An administrator applies an IPS sensor to an outbound firewall policy. Within the sensor, one signature filter sets the action to monitor, while a separate signature override below it sets the same overlapping signature to block. When traffic matches that signature, which action does FortiGate take and why?
- AMonitor, because the first matching entry in the sensor wins and the filter is listed above the override.
- BPass, because the conflicting monitor and block actions cancel out and FortiGate falls back to the default permit behaviour.
- CReset, because combining a monitor filter and a block override forces FortiGate to send a TCP reset to both endpoints.
- DBlock, because a signature override is evaluated after the filters and takes precedence over the filter action for the matching signature. Correct
Why A is wrong: Tempting because firewall policy lists use top-down first-match, but IPS sensor processing is not simple top-down: the per-signature override deliberately supersedes the broader filter regardless of list order.
Why B is wrong: Tempting if you assume conflicts void both entries, but FortiOS never cancels actions; it resolves the conflict deterministically in favour of the override rather than passing the traffic.
Why C is wrong: Tempting because reset is a valid IPS action, but it is never produced by merging two configured actions; reset only applies when an entry is explicitly set to reset.
Why D is correct: Correct. Within an IPS sensor, FortiOS evaluates signature filters first and then applies any per-signature override, so the override action of block wins for that specific signature.