NSE4 Security Profiles Practice Question
A FortiGate administrator receives reports that some users are receiving spam emails despite an email filter profile being applied to the SMTP traffic. The email filter profile has 'spam' action set to 'discard'. What is the most likely reason spam is still reaching users?
⚠ Common exam trap
A common mix-up: candidates assume the email filter profile is correctly applied and focus on configuration details (like dictionary updates or policy direction), rather than verifying whether the traffic actually passes through the FortiGate at the network level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The internal email server receives email directly from the internet without passing through the FortiGate
If the internal email server receives email directly from the internet without passing through the FortiGate, the email filter profile applied to SMTP traffic on the FortiGate will never inspect those messages. The FortiGate can only filter traffic that actually traverses it; any email routed around the FortiGate bypasses all security profiles entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The internal email server receives email directly from the internet without passing through the FortiGate
Why this is correct
If the internal mail server's MX record points to a public IP that is reachable directly from the internet (i.e., not behind the FortiGate), SMTP packets will never traverse the firewall. Since the FortiGate can only inspect traffic that physically passes through its interfaces, the email filter profile—regardless of how it is configured—will never see these messages. This is the definitive root cause: the FortiGate is completely out of the data path for inbound SMTP, so no email filtering can occur.
- ✗
The spam dictionary is not updated with latest spam signatures
Why it's wrong here
A stale spam dictionary would only degrade detection of newly emerging spam campaigns, but it would not cause a complete failure to block all spam. Even an up-to-date dictionary cannot filter messages that bypass the FortiGate entirely. The symptom of widespread spam delivery is far more consistent with a traffic path issue than with outdated signatures, especially since FortiGuard spam dictionary updates are typically automatically downloaded and applied.
- ✗
The email filter profile is not configured to scan outbound emails
Why it's wrong here
Outbound email scanning is designed to inspect messages sent from the internal network to the internet, such as enforcing content policy or detecting spam/compromised accounts sending mail out. The reported issue is inbound spam coming from the internet to the internal mail server. Configuring the outbound direction would not affect incoming SMTP traffic, and it would still be ineffective if the inbound SMTP traffic never passes through the FortiGate in the first place.
- ✗
The email filter profile is applied to the wrong policy direction (inbound vs outbound)
Why it's wrong here
Applying the email filter profile to the wrong policy direction (e.g., outbound instead of inbound) could certainly break filtering, but this assumes the SMTP session actually traverses the FortiGate and matches a policy. In the described scenario, the mail server is directly reachable from the internet, meaning no FortiGate policy is matched by the SMTP connection—it never reaches the firewall. Therefore, correcting the policy direction alone would not solve the problem; the underlying traffic delivery path must be fixed first.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.