nerdexam
Fortinet

NSE4 · Question #285

When viewing the Banned User monitor in Web Config, the administrator notes the entry illustrated in the exhibit. Which of the following statements is correct regarding this entry?

The correct answer is A. The entry displays a ban that has been added as a result of traffic triggering a configured DLP. The entry in the Banned User monitor indicates an automated ban triggered by a Data Leak Prevention (DLP) sensor, likely due to a policy violation.

Submitted by tom_us· Apr 18, 2026Security Profiles and Content Inspection

Question

When viewing the Banned User monitor in Web Config, the administrator notes the entry illustrated in the exhibit. Which of the following statements is correct regarding this entry?

Options

  • AThe entry displays a ban that has been added as a result of traffic triggering a configured DLP
  • BThe entry displays a ban that was triggered by HTTP traffic matching an IPS signature.
  • CThe entry displays a quarantine, which could have been added by either IPS or DLP.
  • DThis entry displays a ban entry that was added manually by the administrator on June11th.

How the community answered

(55 responses)
  • A
    82% (45)
  • B
    5% (3)
  • C
    9% (5)
  • D
    4% (2)

Why each option

The entry in the Banned User monitor indicates an automated ban triggered by a Data Leak Prevention (DLP) sensor, likely due to a policy violation.

AThe entry displays a ban that has been added as a result of traffic triggering a configured DLPCorrect

Entries in the Banned User monitor can result from various security events, and a common trigger for user bans is when their network traffic violates a configured Data Leak Prevention (DLP) sensor, indicating an attempt to transmit sensitive information as defined by policy.

BThe entry displays a ban that was triggered by HTTP traffic matching an IPS signature.

While IPS can trigger bans or quarantines, the correct answer specifically attributes the ban to a DLP sensor, implying the exhibit's context points to a DLP-related event.

CThe entry displays a quarantine, which could have been added by either IPS or DLP.

Quarantines can indeed be added by either IPS or DLP, but the correct answer specifies a ban triggered by DLP, which is a distinct action from a general quarantine.

DThis entry displays a ban entry that was added manually by the administrator on June11th.

The statement indicates the ban was 'triggered' by traffic, implying an automated process initiated by a security feature like DLP, rather than a manual entry by an administrator.

Concept tested: FortiGate Banned Users and DLP Actions

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/526779/data-leak-prevention

Topics

#DLP#User Banning#Security Profiles#Monitoring

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice