Explain and Inspect Encrypted Traffic Using Certificates NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company has enabled full SSL inspection on its FortiGate. Users report that they receive certificate errors when accessing internal HTTPS servers that use certificates from the company's internal PKI. The FortiGate's CA certificate is installed on all endpoints. What is the most likely cause?

   • AThe users' browsers are not configured to trust the internal PKI.
   • BThe internal servers are using expired certificates.
   • CThe FortiGate does not trust the internal PKI's root certificate.
   • DThe FortiGate's CA certificate is not installed on the internal servers.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When FortiGate performs full SSL inspection on outbound HTTPS traffic, what is the correct sequence of actions it takes?

   • ABlock all HTTPS traffic unless the client presents a valid client certificate
   • BInspect the encrypted traffic by analyzing packet headers without decrypting it
   • CForward the encrypted traffic to a third-party cloud service for decryption and inspection
   • DDecrypt the traffic, inspect the plaintext, then re-encrypt it using a certificate that the client trusts
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company wants to use full SSL inspection to enforce acceptable use policies by blocking access to social media and streaming sites. They have enabled SSL inspection. What should the administrator configure to block these sites?

   • ACreate a firewall policy to block traffic to those sites' IP addresses.
   • BUse a DNS filter to block the domains.
   • CApply an application control profile to block social media and streaming applications.
   • DApply a web filter profile to the firewall policy that handles HTTPS traffic.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A user reports that they cannot access a specific HTTPS website, and the browser shows a certificate error. Other websites work fine. The FortiGate is performing full SSL inspection. What is the most likely cause?

   • AThe user's browser does not have the FortiGate's CA certificate installed.
   • BThe website's certificate is not trusted by the FortiGate, so it is not being re-encrypted with a trusted certificate.
   • CThe FortiGate is not configured to inspect traffic to that specific website.
   • DThe website is using an unsupported cipher suite.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the recommended method to distribute the FortiGate's private CA certificate to client endpoints in a managed environment?

   • AEmailing the certificate to each user
   • BHaving users manually download it from the FortiGate's web interface
   • CGroup Policy (GPO) in Active Directory
   • DIncluding it in the FortiGate's firmware update
   Reveal Solution Discussion Select an answer first