Exam NSE4_FGT-7.2 topic 1 question 77 discussion

B is the correct answer, this is just a tricky question, It says "if there are only a few calls originating or incoming?" and additionally the name of the filter is "excessive bandwidth" IN this case we only need to take into account the position of the filter, the application, and the action. Fortigate will analyze the filter from top to bottom like a regular firewall policy. Therefore we have position, then facetime and then action block the final result will be "Block face time"

B. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration. FortiGate Security 7.2 Study Guide (p.310): "Then, FortiGate scans packets for matches, in this order, for the application control profile: 1. Application and filter overrides: If you have configured any application overrides or filter overrides, the application control profile considers those first. It looks for a matching override starting at the top of the list, like firewall policies. 2. Categories: Finally, the application control profile applies the action that you’ve configured for applications in your selected categories." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

B. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.

B. correct

Similar example page 311 in the FortiGate Security study guide.

B, Because matching the override, and contains FACETIME Fortigate Security Guide 7.2 page 310 order of scan and blocking behavior: 1 - Application and filter overrides 2- Categories 1 application overrides in this case, blocking

B due to there is no threshold defined in the Exessive Bandwith filter

B, based on priority of rule

"if there are only a few calls originating or incoming?" indicates Facetime does not trigger the excessive bandwidth filter.

The answer is B

Since the question states "if there are only a few calls originating or incoming?: C should be the correct answer