StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Intrusion prevention

Practice question 307 of 440 · medium

A narrow Monitor exception sits below a broad Block entry that includes the same signature. The false positive remains blocked. What should be reviewed?

Choose the single best answer.

  1. A.Assume the lower entry always wins
  2. B.Disable logging to change the blocking action
  3. C.Move the justified narrow exception before the broad entry
  4. D.Increase the DNS cache size
Show the answer and explanation

✓ Correct answer

  • Move the justified narrow exception before the broad entry

Sensor ordering can make the broad entry apply first. DNS cache and logging do not change signature action precedence.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.