NSE4_FGT Question 76

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose AC1

  Correct: A. A session for denied traffic is created. C. The number of logs generated by denied traffic is reduced. Incorrect: B. Denied users are blocked for 30 minutes. D. Device detection on all interfaces is enforced for 30 minutes. FortiGate Security 7.2 Study Guide (p.69): "During the session, if a security profile detects a violation, FortiGate records the attack log immediately. To reduce the number of log messages generated and improve performance, you can enable a session table entry of dropped traffic. This creates the denied session in the session table and, if the session is denied, all packets of that session are also denied." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

• Chose AC2

  FortiGate_Security_7.0_Study_Guide page 127: If you have enabled logging in the policy, FortiGate generates traffic logs after a firewall policy closes an IP session. By default, Log Allowed Traffic is enabled and set to Security Events and generates logs for only the applied security profiles in the firewall policy. However, you can change the setting to All Sessions, which generates logs for all sessions. If you enable Generate Logs when Session Starts, FortiGate creates a traffic log when the session begins. FortiGate also generates a second log for the same session when it is closed. But remember that increasing logging decreases performance, so use it only when necessary. During the session, if a security profile detects a violation, FortiGate records the attack log immediately.

• 6

  To reduce the number of log messages generated and improve performance, you can enable a session table entry of dropped traffic. This creates the denied session in the session table and, if the session is denied, all packets of that session are also denied. This ensures that FortiGate does not have to do a policy lookup for each new packet matching the denied session, which reduces CPU usage and log generation. This option is in the CLI, and is called ses-denied-traffic. You can also set the duration for block sessions. This determines how long a session will be kept in the session table by setting blocksession-timer in the CLI. By default, it is set to 30 seconds. If the GUI option Generate Logs when Session Starts is not displayed, this means that your FortiGate device does not have internal storage. This option is on the CLI, regardless of internal storage, and is called set logtraffic-start enable.