NSE4 System and Network Administration Practice Question
A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?
⚠ Common exam trap
Candidates often assume antivirus profiles can scan encrypted traffic automatically, but FortiGate cannot inspect encrypted payloads without SSL/TLS deep inspection enabled on the policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL/TLS deep inspection is not enabled on the firewall policy
D is correct because antivirus scanning of HTTPS traffic requires the firewall to decrypt the SSL/TLS-encrypted payload. Without SSL/TLS deep inspection enabled on the policy, FortiGate sees only encrypted packets and cannot inspect the content for viruses, even if an antivirus profile is applied. The admin must configure a deep inspection profile that includes SSL/TLS decryption to allow the antivirus engine to scan the decrypted traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The web server's certificate is self-signed and FortiGate is rejecting the connection
Why it's wrong here
A self-signed certificate would trigger an explicit TLS handshake failure or user-facing certificate warning if FortiGate is configured to validate server certificates, not a silent skip of antivirus scanning. Even if the FortiGate is set to allow untrusted certificates, the encrypted session would still need to be decrypted by a deep inspection profile before any antivirus filtering occurs. Since the symptom is that HTTPS traffic passes without inspection, the absence of SSL deep inspection is the true cause, not the certificate type.
- ✗
The FortiGuard antivirus subscription has expired
Why it's wrong here
An expired FortiGuard antivirus subscription does not stop the antivirus engine from attempting to scan traffic; it simply means the signature database may be stale, and the FortiGate might use a fallback policy such as 'continue' or 'monitor'. The agent would still inspect decrypted content and could still detect known older malware. The fact that HTTPS traffic is completely unscanned indicates there is no decryption at all, which points to a missing deep inspection profile rather than a lapsed subscription.
- ✗
The antivirus profile is configured for flow-based inspection instead of proxy-based
Why it's wrong here
Flow-based and proxy-based inspection are two processing modes that both support antivirus scanning of HTTPS, provided the traffic is first decrypted by SSL deep inspection. The mode only changes whether packets are buffered and processed offload, affecting performance and certain advanced features, but it does not bypass the need for a decryption policy. Therefore, choosing flow-based inspection could not, by itself, prevent the antivirus profile from seeing the HTTPS payload; the absence of SSL inspection is the root cause.
- ✓
SSL/TLS deep inspection is not enabled on the firewall policy
Why this is correct
To inspect HTTPS for malware, FortiGate must terminate the TLS session using an SSL/TLS deep inspection profile, which decrypts the payload, applies the antivirus profile, and then re-encrypts the traffic. Without this, the FortiGate only sees ciphertext and cannot apply antivirus signatures because the content is opaque. The firewall policy must explicitly reference an SSL inspection profile set to 'deep-inspection' (not just 'certificate-inspection') and clients must trust the FortiGate's CA to avoid handshake warnings. If this is not enabled, all HTTPS traffic bypasses antivirus scanning regardless of the configured antivirus profile.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.