NSE4 Security Profiles Practice Question
An administrator configures a DLP profile to detect credit card numbers in email traffic. The DLP rule uses a regular expression. However, the DLP sensor is not triggering on emails containing credit card numbers. What is a likely reason?
⚠ Common exam trap
Many candidates assume DLP works on all traffic regardless of encryption, but Fortinet tests the understanding that SSL deep inspection is a prerequisite for DLP to inspect encrypted email content.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL deep inspection is not enabled on the policy
DLP sensors inspecting email traffic require SSL deep inspection to decrypt the SMTP traffic if it is encrypted via TLS (STARTTLS). Without SSL deep inspection enabled on the firewall policy, the FortiGate cannot see the plaintext content of encrypted emails, so the DLP regular expression will never match credit card numbers. This is the most likely reason the DLP sensor is not triggering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SSL deep inspection is not enabled on the policy
Why this is correct
The FortiGate cannot inspect email content that is encrypted with TLS unless SSL deep inspection is enabled on the security policy. Without it, the device only sees the encrypted SMTP session, so DLP pattern matching never reads the credit card numbers in the payload. This is why the DLP profile appears to detect nothing despite being correctly configured.
- ✗
The regular expression is case-sensitive and credit card numbers are lowercase
Why it's wrong here
Credit card numbers are composed entirely of numeric digits, so regular expression case sensitivity is irrelevant. A regex like \d{13,16} will match regardless of letter case, and no valid credit card contains lowercase or uppercase letters. Therefore, a case sensitivity setting cannot explain the complete failure to trigger DLP detection in this scenario.
- ✗
The DLP sensor is configured to 'monitor' only
Why it's wrong here
In 'monitor' mode, the FortiGate still performs full DLP inspection and logs each match, though it does not quarantine or block the email. If the DLP sensor had actually matched credit card numbers, those matches would appear in the DLP logs. Since no triggering at all is observed, the monitor-vs-block setting is not the root cause; the issue lies elsewhere.
- ✗
The DLP profile is applied to the inbound policy only
Why it's wrong here
Applying the DLP profile to the inbound policy only means it inspects emails arriving from external senders, which would still detect credit card numbers in plaintext SMTP traffic. However, when the email is sent over TLS, the inbound inspection still sees only encrypted content, so the direction of the policy does not help. This option incorrectly points to direction as the cause, while the real problem is the lack of decryption.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.