NSE4 Security Profiles Practice Question
An administrator wants to block users from uploading sensitive documents through webmail. Which security profile should be configured on the FortiGate to achieve this goal?
⚠ Common exam trap
Watch out — candidates often confuse the function of DLP with web filtering or application control, thinking that blocking the webmail application entirely is equivalent to preventing data leaks, when in fact DLP is the only profile that inspects the actual content being transmitted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Leak Prevention (DLP)
Data Leak Prevention (DLP) is the correct security profile because it is specifically designed to inspect content (e.g., file names, patterns, or keywords) in traffic such as webmail uploads and block sensitive data from leaving the network. DLP sensors can be configured with rules to match patterns like credit card numbers, social security numbers, or custom keywords, and then take action such as blocking or logging the session.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data Leak Prevention (DLP)
Why this is correct
DLP (Data Leak Prevention) profiles in FortiOS inspect traffic content, not just metadata. It can match file content against predefined or custom sensitive data patterns (e.g., credit card numbers or confidential labels like 'INTERNAL ONLY') using full-content scanning. When a match occurs, the firewall can block the upload, log it, and optionally send a notification. Unlike antivirus or web filter, DLP operates at the content-inspection layer of the proxy and can be applied to HTTP/HTTPS, FTP, and email protocols, making it the appropriate choice for preventing sensitive-data exfiltration via uploads.
- ✗
Antivirus
Why it's wrong here
Antivirus scanning inspects files for malicious code, viruses, and malware signatures, not for contextual or confidential data. Even though FortiOS's AV engine scans files during proxy traffic, its purpose is to identify known malware patterns or heuristics, not to determine whether a file's contents contain regulated data like credit card numbers. Thus, antivirus would not block an upload of a sensitive but malware-free file.
- ✗
Application control
Why it's wrong here
Application control identifies and categorizes network traffic based on application signatures (e.g., webmail, social media) and can restrict or deny access to entire applications over the network. However, once an application such as a webmail portal is allowed, application control does not perform deep content inspection on the file payloads being transferred within that permitted session. It cannot both allow the application and selectively block a specific sensitive upload inside it.
- ✗
Web filter
Why it's wrong here
Web filter, or web filtering, classifies URLs and domain names into categories (e.g., social media, file sharing) and enforces access policies based on those categories. It blocks or allows web requests at the HTTP/HTTPS header level but does not inspect the body/content of uploaded files. Therefore, a web filter cannot detect that a file contains sensitive data patterns; it only governs which websites or categories a user can visit.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.