NSE4 Firewall Policies and NAT Practice Question
An admin wants to block access to malicious websites using FortiGuard Web Filtering. Which policy configuration is necessary to apply the web filter profile to HTTP/HTTPS traffic?
⚠ Common exam trap
Many exam-takers think a deny policy can have a web filter profile applied to block malicious sites, but FortiGate only applies security profiles on allow policies, and deny policies simply drop traffic without inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an allow policy for HTTP/HTTPS and apply a web filter profile
FortiGate requires an explicit allow policy for HTTP/HTTPS traffic to pass through the firewall before a web filter profile can inspect and block malicious URLs. The web filter profile is applied as a security policy feature on an allow policy, not on a deny policy, since deny policies drop traffic before inspection can occur. Without an allow policy, the traffic would be blocked by default, and the web filter would never see the traffic to apply its filtering rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a DNS filter instead of a web filter
Why it's wrong here
A DNS filter only blocks resolution of fully qualified domain names to IP addresses, preventing a host from connecting to a known malicious domain by name. However, it cannot inspect individual URLs, paths, or content within a page, nor does it handle traffic that uses the IP address directly. The question specifically calls for web filtering, which provides URL-level categorization and blocking, making DNS filter insufficient.
- ✗
Create a policy with action DENY and a web filter profile
Why it's wrong here
A firewall policy with action DENY terminates the session before any UTM inspection can occur, so an attached web filter profile would never be evaluated. Web filter profiles are designed to operate on traffic that has been allowed forward by the policy, where the HTTP/HTTPS stream can be inspected and the URL can be categorized. Thus, DENY does not block malicious websites through the web filter; it simply blocks all traffic at the policy layer.
- ✓
Create an allow policy for HTTP/HTTPS and apply a web filter profile
Why this is correct
Creating an allow policy for HTTP/HTTPS and attaching a web filter profile is the correct approach because the web filter profile inspects every allowed web request and compares each URL against FortiGuard categories or a custom block list. If a site is categorized as malicious or matches a blocked URL pattern, the web filter blocks the connection while still permitting access to other legitimate sites. This is the built-in mechanism for controlling web access based on URL reputation and content classification.
- ✗
Use an application control profile to block malicious sites
Why it's wrong here
An application control profile identifies and controls applications by their network signatures and behavior, such as blocking social media, P2P file sharing, or streaming protocols. It does not perform URL categorization or domain reputation checks, so it cannot distinguish a malicious website from a benign one that uses the same application (like HTTP). Malicious-site blocking requires web filtering, which operates on the URL and FortiGuard web categories, not on application signatures.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.