NSE4 Security Profiles Practice Question
An administrator runs the CLI command 'diagnose debug rating' and sees that all FortiGuard web filter requests are timing out. What is the most likely cause?
⚠ Common exam trap
Candidates often assume timeouts are caused by license expiration or profile misconfiguration, but the debug output clearly distinguishes between 'timeout' (connectivity/DNS issue) and 'license expired' (licensing issue), so reading the exact debug message is critical.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DNS server configured on the FortiGate is not resolving the FortiGuard FQDN
The 'diagnose debug rating' command shows real-time FortiGuard web filter request status. When all requests are timing out, it indicates that the FortiGate cannot reach the FortiGuard servers. The most common cause is a DNS resolution failure, where the FortiGate cannot resolve the FortiGuard FQDN (e.g., service.fortiguard.net) due to an incorrect or unreachable DNS server configuration. Without proper DNS, the FortiGate cannot establish the necessary HTTPS connections to query the FortiGuard rating service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The web filter profile has an incorrect action configured
Why it's wrong here
A profile's action (e.g., block, allow, monitor) is applied only after the FortiGate receives a rating verdict from FortiGuard. An incorrectly configured action does not alter the transport path or the HTTPS request used to obtain that rating. Consequently, the 'diagnose debug rating' output would still show successful round-trip communications; the misconfiguration would simply cause the wrong enforcement decision later. A timeout in the debug output points to a failure before any profile action is ever evaluated.
- ✗
The web filter is set to 'monitor all' which causes all requests to timeout
Why it's wrong here
The 'monitor all' mode in a web filter profile is a traffic inspection setting that permits all requests while logging violations for later review. It does not change how the FortiGate sends rating queries to FortiGuard; the device still performs the same DNS lookup, TCP connection, and HTTPS request for each URL. If a rating request times out, the cause is independent of this mode, because 'monitor all' only affects post-rating handling. A timeout here would occur equally with any profile action, so this option misattributes a network-layer issue to a policy-layer behavior.
- ✗
The FortiGuard web filtering license has expired
Why it's wrong here
An expired FortiGuard web filtering license triggers a specific denial response from the FortiGuard rating server, typically a 'not licensed' or 'service not available' message that the FortiGate interprets and logs. In the 'diagnose debug rating' output, this would appear as a rating status of 'not licensed' or an HTTP error code, not as a timeout event. A timeout indicates that the FortiGate could not reach the rating server at all—either due to DNS failure, routing, or connectivity—rather than receiving an explicit license rejection. Hence, the symptom described in the question is inconsistent with a lapsed license.
- ✓
The DNS server configured on the FortiGate is not resolving the FortiGuard FQDN
Why this is correct
Before it can send a rating request to FortiGuard, the FortiGate must resolve the FortiGuard server's FQDN (such as 'fortiguard.fortinet.net') via its configured DNS servers. If DNS resolution fails, the FortiGate has no IP address to connect to, so the HTTPS request never leaves the device and the rating operation eventually times out. This matches the timeout symptom in the 'diagnose debug rating' output, because the lookup cannot complete. To confirm, an administrator should check the FortiGate's DNS settings with 'get system dns' and test name resolution for the FortiGuard domain.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.