NSE4 · Question #374
Which statement is correct concerning creating a custom signature?
The correct answer is A. It must start with the name. When creating a custom signature, it must begin with a name to identify the signature uniquely.
Question
Which statement is correct concerning creating a custom signature?
Options
- AIt must start with the name
- BIt must indicate whether the traffic flow is from the client or the server.
- CIt must specify the protocol. Otherwise, it could accidentally match lower-layer protocols.
- DIt is not supported by Fortinet Technical Support.
How the community answered
(24 responses)- A88% (21)
- B8% (2)
- D4% (1)
Why each option
When creating a custom signature, it must begin with a name to identify the signature uniquely.
A custom signature definition, regardless of its content, must always start with a unique 'name' identifier to allow for its proper storage, reference, and management within the system.
While a custom signature can specify traffic direction, it is not a mandatory requirement for every custom signature definition.
Specifying the protocol can be important for precision, but it's not a strict requirement for every custom signature; some may target raw patterns without explicit protocol definition.
Fortinet Technical Support often assists with custom signatures, though detailed troubleshooting for very complex or poorly written custom signatures may have limitations.
Concept tested: Custom signature creation fundamentals
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/500078/creating-custom-ips-signatures
Topics
Community Discussion
No community discussion yet for this question.