Why You Must Apply DNS Filter Profile to a Firewall Policy for Inspection
A FortiGate administrator needs to ensure that all outbound DNS queries from internal clients are inspected for malicious domains. The administrator has a DNS filter profile configured. What additional configuration is required on the firewall policy to make the DNS filter effective?
Quick Answer
The answer is that you must apply the DNS filter profile to a firewall policy that matches DNS traffic, specifically on UDP and TCP port 53. This is required because a DNS filter profile is a security inspection tool that operates at the firewall policy layer; without being explicitly attached to a policy that governs the traffic flow, the FortiGate has no instruction to process the DNS queries through the filter’s domain reputation and category databases. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this concept tests your understanding of how security profiles are bound to policies—a common trap is assuming that enabling the DNS filter globally or on a profile alone is sufficient, when in fact the policy must both match the traffic and have the profile applied. To remember this, think of the firewall policy as the gatekeeper: the DNS filter profile is the guard, but the guard cannot inspect anyone unless the gatekeeper lets them through on port 53.
⚠ Common exam trap
Test-takers frequently assume configuring a DNS filter profile globally or under Security Profiles is sufficient, but FortiGate requires explicit policy attachment for the profile to take effect on traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply the DNS filter profile to a firewall policy that matches DNS traffic (UDP/TCP port 53)
A DNS filter profile must be explicitly applied to a firewall policy that matches DNS traffic (UDP/TCP port 53) to be effective. Without this association, the FortiGate will not inspect DNS queries against the configured DNS filter profile, even if the profile is defined globally or under Security Profiles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable SSL deep inspection on the policy
Why it's wrong here
SSL deep inspection decrypts TLS traffic; DNS queries are typically plaintext UDP/TCP port 53 and are not protected by TLS. It is tempting because deep inspection exposes hidden content, but it would be correct for inspecting HTTPS traffic, not for applying a DNS filter profile.
- ✗
Configure FortiGuard DNS filtering service on the FortiGate
Why it's wrong here
The DNS filter profile is applied per firewall policy; enabling a FortiGuard service does not attach the profile to traffic. It is tempting because FortiGuard provides the malicious-domain ratings, but it would be correct when configuring the rating source, not when binding the profile to the policy.
- ✗
Set the inspection mode to proxy-based
Why it's wrong here
Proxy-based inspection mode is not required for DNS filtering; DNS filter profiles work in flow-based inspection too. It is tempting because proxy mode offers deeper inspection for some profiles, but it would be correct when a profile demands full content buffering, not for DNS query inspection.
- ✓
Apply the DNS filter profile to a firewall policy that matches DNS traffic (UDP/TCP port 53)
Why this is correct
A DNS filter profile only inspects traffic when attached to a firewall policy whose destination matches DNS. Applying it to a policy matching UDP and TCP port 53 forces internal client queries through the profile, enabling malicious domain blocking.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator wants to ensure that all DNS queries to known malware domains are blocked. The firewall policy allows DNS traffic. Which security profile must be applied?
medium- A.Web filter profile
- ✓ B.DNS filter profile
- C.Antivirus profile
- D.Application control profile
Why B: To block DNS queries to known malware domains, the FortiGate must apply a DNS filter profile to the firewall policy that allows DNS traffic. The DNS filter profile uses FortiGuard's DNS threat database to block or redirect queries to malicious domains, botnets, and phishing sites. This is the purpose-built profile for DNS-layer protection.
Variation 2. A security administrator wants to ensure that all DNS queries from internal users are filtered to block access to known malicious domains. Which TWO configurations must be applied?
medium- A.Enable deep inspection on the firewall policy
- ✓ B.Apply the DNS Filter profile to the firewall policy that allows DNS traffic
- C.Enable DNS inspection on the SSL/SSH inspection profile
- ✓ D.Create a DNS Filter profile to block malicious domains
- E.Configure a DNS server on the FortiGate
Why B: Option B is correct because the DNS Filter profile only takes effect when it is attached to the firewall policy that permits the DNS traffic, so applying it to that policy is what actually enforces filtering on users' queries. Option D is correct because the DNS Filter profile itself is the object that defines which domains are blocked (e.g., via FortiGuard category-based filtering or static domain lists), so it must be created before it can be applied. Option A is not required because deep inspection applies to content/AV scanning of traffic, not to DNS query filtering. Option C is incorrect because DNS inspection is not enabled through the SSL/SSH inspection profile; DNS filtering is handled by the DNS Filter profile. Option E is not needed because configuring a DNS server on the FortiGate does not filter or block malicious domains for internal users.
Variation 3. An administrator wants to ensure that all DNS traffic from internal users is filtered by the FortiGate to block malicious domains. Which TWO configurations are necessary? (Choose two.)
medium- A.Set DNS server to FortiGate's IP
- ✓ B.Apply the DNS filter profile to a firewall policy that matches DNS traffic
- ✓ C.Create a DNS filter profile and set action for malicious domains to 'block'
- D.Enable sinkhole on the DNS filter profile
- E.Configure SSL deep inspection for DNS over HTTPS
Why B: A DNS filter profile must be applied to a firewall policy that matches DNS traffic for the filtering to take effect. Without this policy-level binding, the DNS filter profile is not enforced, even if it is configured. This ensures that all DNS queries from internal users are inspected by the FortiGate.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.