StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Inspection modes and web filtering

Practice question 246 of 440 · medium

A traffic event says action=accept, while a web event for the same session says action=blocked. Which interpretation fits?

Choose the single best answer.

  1. A.The traffic log proves that the block event is invalid
  2. B.The routing table was necessarily removed mid-session
  3. C.Both actions mean the website was allowed
  4. D.The later web-filter decision denied an accepted connection
Show the answer and explanation

✓ Correct answer

  • The later web-filter decision denied an accepted connection

A firewall accept and later UTM denial can coexist. Correlate session fields; accept does not cancel the security event, and no route removal is established.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.