NSE4 Security Profiles — 100 Questions

Question 1

A network administrator notices that users cannot access HTTPS websites after enabling SSL inspection. The firewall policy allows the traffic, and the certificate is trusted on the clients. What is the most likely cause?

Accepted Answer

The CA certificate used for SSL inspection is not trusted by the clients.. Option A is correct because the most likely cause is that the CA certificate used for SSL inspection is not trusted by the clients. Even if the firewall policy allows the traffic and the certificate is trusted on the clients, if the CA certificate used to generate the inspection certificate is not trusted, the clients will not trust the certificate presented by the firewall, resulting in HTTPS access failures.

Answer

The client's browser has a proxy configured incorrectly.

Answer

The firewall policy has SSL inspection disabled.

Answer

The DNS server is not resolving the domain names.

Question 2

Which FortiGate feature allows you to block access to specific URL categories such as 'Social Media' or 'Gambling'?

Accepted Answer

Web Filtering. FortiGate's Web Filtering feature uses URL rating and category databases (e.g., FortiGuard) to block access to entire categories like 'Social Media' or 'Gambling' based on the destination URL. This is distinct from content inspection; it operates at the HTTP/HTTPS request level by matching the requested URL against predefined or custom category lists.

Answer

Antivirus

Answer

Intrusion Prevention System (IPS)

Answer

Application Control

Question 3

An administrator configured SSL inspection with 'deep-inspection' profile. Users report that some websites fail to load with certificate errors. The firewall policy is correct. What is the most likely reason?

Accepted Answer

The web server uses a cipher that the FortiGate cannot re-encrypt.. When deep-inspection is used, the FortiGate decrypts the client-to-server traffic, inspects the content, and then re-encrypts it before forwarding to the client. If the web server uses a cipher suite that the FortiGate does not support for re-encryption (e.g., an obsolete or non-standard cipher), the FortiGate cannot complete the SSL handshake with the client, causing certificate errors or connection failures. This is the most likely reason because the firewall policy is correct and the CA certificate is valid.

Answer

The CA certificate has expired.

Answer

The user's browser is outdated.

Answer

The firewall needs a policy to allow DNS traffic.

Question 4

When configuring SSL inspection, which type of inspection decrypts and inspects all HTTPS traffic including applications using non-standard ports?

Accepted Answer

Full SSL Inspection (Deep Inspection). Full SSL Inspection (Deep Inspection) is the correct answer because it performs a man-in-the-middle decryption and re-encryption of all HTTPS traffic, regardless of the port used. This allows the FortiGate to inspect the payload of encrypted sessions, including those on non-standard ports, for threats and policy violations.

Answer

SSL Offloading

Answer

Certificate Inspection

Answer

Flow-based Inspection

Question 5

A company wants to block downloads of executable files via HTTP and HTTPS while allowing other content. Which combination of security profiles should be applied to the firewall policy?

Accepted Answer

Web Filtering and Antivirus. To block executable file downloads over HTTP and HTTPS while allowing other content, a Web Filtering profile is required to filter based on URL category or content type, and an Antivirus profile is needed to scan and block files (such as .exe) within the HTTP/HTTPS stream. The Antivirus profile can detect and block executable files by file signature or MIME type, while Web Filtering controls access to download sites or file types. Together, they provide layered defense against malicious executable downloads without affecting other web content.

Answer

Application Control and Antivirus

Answer

Web Filtering and IPS

Answer

DNS Filtering and Web Filtering

Question 6

After enabling SSL inspection, a user receives a warning 'The certificate is not trusted' in the browser. The administrator has installed the CA certificate on the client. What else could be the cause?

Accepted Answer

The CA certificate is not added to the browser's trusted root store.. Even though the administrator installed the CA certificate on the client, the browser uses its own trusted root store, which is separate from the operating system's certificate store. If the CA certificate is not specifically added to the browser's trusted root store (e.g., Chrome uses the system store but Firefox maintains its own), the browser will still flag the certificate as untrusted. This is a common misconfiguration when deploying SSL inspection with FortiGate.

Answer

The firewall policy denies the traffic.

Answer

The FortiGate is not decrypting the traffic.

Answer

The web server's certificate has expired.

Question 7

An administrator wants to inspect SSL traffic to a specific finance application that uses a custom port (9443) and a self-signed certificate. Which configuration is required?

Accepted Answer

Use deep inspection and add the application's self-signed certificate to the FortiGate's trusted CA list.. Option C is correct because deep inspection is required to decrypt and inspect SSL traffic using a self-signed certificate on a non-standard port. The FortiGate must trust the application's self-signed certificate by adding it to the trusted CA list; otherwise, the deep inspection proxy will fail to validate the certificate and drop the connection. Certificate inspection (Option A) only checks the certificate metadata without decrypting the payload, so it cannot inspect the actual application traffic.

Answer

Configure certificate inspection on the policy.

Answer

Disable SSL inspection for that application.

Answer

Use flow-based inspection with certificate inspection.

Question 8

Which of the following is a prerequisite for SSL deep inspection to work correctly on FortiGate?

Accepted Answer

A firewall policy that has SSL inspection enabled.. SSL deep inspection requires a firewall policy with SSL inspection enabled to intercept and decrypt HTTPS traffic. Without such a policy, the FortiGate cannot apply the CA certificate to re-encrypt traffic for inspection, making deep inspection non-functional.

Answer

A dedicated HTTPS firewall policy.

Answer

The FortiGate must be operating in proxy mode.

Answer

An active FortiCare license.

Question 9

A user reports that a legitimate website is being blocked by FortiGate web filtering. The administrator checks and finds that the URL category is 'Unrated'. What is the most likely cause?

Accepted Answer

The website is new and not yet categorized by FortiGuard.. When a website is categorized as 'Unrated' in FortiGate web filtering, it means FortiGuard's web filtering database has not yet assigned a category to that URL. This commonly occurs for newly registered or recently launched websites that have not been crawled and classified by FortiGuard's rating infrastructure. The correct answer is B because the 'Unrated' status directly indicates the site is new and not yet categorized.

Answer

The DNS server is not resolving the domain.

Answer

The web filter is configured to block all unrated sites.

Answer

The website is in the 'Blocked' category.

Question 10

Which TWO actions can cause SSL inspection to fail with certificate errors on client browsers? (Choose two.)

Accepted Answer

The FortiGate's CA certificate has expired.. Option A is correct because the FortiGate acts as a certificate authority (CA) for SSL inspection. If the FortiGate's CA certificate has expired, any server certificate it generates and signs for intercepted HTTPS sessions will be considered invalid by client browsers. Browsers will display a certificate error because the signing CA (the FortiGate) is no longer trusted due to expiration, even if the client has the CA certificate installed.

Answer

The firewall policy allows the traffic.

Answer

The web server's certificate is signed by a public CA.

Answer

The client browser has the FortiGate CA certificate installed.

Question 11

Which THREE steps are necessary when configuring SSL deep inspection on FortiGate? (Choose three.)

Accepted Answer

Create an SSL inspection profile defining the inspection mode.. Option B is correct because an SSL inspection profile defines how FortiGate handles encrypted traffic, including the inspection mode (e.g., full or certificate-inspection). This profile is a mandatory component for deep inspection, as it specifies whether to decrypt, re-encrypt, or simply examine certificates.

Answer

Add a static route to the internet.

Answer

Configure a forward proxy server.

Question 12

Which TWO web filtering features can be used to block access to malicious websites? (Choose two.)

Accepted Answer

FortiGuard category-based filtering. FortiGuard category-based filtering (C) is correct because it leverages FortiGuard's cloud-based web rating database to categorize URLs and block access to known malicious sites, such as those hosting malware or phishing. Web rating override (D) is correct because it allows administrators to manually override the FortiGuard rating for specific URLs, enabling them to block a site that may not yet be categorized as malicious by FortiGuard. Both features directly control access to malicious websites based on URL reputation.

Answer

Static URL filtering

Answer

Application control

Answer

DNS filter

Question 13

Refer to the exhibit. The policy applies deep inspection, but users cannot access any HTTPS websites. The FortiGate CA certificate is installed on clients. What is the most likely cause?

Accepted Answer

The service 'HTTPS' only allows TCP 443, but some websites use other ports.. Option D is correct because the policy uses the service 'HTTPS', which by default only matches TCP port 443. If any HTTPS websites are hosted on non-standard ports (e.g., 8443, 9443), the FortiGate will not apply deep inspection to that traffic, causing the connection to fail when deep inspection is required. The FortiGate CA certificate being installed on clients ensures trust, but the service definition must match the actual destination port for inspection to occur.

Answer

The deep inspection profile is misconfigured.

Answer

The antivirus profile is blocking the traffic.

Answer

The web filter profile 'strict' is blocking all sites.

Question 14

Refer to the exhibit. A FortiGate SSL VPN user is unable to connect. The debug output shows the above error. What is the most likely cause?

Accepted Answer

The CA that issued the SSL VPN certificate is not trusted by the client.. The debug output indicates an SSL/TLS handshake failure, specifically that the client does not trust the server's certificate. This occurs when the Certificate Authority (CA) that issued the SSL VPN certificate is not in the client's trusted root store. Option B correctly identifies this as the most likely cause because the error is a certificate trust issue, not an expiration or authentication problem.

Answer

The SSL VPN certificate has expired.

Answer

The user's password is incorrect.

Answer

The firewall policy is blocking the SSL VPN port.

Question 15

A company with 500 employees uses FortiGate as their internet gateway. They recently enabled SSL deep inspection using the built-in CA certificate. After deployment, many users report that they cannot access their online banking websites. The error message in the browser says 'The certificate is not trusted'. The administrator has already pushed the FortiGate CA certificate to all domain-joined computers via Group Policy. However, the problem persists for banking sites. The administrator also notices that banking sites load fine on mobile devices that do not have the CA certificate installed. What is the most likely cause and solution?

Accepted Answer

Banking websites use certificate pinning. Exempt them from deep inspection using an SSL inspection exemption list.. Banking websites often use HTTP Public Key Pinning (HPKP) or certificate pinning, where the browser expects a specific certificate or public key from the server. When FortiGate performs SSL deep inspection, it re-signs the server's certificate with its own CA, breaking the pinning validation. This causes the 'certificate not trusted' error even when the FortiGate CA is trusted, because the browser detects that the presented certificate does not match the pinned certificate. The correct solution is to exempt banking sites from deep inspection using an SSL inspection exemption list, allowing the original server certificate to pass through.

Answer

Disable SSL inspection entirely to avoid certificate issues.

Answer

The CA certificate is not properly installed on all computers. Re-deploy via Group Policy.

Answer

Use certificate inspection instead of deep inspection for all traffic.

Question 16

A school uses FortiGate for web filtering. They want to block social media sites for students during class hours (8 AM to 3 PM) but allow access for teachers at all times. The network has a single internet connection and all users are in the same subnet. The administrator created a firewall policy for students (source IP range 192.168.1.100-200) and another for teachers (source IP range 192.168.1.10-50). The student policy has a web filter profile that blocks social media. However, teachers are also being blocked from social media during class hours. What is the most likely cause?

Accepted Answer

The student policy is placed before the teacher policy in the policy list.. FortiGate processes firewall policies in sequential order from top to bottom, and the first matching policy is applied. Since the student policy (source IP range 192.168.1.100-200) is placed before the teacher policy (source IP range 192.168.1.10-50), traffic from teachers whose source IP falls within the student range (e.g., 192.168.1.50) will match the student policy first, causing them to be subject to the web filter profile that blocks social media. This is the most likely cause of teachers being blocked during class hours.

Answer

The web filter profile is applied globally.

Answer

The teacher policy has a schedule that restricts access.

Answer

The student policy is placed after the teacher policy.

Question 17

A network administrator notices that an IPS sensor is generating excessive false positives for a specific signature. The administrator wants to exclude traffic from a trusted internal server (IP 10.1.1.100) from inspection for that signature only, while keeping other signatures active. Which configuration change should the administrator apply?

Accepted Answer

Create an IPS filter that excludes the server's source IP address from the signature.. Option D is correct because an IPS filter allows the administrator to define a rule that excludes traffic from a specific source IP address (10.1.1.100) from inspection for a particular signature, while leaving all other signatures active. This granular approach ensures that false positives for that signature are reduced without disabling the signature entirely or affecting other traffic.

Answer

Set the signature action to 'pass' and use an application control profile to bypass the server.

Answer

Disable the signature in the IPS sensor configuration.

Answer

Add the server's IP to the exempt list in the IPS sensor.

Question 18

A security engineer is designing an application control policy for a corporate network. The goal is to allow Microsoft Teams for business use but block personal use of other collaboration apps like Zoom and Slack. The engineer configures an application control profile with a rule to 'monitor' Microsoft Teams and 'block' Zoom and Slack. However, users report that Zoom is still working. What is the most likely reason?

Accepted Answer

There is an implicit allow rule or a higher-priority rule that allows Zoom before the block rule is evaluated.. Option B is correct because FortiGate application control policies are evaluated in order, and the first matching rule is applied. If a higher-priority rule (or an implicit allow rule) permits Zoom traffic before the block rule is reached, Zoom will be allowed. The engineer likely placed the block rule after an allow rule or the default implicit allow policy is permitting Zoom traffic.

Answer

Application control profiles can only have one rule.

Answer

The 'monitor' rule for Teams overrides the 'block' rule for Zoom.

Answer

Application control uses port-based inspection and Zoom uses a non-standard port.

Question 19

A company wants to block all peer-to-peer file sharing applications on the network. Which FortiGate feature should be used to achieve this goal?

Accepted Answer

Application Control. Application Control is the correct feature because it is specifically designed to identify and block peer-to-peer (P2P) file-sharing applications by inspecting traffic patterns and signatures, regardless of the port or protocol used. Unlike port-based blocking, Application Control uses deep packet inspection (DPI) to recognize P2P protocols such as BitTorrent, eDonkey, and Gnutella, even when they attempt to evade detection by using non-standard ports or encryption.

Answer

Web Filter

Answer

DNS Filter

Answer

Intrusion Prevention System (IPS)

Question 20

During a security audit, an administrator finds that an IPS sensor configured with a 'block' action for a critical vulnerability signature is not blocking the associated traffic. The traffic matches the signature, but the action appears as 'pass' in the logs. The IPS sensor is applied to a firewall policy that also has application control enabled. What is the most likely cause?

Accepted Answer

Application control profile is set to 'allow' for the application associated with the traffic, overriding the IPS block action.. When an IPS sensor with a 'block' action logs 'pass' for matching traffic, it indicates that another security profile is overriding the IPS action. In FortiOS, if an application control profile is set to 'allow' for the application, it can bypass the IPS block because application control processing occurs before IPS inspection. The traffic is permitted by the application control profile, so the IPS engine does not enforce the block action, resulting in a 'pass' log entry.

Answer

The IPS engine is bypassed because the traffic matches a fast-path rule.

Answer

The IPS sensor is not enabled in the firewall policy.

Answer

The IPS sensor is configured with 'monitor' action instead of 'block'.