Exam NSE4_FGT-7.0 topic 1 question 28 discussion

FortiGate_Security_7.0_Study_Guide page 567 If there are high-CPU use problems caused by the IPS, you can use the diagnose test application ipsmonitor command with option 5 to isolate where the problem might be. Option 5 enables IPS bypass mode. In this mode, the IPS engine is still running, but it is not inspecting traffic. If the CPU use decreases after that, it usually indicates that the volume of traffic being inspected is too high for that FortiGate model. If the CPU use remains high after enabling IPS bypass mode, it usually indicates a problem in the IPS engine, which you must report to Fortinet Support.

D. The IPS engine was inspecting high volume of traffic. FortiGate Security 7.2 Study Guide (p.417): "If there are high-CPU use problems caused by the IPS, you can use the diagnose test application ipsmonitor command with option 5 to isolate where the problem might be. Option 5 enables IPS bypass mode. In this mode, the IPS engine is still running, but it is not inspecting traffic. If the CPU use decreases after that, it usually indicates that the volume of traffic being inspected is too high for that FortiGate model." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

D is the correct answer.

If there are high-CPU use problems caused by the IPS, you can use the diagnose test application ipsmonitor command with option 5 to isolate where the problem might be. Option 5 enables IPS bypass mode. In this mode, the IPS engine is still running, but it is not inspecting traffic. If the CPU use decreases after that, it usually indicates that the volume of traffic being inspected is too high for that FortiGate model. From: Page 416 FortiGate Security 7.2 Study Guide

Correct is D

d is correct

the question is about what happened after user, not the function of option 5. if it was asked for the function, Option B will be correct.

If the CPU use decreases after that, it usually indicates that the volume of traffic being inspected is too high for that FortiGate model.

Correct answer is D

toto74500 1 month, 1 week ago FortiGate_Security_7.0_Study_Guide page 567 If there are high-CPU use problems caused by the IPS, you can use the diagnose test application ipsmonitor command with option 5 to isolate where the problem might be. Option 5 enables IPS bypass mode. In this mode, the IPS engine is still running, but it is not inspecting traffic. If the CPU use decreases after that, it usually indicates that the volume of traffic being inspected is too high for that FortiGate model. If the CPU use remains high after enabling IPS bypass mode, it usually indicates a problem in the IPS engine, which you must report to Fortinet Support.

I guess the answer here is D. it mentioned "was" means before, so it's pertaining that the volume of traffic is high before they disabled the IPS.. causing the CPU usage to decreased. B on the other hand, is not true.. It is able to prevent an intrusion attack and will always be.

diagnose test application ipsmonitor 5 <----- This command will help us to bypass the IPS for monitoring) - So less CPU and Memory usage

When IPS is bypassed it should reduce CPU usages for traffic inspection. Hence D is more likely a correct answer.

And Anwser is?

decrease??