Fortinet NSE4_FGT_AD-7.6 Exam - Topic 3 Question 3 Discussion

In FortiOS 7.6, if an administrator wants to block traffic only after an IPS signature is triggered a specific number of times within a defined time window, this must be done using IPS filters with rate-based settings.

Why option D is correct

IPS filters allow administrators to match signatures based on attributes such as:

Severity

Protocol

CVE

Signature ID

IPS filters support rate-based actions using:

rate-mode periodical

rate-count

rate-duration

With rate-mode periodical, FortiGate:

Counts how many times a signature is triggered

Within a defined time period

And applies the configured action (for example, block) once the threshold is exceeded

This directly matches the requirement:

''block traffic that triggers the signature set number of times during a specific time period.''

Why the other options are incorrect

A . IPS group signatures, set rate-mode 60 Group signatures do not provide the required per-period rate-based blocking logic.

B . IPS packet logging option Logging does not enforce blocking behavior.

C . IPS signatures, rate-mode periodical option Rate-based controls are applied via IPS filters, not directly on individual signature definitions.