A network engineer at a regional electric utility builds and tunes an IPS sensor for the substation segment, but does not touch any existing firewall policy. What happens to traffic entering that segment?
Select an answer to reveal the explanation.
Short Explanation
Think of an IPS sensor like a set of instructions sitting on a shelf — it doesn't do anything until someone hands it to the right job. On FortiGate, that hand-off is attaching the sensor to a firewall policy; only traffic matched by that policy gets inspected against it.
Full Explanation
Security profiles such as IPS sensors, file filter, and DLP are standalone objects on FortiOS: building one only defines what it would do, not where it does it. The profile becomes active only when it is referenced inside a firewall policy's security profile settings, and even then it only inspects sessions that policy actually permits. That is why creating and tuning a sensor for the substation segment has zero effect if it was never bound to the policy governing that segment's traffic. The first wrong option assumes profiles are global once created, but FortiOS has no such implicit scope — every profile is opt-in per policy. The second wrong option imagines partial activation by severity, but an unattached sensor evaluates nothing at all, high severity or otherwise. The third wrong option confuses inter-VDOM traffic handling with automatic inspection; inter-VDOM links are still governed by ordinary policies and need the same explicit profile assignment. A useful caveat: attaching a sensor to the wrong policy — one that never carries the substation traffic — is functionally identical to not attaching it at all. To verify the binding actually matters, generate representative test traffic and confirm hits appear in the security event log tied to that specific policy.