NSE4 · Question #407
Which action is taken by the FortiGate device when a file matches more than one rule in a Data Leak Prevention sensor?
The correct answer is D. The actions specified in the rule with the higher priority number. When multiple Data Leak Prevention (DLP) rules match a file, the FortiGate applies the action specified by the rule with the highest priority number.
Question
Which action is taken by the FortiGate device when a file matches more than one rule in a Data Leak Prevention sensor?
Options
- AThe actions specified by the rule that most specifically matched the file
- BThe actions specified in the first rule from top to bottom
- CAll actions specified by all the matched rules.
- DThe actions specified in the rule with the higher priority number
How the community answered
(23 responses)- A4% (1)
- C4% (1)
- D91% (21)
Why each option
When multiple Data Leak Prevention (DLP) rules match a file, the FortiGate applies the action specified by the rule with the highest priority number.
FortiGate does not prioritize based on 'most specific match' for DLP rules but rather on the explicit priority number configured.
DLP rule evaluation is not based on top-to-bottom order but on configured priority.
FortiGate applies a single, most prioritized action, not all actions from all matched rules simultaneously.
FortiGate processes DLP rules by their assigned priority number, and if multiple rules are matched, the action defined in the rule with the highest priority (lower numerical value indicating higher priority) will be enforced.
Concept tested: FortiGate DLP rule matching precedence
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/526786/data-leak-prevention
Topics
Community Discussion
No community discussion yet for this question.