nerdexam
Fortinet

NSE4 · Question #291

The following ban list entry is displayed through the CLI. get user ban list id cause src-ip-addr dst-ip-addr expires created 531 protect_client 10.177.0.21 207.1.17.1 indefinite Wed Dec 24 :21:33 200

The correct answer is A. The administrator has specified the Attack and Victim Address method for the quarantine.. The CLI output for a user ban list entry showing src-ip-addr and dst-ip-addr indicates that the ban uses the Attack and Victim Address method.

Submitted by chiamaka_o· Apr 18, 2026Security Profiles and Content Inspection

Question

The following ban list entry is displayed through the CLI. get user ban list id cause src-ip-addr dst-ip-addr expires created 531 protect_client 10.177.0.21 207.1.17.1 indefinite Wed Dec 24 :21:33 2008 Based on this command output, which of the following statements is correct?

Options

  • AThe administrator has specified the Attack and Victim Address method for the quarantine.
  • BThis diagnostic entry results from the administrator running the diag ips log test command. This
  • CA DLP rule has been matched.
  • DAn attack has been repeated more than once during the holddown period; the expiry time has

How the community answered

(15 responses)
  • A
    87% (13)
  • B
    7% (1)
  • C
    7% (1)

Why each option

The CLI output for a user ban list entry showing `src-ip-addr` and `dst-ip-addr` indicates that the ban uses the Attack and Victim Address method.

AThe administrator has specified the Attack and Victim Address method for the quarantine.Correct

The `src-ip-addr` and `dst-ip-addr` fields explicitly present in the `get user ban list` output confirm that the ban is tied to a specific pair of source and destination IP addresses, which defines the Attack and Victim Address method for quarantine or banning.

BThis diagnostic entry results from the administrator running the diag ips log test command. This

The `get user ban list` command is used to display ban entries, not to run IPS diagnostic log tests. The output format is also for ban list entries, not IPS logs.

CA DLP rule has been matched.

The 'cause' field showing 'protect_client' typically refers to IPS or firewall protection, not specifically a Data Loss Prevention (DLP) rule match.

DAn attack has been repeated more than once during the holddown period; the expiry time has

The output shows an 'indefinite' expiry time and provides no information to determine if an attack was repeated or if a holddown period was involved.

Concept tested: FortiGate user ban list interpretation

Source: https://docs.fortinet.com/document/fortigate/7.4.0/fortios-cli-reference/192289/get-user-ban-list

Topics

#CLI#Quarantine#IPS#Automated Actions

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full NSE4 Practice