NSE4 Security Profiles Practice Question
A FortiGate is configured with SSL deep inspection using a self-signed CA certificate. Users report that they see a certificate warning in their browser when accessing HTTPS sites. The admin wants to eliminate these warnings. What should the admin do?
⚠ Common exam trap
Test-takers frequently think disabling or bypassing SSL inspection (options B, C, or D) is a valid way to eliminate warnings, but the correct approach is to establish trust by distributing the FortiGate's CA certificate to clients.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install the FortiGate's CA certificate on each client device's trusted root certificate store
When FortiGate performs SSL deep inspection, it decrypts HTTPS traffic by acting as a man-in-the-middle, using its own CA certificate to re-encrypt the connection. If the FortiGate's self-signed CA certificate is not trusted by the client, the browser will display a certificate warning because the issuer is not in the client's trusted root store. Installing the FortiGate's CA certificate on each client device's trusted root certificate store establishes trust, eliminating the warnings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Install the FortiGate's CA certificate on each client device's trusted root certificate store
Why this is correct
Installing the FortiGate CA certificate into each client's trusted root store is the only way to make the browser accept the dynamically generated server certificates that FortiGate presents during MITM decryption. Without this trust anchor, every HTTPS session fails the chain validation and triggers a 'certificate not trusted' warning. This step validates the FortiGate as the legitimate signing authority for its intercepted sessions, eliminating warnings and restoring secure, transparent deep inspection.
- ✗
Disable SSL deep inspection and rely on flow-based antivirus
Why it's wrong here
Disabling SSL deep inspection and relying solely on flow-based antivirus eliminates the immediate certificate warning, but it cripples security by leaving all encrypted traffic unexamined. Flow-based antivirus can only scan plaintext or already-decrypted flows, so malicious content inside HTTPS passes through without detection. Furthermore, disabling inspection does not resolve the underlying issue of clients lacking trust in FortiGate's CA; any future re-enablement of deep inspection will simply reproduce the same certificate warnings.
- ✗
Change the SSL inspection mode to certificate inspection only
Why it's wrong here
Certificate inspection mode examines only the server certificate metadata during the TLS handshake and forwards the original certificate to the client, so FortiGate does not re-sign traffic and does not generate its own CA warnings. However, this mode does not decrypt the HTTP payload, leaving the FortiGate unable to inspect actual content for threats. It also fails to address the trust policy that caused the problem—if the client's trust store is corrupt or missing another required CA, warnings can still appear, and the security benefit of deep inspection is entirely absent.
- ✗
Configure an SSL certificate exemption for all HTTPS traffic
Why it's wrong here
Creating a blanket SSL certificate exemption for all HTTPS traffic simply tells the FortiGate to bypass decryption, so clients receive original server certificates and the immediate CA-trust warning disappears. But this completely defeats the purpose of deep inspection, allowing encrypted malware, phishing, and data exfiltration to flow through unchecked. The exemption also leaves the root cause untouched—if a narrower exemption is applied later, any HTTPS flow that is still inspected will trigger the same warnings because the FortiGate CA has never been made trusted.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.