Exam NSE4_FGT-6.4 topic 1 question 37 discussion

Actual exam question from Fortinet's NSE4_FGT-6.4

Question #: 37
Topic #: 1

Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).

Exhibit A -

Exhibit B -

Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

A. The volume of traffic being inspected is too high for this model of FortiGate.
B. The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.
C. The firewall policy performs the full content inspection on the file.
D. The flow-based inspection is used, which resets the last packet to the user.

Show Suggested Answer

Suggested Answer: D 🗳️

by Lionardo at April 12, 2021, 7:10 a.m.

Comments

Submit Cancel

Lionardo

Highly Voted 4 years, 3 months ago

D is correct. FortiGate_Security_6.4 page 479 Key to rigt answer is "unable to receive a block replacement message when downloading an infected file for the first time"

upvoted 15 times

Cunawaro

3 years, 10 months ago

read carefully question final part "when downloading an infected file for the first time?"

upvoted 1 times

Cunawaro

3 years, 10 months ago

sorry this reply is not for u comment..

upvoted 1 times

...

Cunawaro

Highly Voted 3 years, 10 months ago

D its OK. FG-SG-6.4-P479. • "ONLY" If the virus is detected at the "START" of the connection, the IPS engine sends the block replacement message immediately • When a virus is detected on a TCP session (FIRST TIME), but where "SOME PACKETS" have been already forwarded to the receiver, FortiGate "resets the connection" and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can’t be opened. The IPS engine also caches the URL of the infected file, so that if a "SECOND ATTEMPT" to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.

upvoted 5 times