The answer is to exempt banking sites from SSL deep inspection using an exemption list because these sites use certificate pinning. When FortiGate performs SSL deep inspection, it intercepts the server’s original certificate and re-signs it with its own CA certificate. Banking websites that implement HTTP Public Key Pinning (HPKP) or certificate pinning expect a specific, unaltered certificate or public key from the server; the re-signed certificate breaks this validation, triggering the “certificate not trusted” error even when the FortiGate CA is trusted via Group Policy. On the NSE4 exam, this scenario tests your understanding of SSL inspection limitations and the need to balance security with application compatibility. A common trap is assuming pushing the CA certificate solves all trust issues, but pinning bypasses that trust chain. Remember the tip: “Pinned sites get a pass—exempt them from the glass.”
NSE4 Security Profiles Practice Question
This NSE4 practice question tests your understanding of security profiles. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company with 500 employees uses FortiGate as their internet gateway. They recently enabled SSL deep inspection using the built-in CA certificate. After deployment, many users report that they cannot access their online banking websites. The error message in the browser says 'The certificate is not trusted'. The administrator has already pushed the FortiGate CA certificate to all domain-joined computers via Group Policy. However, the problem persists for banking sites. The administrator also notices that banking sites load fine on mobile devices that do not have the CA certificate installed. What is the most likely cause and solution?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Banking websites use certificate pinning. Exempt them from deep inspection using an SSL inspection exemption list.
Banking websites often use HTTP Public Key Pinning (HPKP) or certificate pinning, where the browser expects a specific certificate or public key from the server. When FortiGate performs SSL deep inspection, it re-signs the server's certificate with its own CA, breaking the pinning validation. This causes the 'certificate not trusted' error even when the FortiGate CA is trusted, because the browser detects that the presented certificate does not match the pinned certificate. The correct solution is to exempt banking sites from deep inspection using an SSL inspection exemption list, allowing the original server certificate to pass through.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Disable SSL inspection entirely to avoid certificate issues.
Why it's wrong here
Overly broad and reduces security.
✗
The CA certificate is not properly installed on all computers. Re-deploy via Group Policy.
Why it's wrong here
It works for other sites, so CA is likely installed.
✗
Use certificate inspection instead of deep inspection for all traffic.
Why it's wrong here
Certificate inspection does not decrypt, so banking sites would work, but other inspection would be lost.
✓
Banking websites use certificate pinning. Exempt them from deep inspection using an SSL inspection exemption list.
Why this is correct
Certificate pinning causes errors with re-signed certificates. Exempting prevents decryption.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume the issue is always a missing CA certificate deployment, but the real problem is certificate pinning, which causes trust failures even when the CA is trusted, because the browser checks the pinned certificate hash against the presented certificate.
Detailed technical explanation
How to think about this question
Certificate pinning, as defined in RFC 7469, allows a website to specify which certificate authorities or public keys are acceptable for its connections. When FortiGate performs full SSL deep inspection (man-in-the-middle), it generates a new certificate on-the-fly signed by its own CA, which will not match the pinned hash. Mobile devices without the FortiGate CA cannot validate the deep-inspection certificate, but they load fine because they receive the original server certificate (if deep inspection is not applied to mobile traffic or if the mobile device is not behind the FortiGate). The exemption list in FortiGate allows specific domains to bypass deep inspection, passing the original server certificate to the client.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the NSE4 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security Profiles — This question tests Security Profiles — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Banking websites use certificate pinning. Exempt them from deep inspection using an SSL inspection exemption list. — Banking websites often use HTTP Public Key Pinning (HPKP) or certificate pinning, where the browser expects a specific certificate or public key from the server. When FortiGate performs SSL deep inspection, it re-signs the server's certificate with its own CA, breaking the pinning validation. This causes the 'certificate not trusted' error even when the FortiGate CA is trusted, because the browser detects that the presented certificate does not match the pinned certificate. The correct solution is to exempt banking sites from deep inspection using an SSL inspection exemption list, allowing the original server certificate to pass through.
What should I do if I get this NSE4 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.