FCP-FGT-AD - Content inspection (20% of the exam) - Section 3.5

Configure IPS to protect networks from known threats and vulnerabilities using signature-based detection.

Configure an IPS sensor by selecting FortiGuard IPS signatures and enabling anomaly detection to protect network resources from known exploits and protocol violations. Tune sensor filters and set override actions to balance protection strength against legitimate traffic impact.

IPS sensorIPS signatureanomaly detectionFortiGuard IPS

Practice question for this objective

Free sampleContent inspectionhard

An administrator applies an IPS sensor to an outbound firewall policy. Within the sensor, one signature filter sets the action to monitor, while a separate signature override below it sets the same overlapping signature to block. When traffic matches that signature, which action does FortiGate take and why?

AMonitor, because the first matching entry in the sensor wins and the filter is listed above the override.
BPass, because the conflicting monitor and block actions cancel out and FortiGate falls back to the default permit behaviour.
CReset, because combining a monitor filter and a block override forces FortiGate to send a TCP reset to both endpoints.
DBlock, because a signature override is evaluated after the filters and takes precedence over the filter action for the matching signature. Correct

Understand that a per-signature override in an IPS sensor takes precedence over a broader signature filter for the matched signature. FortiGate processes an IPS sensor by first matching signature filters and then applying any specific signature override. Because the override targets one signature directly, its configured action replaces whatever the filter would have applied, so block is enforced.

Why A is wrong: Tempting because firewall policy lists use top-down first-match, but IPS sensor processing is not simple top-down: the per-signature override deliberately supersedes the broader filter regardless of list order.

Why B is wrong: Tempting if you assume conflicts void both entries, but FortiOS never cancels actions; it resolves the conflict deterministically in favour of the override rather than passing the traffic.

Why C is wrong: Tempting because reset is a valid IPS action, but it is never produced by merging two configured actions; reset only applies when an entry is explicitly set to reset.

Why D is correct: Correct. Within an IPS sensor, FortiOS evaluates signature filters first and then applies any per-signature override, so the override action of block wins for that specific signature.

See more FCP-FGT-AD practice questions, answers explained.

Exam traps in Content inspection

Answers that look right on this material and are not. Each one is a distractor from a different question in the FCP-FGT-AD bank for this domain.

Add individual signature overrides for every current critical server signature and schedule a weekly task to add new ones manually.
Why it is wrong: Tempting because per-signature overrides give precise control, but enumerating signatures by hand cannot pick up newly published ones automatically, which is exactly what the requirement forbids.
Apply an application control profile that blocks the offending application category, so both the buffer-overflow payload and the SYN flood are stopped by application identification.
Why it is wrong: This is tempting because application control is another security profile, but it classifies applications by behaviour and does not match exploit byte patterns or enforce a connection-rate threshold for a SYN flood.
Lowering the broad filter's action from block to monitor would be the only safe fix, because a per-signature override can never take precedence over the filter it sits within.
Why it is wrong: This is wrong because a per-signature override is evaluated ahead of the broader filter for its specific signature, so the override is the correct narrow fix and dropping the whole filter to monitor would needlessly weaken every other signature.

Examworthy is not affiliated with or endorsed by Fortinet. Original, blueprint-aligned practice material only.