Question 823 of 282
Why Application Control Fails on HTTPS Traffic Without SSL Decryption
A network administrator notices that traffic from a specific internal host is not being inspected by the application control profile applied to the firewall policy. The policy is configured with proxy-based inspection and the application control profile includes a rule to block 'Facebook'. The administrator confirms the host can still access Facebook. What is the MOST likely cause?
Quick Answer
The correct answer is that the host is accessing Facebook over HTTPS and the policy does not have SSL/TLS deep inspection enabled. Without SSL decryption, the FortiGate’s proxy-based inspection sees only an encrypted tunnel, not the actual application layer inside it, so application control cannot identify or block Facebook traffic. This question tests your understanding of how application control depends on visibility into encrypted sessions, a common pitfall on the Fortinet NSE 4 Network Security Professional NSE4 exam. The trap is assuming proxy-based inspection alone is enough; remember, without SSL inspection, HTTPS traffic remains opaque to application control. Memory tip: “No decrypt, no detect” — if you don’t break the SSL, you can’t block the app.
⚠ Common exam trap
A common mix-up: candidates confuse 'application control' with 'web filtering' or assume that proxy-based inspection alone can inspect encrypted traffic, overlooking the requirement for SSL/TLS deep inspection to be explicitly enabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The host is accessing Facebook over HTTPS and the policy does not have SSL/TLS deep inspection enabled.
The most likely cause is that the host is accessing Facebook over HTTPS, and the firewall policy does not have SSL/TLS deep inspection enabled. Without deep inspection, the firewall cannot decrypt the HTTPS traffic to inspect the application layer payload, so the application control profile cannot identify or block 'Facebook' traffic. Proxy-based inspection requires decryption to match application signatures for encrypted traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The host is accessing Facebook over HTTPS and the policy does not have SSL/TLS deep inspection enabled.
Why this is correct
Application control cannot inspect encrypted application signatures without SSL deep inspection to decrypt the traffic.
- ✗
The firewall policy is using flow-based inspection instead of proxy-based.
Why it's wrong here
The question states proxy-based is used, so this is not the cause.
- ✗
The application control profile is configured with 'deep inspection' disabled.
Why it's wrong here
Application control can work without deep inspection for many applications; deep inspection is needed only for encrypted traffic.
- ✗
The application control profile is applied only to outgoing traffic, but the host is using a proxy.
Why it's wrong here
Even with a proxy, application control should still inspect the traffic if the policy is correctly applied.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization uses Application Control to allow only business-critical applications and block social media. The administrator has configured the profile to block Facebook and Twitter, but users can still access Facebook. The firewall policy applies the profile correctly. What is the most likely cause?
medium- A.The application control profile is applied to the wrong direction.
- B.Facebook is not included in the default application signatures.
- ✓ C.SSL inspection is not enabled on the firewall policy.
- D.The FortiGate is in flow-based inspection mode.
Why C: Application Control relies on SSL inspection to identify applications like Facebook that use HTTPS. Without SSL inspection enabled on the firewall policy, FortiGate can only see encrypted traffic as generic SSL/TLS flows and cannot match the application signatures for Facebook. Enabling SSL inspection (deep inspection or certificate-based inspection) allows the FortiGate to decrypt the traffic and apply the application control profile correctly.
Last reviewed: Jul 4, 2026
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.