NSE4 Security Profiles Practice Question
An administrator configures a web filter profile with FortiGuard category blocking and URL filter to allow example.com. Users report that example.com is still blocked. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to assume URL filter entries are evaluated before FortiGuard categories, or that a URL filter allow rule can override a FortiGuard block, when in fact FortiGuard category blocking takes precedence regardless of URL filter order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The FortiGuard category action is set to 'block' and takes precedence over the URL filter allow rule
When both FortiGuard category blocking and a URL filter are configured in the same web filter profile, the FortiGuard category action (e.g., 'block') is evaluated first and takes precedence over any URL filter allow rule. This is because FortiGate processes web filter rules in a specific order: FortiGuard category blocking is applied before URL filter entries. Therefore, even if a URL filter explicitly allows example.com, the FortiGuard category block will prevent access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The URL filter requires deep inspection to be enabled
Why it's wrong here
Deep inspection is not a prerequisite for URL filtering in FortiOS. For plaintext HTTP requests, the full URL is visible in the traffic and can be matched by a URL filter rule. For HTTPS, the filter can use the Server Name Indication (SNI) field to match the domain, so even without deep inspection, a URL filter rule can block or allow a specific hostname. Deep inspection would only become necessary if you needed to filter on the full URL path of an encrypted HTTPS connection, which is not implied by the scenario.
- ✗
The URL filter entry is placed after the FortiGuard category in the policy
Why it's wrong here
The interplay between the FortiGuard category list and the URL filter list is not a simple matter of list order within the policy. In FortiOS, FortiGuard category blocking is evaluated as the default and takes precedence over an individual URL filter entry unless the URL filter is explicitly set to 'allow' and has the 'Allow URL filter to override FortiGuard category' option enabled. Placing a URL filter entry after the category list in the web filter profile does not change this precedence; the URL filter section and category section are separate, and the category block still wins.
- ✗
The DNS filter is blocking example.com before the web filter is evaluated
Why it's wrong here
If the DNS filter had blocked example.com, the user would receive a DNS resolution failure before any HTTP connection could be attempted. The web filter is only evaluated after the DNS query succeeds and the client establishes a TCP connection to the resolved IP address. A FortiGuard block page or a connection reset from the web filter indicates that the connection reached the FortiGate and was evaluated by the web filter, so the DNS filter cannot be the cause of this specific symptom. Additionally, the DNS filter and web filter are separate inspection phases; a DNS block would not prevent the web filter from being evaluated for a different resolved address.
- ✓
The FortiGuard category action is set to 'block' and takes precedence over the URL filter allow rule
Why this is correct
In FortiOS, when a category is set to block, it blocks all URLs in that category regardless of individual URL filter entries unless the URL filter uses an allow action and is configured to override categories.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.