Why Antivirus Isn't Scanning HTTPS Traffic
A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?
Quick Answer
The answer is that SSL/TLS deep inspection is not enabled on the firewall policy. This is the most likely reason HTTPS traffic is not being scanned by the antivirus profile because HTTPS encrypts the payload with SSL/TLS, making the content invisible to security tools. Without deep inspection—also called SSL inspection or HTTPS decryption—the FortiGate can only see encrypted packets, so even with antivirus enabled in the policy, it cannot inspect the data for malware. On the Fortinet NSE 4 exam, this question tests your understanding that antivirus profiles require decrypted traffic to function; a common trap is assuming that simply enabling antivirus in the policy is sufficient. Remember the key principle: encrypted traffic must be decrypted before it can be scanned. A useful memory tip is “No decrypt, no detect”—if SSL inspection is off, antivirus is blind to HTTPS threats.
⚠ Common exam trap
It's easy for candidates to assume antivirus profiles automatically inspect all traffic, forgetting that encrypted HTTPS requires explicit SSL/TLS decryption before any content inspection can occur.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL/TLS deep inspection is not enabled on the firewall policy
HTTPS traffic is encrypted with SSL/TLS, so an antivirus profile cannot inspect the payload unless the firewall can decrypt the traffic. Even with antivirus enabled in the policy, without SSL/TLS deep inspection (also called SSL inspection or HTTPS decryption), FortiGate only sees encrypted packets and cannot scan for malware. Therefore, the most likely reason is that SSL/TLS deep inspection is not enabled on the firewall policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The web server's certificate is self-signed and FortiGate is rejecting the connection
Why it's wrong here
A certificate error would typically block or warn on the connection, not silently bypass antivirus scanning.
- ✗
The antivirus profile is configured for flow-based inspection instead of proxy-based
Why it's wrong here
Both flow and proxy modes can scan HTTPS if SSL inspection is enabled. This is not the root cause.
- ✓
SSL/TLS deep inspection is not enabled on the firewall policy
Why this is correct
HTTPS traffic is encrypted. FortiGate cannot inspect the payload without SSL deep inspection decrypting the TLS session. The antivirus profile requires inspection mode to be enabled.
- ✗
The FortiGuard antivirus subscription has expired
Why it's wrong here
An expired subscription would typically still scan with old signatures, and the symptom would be different — the profile would still attempt scanning.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?
medium- A.The web server's certificate is self-signed and FortiGate is rejecting the connection
- B.The FortiGuard antivirus subscription has expired
- C.The antivirus profile is configured for flow-based inspection instead of proxy-based
- ✓ D.SSL/TLS deep inspection is not enabled on the firewall policy
Why D: D is correct because antivirus scanning of HTTPS traffic requires the firewall to decrypt the SSL/TLS-encrypted payload. Without SSL/TLS deep inspection enabled on the policy, FortiGate sees only encrypted packets and cannot inspect the content for viruses, even if an antivirus profile is applied. The admin must configure a deep inspection profile that includes SSL/TLS decryption to allow the antivirus engine to scan the decrypted traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.