic from the address object `LINUX_SERVER'.
- DThe sensor will reset all connections that match these signatures.
- EThe sensor only filters which IPS signatures to apply to the selected firewall policy.
How the community answered
(29 responses)- A14% (4)
- B76% (22)
- C7% (2)
- D3% (1)
Why each option
The IPS sensor configured to detect Linux server attacks will include a PCAP file in logs due to `log-packet enable` and filters signatures based on attributes like OS and location.
The `set os Linux` command restricts the sensor entry to only match signatures targeting the Linux operating system, not 'all operating systems'.
The `set log-packet enable` command explicitly configures the IPS sensor to capture packet traces as PCAP files and include them with the corresponding log messages when a signature match occurs.
The sensor name `LINUX_SERVER` does not imply matching an address object; `set location server` means the *target* of the attack is a server, and IPS matches traffic based on policy flow and signature conditions.
The `set action default` command means the sensor will use the default action defined for the matched signature, which is not necessarily 'reset' and could be 'pass' or 'block' depending on the signature's default behavior.
An IPS sensor acts as a filter, allowing administrators to select which specific IPS signatures are applied based on criteria such as operating system (`set os Linux`), application, protocol, severity, and attack location (`set location server`), when the sensor is attached to a firewall policy.
Concept tested: FortiGate IPS sensor configuration and functionality
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/526786/intrusion-prevention
Topics
Community Discussion
No community discussion yet for this question.