NSE4 Security Profiles Practice Question
An administrator wants to block an application named 'Skype' on the network. They create an application control profile and add a rule to block 'Skype'. However, after applying the profile to the policy, users can still use Skype. What is the most likely reason?
⚠ Common exam trap
Watch out — candidates often assume application control can block any application by name alone, forgetting that encrypted traffic requires SSL deep inspection to be enabled on the firewall policy for the application signatures to work.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Skype traffic is encrypted and SSL deep inspection is not enabled
Skype uses proprietary encryption and often relies on peer-to-peer connections that bypass traditional port-based inspection. Without SSL deep inspection (also known as HTTPS inspection or certificate-based decryption), the FortiGate cannot decrypt the encrypted Skype traffic to match it against the application control signature. Application control relies on either protocol decoders or deep packet inspection (DPI) to identify applications; if the traffic is encrypted and not decrypted, the FortiGate sees only encrypted payloads and cannot apply the block rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The application control profile is not enabled on the firewall policy
Why it's wrong here
If the application control profile were not attached to the firewall policy, the FortiGate would not apply any application signatures, so Skype traffic would be allowed without any inspection. Since the administrator confirmed the profile is enabled on the policy, a missing profile cannot cause the issue. The profile's presence is a prerequisite, but the blocking rule within that profile is what takes action, so other factors like encryption are at play.
- ✗
The application signature for Skype is outdated
Why it's wrong here
FortiGuard regularly updates signatures, and Skype has been a major application for years, so its signatures are stable and well-known. An outdated signature could conceivably miss a new version, but it would not prevent detection of all Skype traffic, especially since the classic protocol remains recognizable. The failure here is not due to signature age but because the traffic is encrypted, hiding the content that the signatures rely on for identification.
- ✗
The application control rule is set to 'monitor' instead of 'block'
Why it's wrong here
Application control rules have two possible actions: 'monitor' and 'block.' A rule set to 'monitor' would simply log Skype usage and allow the traffic, so the problem would be a configuration mistake, not a technical limitation. However, the administrator explicitly added the rule with a 'block' action, so the rule is properly set to deny. Even if there were multiple rules, the block rule would take precedence for Skype, so this explanation does not hold.
- ✓
Skype traffic is encrypted and SSL deep inspection is not enabled
Why this is correct
Skype uses transport-layer encryption (TLS) to protect its signaling and media traffic. Without SSL deep inspection enabled in the firewall policy, the FortiGate cannot decrypt the SSL/TLS session to read the application-layer payload where the application signature resides. Consequently, the FortiGate sees only encrypted packets that do not match Skype's signature, so the block rule never triggers. To block Skype effectively, the administrator must enable SSL deep inspection with a valid CA certificate, allowing the FortiGate to proxy and inspect the traffic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.