Overview
Domain 3 is the largest objective area on the FortiOS 7.6 Administrator exam. Its five objectives cover inspecting encrypted traffic with certificates, choosing inspection modes and configuring web filtering, using application control, configuring antivirus scanning modes, and protecting networks with IPS sensors. Each objective includes the common problems that appear in real deployments, such as certificate warnings, FortiGuard rating failures, misidentified applications and IPS-driven CPU load.
All of these profiles attach to firewall policies, and most of them see little inside HTTPS unless the right SSL inspection profile is in place. The exam therefore keeps returning to three questions: what inspection mode the policy uses, whether the traffic is decrypted, and which profile setting produced the result the user sees. Knowing the order in which FortiGate applies static URL filters, FortiGuard categories and other checks also earns marks.
How it's tested
Questions here usually pair a profile configuration with a user symptom: a blocked site, a certificate warning, an application that still works, or a high CPU alarm. You must trace the symptom back to the inspection mode, the SSL profile or a specific profile setting, often from a screenshot of the profile or a log entry.
-
Explain the user's experience
A browser warning, block page or unexpected allow is described, and you name the SSL or web filter setting responsible.
-
Flow or proxy
A requirement such as content replacement or minimal latency is given, and you choose the inspection mode that supports it.
-
Tune the profile
An IPS, antivirus or application control problem is described, such as high CPU or missed detections, and you select the right change.
Users can still reach a blocked category over HTTPS, and the logs show only the domain name. The firewall policy uses certificate inspection, which reads the SNI and certificate but not the full URL or content. FortiGuard category blocking by domain should still work, so the next check is whether a static URL filter exempt entry matches first. Static URL filters are evaluated before FortiGuard categories.
Objectives 5
Official objectives from the Fortinet outline, in outline order.
3.1 Explain and inspect encrypted traffic using certificatesFull SSL/SSH inspection for outbound traffic, CA certificates on endpoints and certificate issues.
- What it means
- Most traffic is encrypted, so FortiGate must decrypt it to inspect content. This objective covers the difference between certificate inspection and full (deep) inspection, how FortiGate re-signs server certificates with its own CA, and how to fix the certificate errors that follow.
- What to understand
- Certificate inspection reads only the TLS handshake, such as the SNI and server certificate, so it supports domain-level web filtering but not content scanning. Full inspection acts as a man-in-the-middle, decrypting and re-encrypting traffic with the FortiGate CA certificate; endpoints must trust that CA or users see warnings. Untrusted server certificates are re-signed with a separate untrusted CA so the browser still warns. Exemptions are used for sensitive categories and applications that pin certificates.
- How it shows up
- Expect questions on why users see certificate warnings or why content is not scanned.
- Common confusion
- Assuming certificate inspection allows antivirus scanning of HTTPS downloads; only full inspection exposes content.
3.2 Identify FortiGate inspection modes and configure web filteringFlow versus proxy, certificate inspection for web filtering, FortiGuard categories, URL filters and issues.
- What it means
- FortiGate inspects traffic either flow-based, scanning packets as they pass, or proxy-based, buffering content before releasing it. Web filtering controls web access using FortiGuard categories, static URL filters and other options in a profile matched to that mode.
- What to understand
- Flow mode is the default and has lower latency; proxy mode supports more features, such as some override and content options. Within a web filter profile, static URL filters are checked before FortiGuard categories, and an exempt action skips later checks. Category actions include allow, monitor, block, warning and authenticate. FortiGuard ratings require the FortiGate to reach FortiGuard servers or a FortiManager; rating errors can be allowed or blocked by setting.
- How it shows up
- You may need to predict the outcome of a URL against a profile or choose the right mode.
- Common confusion
- Thinking FortiGuard categories are checked before the static URL filter list.
3.3 Configure application control to monitor and control network applicationsApplication control in profile mode, event monitoring and traffic matching issues.
- What it means
- Application control identifies applications by signature rather than port, so FortiGate can allow, monitor or block applications that share common ports such as 443. In profile-based mode, an application control profile is attached to a firewall policy.
- What to understand
- Profiles act on categories, individual application overrides and filter overrides, with overrides taking precedence over categories. Many applications are identified only after several packets, so the first packets of a session may pass under the policy. Encrypted applications often need deep inspection for reliable identification, and blocking QUIC can force browsers back to TLS that FortiGate can inspect. Application control events appear in the security logs and FortiView.
- How it shows up
- Expect to choose between a category action and an override, or to explain why an application is not blocked.
- Common confusion
- Assuming port-based services in the policy block applications; application control works by signature.
3.4 Configure antivirus scanning modes to neutralize malware threatsAntivirus in flow and proxy modes, protocol options, logging and common issues.
- What it means
- Antivirus profiles scan files in supported protocols for malware using FortiGuard signatures, heuristics and optional cloud or sandbox services. The objective covers how scanning works in each inspection mode, the protocol options that shape it, and how to monitor and troubleshoot detections.
- What to understand
- In proxy mode, FortiGate buffers the whole file, scans it and can replace a blocked file with a replacement message. In flow mode, it scans as packets pass and holds the final packet until the verdict, so a block resets the connection rather than showing a page. Protocol options set the ports for each protocol and what to do with oversized files. Signature updates depend on a valid FortiGuard antivirus license.
- How it shows up
- You may need to explain what a user sees when a file is blocked in each mode, or why large files pass.
- Common confusion
- Expecting a replacement block page in flow mode; flow mode typically resets the session instead.
3.5 Configure an intrusion prevention system (IPS) to protect a network from threats and vulnerabilitiesIPS sensors, high CPU caused by IPS, and blocking known exploits.
- What it means
- IPS detects and blocks attacks against vulnerabilities using signatures and protocol decoders. An IPS sensor lists the signatures and filters to apply and the action for each, and it is attached to a firewall policy.
- What to understand
- Sensors can select signatures by filters such as severity, target, operating system and application, or individually, with actions such as pass, monitor, block, reset, quarantine or the signature default. Rate-based signatures block activity that exceeds thresholds. Applying every signature to every policy wastes CPU, so sensors should match the protected assets. When the IPS engine is overloaded, fail-open settings decide whether traffic passes uninspected or is dropped.
- How it shows up
- Expect to pick a sensor change that blocks an exploit or reduces IPS CPU load.
- Common confusion
- Thinking more signatures always means better protection; irrelevant signatures add load without benefit.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Certificate inspection
Reads the TLS handshake (SNI and certificate) without decrypting content.
- Remember
- Supports domain-level web filtering only.
- Tested as
- SSL profile questions.
- Trap
- Expecting content scanning with it.
-
Full SSL inspection
Decrypts and re-encrypts traffic using the FortiGate CA.
- Remember
- Endpoints must trust the CA certificate.
- Tested as
- Certificate warning scenarios.
- Trap
- Forgetting to deploy the CA to endpoints.
-
Untrusted CA re-signing
Invalid server certificates are re-signed with an untrusted CA.
- Remember
- Users still receive a warning.
- Tested as
- Certificate issue questions.
- Trap
- Assuming FortiGate hides bad certificates.
-
Flow-based inspection
Scans packets as they pass with minimal buffering.
- Remember
- The default and lower latency.
- Tested as
- Mode selection questions.
- Trap
- Expecting full block pages for every feature.
-
Proxy-based inspection
Buffers content before releasing it.
- Remember
- Supports more features, such as content replacement.
- Tested as
- Mode selection questions.
- Trap
- Ignoring the extra resource use.
-
Web filter order
Static URL filter is checked before FortiGuard categories.
- Remember
- Exempt skips further checks.
- Tested as
- URL outcome questions.
- Trap
- Assuming categories are checked first.
-
Warning and authenticate actions
Warning lets users proceed after a notice; authenticate requires credentials to proceed.
- Remember
- Both are category actions.
- Tested as
- Web filter behavior.
- Trap
- Swapping the two.
-
FortiGuard rating errors
Setting decides whether unrated or unreachable lookups allow or block.
- Remember
- Rating needs FortiGuard connectivity.
- Tested as
- Web filtering issues.
- Trap
- Blaming the profile when FortiGuard is unreachable.
-
Application overrides
Specific application actions override category actions.
- Remember
- Overrides take precedence.
- Tested as
- Application control questions.
- Trap
- Changing the category when one app is the issue.
-
QUIC blocking
Blocking QUIC forces fallback to TLS that FortiGate can inspect.
- Remember
- Improves application and web inspection.
- Tested as
- Application control questions.
- Trap
- Leaving QUIC traffic uninspected.
-
Antivirus oversized files
Protocol options decide whether files above the size limit pass or are blocked.
- Remember
- Large files may pass unscanned.
- Tested as
- Antivirus issue questions.
- Trap
- Assuming every file is scanned.
-
IPS sensor filters
Select signatures by severity, target, OS and application.
- Remember
- Match sensors to protected assets.
- Tested as
- IPS tuning.
- Trap
- Enabling all signatures everywhere.
-
IPS fail-open
Decides whether traffic passes when the IPS engine is overloaded.
- Remember
- It trades security for availability.
- Tested as
- High CPU questions.
- Trap
- Assuming traffic is always dropped.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Certificate versus full SSL inspection
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Certificate inspection | Reads SNI and server certificate | No decryption | Expecting AV or URL path visibility |
| Full inspection | Decrypts and re-signs traffic | Sees full content | Not deploying the FortiGate CA |
| Exemptions | Bypass decryption for chosen traffic | Privacy or pinned apps | Exempting too broadly |
Flow-based versus proxy-based inspection
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Flow-based | Packet-by-packet scanning | Lower latency, default mode | Expecting replacement pages for blocked files |
| Proxy-based | Content buffered then scanned | More features, more resources | Using it where latency matters most |
Security profiles and what they match
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Web filter | URLs and categories | Destination-focused | Using it to block an app on a shared domain |
| Application control | Application signatures | Identifies apps regardless of port | Relying on ports instead |
| Antivirus | Files in supported protocols | Malware in content | Expecting it to stop exploits |
| IPS | Attack patterns and anomalies | Protects vulnerable services | Expecting it to scan files for malware |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Certificate inspection scans content
- What candidates pick
- Rely on certificate inspection for HTTPS malware scanning.
- Why it looks right
- It is part of the SSL profile.
- Why it's wrong
- It never decrypts the session, so file content stays hidden from antivirus.
Clue to watch for The scenario needs file or full URL visibility in HTTPS.
-
Category beats URL filter
- What candidates pick
- Predict the FortiGuard category decides first.
- Why it looks right
- Categories feel like the main control.
- Why it's wrong
- Static URL filter entries are evaluated first, and an exempt or allow entry changes the outcome before categories run.
Clue to watch for The profile shows both a URL filter entry and a blocked category.
-
Warning means blocked
- What candidates pick
- Treat the warning action as a hard block.
- Why it looks right
- It shows a block-style page.
- Why it's wrong
- Warning lets the user continue after acknowledging the notice; block does not.
Clue to watch for Users report they can proceed after clicking through.
-
Ports control apps
- What candidates pick
- Block an application by removing its service port from the policy.
- Why it looks right
- Older firewalls worked by port.
- Why it's wrong
- Many applications share 443, so signature-based application control is needed.
Clue to watch for The application uses HTTPS on standard ports.
-
Flow mode shows a page
- What candidates pick
- Expect a replacement message when antivirus blocks a file in flow mode.
- Why it looks right
- Proxy mode does show one.
- Why it's wrong
- In flow mode the verdict comes at the last packet, so FortiGate typically resets the connection.
Clue to watch for The policy is flow-based and users see failed downloads.
-
More IPS is better
- What candidates pick
- Add all signatures to fix a missed detection.
- Why it looks right
- Coverage sounds safer.
- Why it's wrong
- Unneeded signatures raise CPU load and can trigger fail-open; tailored filters protect better.
Clue to watch for The scenario mentions high CPU from the IPS engine.
Answer framework
Use this process for Domain 3 scenarios where inspection produced an unexpected result.
- Find the firewall policy that matched and note its inspection mode, flow or proxy, because it changes the features and the user's experience.
- Check the SSL inspection profile: certificate inspection sees only handshake data, while full inspection decrypts content and needs the CA on endpoints.
- Identify which profile acted, using the security log: web filter, application control, antivirus or IPS, since each matches different evidence.
- Walk that profile's order of evaluation, such as static URL filter before FortiGuard categories, or application overrides before categories.
- For performance complaints, narrow IPS sensors and antivirus scope, and review fail-open and oversized file settings before adding hardware.
Practice question
Want more like this? The NSE 4 practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Spend the most time here, since this domain carries the largest weight. Start with SSL inspection in a lab: browse with certificate inspection, then switch to full inspection and watch the certificate chain change. Install the FortiGate CA on a test machine and confirm the warnings disappear, then visit a site with an expired certificate to see the untrusted CA behavior.
Next, build one web filter profile and test it with a static URL filter, several FortiGuard categories and each action. Repeat the tests in flow and proxy mode and record differences. Add application control with an override for one application and block QUIC to see the effect on identification.
Finally, download the EICAR test file in both modes and compare what the browser shows. Create an IPS sensor filtered for one server type, generate test traffic, and read the IPS logs. Keep a one-page table of each profile's evaluation order and its common issues for revision.
FAQ
How much of the NSE 4 exam is Content Inspection?
Content Inspection carries 25-30% of the FortiOS 7.6 Administrator exam, the largest share, which is about 13 to 16 questions on a 50-55 question form.
Do I need full SSL inspection for web filtering?
Not for category blocking by domain, which certificate inspection supports through the SNI and certificate. Full inspection is needed for complete URLs, content scanning and many application signatures.
Which is checked first, the URL filter or FortiGuard categories?
The static URL filter is checked before FortiGuard categories. An exempt entry also skips later web filter checks for that URL.
What is the difference between flow and proxy inspection?
Flow mode scans packets as they pass with low latency and is the default. Proxy mode buffers content first and supports additional features at higher resource cost.
Why does a blocked download fail without a block page?
In flow mode, antivirus holds the last packet and resets the connection on detection, so the browser shows a failed download instead of a replacement message.
How do I lower IPS CPU usage?
Narrow the sensor with filters for the operating systems, applications and targets you actually protect, apply sensors only where needed, and review fail-open settings.
Is DNS filtering part of this domain?
DNS filtering is not named in the current FortiOS 7.6 objectives. The listed areas are SSL inspection, web filtering, application control, antivirus and IPS.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 3 knowledge
You have reviewed SSL inspection, inspection modes, web filtering, application control, antivirus and IPS. Test whether you can explain each user symptom from the profile settings.