How to Configure DLP to Prevent Social Security Number Leakage
A FortiGate administrator is configuring a data leak prevention (DLP) profile to prevent the leakage of social security numbers (SSNs) via email. Which TWO settings must be configured in the DLP profile?
Quick Answer
The correct answer is to create a DLP sensor that uses a custom pattern for SSNs and to enable SSL deep inspection. A custom pattern is necessary because standard DLP filters do not inherently recognize the specific nine-digit format of Social Security numbers, so you must define a regex or signature to match that exact data pattern. Additionally, SSL deep inspection is critical because modern email traffic, such as SMTP over TLS, is encrypted; without decrypting that traffic, the DLP sensor cannot read the content to detect the SSN. On the Fortinet NSE 4 exam, this question tests your understanding that DLP detection requires both a content-matching mechanism and the ability to inspect encrypted channels—a common trap is forgetting that deep inspection is mandatory for encrypted protocols like SMTP over TLS. Memory tip: “Pattern to catch, decrypt to match”—you need a custom pattern to identify the SSN and SSL inspection to see inside the encrypted email.
⚠ Common exam trap
Many exam-takers confuse DLP with other security features like IPS or email filtering, or assume DLP can inspect encrypted traffic without explicitly enabling SSL deep inspection on the firewall policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable SSL deep inspection on the firewall policy
FortiGate's DLP profiles inspect traffic at the application layer, and without SSL deep inspection, encrypted email traffic (e.g., SMTP over TLS) cannot be decrypted for pattern matching. Enabling SSL deep inspection on the firewall policy allows the DLP sensor to see the plaintext content of emails, including SSNs. This is a prerequisite for DLP to function on encrypted sessions.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to prevent employees from uploading sensitive credit card numbers via web forms. Which security profile feature is MOST appropriate to achieve this?
medium- A.Antivirus with FortiSandbox integration
- ✓ B.Data Leak Prevention (DLP) with a credit card number sensor
- C.Web Filter to block all upload sites
- D.Application Control to block web forms
Why B: Data Leak Prevention (DLP) with a credit card number sensor is the most appropriate feature because it uses pattern matching (e.g., Luhn algorithm) to detect and block sensitive credit card numbers in HTTP POST requests, preventing data exfiltration via web forms. Unlike other security profiles, DLP is specifically designed to inspect content for sensitive data patterns and enforce policy actions such as blocking or logging.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.