NSE4 Security Profiles Practice Question
An administrator configures SSL deep inspection with a CA certificate. Users accessing an internal site (internal.company.com) receive a certificate error. The administrator wants to avoid the error without disabling deep inspection. What should be done?
⚠ Common exam trap
It's easy for candidates to think disabling certificate validation (Option C) is a quick fix, but that compromises security and is not the intended method to handle trusted internal sites; the correct approach is to use the exemption list to selectively bypass inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add internal.company.com to the SSL/SSH inspection exemption list
Adding internal.company.com to the SSL/SSH inspection exemption list tells the FortiGate to bypass deep inspection for that specific site, allowing the internal CA certificate to be used without triggering a certificate error. This avoids the error while keeping deep inspection enabled for all other traffic, which is the administrator's goal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replace the CA certificate with a self-signed one
Why it's wrong here
Replacing the CA certificate with a self-signed certificate is ineffective because the FortiGate's CA is already self-signed and used to sign the dynamically generated certificates presented to clients. The error stems from the fact that the internal server's original certificate is not signed by the FortiGate CA, so the client does not see the trusted internal PKI chain. Simply swapping the CA does not address the trust relationship between the client and the internal certificate.
- ✗
Use certificate inspection instead of deep inspection
Why it's wrong here
Certificate inspection only evaluates metadata of the server certificate and forwards the original certificate untouched, so no re-signed certificate is presented to the client and no trust error occurs. However, because the traffic is not decrypted, the firewall cannot inspect the HTTP payload for malware, data exfiltration, or application-level rules. This bypasses the symptom but sacrifices the security benefits that deep inspection is intended to provide, making it an inadequate solution if full visibility is required.
- ✗
Disable certificate validation in the deep inspection profile
Why it's wrong here
Disabling certificate validation inside the deep inspection profile makes FortiGate skip checks such as expired certificates, hostname mismatch, and untrusted server chains during the handshake, which can suppress some server-side errors. Yet the client still receives a certificate re-signed by the FortiGate CA, so the client will reject it unless the FortiGate CA is installed in its trust store. Therefore, this option neither restores trust nor resolves the exact error, and it additionally weakens overall security posture by accepting invalid certificates.
- ✓
Add internal.company.com to the SSL/SSH inspection exemption list
Why this is correct
Adding internal.company.com to the SSL/SSH inspection exemption list instructs the FortiGate to pass those sessions without decrypting or re-signing the certificate, so the client receives the original certificate issued by the company's internal PKI. This eliminates the certificate error because the client sees a chain it already trusts, while allowing deep inspection to continue for other traffic. It is the recommended approach for internal domains that have their own CA or for applications with certificate pinning that cannot tolerate interception.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.