Troubleshooting: Application Control Not Blocking BitTorrent (Encrypted P2P)
A company wants to block all peer-to-peer (P2P) traffic using Application Control on their FortiGate. They have enabled the application control profile, but users can still download files via BitTorrent. What is the most likely reason?
Quick Answer
The answer is that the application control profile does not have SSL inspection enabled. BitTorrent and other peer-to-peer applications commonly encrypt their traffic to evade detection, and without SSL inspection, the FortiGate cannot perform deep packet inspection on the encrypted payload. Application Control relies on matching traffic patterns against application signatures, but encrypted sessions appear as opaque data streams, so the firewall cannot identify BitTorrent and allows the traffic to pass. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this scenario tests your understanding that application control is not a standalone solution for encrypted P2P traffic—it must be paired with SSL inspection to decrypt and analyze the session. A common trap is assuming the application control profile alone is sufficient, but the key is that encryption blinds the signature-based detection. Memory tip: “No decrypt, no detect—encrypted P2P slips right through.”
⚠ Common exam trap
It's easy for candidates to assume application control works on all traffic regardless of encryption, but FortiGate requires SSL inspection to identify applications that use encryption, such as BitTorrent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application control profile does not have SSL inspection enabled.
BitTorrent traffic is often encrypted, so without SSL inspection, the FortiGate cannot inspect the payload of the encrypted sessions to identify the application. Application Control relies on deep packet inspection (DPI) to match traffic against application signatures; if SSL inspection is not enabled, the FortiGate only sees encrypted packets and cannot detect BitTorrent, allowing the traffic to pass unchecked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The application control profile does not have SSL inspection enabled.
Why this is correct
Without SSL inspection, encrypted BitTorrent traffic cannot be inspected and matched.
- ✗
The FortiGate is operating in Transparent mode.
Why it's wrong here
Application Control works in both NAT and Transparent modes.
- ✗
The application control profile is applied to the outgoing policy, but BitTorrent traffic is incoming.
Why it's wrong here
Application Control is bidirectional; it can inspect traffic in both directions.
- ✗
The default application signatures do not include BitTorrent.
Why it's wrong here
BitTorrent is included in the default application signatures.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to block all peer-to-peer file sharing applications on the network. Which FortiGate feature should be used to achieve this goal?
easy- ✓ A.Application Control
- B.Web Filter
- C.DNS Filter
- D.Intrusion Prevention System (IPS)
Why A: Application Control is the correct feature because it is specifically designed to identify and block peer-to-peer (P2P) file-sharing applications by inspecting traffic patterns and signatures, regardless of the port or protocol used. Unlike port-based blocking, Application Control uses deep packet inspection (DPI) to recognize P2P protocols such as BitTorrent, eDonkey, and Gnutella, even when they attempt to evade detection by using non-standard ports or encryption.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.