NSE7 Advanced Threat Protection Practice Question
An NSE7 administrator is configuring a FortiGate to use the built-in intrusion prevention system (IPS) to detect and block exploits targeting a custom web application. The administrator wants to ensure that the IPS engine inspects all HTTP traffic, including encrypted sessions, without impacting performance. Which FortiGate feature should be enabled to allow IPS inspection of SSL/TLS traffic?
⚠ Common exam trap
The trap here is assuming that enabling IPS automatically inspects encrypted traffic without configuring SSL inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deep packet inspection (DPI) with SSL inspection profile
To inspect encrypted HTTP traffic with IPS, the FortiGate must decrypt SSL/TLS sessions. This is achieved by applying an SSL inspection profile alongside deep packet inspection. The other options either improve performance or segment traffic but do not provide the necessary decryption to expose malicious content to the IPS engine.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardware acceleration with NP6 processors
Why it's wrong here
NP6 processors offload traffic to hardware to improve throughput, but they do not perform SSL decryption or IPS inspection. While they enhance performance, they do not enable inspection of encrypted traffic. Thus, this option does not address the need to inspect SSL/TLS sessions.
- ✗
Flow-based inspection mode
Why it's wrong here
Flow-based inspection mode examines packets as they traverse the FortiGate but does not decrypt SSL/TLS traffic. It can improve performance but leaves encrypted sessions uninspected by IPS. Therefore, it is insufficient for detecting exploits within encrypted HTTP traffic.
- ✓
Deep packet inspection (DPI) with SSL inspection profile
Why this is correct
Enabling deep packet inspection with an SSL inspection profile allows the FortiGate to decrypt SSL/TLS traffic so the IPS engine can inspect the plaintext for malicious patterns. Without SSL inspection, encrypted traffic bypasses IPS. This is the correct approach for inspecting encrypted HTTP sessions while maintaining security.
- ✗
Virtual domain (VDOM) segmentation
Why it's wrong here
VDOM segmentation divides a FortiGate into multiple independent virtual firewalls, which helps with management and policy separation but does not decrypt SSL/TLS traffic. It has no effect on IPS inspection of encrypted sessions. Therefore, it does not meet the requirement of inspecting encrypted HTTP traffic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.