NSE4 Security Profiles Practice Question
A company with 500 employees uses FortiGate as their internet gateway. They recently enabled SSL deep inspection using the built-in CA certificate. After deployment, many users report that they cannot access their online banking websites. The error message in the browser says 'The certificate is not trusted'. The administrator has already pushed the FortiGate CA certificate to all domain-joined computers via Group Policy. However, the problem persists for banking sites. The administrator also notices that banking sites load fine on mobile devices that do not have the CA certificate installed. What is the most likely cause and solution?
⚠ Common exam trap
Watch out — candidates often assume the issue is always a missing CA certificate deployment, but the real problem is certificate pinning, which causes trust failures even when the CA is trusted, because the browser checks the pinned certificate hash against the presented certificate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Banking websites use certificate pinning. Exempt them from deep inspection using an SSL inspection exemption list.
Banking websites often use HTTP Public Key Pinning (HPKP) or certificate pinning, where the browser expects a specific certificate or public key from the server. When FortiGate performs SSL deep inspection, it re-signs the server's certificate with its own CA, breaking the pinning validation. This causes the 'certificate not trusted' error even when the FortiGate CA is trusted, because the browser detects that the presented certificate does not match the pinned certificate. The correct solution is to exempt banking sites from deep inspection using an SSL inspection exemption list, allowing the original server certificate to pass through.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable SSL inspection entirely to avoid certificate issues.
Why it's wrong here
Disabling SSL inspection entirely leaves the encrypted traffic unexamined, allowing malware, phishing, and data exfiltration to hide inside TLS tunnels. That is a drastic security downgrade, and it addresses only the symptom of certificate errors rather than the real cause. A targeted exemption for pinned banking sites would preserve security for the remaining traffic.
- ✗
The CA certificate is not properly installed on all computers. Re-deploy via Group Policy.
Why it's wrong here
If the FortiGate's CA certificate were missing or incorrectly deployed, users would see certificate validation errors for every HTTPS site, not just banking sites. Since other websites load successfully with deep inspection, the CA is clearly trusted on the clients. Re-deploying via Group Policy would not stop the errors on sites that use certificate pinning, which ignores the CA trust chain and checks the exact public key.
- ✗
Use certificate inspection instead of deep inspection for all traffic.
Why it's wrong here
Switching from deep inspection to certificate inspection only validates whether the remote server's certificate is trusted, without decrypting the HTTP payload. This would indeed avoid the pinning errors because the original certificate is passed through, but it also forfeits all content inspection—including antivirus, web filter categorisation, and data-loss prevention—on every HTTPS session. That is an unnecessary blanket reduction in security when a few known pinned domains can be excluded from deep inspection instead.
- ✓
Banking websites use certificate pinning. Exempt them from deep inspection using an SSL inspection exemption list.
Why this is correct
Banking platforms frequently implement certificate pinning by hard-coding the expected public key or certificate fingerprint in the client or browser. When FortiGate performs deep inspection, it replaces the original server certificate with its own re-signed copy, causing the pin validation to fail and the connection to be blocked. The recommended fix is to add these banking domains to the SSL exemption list so the FortiGate passes the original certificate untouched, preserving deep inspection for all other domains.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.