NSE4 Security Profiles Practice Question
A FortiGate is configured for SSL deep inspection using a CA certificate. Users report that some websites show certificate errors. The administrator wants to allow these sites without inspection. Which setting should be used?
⚠ Common exam trap
Watch out — candidates often confuse 'allowing invalid certificates' (Option C) with 'exempting from inspection' (Option D), not realizing that allowing invalid certificates still performs inspection and may break sites with certificate pinning, whereas exemption completely bypasses inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the websites to the SSL/SSH exemption list
The SSL/SSH exemption list allows administrators to specify websites that should bypass SSL deep inspection entirely, preventing certificate errors for sites that use self-signed, expired, or otherwise untrusted certificates. This is the intended mechanism in FortiOS to exclude specific destinations from inspection while maintaining inspection for all other traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable certificate validation in the SSL inspection profile
Why it's wrong here
Disabling certificate validation in the SSL inspection profile removes all trust-chain checks, meaning FortiGate will not verify whether the server's certificate is signed by a trusted public CA or has expired. This is a global change that weakens security for all inspected traffic, creating a severe MITM vulnerability, and it still attempts to inspect the problematic sites. Instead, an exemption list is a selective and safer method to exclude only specific destinations from inspection.
- ✗
Create a separate firewall policy without SSL inspection
Why it's wrong here
Creating a separate firewall policy without SSL inspection would bypass deep inspection for all traffic matching that policy, but the scenario requires selective exemption of specific websites while continuing to inspect other traffic. This approach is tempting because it is commonly used to exclude entire traffic categories from inspection, such as for a guest network or a trusted server, where blanket bypass is acceptable.
- ✗
Set the action for invalid certificates to 'allow'
Why it's wrong here
Setting the action for invalid certificates to 'allow' configures FortiGate to permit connections even when certificate validation fails, but it still terminates and re-inspects the traffic, and the browser will continue to see a warning-free certificate because FortiGate has substituted its own. However, this setting applies globally to any invalid certificate, not just the sites you want to exclude, so it can blind users to real security issues while still not resolving the underlying connectivity problem. An exemption list is the precise solution because it bypasses inspection entirely for the intended destinations.
- ✓
Add the websites to the SSL/SSH exemption list
Why this is correct
Adding the websites to the SSL/SSH exemption list tells the FortiGate to skip deep inspection for those specific domains, so the original server certificate is passed directly to the client without interception. This preserves the exact certificate and avoids breaking apps that use certificate pinning, while all other web traffic continues to be inspected with the CA-signed proxy certificate. It is the recommended, granular approach because only the listed destinations are exempted, not the entire inspection policy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.