Domain 3 — Content inspection 26 cards
What does certificate inspection let the FortiGate see?
The SNI and the certificate CN only. No decryption, no payload.
What does full (deep) SSL inspection require on every endpoint?
The re-signing CA certificate must be installed and trusted — otherwise every HTTPS site throws an error.
What is the default re-signing CA certificate?
Fortinet_CA_SSL
The destination server's certificate is invalid. Which CA does the FortiGate re-sign with, and why?
Fortinet_CA_Untrusted — deliberately, so the browser warning still reaches the user.
Deep inspection breaks a banking app. What is the correct fix?
Add an SSL exemption for that destination. Certificate pinning and HSTS cannot be worked around — and 'disable inspection' is the wrong answer.
Which FortiGuard categories are exempt from deep inspection by default?
Finance and Health.
What is the web filter evaluation order?
1. Static URL filter · 2. FortiGuard category filtering · 3. Content and advanced filters
What does the URL filter 'exempt' action do that 'allow' does not?
Exempt skips the REMAINING inspection as well — antivirus and DLP included. Allow only overrides the category decision.
Name the five FortiGuard category actions.
Allow · Monitor (allow and log) · Block · Warning (interstitial with a timer) · Authenticate (require credentials to continue).
Which features require PROXY-based inspection?
Web profile overrides, quotas, CDR (content disarm), DLP, client comforting, and full safe-search enforcement.
Which engine runs application control, and what does that imply?
The IPS engine — so application control is ALWAYS flow-based, even inside a proxy-based policy.
What is the application control match order?
1. Application overrides (individual apps) · 2. Filter overrides · 3. Categories · · Most specific first — an app entry always beats its own category.
Why does application control misidentify HTTPS applications with certificate inspection only?
Without deep inspection it can only match on the SNI, giving coarse identification. Real app identification needs full SSL inspection.
Flow-based versus proxy-based antivirus — the key behavioural difference?
Flow scans as the stream passes, so the client may receive part of the file before the connection is reset. · · Proxy buffers the whole file, scans it, then releases it.
What happens to a file larger than the oversize limit, by default?
It is NOT scanned, and it is PASSED through.
Where is the antivirus oversize limit actually configured?
In the PROTOCOL OPTIONS profile — a separate object from the antivirus profile. This is the answer to most 'why isn't it scanning' questions.
Which inspection mode is required for CDR (content disarm and reconstruction)?
Proxy-based only.
What is FortiGuard Outbreak Prevention?
A real-time hash lookup against FortiGuard for files the signature database does not know. Requires a license and live connectivity.
Name the three antivirus signature databases.
Normal, extended, extreme.
What are the two components of an IPS sensor, and which is evaluated first?
Filters (by severity, target, protocol, OS, application) and individual signature entries. · · Signature entries are evaluated first.
Name the IPS sensor actions.
Allow, Monitor, Block, Reset, Quarantine, or default (use the signature's own recommended action).
What three things must a rate-based IPS signature define?
A threshold, a duration, and a track-by value (source or destination).
diagnose test application ipsmonitor 99 does what?
Restarts all IPS engines. · · (1 = display engine info, 2 = toggle engine on/off, 5 = toggle bypass status.)
Are DoS policies part of IPS sensors, and when are they evaluated?
No — they are separate objects, and they are evaluated BEFORE firewall policies.
Does DNS filtering need deep inspection?
No. It is a separate profile and works without decrypting anything.
Which web filtering features require deep inspection?
Safe search enforcement and the YouTube education filter.