The answer is to create an allow policy for HTTP/HTTPS and apply a web filter profile. This is correct because FortiGate processes traffic through a sequential flow: a firewall policy must first permit the session before any security profiles, including web filtering, can inspect the content. A deny policy drops packets immediately, preventing the FortiGuard Web Filtering engine from ever seeing the traffic to block malicious URLs. On the Fortinet NSE 4 Network Security Professional exam, this concept tests your understanding of policy order and the relationship between firewall rules and security profiles—a common trap is assuming a web filter can be applied to a deny policy or that traffic is inspected before the policy decision. Remember the key sequence: allow first, then inspect. A helpful memory tip is “Allow to inspect, deny to reject”—if you want web filtering to work, the policy must be an allow action, not a deny.
NSE4 Firewall Policies and NAT Practice Question
This NSE4 practice question tests your understanding of firewall policies and nat. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An admin wants to block access to malicious websites using FortiGuard Web Filtering. Which policy configuration is necessary to apply the web filter profile to HTTP/HTTPS traffic?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an allow policy for HTTP/HTTPS and apply a web filter profile
Option C is correct because FortiGate requires an explicit allow policy for HTTP/HTTPS traffic to pass through the firewall before a web filter profile can inspect and block malicious URLs. The web filter profile is applied as a security policy feature on an allow policy, not on a deny policy, since deny policies drop traffic before inspection can occur. Without an allow policy, the traffic would be blocked by default, and the web filter would never see the traffic to apply its filtering rules.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Configure a DNS filter instead of a web filter
Why it's wrong here
DNS filter blocks by domain, but the question asks for web filter.
✗
Create a policy with action DENY and a web filter profile
Why it's wrong here
A deny policy blocks traffic before inspection; web filter profiles work on allow policies.
✓
Create an allow policy for HTTP/HTTPS and apply a web filter profile
Why this is correct
The web filter profile is applied to allowed traffic; the profile will block malicious sites.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use an application control profile to block malicious sites
Why it's wrong here
Application control blocks applications, not specific URLs.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often think a deny policy can have a web filter profile applied to block malicious sites, but FortiGate only applies security profiles on allow policies, and deny policies simply drop traffic without inspection.
Detailed technical explanation
How to think about this question
FortiGate uses a flow-based or proxy-based inspection engine to apply web filter profiles on allowed traffic; the web filter profile checks URLs against FortiGuard's cloud-based category database and can block, warn, or allow based on policy settings. A common subtlety is that HTTPS traffic requires SSL inspection (via a deep inspection profile) for the web filter to see the full URL, otherwise it can only filter based on the SNI field in the TLS handshake. In a real-world scenario, an admin might configure an allow policy with a web filter profile and SSL inspection to block access to 'malware' or 'phishing' categories while still permitting general web browsing.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Firewall Policies and NAT — This question tests Firewall Policies and NAT — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Create an allow policy for HTTP/HTTPS and apply a web filter profile — Option C is correct because FortiGate requires an explicit allow policy for HTTP/HTTPS traffic to pass through the firewall before a web filter profile can inspect and block malicious URLs. The web filter profile is applied as a security policy feature on an allow policy, not on a deny policy, since deny policies drop traffic before inspection can occur. Without an allow policy, the traffic would be blocked by default, and the web filter would never see the traffic to apply its filtering rules.
What should I do if I get this NSE4 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.