NSE4 Security Profiles Practice Question
A FortiGate administrator wants to block access to Facebook for all internal users. However, the administrator must ensure that the CEO's computer (IP 10.0.0.100) is exempted. Which TWO steps should the administrator take? (Choose two.)
⚠ Common exam trap
NSE4 often tests the misconception that application control profiles support IP exemptions, when in fact exemptions are achieved through firewall policy ordering and source IP matching.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an application control profile with a rule to block 'Facebook' and apply it to the firewall policy for all users.
Option C is correct because the administrator must first create an application control profile containing a rule that blocks the Facebook application (Facebook is recognized as an application signature, not merely a URL), and then apply that profile to the firewall policy covering all internal users so the block is enforced. Option D is correct because FortiGate evaluates firewall policies top-down, so placing a policy above the blocking policy that permits traffic sourced from the CEO's IP 10.0.0.100 and does not reference the application control profile ensures the CEO's traffic is matched and allowed before the blocking policy is reached. Option A is incorrect because application control profiles in FortiOS do not provide an 'exempt IP' list; exemptions are achieved through policy ordering, not profile-level IP exceptions. Option B is incorrect for the same reason—there is no per-IP exemption setting inside an application control profile. Option E is incorrect because a web filter URL block for facebook.com would not reliably block the Facebook application (which can use multiple domains and non-HTTP traffic) and does not address the CEO exemption requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add the CEO's IP to the application control profile's 'exempt IP' list.
Why it's wrong here
Application control profiles in FortiOS do not contain an 'exempt IP' list or any similar per-IP exception parameter. The profile is purely signature-based, and its rules apply uniformly to all traffic permitted by the firewall policy. IP-based exemptions must be implemented through firewall policy order, not inside the application control profile itself.
- ✗
Configure an IP exemption in the application control profile.
Why it's wrong here
Configuring an IP exemption inside an application control profile is not supported because FortiOS application control lacks address objects or per-host exception controls. Unlike web filter profiles, which have an 'Exempt' list for URL categories, application control profiles have no such mechanism. Excluding a specific source IP requires creating a separate higher-priority firewall policy that permits that traffic before the blocking policy.
- ✓
Create an application control profile with a rule to block 'Facebook' and apply it to the firewall policy for all users.
Why this is correct
Creating an application control profile with a rule that blocks the 'Facebook' application signature and assigning that profile to the firewall policy for all users is the correct method. FortiOS application control uses deep packet inspection and regularly updated signatures to identify Facebook traffic even when it uses alternate domains or IP addresses. Because the profile is applied to the policy, every matching session that is detected as Facebook will be blocked for all users.
- ✓
Create a firewall policy above the blocking policy that allows traffic from the CEO's IP to Facebook, with no application control profile.
Why this is correct
Placing a firewall policy above the blocking policy that permits traffic from the CEO's IP address to Facebook, and attaching no application control profile to that policy, is a valid exemption technique. Firewall policies are evaluated top-down and the first match wins, so the CEO's traffic matches this ACCEPT policy and bypasses the application control inspection that would otherwise block it. This approach requires careful policy ordering and should be limited to the specific user to avoid unintended bypasses.
- ✗
Use a web filter profile with a URL block for 'facebook.com' instead of application control.
Why it's wrong here
Using a web filter profile with a URL block for 'facebook.com' instead of application control is ineffective because it only inspects the hostname or URL, not the actual application. Facebook traffic can be accessed through alternate domains, direct IP addresses, or mobile app APIs, which would bypass a simple URL block. Additionally, web filter profiles have their own exemption mechanism (such as an 'Exempt' list) that must be configured for the CEO, making this solution brittle and incomplete.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.