NSE4 Security Profiles Practice Question
Which of the following is a prerequisite for SSL deep inspection to work correctly on FortiGate?
⚠ Common exam trap
Test-takers frequently confuse the need for a firewall policy with SSL inspection enabled with the misconception that a separate HTTPS-only policy or proxy mode is mandatory, when in fact any policy matching HTTPS traffic can be configured for deep inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A firewall policy that has SSL inspection enabled.
SSL deep inspection requires a firewall policy with SSL inspection enabled to intercept and decrypt HTTPS traffic. Without such a policy, the FortiGate cannot apply the CA certificate to re-encrypt traffic for inspection, making deep inspection non-functional.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A dedicated HTTPS firewall policy.
Why it's wrong here
A dedicated HTTPS firewall policy is not required because SSL deep inspection is simply an action applied to a firewall policy that matches HTTPS traffic. The same policy that allows web access can inspect HTTPS without needing a separate, HTTPS-only rule; the key is that the policy's SSL inspection profile is enabled, not that it exclusively handles HTTPS.
- ✓
A firewall policy that has SSL inspection enabled.
Why this is correct
The correct prerequisite is that the firewall policy permitting the HTTPS traffic must have SSL inspection enabled, meaning an SSL/SSH inspection profile is applied to that policy. This profile instructs the FortiGate to decrypt the traffic, apply security controls, and re-encrypt it, which is the essence of deep inspection. Without this profile attached, the policy merely forwards the encrypted traffic without any visibility.
- ✗
The FortiGate must be operating in proxy mode.
Why it's wrong here
SSL deep inspection does not require the FortiGate to operate in proxy mode; it functions in both flow-based and proxy-based inspection modes. Flow mode uses optimized processing with hardware offloading while still decrypting and inspecting the TLS payload, whereas proxy mode performs full buffering and advanced content analysis. Therefore, the mode is a design choice affecting performance and feature depth, not a prerequisite.
- ✗
An active FortiCare license.
Why it's wrong here
An active FortiCare license is not needed for SSL deep inspection because it is a core firewall security feature available on all FortiOS models. FortiCare licenses provide support contracts and subscription services like updated threat intelligence for NGFW features, but the decryption and inspection logic itself is built into the FortiOS platform. You can enable SSL inspection on a local policy with no license, though some UTM profiles attached after decryption may require subscriptions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.