NSE7 Application Control Practice Question
An administrator notices that some traffic through the FortiGate is not being inspected by the application control profile. Which TWO reasons could explain this? (Choose two.)
⚠ Common exam trap
Candidates often confuse proxy-based inspection with disabling application control. In reality, proxy-based mode is necessary for deep application control inspection. The real reason for missed inspection is typically policy misconfiguration—traffic hitting a policy without the profile applied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application control profile is disabled
The two valid reasons are that traffic may match a different policy without the application control profile (E), and that the application control profile may be disabled on the policy the traffic hits (D). Option A is incorrect because proxy-based inspection is required for application control; setting it to proxy-based enables inspection. Option B is incorrect because outdated signatures still allow inspection, albeit with reduced effectiveness. Option C is incorrect because high memory usage may impact performance but does not entirely prevent inspection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The inspection mode is set to proxy-based
Why it's wrong here
Incorrect. Proxy-based inspection is required for application control to function; this setting enables inspection, not disables it.
- ✗
The application control signatures are outdated
Why it's wrong here
Incorrect. Outdated signatures may reduce detection of new applications, but inspection still occurs with existing signatures.
- ✗
The FortiGate has high memory usage
Why it's wrong here
Incorrect. High memory usage can cause performance issues but does not stop application control inspection entirely.
- ✓
The application control profile is disabled
Why this is correct
Incorrect. If the profile is disabled globally, no traffic would be inspected; but the question specifies 'some traffic' not being inspected, which points to a per-policy issue.
- ✓
Traffic matches a different policy without the application control profile
Why this is correct
Correct. If traffic matches a different policy that does not have the application control profile, it will bypass the intended inspection.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.