NSE4 Security Profiles Practice Question
A company is deploying FortiGate for outbound web filtering. They want to block users from accessing social media sites during business hours, but still allow access to cloud-based productivity tools like Office 365. Which approach should the administrator use to meet this requirement?
⚠ Common exam trap
Many exam-takers assume URL filtering or port blocking is sufficient, but the NSE4 exam tests the understanding that application control is required when applications share the same port (e.g., TCP 443) and need to be differentiated based on their behavior, not just their domain or port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an application control profile with rules to block social media applications and allow Office 365 applications.
Application control is the correct approach because it can identify and control applications like social media and Office 365 based on their unique signatures, regardless of the ports or protocols they use. Unlike URL filtering or port blocking, application control can differentiate between Office 365 traffic and social media traffic even when both use HTTPS on TCP 443, allowing the administrator to block social media while permitting cloud productivity tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a firewall policy to block all traffic to ports commonly used by social media (e.g., TCP 443).
Why it's wrong here
Blocking TCP 443, or any single port, is fundamentally incompatible with the requirement because Office 365 also uses HTTPS (443) and its traffic must be allowed. This approach would indiscriminately break all web access, including legitimate enterprise email and collaboration, while social media platforms can also be accessed over non-standard ports or protocols. It is a coarse transport-layer control, not an application-aware control, so it cannot distinguish between allowed and disallowed applications sharing the same port.
- ✗
Use a web filter profile to block URLs containing 'facebook' or 'twitter'.
Why it's wrong here
A web filter profile that blocks URLs merely containing 'facebook' or 'twitter' is unreliable because many social media apps access content through domains or CDNs that do not include these strings, and users can bypass keyword rules by using IP addresses or shortened URLs. It also risks false positives, blocking legitimate sites that happen to contain those words in the URL path or query string. Moreover, web filtering only inspects HTTP/HTTPS requests, so native mobile or desktop social media clients that use non-HTTP protocols would evade the block entirely.
- ✓
Configure an application control profile with rules to block social media applications and allow Office 365 applications.
Why this is correct
Application control is the correct approach because it classifies traffic based on application signatures and behaviors rather than static port numbers or URL strings. A properly configured application control profile can identify and block specific social media applications—even when they run over HTTPS or use non-standard ports—while explicitly allowing Office 365 applications, including Outlook, Teams, and SharePoint Online. This granularity meets the exact requirement without disrupting business-critical services, and with SSL inspection enabled, it remains effective against encrypted social media traffic.
- ✗
Implement a DNS filter to block DNS queries for social media domains.
Why it's wrong here
DNS filtering blocks the resolution of social media domain names, but it fails if a user has a cached DNS entry, uses DoH/DoT to bypass, or connects directly to a known IP address. Many social media apps also utilize Content Delivery Networks (CDNs) with constantly changing domains, so the DNS block may miss the actual application traffic or inadvertently block other services sharing that domain. Crucially, DNS filtering is not application-aware—it cannot differentiate between a social media app and a business app that uses the same DNS infrastructure, nor can it enforce policy on already-resolved connections.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.