NSE4 Security Profiles Practice Question
A company is implementing SSL/TLS inspection on a FortiGate to monitor encrypted traffic. They want to ensure that traffic to high-risk categories is blocked, while traffic to financial sites is inspected but not blocked. The administrator creates an SSL inspection profile that deep-inspects all traffic except traffic to financial sites. However, users report that they cannot access financial websites. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often assume the SSL inspection exemption automatically prevents web filtering from blocking the traffic, but FortiGate applies web filter policies independently, so a block action in the web filter profile overrides any SSL inspection exemption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The web filter profile is configured to block financial websites, overriding the SSL inspection exemption.
The most likely cause is that the web filter profile applied in the same firewall policy is configured to block financial websites. Even though the SSL inspection profile exempts financial sites from deep inspection, the web filter profile operates independently and can block traffic based on URL category. Since the web filter is evaluated after SSL inspection, it will block the decrypted or even non-decrypted traffic to financial sites if the category is set to block, overriding the SSL inspection exemption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The web filter profile is configured to block financial websites, overriding the SSL inspection exemption.
Why this is correct
The SSL inspection exemption only controls whether the FortiGate decrypts the TLS stream; it does not disable URL/web filtering. FortiGuard can still classify the destination based on the SNI, IP address, or FQDN from the ClientHello, so if the web filter profile blocks the 'Financial Services' category, the session is denied regardless of the decryption bypass. The exemption is the wrong place to expect 'allow' semantics when the web filter policy explicitly says block.
- ✗
The SSL inspection profile should be set to certificate-inspection instead of deep-inspection for financial sites.
Why it's wrong here
Switching from deep inspection to certificate inspection would not resolve this issue. Certificate inspection performs no payload decryption, so content-based web filtering would be weaker, but the FortiGuard URL category lookup still happens on the handshake’s SNI and the destination IP, and that category is what the web filter profile is blocking. A blocked category will be enforced even under certificate inspection; the block is a policy decision, not a result of deep inspection depth.
- ✗
The SSL inspection profile must be applied after the web filter profile in the firewall policy.
Why it's wrong here
In a FortiGate security policy, the SSL inspection profile and the web filter profile are independent inspection components, not sequential processing stages in a pipeline. The firewall determines whether to decrypt via the SSL profile and then, if decryption is performed, the web filter can inspect the HTTP request; but URL category blocking is evaluated against the destination and SNI regardless of profile order. There is no 'applied after' relationship — order in the policy GUI does not alter which profile gets evaluated or change the block behavior.
- ✗
The SSL inspection profile should have deep-inspection disabled for all categories except financial.
Why it's wrong here
Disabling deep inspection for all categories except financial would not allow access; it would mean only the financial category is fully decrypted, which makes the existing web filter block even more likely to catch the site by inspecting the HTTP layer. The exemption mechanism does not preempt FortiGuard categorisation — the URL category is still matched and the web filter action (block) is enforced. To allow a financial site, you would need a web filter explicit allow rule or a corresponding URL allow action, not a deep inspection exclusion.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.