Manage SSL/SSH Inspection Profiles, Based on a Scenario NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which action does a certificate inspection profile perform on a server certificate that fails validation?

   • AIt blocks the connection based on the profile's failure action.
   • BIt allows the connection but logs a warning.
   • CIt replaces the certificate with a FortiGate-generated certificate.
   • DIt decrypts the traffic to inspect the payload for threats.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has deployed full SSL inspection in a transparent proxy mode. Users report that some HTTPS sites fail to load, while others work fine. The administrator checks the FortiGate logs and sees 'SSL handshake failure' errors for the failing sites. The failing sites include a banking portal and a software update service. The administrator has already added the banking portal to the exemption list, but the issue persists. What is the most likely cause and the best next step?

   • AThe cipher suites in the full inspection profile are too restrictive; the administrator should enable all available cipher suites
   • BThe FortiGate is placed incorrectly in the network path; the administrator should move it to a different interface
   • CThe sites use certificate pinning; the administrator should add them to the exemption list and verify the exemption is applied to the correct policy
   • DThe FortiGate's CA certificate has expired; the administrator should generate a new CA and reinstall it on all clients
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A hospital wants to validate that all outbound HTTPS traffic from its finance department is destined for legitimate banking domains, but the compliance team prohibits decryption of financial transactions. The security team needs to verify the certificate chain and detect expired or untrusted certificates without seeing the payload. Which inspection mode should the administrator configure?

   • ADisable SSL inspection and rely on DNS filtering to block malicious banking domains
   • BFull SSL inspection with a custom CA certificate installed on all finance workstations
   • CSSH deep inspection with a proxy CA to intercept encrypted tunnels
   • DCertificate inspection with a profile that validates the certificate chain and checks for revocation
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is using certificate inspection and users report that some HTTPS sites are being blocked. The administrator checks the logs and sees 'certificate validation failed' errors for these sites. The sites are legitimate and use certificates from well-known CAs. What is the most likely cause?

   • AThe certificate inspection profile is set to 'allow' invalid certificates
   • BThe sites are using certificate pinning
   • CThe exemption list is blocking the sites
   • DThe FortiGate's clock is incorrect, causing certificate validity checks to fail
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A retail company is deploying full SSL inspection for all employee web traffic. The security administrator has created a full inspection profile and selected the internal CA certificate. However, employees are reporting browser certificate warnings when visiting https://www.vendor-portal.com. The administrator wants to exclude this specific domain from inspection while keeping full inspection for all other traffic. What is the most efficient way to achieve this?

   • AChange the full inspection profile to certificate inspection for all traffic
   • BCreate a separate firewall policy for the domain with SSL inspection disabled
   • CAdd the domain to the exemption list in the SSL/SSH inspection profile
   • DInstall the internal CA certificate on all employee browsers again
   Reveal Solution Discussion Select an answer first