Key Web Filtering Features for Malicious Site Blocking
Which TWO web filtering features can be used to block access to malicious websites? (Choose two.)
Quick Answer
The correct answers are FortiGuard category-based filtering and web rating override. FortiGuard category-based filtering works by querying FortiGuard’s cloud-based web rating database, which categorizes URLs into threat types like malware or phishing, allowing the FortiGate to automatically block access to known malicious websites. Web rating override complements this by letting administrators manually assign a custom rating to a specific URL, effectively blocking a site that FortiGuard has not yet flagged as malicious—closing the gap between automated detection and emerging threats. On the Fortinet NSE 4 Network Security Professional exam, this question tests your understanding of how web filtering features block malicious websites through both automated reputation and manual administrative control. A common trap is assuming only one feature handles malicious sites, but the exam emphasizes that overrides are essential for zero-day or uncategorized threats. Memory tip: think “Auto + Manual” — FortiGuard handles the known, overrides handle the unknown.
⚠ Common exam trap
Watch out — candidates often confuse DNS filter with web filtering, but DNS filter is a separate security feature (under DNS Filter profile) and is not considered a web filtering feature in the NSE4 exam; the question explicitly asks for 'web filtering features' as defined in the FortiGate Web Filter profile.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FortiGuard category-based filtering
FortiGuard category-based filtering (C) is correct because it leverages FortiGuard's cloud-based web rating database to categorize URLs and block access to known malicious sites, such as those hosting malware or phishing. Web rating override (D) is correct because it allows administrators to manually override the FortiGuard rating for specific URLs, enabling them to block a site that may not yet be categorized as malicious by FortiGuard. Both features directly control access to malicious websites based on URL reputation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Static URL filtering
Why it's wrong here
Static filtering blocks specific URLs, but not necessarily malicious.
- ✗
Application control
Why it's wrong here
Application control manages apps, not URLs.
- ✓
FortiGuard category-based filtering
Why this is correct
Blocks categories like 'Malicious'.
- ✓
Web rating override
Why this is correct
Allows overriding categories to block malicious sites.
- ✗
DNS filter
Why it's wrong here
DNS filter blocks based on DNS, not web content.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which FortiGate feature allows you to block access to specific URL categories such as 'Social Media' or 'Gambling'?
easy- ✓ A.Web Filtering
- B.Antivirus
- C.Intrusion Prevention System (IPS)
- D.Application Control
Why A: FortiGate's Web Filtering feature uses URL rating and category databases (e.g., FortiGuard) to block access to entire categories like 'Social Media' or 'Gambling' based on the destination URL. This is distinct from content inspection; it operates at the HTTP/HTTPS request level by matching the requested URL against predefined or custom category lists.
Variation 2. A network administrator wants to prevent users from accessing known malicious websites using FortiGate. Which security profile should be applied to the firewall policy to achieve this goal?
easy- A.Antivirus profile
- B.Application control profile
- C.IPS profile
- ✓ D.Web filtering profile
Why D: Web filtering profile. FortiGate's web filtering profile uses URL rating and category-based filtering to block access to known malicious websites by leveraging FortiGuard's real-time threat intelligence. This is the specific security profile designed to control web access based on URL reputation, including blocking malicious URLs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.