Why You Must Apply DNS Filter Profile to a Firewall Policy for Inspection
A FortiGate administrator needs to ensure that all outbound DNS queries from internal clients are inspected for malicious domains. The administrator has a DNS filter profile configured. What additional configuration is required on the firewall policy to make the DNS filter effective?
Quick Answer
The answer is that you must apply the DNS filter profile to a firewall policy that matches DNS traffic, specifically on UDP and TCP port 53. This is required because a DNS filter profile is a security inspection tool that operates at the firewall policy layer; without being explicitly attached to a policy that governs the traffic flow, the FortiGate has no instruction to process the DNS queries through the filter’s domain reputation and category databases. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this concept tests your understanding of how security profiles are bound to policies—a common trap is assuming that enabling the DNS filter globally or on a profile alone is sufficient, when in fact the policy must both match the traffic and have the profile applied. To remember this, think of the firewall policy as the gatekeeper: the DNS filter profile is the guard, but the guard cannot inspect anyone unless the gatekeeper lets them through on port 53.
⚠ Common exam trap
Test-takers frequently assume configuring a DNS filter profile globally or under Security Profiles is sufficient, but FortiGate requires explicit policy attachment for the profile to take effect on traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply the DNS filter profile to a firewall policy that matches DNS traffic (UDP/TCP port 53)
A DNS filter profile must be explicitly applied to a firewall policy that matches DNS traffic (UDP/TCP port 53) to be effective. Without this association, the FortiGate will not inspect DNS queries against the configured DNS filter profile, even if the profile is defined globally or under Security Profiles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable SSL deep inspection on the policy
Why it's wrong here
DNS traffic is typically not encrypted; SSL inspection is not needed.
- ✗
Configure FortiGuard DNS filtering service on the FortiGate
Why it's wrong here
FortiGuard service is needed for categories, but the profile still must be applied to a policy.
- ✗
Set the inspection mode to proxy-based
Why it's wrong here
DNS filter works in both flow and proxy modes.
- ✓
Apply the DNS filter profile to a firewall policy that matches DNS traffic (UDP/TCP port 53)
Why this is correct
The DNS filter profile must be attached to a policy that handles DNS traffic; otherwise it is not applied.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator wants to ensure that all DNS queries to known malware domains are blocked. The firewall policy allows DNS traffic. Which security profile must be applied?
medium- A.Web filter profile
- ✓ B.DNS filter profile
- C.Antivirus profile
- D.Application control profile
Why B: DNS filter is specifically designed to inspect DNS queries and block based on FortiGuard categories or custom lists.
Variation 2. A security administrator wants to ensure that all DNS queries from internal users are filtered to block access to known malicious domains. Which TWO configurations must be applied?
medium- A.Enable deep inspection on the firewall policy
- ✓ B.Apply the DNS Filter profile to the firewall policy that allows DNS traffic
- C.Enable DNS inspection on the SSL/SSH inspection profile
- ✓ D.Create a DNS Filter profile to block malicious domains
- E.Configure a DNS server on the FortiGate
Why B: The correct answers are B and D. A DNS Filter profile must first be created (D) to define the categories or domains to block. Then, this profile must be applied to the firewall policy that permits DNS traffic from internal users to the DNS server (B). Options A and C are incorrect because deep inspection is not needed for DNS filtering, and DNS inspection is part of the DNS filter profile, not the SSL/SSH inspection profile.
Variation 3. An administrator wants to ensure that all DNS traffic from internal users is filtered by the FortiGate to block malicious domains. Which TWO configurations are necessary? (Choose two.)
medium- A.Set DNS server to FortiGate's IP
- ✓ B.Apply the DNS filter profile to a firewall policy that matches DNS traffic
- ✓ C.Create a DNS filter profile and set action for malicious domains to 'block'
- D.Enable sinkhole on the DNS filter profile
- E.Configure SSL deep inspection for DNS over HTTPS
Why B: A DNS filter profile must be applied to a firewall policy that matches DNS traffic for the filtering to take effect. Without this policy-level binding, the DNS filter profile is not enforced, even if it is configured. This ensures that all DNS queries from internal users are inspected by the FortiGate.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.