NSE4 Security Profiles Practice Question
What is the difference between 'certificate inspection' and 'full SSL deep inspection' on a FortiGate?
⚠ Common exam trap
Candidates often confuse 'certificate inspection' with 'deep inspection' because both involve SSL/TLS, but certificate inspection never decrypts the payload, making it a common misconception that it provides the same security level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Certificate inspection only validates the server certificate, while deep inspection decrypts and inspects the entire TLS session content.
Certificate inspection only validates the server certificate's authenticity (e.g., checking the certificate chain, expiration, and revocation status) without decrypting the actual TLS session. In contrast, full SSL deep inspection performs a man-in-the-middle decryption by re-encrypting traffic with a FortiGate-generated certificate, allowing the firewall to inspect the entire payload for threats like malware or data leakage. This distinction is critical for understanding how FortiGate applies security profiles to encrypted traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Certificate inspection decrypts the traffic but does not check the certificate.
Why it's wrong here
Certificate inspection does not decrypt traffic; it examines only the TLS server certificate's chain, expiration, and hostname during the handshake. The statement falsely implies that certificate inspection decrypts the session while skipping certificate validation, which inverts how these features operate. In reality, no decrypted content is ever accessed by certificate inspection.
- ✗
Deep inspection is less secure than certificate inspection.
Why it's wrong here
Deep inspection is actually more secure because it decrypts the TLS session, applies intrusion prevention, antivirus, and URL filtering to the plaintext payload, and then re-encrypts the data. Certificate inspection only validates the certificate's authenticity and never sees the encrypted content, leaving malware and exploits hidden. Therefore, deep inspection provides a higher level of security at the cost of additional processing overhead and cannot be called less secure.
- ✓
Certificate inspection only validates the server certificate, while deep inspection decrypts and inspects the entire TLS session content.
Why this is correct
Certificate inspection validates the server certificate — chain of trust, expiration, and hostname — but passes the TLS session through without decrypting it. Deep inspection (full SSL/TLS inspection) performs a man-in-the-middle: it terminates the client connection, decrypts the session, inspects the contents, then initiates a new TLS connection to the server and re-encrypts the traffic. This allows deep inspection to detect threats inside the payload rather than simply checking the outer certificate.
- ✗
Both methods provide the same level of inspection.
Why it's wrong here
Certificate inspection and deep inspection operate at fundamentally different layers. Certificate inspection is a lighter-weight, metadata-only check performed during the handshake, while deep inspection terminates the session, decrypts and scans all application data, then re-encrypts onward. Claiming they provide the same level of inspection ignores that certificate inspection cannot see the plaintext content at all, making the two methods anything but equivalent.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.