NSE 7 - Enterprise Firewall 7.6 Administrator Exam Materials - Question #31 Discussion

C makes more sense

C. Enable inspect all ports in flow mode

Explanation:
- Intrusion Prevention System (IPS) on FortiGate uses protocol decoders and application signatures to detect and block malicious traffic patterns.
- By default, IPS inspection may only occur on well-known ports. Enabling "Inspect All Ports" ensures that IPS can analyze traffic across all ports, which is crucial for detecting threats that use non-standard ports or evade traditional port-based filtering.
- This setting works in flow mode, which is optimized for performance while still providing deep inspection.


A. DNS filter: Focuses on domain-based filtering, not IPS protocol decoders.
B. Application control: Controls application usage but does not directly leverage IPS protocol decoders.
D. SD-WAN rules: These are for traffic steering and performance, not IPS threat detection.

B. Use Application Control to limit non-URL-based software handling.

Why it’s B (and not C)
Application Control is the feature designed to identify applications by signatures/behavior, and it relies on protocol decoders (the same decoding logic used by IPS) to recognize apps even when they use non-standard ports. Once the application is identified, Application Control can block it directly with an Application Control profile/sensor.
That matches the wording: “protocol decoders… transmission patterns… application signatures” → Application Control.

C. “Inspect all ports in flow mode” is not the blocking mechanism the question is describing.
It’s an inspection scope setting: it tells the inspection engine to look beyond default ports so traffic can’t evade detection by switching ports. It can help detection, but it doesn’t specifically mean blocking traffic based on application signatures via protocol decoders. The question is asking for the feature/action that performs that signature-based blocking, which is Application Control.

In one line:
true. B blocks by application signature/decoder detection.
false. C only broadens inspection to all ports; it’s not the specific “block by app signature” control.

From Study Guide:
"Application control operates solely with flow-based inspection and identifies applications through their transmission patterns, using application signatures and protocol decoders, as well as rate-based IPS signatures to spot anomalies."

"flow-based inspections assess all ports, regardless of protocol port-mapping settings"

transmission patterns are what application control do.
B

B is correct. Page 171 of Study guide.

B

Enterprise_Firewall_7.6_Administrator_Study_Guide Page 171

The question explicitly mentions IPS protocol decoders. These are part of the IPS engine, not Application Control.
To effectively use IPS decoders and block traffic, the firewall must inspect traffic on all ports, not just standard ones.

“Inspect all ports” ensures IPS can detect and act on applications/protocols regardless of port usage.

B