Refer to the exhibit. Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?
A.
Traffic matching the signature will be silently dropped and logged.
B.
The signature setting uses a custom rating threshold.
C.
The signature setting includes a group of other signatures.
D.
Traffic matching the signature will be allowed and logged.
"pass" is only default action
To explain this: the Pass action on the specific signature would only be chosen, if the Action (on the top) was set to Default. But instead its set to Block, se the action is will be to block and drop.
A is correct. FortiGate Security 6.4 page 529. "Select the block to silently drop mathematical traffic from any of the signatures included in the entry"
I vote for A, by adding this signature it will overwrite the default setting with the Block action. Silent drop means it will break the TCP session state without sending a FIN to the sender.
D is correct as it says traffic matching with IPS signature "FTP.login" and action is passed, all others will be dropped except matching signature FTP.loginfailed.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Lionardo
Highly Voted 4 years agoHriibek
3 years, 4 months agoXillar
Highly Voted 4 years agojuanK1982
Most Recent 3 years agoxandao
3 years, 1 month agoWindral
3 years, 1 month agoEngelL
3 years, 2 months agoAltimbo
3 years, 3 months agoPinchi_111
3 years, 3 months agoaandreou020
3 years, 3 months agoMrSaintz
3 years, 4 months agoScottXYZ
3 years, 4 months agopicasso701
3 years, 5 months agoforti_Ctes
3 years, 5 months agodeepakkalri
3 years, 6 months agoHasan2021
3 years, 6 months agodragonwise
3 years, 8 months agostudentc
3 years, 7 months agoZaiderr
3 years, 11 months ago