NSE4 Security Profiles Practice Question
An administrator has configured an SSL deep inspection profile with 'certificate inspection' for a firewall policy. Users report that they receive certificate errors when accessing HTTPS sites. What is the MOST likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The web server uses a self-signed certificate which is blocked by the inspection profile
With 'certificate inspection' mode, the FortiGate does not decrypt traffic or present its own certificate to clients. It only inspects the server certificate during the SSL handshake. If the inspection profile is configured to block invalid certificates (e.g., self-signed, expired, untrusted CA), and the web server uses a self-signed certificate, the FortiGate will drop the connection. Users may then see a certificate error or connection failure in their browsers. Option C is incorrect because certificate inspection never involves the FortiGate's CA certificate; that is only used in full SSL inspection when re-signing certificates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The certificate installed on the FortiGate for SSL inspection is expired
Why it's wrong here
The FortiGate's own SSL inspection certificate is used only when the FortiGate must re-encrypt traffic after decryption, which occurs in full SSL inspection. In certificate inspection mode, the FortiGate never presents its own certificate to the client; it simply forwards the server's certificate and enforces policy based on the certificate's validity. An expired FortiGate certificate would not cause client-side certificate errors because the client never sees it.
- ✓
The web server uses a self-signed certificate which is blocked by the inspection profile
Why this is correct
In certificate inspection mode, the FortiGate does not decrypt the SSL stream but still inspects the server certificate during the handshake. A self-signed certificate is inherently untrusted because it is not issued by a recognized CA, so the inspection profile blocks the connection. This block prevents the browser from completing the handshake, resulting in certificate error messages being displayed to the user.
- ✗
The users' browsers do not trust the FortiGate's CA certificate
Why it's wrong here
Browser trust of the FortiGate's CA certificate only matters in full SSL inspection, where the FortiGate presents a CA-signed copy of the server certificate to the client. In certificate inspection mode, the FortiGate does not alter or substitute the server certificate; the client sees the original certificate directly. Therefore, even if the browser distrusts the FortiGate's CA, that CA is never presented, so it cannot be the reason for the certificate error.
- ✗
The FortiGate is not configured to re-sign certificates with its own CA certificate
Why it's wrong here
Re-signing server certificates with a FortiGate CA is a defining feature of full SSL inspection, where the FortiGate decrypts, inspects, and re-encrypts traffic using a local CA certificate. Certificate inspection mode does not decrypt or re-sign anything, so the absence of such re-signing configuration is irrelevant to the symptoms. The error is instead caused by the inspection profile rejecting the server's self-signed certificate based on its trust policy.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.