DLP Not Detecting Credit Card Numbers Due to Encryption
An administrator configured a DLP profile to detect credit card numbers in outgoing emails. The profile is applied to an outbound SMTP policy. Users report that emails with credit card numbers are still being sent successfully. What is the most likely cause?
Quick Answer
The answer is that the SMTP traffic is encrypted and deep inspection is not enabled. This is the most likely cause because DLP scanning relies on inspecting the content of data in transit, and when SMTP traffic uses TLS encryption, the FortiGate cannot read the payload without first decrypting it. SSL deep inspection is required to break the TLS tunnel, allowing the DLP sensor to scan for patterns like credit card numbers; without it, the encrypted content passes through undetected. On the Fortinet NSE 4 exam, this scenario tests your understanding of how DLP interacts with encryption—a common trap is assuming DLP works on all traffic by default, but it only applies to unencrypted or decrypted streams. Remember the memory tip: “No decrypt, no detect”—if traffic is encrypted, deep inspection must be enabled for DLP to function.
⚠ Common exam trap
Candidates often assume DLP profiles work on all traffic regardless of encryption, but Fortinet tests the understanding that DLP requires deep inspection to see inside encrypted sessions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SMTP traffic is encrypted and deep inspection is not enabled
FortiGate DLP inspection requires the firewall to decrypt SSL/TLS-encrypted SMTP traffic before it can match patterns like credit card numbers. If deep inspection (SSL/SSH inspection) is not enabled on the outbound SMTP policy, the DLP profile will only see encrypted data and cannot detect the credit card numbers, allowing the emails to pass through successfully.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DLP profile is set to 'monitor' instead of 'block'
Why it's wrong here
Monitor would still detect and log, but the question states it is not detecting at all.
- ✗
The DLP profile is not applied to the correct policy
Why it's wrong here
The question states it is applied to an outbound SMTP policy.
- ✗
The credit card number pattern is not correctly defined
Why it's wrong here
While possible, the most common issue is encryption blocking visibility.
- ✓
The SMTP traffic is encrypted and deep inspection is not enabled
Why this is correct
If SMTP over TLS is used, the FortiGate cannot inspect the email content without SSL deep inspection decrypting the traffic. DLP will not detect the credit card numbers.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator configures a DLP profile to detect credit card numbers in email traffic. The DLP rule uses a regular expression. However, the DLP sensor is not triggering on emails containing credit card numbers. What is a likely reason?
hard- ✓ A.SSL deep inspection is not enabled on the policy
- B.The regular expression is case-sensitive and credit card numbers are lowercase
- C.The DLP sensor is configured to 'monitor' only
- D.The DLP profile is applied to the inbound policy only
Why A: DLP sensors inspecting email traffic require SSL deep inspection to decrypt the SMTP traffic if it is encrypted via TLS (STARTTLS). Without SSL deep inspection enabled on the firewall policy, the FortiGate cannot see the plaintext content of encrypted emails, so the DLP regular expression will never match credit card numbers. This is the most likely reason the DLP sensor is not triggering.
Variation 2. An administrator configures a DLP sensor to detect credit card numbers in traffic. However, the sensor is not detecting any credit card numbers even though they are present in emails. What could be the reason?
medium- ✓ A.Email traffic is encrypted and SSL deep inspection is not enabled
- B.The DLP sensor is applied to the wrong policy
- C.The credit card regular expression is incorrect
- D.The DLP sensor is in 'Monitor' mode
Why A: DLP sensors inspect traffic content. If the traffic is encrypted (e.g., via TLS), the sensor cannot see the plaintext unless SSL deep inspection is enabled to decrypt the traffic first.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.