nerdexam
Fortinet

NSE4_FGT-7.0 · Question #175

Refer to the exhibit. The exhibit shows the IPS sensor configuration. If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

The correct answer is A. The sensor will allow attackers matching the NTP.Spoofed.KoD.DoS signature. B. The sensor will block all attacks aimed at Windows servers. Based on the IPS sensor configuration (as implied by the correct answers), the sensor is expected to explicitly allow traffic matching the NTP.Spoofed.KoD.DoS signature and block attacks specifically aimed at Windows servers.

Security Profiles

Question

Refer to the exhibit. The exhibit shows the IPS sensor configuration. If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

Exhibit

NSE4_FGT-7.0 question #175 exhibit

Options

  • AThe sensor will allow attackers matching the NTP.Spoofed.KoD.DoS signature.
  • BThe sensor will block all attacks aimed at Windows servers.
  • CThe sensor will reset all connections that match these signatures.
  • DThe sensor will gather a packet log for all matched traffic.

How the community answered

(48 responses)
  • A
    71% (34)
  • C
    21% (10)
  • D
    8% (4)

Why each option

Based on the IPS sensor configuration (as implied by the correct answers), the sensor is expected to explicitly allow traffic matching the NTP.Spoofed.KoD.DoS signature and block attacks specifically aimed at Windows servers.

AThe sensor will allow attackers matching the NTP.Spoofed.KoD.DoS signature.Correct

The IPS sensor configuration (as shown in the implied exhibit) includes an explicit rule or setting that specifies the action for the NTP.Spoofed.KoD.DoS signature as 'Allow' or 'Pass', letting such traffic through. This is a configurable action within an IPS sensor.

BThe sensor will block all attacks aimed at Windows servers.Correct

The IPS sensor configuration (as shown in the implied exhibit) includes a rule or filter that targets 'Windows servers' and sets the action for matching attacks to 'Block', preventing them from reaching those systems. IPS sensors allow defining attack target-based actions.

CThe sensor will reset all connections that match these signatures.

If 'Reset' was configured for all matched signatures, then options A (allow) and B (block) would contradict this general action, indicating more specific rules are in place.

DThe sensor will gather a packet log for all matched traffic.

While packet logging is a common IPS feature, the question asks for the primary actions the sensor is expected to take on traffic, not supplementary logging functions.

Concept tested: FortiGate IPS sensor signature actions and attack target configuration

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/339180/ips-sensor-configuration

Topics

#IPS sensor#intrusion prevention#security profiles#signature actions

Community Discussion

No community discussion yet for this question.

Full NSE4_FGT-7.0 Practice