Why Antivirus Profile Does Not Scan HTTPS Traffic
A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?
Quick Answer
The answer is that SSL/TLS deep inspection is not enabled on the firewall policy. This is correct because HTTPS traffic is encrypted using TLS, and a FortiGate antivirus profile cannot read the payload of encrypted packets without first decrypting them. Deep inspection performs that decryption, allowing the antivirus engine to scan the content for threats; without it, the profile only sees the encrypted tunnel and passes the traffic unscanned. On the Fortinet NSE 4 exam, this scenario tests your understanding of how security profiles interact with encryption—a common trap is assuming that simply enabling antivirus on a policy is enough, when in fact you must also configure an SSL/SSH inspection profile to handle HTTPS. Remember the memory tip: “No decrypt, no detect”—if deep inspection isn’t applied, encrypted traffic remains invisible to the antivirus scanner.
⚠ Common exam trap
Candidates often assume antivirus profiles can scan all traffic types by default, forgetting that encrypted traffic requires explicit decryption via SSL/TLS deep inspection before any content scanning can occur.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL/TLS deep inspection is not enabled on the firewall policy
HTTPS traffic is encrypted with SSL/TLS, so the FortiGate cannot inspect the payload for viruses unless SSL/TLS deep inspection is enabled to decrypt the traffic. Even with an antivirus profile applied, the FortiGate can only scan the outer headers of encrypted sessions without deep inspection, leaving the actual content unscanned. Option C correctly identifies that deep inspection must be explicitly enabled on the firewall policy to allow the antivirus profile to scan decrypted HTTPS traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FortiGuard antivirus subscription has expired
Why it's wrong here
An expired subscription would typically still scan with old signatures, and the symptom would be different — the profile would still attempt scanning.
- ✗
The web server's certificate is self-signed and FortiGate is rejecting the connection
Why it's wrong here
A certificate error would typically block or warn on the connection, not silently bypass antivirus scanning.
- ✓
SSL/TLS deep inspection is not enabled on the firewall policy
Why this is correct
HTTPS traffic is encrypted. FortiGate cannot inspect the payload without SSL deep inspection decrypting the TLS session. The antivirus profile requires inspection mode to be enabled.
- ✗
The antivirus profile is configured for flow-based inspection instead of proxy-based
Why it's wrong here
Both flow and proxy modes can scan HTTPS if SSL inspection is enabled. This is not the root cause.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?
medium- ✓ A.SSL/TLS deep inspection is not enabled on the firewall policy
- B.The antivirus profile is configured for flow-based inspection instead of proxy-based
- C.The web server's certificate is self-signed and FortiGate is rejecting the connection
- D.The FortiGuard antivirus subscription has expired
Why A: HTTPS uses TLS encryption. Without SSL/TLS deep inspection enabled on the policy, FortiGate cannot decrypt and inspect the content of HTTPS traffic. The antivirus profile will only scan unencrypted traffic or traffic where deep inspection has decrypted it first.
Variation 2. A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?
medium- A.The FortiGuard antivirus subscription has expired
- B.The web server's certificate is self-signed and FortiGate is rejecting the connection
- ✓ C.SSL/TLS deep inspection is not enabled on the firewall policy
- D.The antivirus profile is configured for flow-based inspection instead of proxy-based
Why C: HTTPS traffic is encrypted with SSL/TLS. Without SSL/TLS deep inspection enabled on the firewall policy, FortiGate cannot decrypt the traffic to scan it for viruses. The antivirus profile can only scan decrypted content, so deep inspection must be enabled for the antivirus to inspect HTTPS traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.