nerdexam
Fortinet

NSE4_FGT-7.0 · Question #13

Refer to the exhibit. Examine the intrusion prevention system (IPS) diagnostic command. Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease…

The correct answer is A. The IPS engine was inspecting high volume of traffic. A decrease in CPU usage after using IPS diagnostic option 5 implies the IPS engine was previously consuming significant resources due to inspecting a high volume of traffic.

Troubleshooting and Monitoring

Question

Refer to the exhibit. Examine the intrusion prevention system (IPS) diagnostic command. Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?

Exhibit

NSE4_FGT-7.0 question #13 exhibit

Options

  • AThe IPS engine was inspecting high volume of traffic.
  • BThe IPS engine was unable to prevent an intrusion attack.
  • CThe IPS engine was blocking all traffic.
  • DThe IPS engine will continue to run in a normal state.

How the community answered

(27 responses)
  • A
    67% (18)
  • B
    19% (5)
  • C
    4% (1)
  • D
    11% (3)

Why each option

A decrease in CPU usage after using IPS diagnostic option 5 implies the IPS engine was previously consuming significant resources due to inspecting a high volume of traffic.

AThe IPS engine was inspecting high volume of traffic.Correct

If a diagnostic command, such as option 5, reduces or bypasses IPS inspection and results in lower CPU utilization, it indicates that the IPS engine was previously under heavy load. This high CPU consumption is a common characteristic of IPS systems actively performing deep packet inspection and signature matching on a large volume of network traffic.

BThe IPS engine was unable to prevent an intrusion attack.

A decrease in CPU usage following a diagnostic command does not indicate whether the IPS engine was effective or ineffective at preventing an intrusion attack.

CThe IPS engine was blocking all traffic.

Blocking all traffic is a firewall function, and a reduction in IPS inspection load leading to lower CPU usage is not directly related to the IPS blocking all traffic.

DThe IPS engine will continue to run in a normal state.

If CPU usage decreases due to a diagnostic command that alters IPS operation, the IPS engine is not continuing to run in a normal, full-inspection state.

Concept tested: IPS CPU usage and diagnostic interpretation

Source: https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/469440/ip-system-performance

Topics

#IPS#diagnostics#CPU usage#troubleshooting

Community Discussion

No community discussion yet for this question.

Full NSE4_FGT-7.0 Practice