A government agency needs to ensure that all HTTPS traffic to external sites presents a valid certificate from a trusted CA, but the agency is not authorized to decrypt the traffic. The administrator needs to configure SSL inspection to validate certificates and reject connections with invalid certificates. What should the administrator configure?

An exemption list to allow all traffic without inspection

A firewall policy that denies all HTTPS traffic

A certificate inspection profile with the action set to 'block' for invalid certificates

A full inspection profile with a custom CA to decrypt and validate the certificate

What must be done to avoid certificate errors on client devices when deploying deep inspection?

Install the FortiGate's CA certificate on the client devices

Disable certificate validation on the FortiGate

Configure the FortiGate to use the server's original certificate

Use a public CA certificate for the FortiGate

A manufacturing company is implementing full SSL inspection for all internal users. The security team wants to ensure that only strong cryptographic algorithms are used for the decrypted sessions. Which configuration option in the full inspection profile should the administrator adjust?

The exemption list, to exclude weak cipher sites from inspection

The cipher suites list, to restrict which algorithms are allowed for the FortiGate's re-encryption

The certificate inspection depth, to control how many levels of the certificate chain are validated

The SSH algorithm list, to restrict SSH ciphers

A financial institution is deploying full SSL inspection for all employee traffic. The security team wants to ensure that the FortiGate can decrypt traffic from all employees without breaking applications that use certificate pinning. The team has identified several pinned applications. What is the best approach to maintain security while avoiding breakage?

Add the pinned applications to the exemption list in the full inspection profile

Use a public CA-signed certificate for the FortiGate to avoid pinning issues

Deploy certificate inspection for all traffic to avoid pinning issues

Disable certificate validation for all traffic to avoid pinning issues

A healthcare organization is deploying full SSL inspection for all outbound traffic. The compliance team has identified that traffic to a specific patient portal must be exempt from inspection due to HIPAA requirements. The administrator needs to configure the exemption while maintaining full inspection for all other traffic. What should the administrator do?

Add the patient portal domain to the exemption list in the full inspection profile

Disable SSL inspection for all traffic to ensure compliance

Create a separate firewall policy for the patient portal with SSL inspection disabled

Change the full inspection profile to certificate inspection for all traffic

FortinetNSE 7 - Enterprise Firewall Administrator

Domain 3Objective 1

Manage SSL/SSH Inspection Profiles, Based on a Scenario NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR Practice Questions (Page 4)

Part of the Security Profiles domain, which makes up ~23% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

6concepts

Questions 16–20

16application · medium
A government agency needs to ensure that all HTTPS traffic to external sites presents a valid certificate from a trusted CA, but the agency is not authorized to decrypt the traffic. The administrator needs to configure SSL inspection to validate certificates and reject connections with invalid certificates. What should the administrator configure?
Select an answer first
17foundation · easy
What must be done to avoid certificate errors on client devices when deploying deep inspection?
Select an answer first
18application · medium
A manufacturing company is implementing full SSL inspection for all internal users. The security team wants to ensure that only strong cryptographic algorithms are used for the decrypted sessions. Which configuration option in the full inspection profile should the administrator adjust?
Select an answer first
19expert · hard
A financial institution is deploying full SSL inspection for all employee traffic. The security team wants to ensure that the FortiGate can decrypt traffic from all employees without breaking applications that use certificate pinning. The team has identified several pinned applications. What is the best approach to maintain security while avoiding breakage?
Select an answer first
20application · medium
A healthcare organization is deploying full SSL inspection for all outbound traffic. The compliance team has identified that traffic to a specific patient portal must be exempt from inspection due to HIPAA requirements. The administrator needs to configure the exemption while maintaining full inspection for all other traffic. What should the administrator do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR” is a trademark of its owner, used for identification only.

Manage SSL/SSH Inspection Profiles, Based on a Scenario NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR Practice Questions (Page 4)

Questions 16–20

What must be done to avoid certificate errors on client devices when deploying deep inspection?

A manufacturing company is implementing full SSL inspection for all internal users. The security team wants to ensure that only strong cryptographic algorithms are used for the decrypted sessions. Which configuration option in the full inspection profile should the administrator adjust?

Keep studying — Security Profiles