The answer is that you must apply the DNS filter profile to a firewall policy that matches DNS traffic, specifically on UDP and TCP port 53. This is required because a DNS filter profile is a security inspection tool that operates at the firewall policy layer; without being explicitly attached to a policy that governs the traffic flow, the FortiGate has no instruction to process the DNS queries through the filter’s domain reputation and category databases. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this concept tests your understanding of how security profiles are bound to policies—a common trap is assuming that enabling the DNS filter globally or on a profile alone is sufficient, when in fact the policy must both match the traffic and have the profile applied. To remember this, think of the firewall policy as the gatekeeper: the DNS filter profile is the guard, but the guard cannot inspect anyone unless the gatekeeper lets them through on port 53.
NSE4 Security Profiles Practice Question
This NSE4 practice question tests your understanding of security profiles. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A FortiGate administrator needs to ensure that all outbound DNS queries from internal clients are inspected for malicious domains. The administrator has a DNS filter profile configured. What additional configuration is required on the firewall policy to make the DNS filter effective?
Apply the DNS filter profile to a firewall policy that matches DNS traffic (UDP/TCP port 53)
Why this is correct
The DNS filter profile must be attached to a policy that handles DNS traffic; otherwise it is not applied.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.
Detailed technical explanation
How to think about this question
This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
Use explanations to understand the rule behind the answer.
TExam Day Tips
→Underline the problem statement mentally.
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the NSE4 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which NSE4 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
Security Profiles — This question tests Security Profiles — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Apply the DNS filter profile to a firewall policy that matches DNS traffic (UDP/TCP port 53) — Option C is correct. The DNS filter profile must be applied to a firewall policy that matches DNS traffic. Without that, the traffic is not inspected.
What should I do if I get this NSE4 question wrong?
Identify which NSE4 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator wants to ensure that all DNS queries to known malware domains are blocked. The firewall policy allows DNS traffic. Which security profile must be applied?
medium
A.Web filter profile
✓ B.DNS filter profile
C.Antivirus profile
D.Application control profile
Why B: Option B is correct: DNS filter is specifically designed to inspect DNS queries and block based on FortiGuard categories or custom lists.
Variation 2. A security administrator wants to ensure that all DNS queries from internal users are filtered to block access to known malicious domains. Which TWO configurations must be applied?
medium
A.Enable deep inspection on the firewall policy
✓ B.Apply the DNS Filter profile to the firewall policy that allows DNS traffic
C.Enable DNS inspection on the SSL/SSH inspection profile
✓ D.Create a DNS Filter profile to block malicious domains
E.Configure a DNS server on the FortiGate
Why B: Options A and C are correct. A DNS filter profile must be created with categories, and the firewall policy for DNS traffic must reference that profile.
Variation 3. An administrator wants to ensure that all DNS traffic from internal users is filtered by the FortiGate to block malicious domains. Which TWO configurations are necessary? (Choose two.)
medium
A.Set DNS server to FortiGate's IP
✓ B.Apply the DNS filter profile to a firewall policy that matches DNS traffic
✓ C.Create a DNS filter profile and set action for malicious domains to 'block'
D.Enable sinkhole on the DNS filter profile
E.Configure SSL deep inspection for DNS over HTTPS
Why B: Options A and B are correct. The DNS filter profile and its application to a firewall policy are necessary.
Last reviewed: Jun 21, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.