DNS Filter Purpose
What is the purpose of the DNS filter security profile on a FortiGate?
Quick Answer
The answer is to block DNS queries to known malicious domains. This is correct because the DNS filter security profile on a FortiGate operates by inspecting outgoing DNS requests in real time, comparing them against FortiGuard’s threat intelligence database of malicious or unwanted domains. When a match is found, the FortiGate can drop the query, redirect it to a sinkhole, or return a forged response, effectively preventing the client from resolving the domain and thus stopping the connection before it begins. On the Fortinet NSE 4 Network Security Professional exam, this concept tests your understanding of how FortiGate enforces security at the DNS layer, often appearing in scenario-based questions where you must choose the correct profile to block command-and-control traffic. A common trap is confusing DNS filter with web filter—remember that DNS filter acts before the HTTP request, blocking the resolution itself. A useful memory tip: DNS filter is the “first gatekeeper” for domain-based threats, stopping the lookup before any data exchange can occur.
⚠ Common exam trap
Watch out — candidates often confuse DNS filter with antivirus or antispam profiles, mistakenly thinking it inspects payloads or email content, when in fact it operates strictly at the DNS query layer to block domain resolution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To block DNS queries to known malicious domains
The DNS filter security profile on a FortiGate is designed to block DNS queries to known malicious domains by comparing the domain names in DNS requests against a regularly updated database of malicious or categorized domains. This prevents users from resolving domains associated with malware, phishing, or command-and-control servers, thereby stopping threats before an IP connection is even established.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To block DNS queries to known malicious domains
Why this is correct
DNS filter uses FortiGuard DNS categories and custom domain lists to block malicious DNS queries.
- ✗
To inspect DNS traffic for virus signatures
Why it's wrong here
Virus scanning is done by antivirus profiles.
- ✗
To filter spam emails based on DNS blacklists
Why it's wrong here
Spam filtering is done by email filter profiles.
- ✗
To prevent DNS tunneling attacks
Why it's wrong here
While DNS filter can help, its primary purpose is domain blocking based on categories.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. What is the purpose of enabling 'DNS filter' in a security profile?
easy- A.To cache DNS responses for faster browsing
- B.To prevent DNS tunneling attacks
- C.To enforce safe search on search engines
- ✓ D.To block DNS queries to known malicious domains
Why D: The primary purpose of DNS filter is to block DNS queries to known malicious domains, leveraging threat intelligence feeds like FortiGuard to prevent users from reaching malicious sites. Option A is incorrect: DNS filter does not cache responses; caching is handled by a DNS resolver or forwarder. Option B is incorrect: while DNS filter can help detect some tunneling patterns, its main function is not specifically to prevent DNS tunneling; that typically requires advanced inspection like deep packet inspection or anomaly detection. Option C is incorrect: enforcing safe search is a separate feature often implemented via web filter or search engine policies, not DNS filter.
Variation 2. What is the purpose of the 'DNS Filter' feature on a FortiGate?
easy- ✓ A.To block DNS queries to malicious domains based on FortiGuard category and allow/block lists.
- B.To cache DNS queries for faster resolution.
- C.To encrypt DNS traffic to prevent eavesdropping.
- D.To filter the content of DNS responses from legitimate servers.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.