A company has deployed full SSL inspection and is experiencing intermittent failures for a specific internal application that uses a client certificate for authentication. The application works fine when SSL inspection is disabled. The administrator has verified that the CA certificate is trusted by all clients. What is the most likely cause and the best solution?

The application uses client certificate authentication, which is not supported by full inspection; the administrator should add the application to the exemption list

The FortiGate's clock is incorrect; the administrator should synchronize the clock

The cipher suites are too restrictive; the administrator should enable all cipher suites

The CA certificate is not trusted by the server; the administrator should install the CA on the server

A multinational company is deploying full SSL inspection across multiple regions. The security team wants to ensure that the FortiGate can decrypt traffic from all regions without breaking applications that use client certificates. What is the most important consideration when configuring the full inspection profile?

Disabling the exemption list to ensure all traffic is inspected

Enabling certificate inspection for all traffic to avoid client certificate issues

Configuring the cipher suites to support the weakest common algorithm

Selecting a CA certificate that is trusted by all clients in all regions

A company has deployed full SSL inspection and is experiencing high CPU usage on the FortiGate, leading to network latency. The administrator suspects that certain high-volume traffic, such as video streaming, is consuming excessive resources. The company wants to maintain security for sensitive applications but reduce the performance impact. What is the most effective approach?

Change the full inspection profile to certificate inspection for all traffic

Upgrade the FortiGate hardware to a higher model

Disable SSL inspection entirely and rely on application control

Add the video streaming domains to the exemption list to bypass inspection for that traffic

Which CLI command is commonly used to debug SSL/SSH inspection issues on a FortiGate?

diagnose debug application antivirus

diagnose debug application firewall

FortinetNSE 7 - Enterprise Firewall Administrator

Domain 3Objective 1

Manage SSL/SSH Inspection Profiles, Based on a Scenario NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR Practice Questions (Page 5)

Part of the Security Profiles domain, which makes up ~23% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

6concepts

Questions 21–25

21expert · hard
A company has deployed full SSL inspection and is experiencing intermittent failures for a specific internal application that uses a client certificate for authentication. The application works fine when SSL inspection is disabled. The administrator has verified that the CA certificate is trusted by all clients. What is the most likely cause and the best solution?
Select an answer first
22foundation · easy
An administrator needs to inspect SSL traffic for malware while preserving user privacy and avoiding the overhead of decryption. Which inspection mode should be used?
Select an answer first
23expert · hard
A multinational company is deploying full SSL inspection across multiple regions. The security team wants to ensure that the FortiGate can decrypt traffic from all regions without breaking applications that use client certificates. What is the most important consideration when configuring the full inspection profile?
Select an answer first
24expert · hard
A company has deployed full SSL inspection and is experiencing high CPU usage on the FortiGate, leading to network latency. The administrator suspects that certain high-volume traffic, such as video streaming, is consuming excessive resources. The company wants to maintain security for sensitive applications but reduce the performance impact. What is the most effective approach?
Select an answer first
25foundation · easy
Which CLI command is commonly used to debug SSL/SSH inspection issues on a FortiGate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR” is a trademark of its owner, used for identification only.

Manage SSL/SSH Inspection Profiles, Based on a Scenario NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR Practice Questions (Page 5)

Questions 21–25

An administrator needs to inspect SSL traffic for malware while preserving user privacy and avoiding the overhead of decryption. Which inspection mode should be used?

Which CLI command is commonly used to debug SSL/SSH inspection issues on a FortiGate?

Keep studying — Security Profiles