Application Control Not Detecting Skype: SSL Deep Inspection Required
An administrator notices that a specific application (e.g., Skype) is not being detected by the application control profile. The profile includes the 'Skype' application signature but traffic is passing through without being logged as Skype. What is the most likely reason?
Quick Answer
The answer is that SSL deep inspection is not enabled on the firewall policy. Application control relies on deep packet inspection to match encrypted traffic against application signatures, and without SSL deep inspection, the FortiGate can only see the outer TLS handshake, classifying the traffic as generic HTTPS rather than Skype. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this scenario tests your understanding that application control profiles require decryption to identify applications using encryption, such as Skype or other VoIP tools. A common trap is assuming the signature alone is sufficient, but the key is that the firewall policy must have SSL/SSH inspection enabled to decrypt the session. Remember the memory tip: “No decrypt, no detect”—if the policy lacks deep inspection, encrypted apps will always appear as HTTPS.
⚠ Common exam trap
Candidates often assume application control works purely on port numbers or that 'Monitor' mode disables detection, but FortiGate's application control is port-agnostic and requires SSL deep inspection for encrypted traffic to be identified.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL deep inspection is not enabled on the firewall policy
The most likely reason is that SSL deep inspection is not enabled on the firewall policy. When Skype traffic is encrypted (which is common for modern Skype versions), the FortiGate cannot inspect the payload to match the application signature. Without SSL deep inspection, the firewall sees only encrypted packets and cannot identify the application as Skype, even if the signature is present in the profile.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The application control profile is set to 'Monitor' mode
Why it's wrong here
Monitor mode logs but does not block; it still detects the application.
- ✗
The traffic is using a non-standard port
Why it's wrong here
Application control can identify applications regardless of port if signatures match the payload; but encryption still prevents inspection.
- ✗
The application signature is outdated
Why it's wrong here
Outdated signatures might miss new versions, but the most common issue with encrypted traffic is lack of deep inspection.
- ✓
SSL deep inspection is not enabled on the firewall policy
Why this is correct
Skype uses encryption. Without deep inspection, FortiGate cannot decrypt the traffic to inspect the application layer.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to block an application named 'Skype' on the network. They create an application control profile and add a rule to block 'Skype'. However, after applying the profile to the policy, users can still use Skype. What is the most likely reason?
medium- A.The application control profile is not enabled on the firewall policy
- B.The application signature for Skype is outdated
- C.The application control rule is set to 'monitor' instead of 'block'
- ✓ D.Skype traffic is encrypted and SSL deep inspection is not enabled
Why D: Skype uses proprietary encryption and often relies on peer-to-peer connections that bypass traditional port-based inspection. Without SSL deep inspection (also known as HTTPS inspection or certificate-based decryption), the FortiGate cannot decrypt the encrypted Skype traffic to match it against the application control signature. Application control relies on either protocol decoders or deep packet inspection (DPI) to identify applications; if the traffic is encrypted and not decrypted, the FortiGate sees only encrypted payloads and cannot apply the block rule.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.