NSE4 Security Profiles Practice Question
An administrator configures an antivirus profile in proxy-based inspection mode on a FortiGate. However, SMTP traffic is not being scanned for viruses. The firewall policy includes the antivirus profile and the FortiGate has a valid FortiGuard subscription. What is the most likely cause?
⚠ Common exam trap
Candidates often assume a valid FortiGuard subscription and a correctly applied antivirus profile guarantee scanning of all traffic, overlooking the requirement to enable the specific protocol in the proxy options for proxy-based inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SMTP protocol is not enabled in the proxy options of the security profile
In proxy-based inspection mode, the antivirus profile relies on the proxy options to determine which protocols to scan. If SMTP is not explicitly enabled in the proxy options of the security profile, the FortiGate will not inspect SMTP traffic for viruses, even if the antivirus profile is applied to the policy and the FortiGuard subscription is valid.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Flow-based inspection is required for SMTP scanning
Why it's wrong here
Flow-based inspection is not required for SMTP scanning. FortiGate's proxy-based inspection also supports SMTP by reassembling the entire session and applying antivirus signatures, offering deeper visibility than flow-based. Both inspection modes can scan SMTP; the choice depends on performance versus granularity, so the antivirus profile can still work in proxy mode without switching to flow-based.
- ✓
The SMTP protocol is not enabled in the proxy options of the security profile
Why this is correct
In proxy-based inspection, each protocol must be explicitly enabled in the proxy options of the security profile. If SMTP is left unchecked, the FortiGate will not decode or scan SMTP traffic, causing the antivirus profile to appear non-functional for email. Navigate to the AV profile's protocol options and ensure SMTP is enabled, then apply the profile to the firewall policy that carries SMTP traffic.
- ✗
The FortiGate does not have a valid SSL certificate for SMTP inspection
Why it's wrong here
This is incorrect because standard SMTP traffic is transmitted in plaintext and does not require SSL certificate validation for antivirus scanning. SSL certificates are only needed when inspecting encrypted protocols like SMTPS (SMTP over TLS) via SSL/SSH inspection. For regular SMTP, no certificate is involved, and a missing certificate would not prevent proxy-based antivirus scanning.
- ✗
The antivirus profile is configured to scan only HTTP traffic
Why it's wrong here
Antivirus profiles commonly have SMTP enabled by default, alongside HTTP, POP3, and IMAP, so the profile is not restricted to HTTP only. Even if the profile were restricted, the failure to scan SMTP would then be a configuration mistake in the profile's protocol selection, not a fundamental limitation. The actual issue in this scenario is that SMTP is disabled in the proxy options, not that the profile lacks SMTP support.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.