StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Logging and diagnosis

Practice question 24 of 440 · medium

A traffic record reports an accepted session, while a correlated web-filter record reports blocked content. Which conclusion is justified?

Choose the single best answer.

  1. A.Accepted traffic prevents any later security block
  2. B.The web-filter record must belong to another device
  3. C.The session was permitted before a security-profile decision blocked content
  4. D.The records prove FortiAnalyzer corrupted the action field
Show the answer and explanation

✓ Correct answer

  • The session was permitted before a security-profile decision blocked content

A firewall permit and a later content block can coexist. Correlate session/device/time fields; acceptance is not a guarantee of content delivery, and neither corruption nor another device follows from these actions alone.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.