nerdexam
Fortinet

NSE4 · Question #339

If traffic matches a DLP filter with the action set to Quarantine IP Address, what action does the FortiGate take?

The correct answer is A. It blocks all future traffic for that IP address for a configured interval. When a FortiGate DLP filter with the "Quarantine IP Address" action is triggered, it blocks all subsequent traffic from the offending source IP address for a specified duration.

Submitted by rachelw· Apr 18, 2026Security Profiles and Content Inspection

Question

If traffic matches a DLP filter with the action set to Quarantine IP Address, what action does the FortiGate take?

Options

  • AIt blocks all future traffic for that IP address for a configured interval.
  • BIt archives the data for that IP address.
  • CIt provides a DLP block replacement page with a link to download the file.
  • DIt notifies the administrator by sending an email.

How the community answered

(66 responses)
  • A
    92% (61)
  • B
    5% (3)
  • C
    2% (1)
  • D
    2% (1)

Why each option

When a FortiGate DLP filter with the "Quarantine IP Address" action is triggered, it blocks all subsequent traffic from the offending source IP address for a specified duration.

AIt blocks all future traffic for that IP address for a configured interval.Correct

When a DLP filter action is configured as "Quarantine IP Address," the FortiGate adds the offending source IP address to a quarantine list and blocks all further traffic originating from that IP address for a specified time interval.

BIt archives the data for that IP address.

Archiving data is a separate DLP action or logging feature, distinct from the "Quarantine IP Address" action which focuses on traffic blocking.

CIt provides a DLP block replacement page with a link to download the file.

Providing a DLP block replacement page is an action used for blocking specific content, whereas "Quarantine IP Address" blocks all traffic from a particular source IP.

DIt notifies the administrator by sending an email.

Sending an email notification is a logging and alerting feature often configured in conjunction with DLP actions, but it is not the primary action performed by "Quarantine IP Address."

Concept tested: DLP action: Quarantine IP Address

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/330691/data-leak-prevention-dlp-profiles

Topics

#DLP#Security Profiles#Traffic Enforcement#IP Quarantine

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice