Quick Answer

The correct answer is to create a DLP sensor that uses a custom pattern for SSNs and to enable SSL deep inspection. A custom pattern is necessary because standard DLP filters do not inherently recognize the specific nine-digit format of Social Security numbers, so you must define a regex or signature to match that exact data pattern. Additionally, SSL deep inspection is critical because modern email traffic, such as SMTP over TLS, is encrypted; without decrypting that traffic, the DLP sensor cannot read the content to detect the SSN. On the Fortinet NSE 4 exam, this question tests your understanding that DLP detection requires both a content-matching mechanism and the ability to inspect encrypted channels—a common trap is forgetting that deep inspection is mandatory for encrypted protocols like SMTP over TLS. Memory tip: “Pattern to catch, decrypt to match”—you need a custom pattern to identify the SSN and SSL inspection to see inside the encrypted email.