NSE4 Security Profiles — Timed 15 Questions

Question 1

A network administrator notices that users cannot access HTTPS websites after enabling SSL inspection. The firewall policy allows the traffic, and the certificate is trusted on the clients. What is the most likely cause?

Accepted Answer

The CA certificate used for SSL inspection is not trusted by the clients.. Option A is correct because the most likely cause is that the CA certificate used for SSL inspection is not trusted by the clients. Even if the firewall policy allows the traffic and the certificate is trusted on the clients, if the CA certificate used to generate the inspection certificate is not trusted, the clients will not trust the certificate presented by the firewall, resulting in HTTPS access failures.

Answer

The client's browser has a proxy configured incorrectly.

Answer

The firewall policy has SSL inspection disabled.

Answer

The DNS server is not resolving the domain names.

Question 2

Which FortiGate feature allows you to block access to specific URL categories such as 'Social Media' or 'Gambling'?

Accepted Answer

Web Filtering. FortiGate's Web Filtering feature uses URL rating and category databases (e.g., FortiGuard) to block access to entire categories like 'Social Media' or 'Gambling' based on the destination URL. This is distinct from content inspection; it operates at the HTTP/HTTPS request level by matching the requested URL against predefined or custom category lists.

Answer

Antivirus

Answer

Intrusion Prevention System (IPS)

Answer

Application Control

Question 3

An administrator configured SSL inspection with 'deep-inspection' profile. Users report that some websites fail to load with certificate errors. The firewall policy is correct. What is the most likely reason?

Accepted Answer

The web server uses a cipher that the FortiGate cannot re-encrypt.. When deep-inspection is used, the FortiGate decrypts the client-to-server traffic, inspects the content, and then re-encrypts it before forwarding to the client. If the web server uses a cipher suite that the FortiGate does not support for re-encryption (e.g., an obsolete or non-standard cipher), the FortiGate cannot complete the SSL handshake with the client, causing certificate errors or connection failures. This is the most likely reason because the firewall policy is correct and the CA certificate is valid.

Answer

The CA certificate has expired.

Answer

The user's browser is outdated.

Answer

The firewall needs a policy to allow DNS traffic.

Question 4

When configuring SSL inspection, which type of inspection decrypts and inspects all HTTPS traffic including applications using non-standard ports?

Accepted Answer

Full SSL Inspection (Deep Inspection). Full SSL Inspection (Deep Inspection) is the correct answer because it performs a man-in-the-middle decryption and re-encryption of all HTTPS traffic, regardless of the port used. This allows the FortiGate to inspect the payload of encrypted sessions, including those on non-standard ports, for threats and policy violations.

Answer

SSL Offloading

Answer

Certificate Inspection

Answer

Flow-based Inspection

Question 5

A company wants to block downloads of executable files via HTTP and HTTPS while allowing other content. Which combination of security profiles should be applied to the firewall policy?

Accepted Answer

Web Filtering and Antivirus. To block executable file downloads over HTTP and HTTPS while allowing other content, a Web Filtering profile is required to filter based on URL category or content type, and an Antivirus profile is needed to scan and block files (such as .exe) within the HTTP/HTTPS stream. The Antivirus profile can detect and block executable files by file signature or MIME type, while Web Filtering controls access to download sites or file types. Together, they provide layered defense against malicious executable downloads without affecting other web content.

Answer

Application Control and Antivirus

Answer

Web Filtering and IPS

Answer

DNS Filtering and Web Filtering

Question 6

After enabling SSL inspection, a user receives a warning 'The certificate is not trusted' in the browser. The administrator has installed the CA certificate on the client. What else could be the cause?

Accepted Answer

The CA certificate is not added to the browser's trusted root store.. Even though the administrator installed the CA certificate on the client, the browser uses its own trusted root store, which is separate from the operating system's certificate store. If the CA certificate is not specifically added to the browser's trusted root store (e.g., Chrome uses the system store but Firefox maintains its own), the browser will still flag the certificate as untrusted. This is a common misconfiguration when deploying SSL inspection with FortiGate.

Answer

The firewall policy denies the traffic.

Answer

The FortiGate is not decrypting the traffic.

Answer

The web server's certificate has expired.

Question 7

An administrator wants to inspect SSL traffic to a specific finance application that uses a custom port (9443) and a self-signed certificate. Which configuration is required?

Accepted Answer

Use deep inspection and add the application's self-signed certificate to the FortiGate's trusted CA list.. Option C is correct because deep inspection is required to decrypt and inspect SSL traffic using a self-signed certificate on a non-standard port. The FortiGate must trust the application's self-signed certificate by adding it to the trusted CA list; otherwise, the deep inspection proxy will fail to validate the certificate and drop the connection. Certificate inspection (Option A) only checks the certificate metadata without decrypting the payload, so it cannot inspect the actual application traffic.

Answer

Configure certificate inspection on the policy.

Answer

Disable SSL inspection for that application.

Answer

Use flow-based inspection with certificate inspection.

Question 8

Which of the following is a prerequisite for SSL deep inspection to work correctly on FortiGate?

Accepted Answer

A firewall policy that has SSL inspection enabled.. SSL deep inspection requires a firewall policy with SSL inspection enabled to intercept and decrypt HTTPS traffic. Without such a policy, the FortiGate cannot apply the CA certificate to re-encrypt traffic for inspection, making deep inspection non-functional.

Answer

A dedicated HTTPS firewall policy.

Answer

The FortiGate must be operating in proxy mode.

Answer

An active FortiCare license.

Question 9

A user reports that a legitimate website is being blocked by FortiGate web filtering. The administrator checks and finds that the URL category is 'Unrated'. What is the most likely cause?

Accepted Answer

The website is new and not yet categorized by FortiGuard.. When a website is categorized as 'Unrated' in FortiGate web filtering, it means FortiGuard's web filtering database has not yet assigned a category to that URL. This commonly occurs for newly registered or recently launched websites that have not been crawled and classified by FortiGuard's rating infrastructure. The correct answer is B because the 'Unrated' status directly indicates the site is new and not yet categorized.

Answer

The DNS server is not resolving the domain.

Answer

The web filter is configured to block all unrated sites.

Answer

The website is in the 'Blocked' category.

Question 10

Which TWO actions can cause SSL inspection to fail with certificate errors on client browsers? (Choose two.)

Accepted Answer

The FortiGate's CA certificate has expired.. Option A is correct because the FortiGate acts as a certificate authority (CA) for SSL inspection. If the FortiGate's CA certificate has expired, any server certificate it generates and signs for intercepted HTTPS sessions will be considered invalid by client browsers. Browsers will display a certificate error because the signing CA (the FortiGate) is no longer trusted due to expiration, even if the client has the CA certificate installed.

Answer

The firewall policy allows the traffic.

Answer

The web server's certificate is signed by a public CA.

Answer

The client browser has the FortiGate CA certificate installed.

Question 11

Which THREE steps are necessary when configuring SSL deep inspection on FortiGate? (Choose three.)

Accepted Answer

Create an SSL inspection profile defining the inspection mode.. Option B is correct because an SSL inspection profile defines how FortiGate handles encrypted traffic, including the inspection mode (e.g., full or certificate-inspection). This profile is a mandatory component for deep inspection, as it specifies whether to decrypt, re-encrypt, or simply examine certificates.

Answer

Add a static route to the internet.

Answer

Configure a forward proxy server.

Question 12

Which TWO web filtering features can be used to block access to malicious websites? (Choose two.)

Accepted Answer

FortiGuard category-based filtering. FortiGuard category-based filtering (C) is correct because it leverages FortiGuard's cloud-based web rating database to categorize URLs and block access to known malicious sites, such as those hosting malware or phishing. Web rating override (D) is correct because it allows administrators to manually override the FortiGuard rating for specific URLs, enabling them to block a site that may not yet be categorized as malicious by FortiGuard. Both features directly control access to malicious websites based on URL reputation.

Answer

Static URL filtering

Answer

Application control

Answer

DNS filter

Question 13

Refer to the exhibit. The policy applies deep inspection, but users cannot access any HTTPS websites. The FortiGate CA certificate is installed on clients. What is the most likely cause?

Accepted Answer

The service 'HTTPS' only allows TCP 443, but some websites use other ports.. Option D is correct because the policy uses the service 'HTTPS', which by default only matches TCP port 443. If any HTTPS websites are hosted on non-standard ports (e.g., 8443, 9443), the FortiGate will not apply deep inspection to that traffic, causing the connection to fail when deep inspection is required. The FortiGate CA certificate being installed on clients ensures trust, but the service definition must match the actual destination port for inspection to occur.

Answer

The deep inspection profile is misconfigured.

Answer

The antivirus profile is blocking the traffic.

Answer

The web filter profile 'strict' is blocking all sites.

Question 14

Refer to the exhibit. A FortiGate SSL VPN user is unable to connect. The debug output shows the above error. What is the most likely cause?

Accepted Answer

The CA that issued the SSL VPN certificate is not trusted by the client.. The debug output indicates an SSL/TLS handshake failure, specifically that the client does not trust the server's certificate. This occurs when the Certificate Authority (CA) that issued the SSL VPN certificate is not in the client's trusted root store. Option B correctly identifies this as the most likely cause because the error is a certificate trust issue, not an expiration or authentication problem.

Answer

The SSL VPN certificate has expired.

Answer

The user's password is incorrect.

Answer

The firewall policy is blocking the SSL VPN port.

Question 15

A company with 500 employees uses FortiGate as their internet gateway. They recently enabled SSL deep inspection using the built-in CA certificate. After deployment, many users report that they cannot access their online banking websites. The error message in the browser says 'The certificate is not trusted'. The administrator has already pushed the FortiGate CA certificate to all domain-joined computers via Group Policy. However, the problem persists for banking sites. The administrator also notices that banking sites load fine on mobile devices that do not have the CA certificate installed. What is the most likely cause and solution?

Accepted Answer

Banking websites use certificate pinning. Exempt them from deep inspection using an SSL inspection exemption list.. Banking websites often use HTTP Public Key Pinning (HPKP) or certificate pinning, where the browser expects a specific certificate or public key from the server. When FortiGate performs SSL deep inspection, it re-signs the server's certificate with its own CA, breaking the pinning validation. This causes the 'certificate not trusted' error even when the FortiGate CA is trusted, because the browser detects that the presented certificate does not match the pinned certificate. The correct solution is to exempt banking sites from deep inspection using an SSL inspection exemption list, allowing the original server certificate to pass through.

Answer

Disable SSL inspection entirely to avoid certificate issues.

Answer

The CA certificate is not properly installed on all computers. Re-deploy via Group Policy.

Answer

Use certificate inspection instead of deep inspection for all traffic.