NSE4 · Question #339
If traffic matches a DLP filter with the action set to Quarantine IP Address, what action does the FortiGate take?
The correct answer is A. It blocks all future traffic for that IP address for a configured interval. When a FortiGate DLP filter with the "Quarantine IP Address" action is triggered, it blocks all subsequent traffic from the offending source IP address for a specified duration.
Question
If traffic matches a DLP filter with the action set to Quarantine IP Address, what action does the FortiGate take?
Options
- AIt blocks all future traffic for that IP address for a configured interval.
- BIt archives the data for that IP address.
- CIt provides a DLP block replacement page with a link to download the file.
- DIt notifies the administrator by sending an email.
How the community answered
(66 responses)- A92% (61)
- B5% (3)
- C2% (1)
- D2% (1)
Why each option
When a FortiGate DLP filter with the "Quarantine IP Address" action is triggered, it blocks all subsequent traffic from the offending source IP address for a specified duration.
When a DLP filter action is configured as "Quarantine IP Address," the FortiGate adds the offending source IP address to a quarantine list and blocks all further traffic originating from that IP address for a specified time interval.
Archiving data is a separate DLP action or logging feature, distinct from the "Quarantine IP Address" action which focuses on traffic blocking.
Providing a DLP block replacement page is an action used for blocking specific content, whereas "Quarantine IP Address" blocks all traffic from a particular source IP.
Sending an email notification is a logging and alerting feature often configured in conjunction with DLP actions, but it is not the primary action performed by "Quarantine IP Address."
Concept tested: DLP action: Quarantine IP Address
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/330691/data-leak-prevention-dlp-profiles
Topics
Community Discussion
No community discussion yet for this question.