nerdexam
Fortinet

NSE4_FGT-7.0 · Question #83

Examine the following web filtering log. Which statement about the log message is true?

The correct answer is C. The name of the applied web filter profile is default. The web filtering log message indicates that the 'default' web filter profile was applied to the traffic, which is a standard field in FortiGate web filter logs.

Troubleshooting and Monitoring

Question

Examine the following web filtering log. Which statement about the log message is true?

Options

  • AThe action for the category Games is set to block.
  • BThe usage quota for the IP address 10.0.1.10 has expired
  • CThe name of the applied web filter profile is default.
  • DThe web site miniclip.com matches a static URL filter whose action is set to Warning.

How the community answered

(29 responses)
  • A
    17% (5)
  • B
    7% (2)
  • C
    72% (21)
  • D
    3% (1)

Why each option

The web filtering log message indicates that the 'default' web filter profile was applied to the traffic, which is a standard field in FortiGate web filter logs.

AThe action for the category Games is set to block.

The log entry would display the specific action taken for a category (e.g., 'action=passthrough', 'action=block'). If the action recorded in the log for the 'Games' category was anything other than 'block' (e.g., 'passthrough' or 'warning'), then this statement would be false.

BThe usage quota for the IP address 10.0.1.10 has expired

Web filtering logs indicate quota expiration with specific fields or status messages, such as 'quota_status=expired' or 'status=quota_exceeded'. Without such an explicit entry in the provided log, this statement cannot be confirmed as true.

CThe name of the applied web filter profile is default.Correct

FortiGate web filtering logs include a 'profile=' field that explicitly names the web filter profile responsible for processing the traffic. If the log message contains 'profile="default"', then the statement that the name of the applied web filter profile is 'default' is directly and accurately reflected by the log entry.

DThe web site miniclip.com matches a static URL filter whose action is set to Warning.

For this statement to be true, the log would need to indicate 'url=miniclip.com', show an 'action=warning', and possibly specify that the match came from a static URL filter (e.g., 'filtertype=url-filter'). If the action was different or the match was from a category, this statement would be false.

Concept tested: Interpreting FortiGate web filter logs

Source: https://docs.fortinet.com/document/fortigate/7.4.0/log-message-reference/310340/web-filter-log-messages

Topics

#web filtering#log analysis#security policies

Community Discussion

No community discussion yet for this question.

Full NSE4_FGT-7.0 Practice