NSE4_FGT-7.0 · Question #120
Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)
The correct answer is A. Web filter in flow-based inspection B. Antivirus in flow-based inspection E. Application control. The IPS engine is fundamental for deep packet inspection features like flow-based web filtering, antivirus, and application control on FortiGate devices.
Question
Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)
Options
- AWeb filter in flow-based inspection
- BAntivirus in flow-based inspection
- CDNS filter
- DWeb application firewall
- EApplication control
How the community answered
(49 responses)- A92% (45)
- C2% (1)
- D6% (3)
Why each option
The IPS engine is fundamental for deep packet inspection features like flow-based web filtering, antivirus, and application control on FortiGate devices.
Web filter in flow-based inspection mode relies on the IPS engine to perform deep packet inspection for identifying and blocking malicious web content or categories based on signatures.
Antivirus in flow-based inspection utilizes the IPS engine to scan network traffic streams in real-time for known malware signatures and suspicious patterns.
DNS filter primarily inspects DNS queries and responses to block access to malicious domains and does not inherently require the full IPS engine for its core function.
Web application firewall (WAF) operates at the application layer to protect web servers and typically uses its own dedicated engine and rule sets, distinct from the core IPS engine's general threat inspection capabilities.
Application control performs deep inspection of network traffic to identify and manage applications based on their signatures and behaviors, a capability provided by the IPS engine.
Concept tested: FortiGate IPS engine dependencies
Source: https://docs.fortinet.com/document/fortigate/7.4.0/fortios-handbook/457999/ips-sensor-configuration
Topics
Community Discussion
No community discussion yet for this question.