StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Intrusion prevention

Practice question 316 of 440 · medium

The IPS raw-socket buffer fills on a non-NTurbo path and fail-open is disabled. What is the documented behavior?

Choose the single best answer.

  1. A.Affected sessions continue normally with full IPS scanning.
  2. B.Affected sessions are dropped.
  3. C.All traffic necessarily bypasses IPS.
  4. D.Proxy av-failopen overrides the disabled raw-buffer fail-open setting.
Show the answer and explanation

✓ Correct answer

  • Affected sessions are dropped.

With IPS raw-buffer fail-open disabled on this non-NTurbo path, affected sessions drop. Full scanning cannot be guaranteed after the buffer fills; bypass requires the eligible fail-open setting. Proxy AV handling does not override this IPS raw-buffer behavior.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.