Exam FCSS_EFW_AD-7.4 topic 1 question 11 discussion

Actual exam question from Fortinet's FCSS_EFW_AD-7.4

Question #: 11
Topic #: 1

An administrator applied a block-all IPS profile for client and server targets to secure the server, but the database team reported the application stopped working immediately after.
How can an administrator apply IPS in a way that ensures it does not disrupt existing applications in the network?

A. Use an IPS profile with all signatures in monitor mode and verify patterns before blocking.
B. Limit the IPS profile to server targets only to avoid blocking connections from the server to clients.
C. Select flow mode in the IPS profile to accurately analyze application patterns.
D. Set the IPS profile signature action to default to discard all possible false positives.

Show Suggested Answer

Suggested Answer: A 🗳️

by Tweefo at March 26, 2025, 2:10 p.m.

Comments

Submit Cancel

Yaghu

4 days, 21 hours ago

Selected Answer: A

This is a good practice when deploying IPS for the first time.

upvoted 1 times

...

Tweefo

1 week ago

Selected Answer: A

A is correct. When applying IPS for the first time, especially with a block-all profiles, there's a high risk of false positives, which can block legitimate trafic. Source : Study Guide Page 175

upvoted 1 times

...

Exam FCSS_EFW_AD-7.4 All Questions

View all questions & answers for the FCSS_EFW_AD-7.4 exam

Exam FCSS_EFW_AD-7.4 topic 1 question 11 discussion

Comments

Yaghu

Tweefo

SY0-701