StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Intrusion prevention

Practice question 310 of 440 · medium

Synthetic IPS event: action="detected" msg="signature is on hold". The sensor is intended to block this attack. What explains the result?

Choose the single best answer.

  1. A.The attack was blocked and the client necessarily received a reset
  2. B.The AV oversize limit was necessarily exceeded
  3. C.Hold time permanently disables the whole sensor
  4. D.The new signature is being monitored during hold time
Show the answer and explanation

✓ Correct answer

  • The new signature is being monitored during hold time

Hold time uses monitoring before enforcement. The event does not prove a block, an AV size condition or permanent sensor disablement.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.