nerdexam
Fortinet

NSE4 · Question #186

SSL content inspection is enabled on the FortiGate unit. Which of the following steps is required to prevent a user from being presented with a web browser warning when accessing an SSL- encrypted…

The correct answer is A. The root certificate of the FortiGate SSL proxy must be imported into the local certificate store on. To prevent web browser warnings during FortiGate SSL content inspection, the FortiGate's root certificate must be imported and trusted by client devices.

Submitted by kev92· Apr 18, 2026Security Profiles and Content Inspection

Question

SSL content inspection is enabled on the FortiGate unit. Which of the following steps is required to prevent a user from being presented with a web browser warning when accessing an SSL- encrypted website?

Options

  • AThe root certificate of the FortiGate SSL proxy must be imported into the local certificate store on
  • BDisable the strict server certificate check in the web browser under Internet Options.
  • CEnable transparent proxy mode on the FortiGate unit.
  • DEnable NTLM authentication on the FortiGate unit. NTLM authentication suppresses the

How the community answered

(35 responses)
  • A
    89% (31)
  • B
    3% (1)
  • C
    6% (2)
  • D
    3% (1)

Why each option

To prevent web browser warnings during FortiGate SSL content inspection, the FortiGate's root certificate must be imported and trusted by client devices.

AThe root certificate of the FortiGate SSL proxy must be imported into the local certificate store onCorrect

When FortiGate performs deep SSL inspection, it acts as a man-in-the-middle, presenting its own certificate to the client; therefore, the client's web browser must trust the FortiGate's root certificate to avoid security warnings.

BDisable the strict server certificate check in the web browser under Internet Options.

Disabling strict server certificate checks is a security risk and is not the proper method to handle warnings arising from a trusted SSL inspection certificate.

CEnable transparent proxy mode on the FortiGate unit.

Transparent proxy mode configures how traffic is intercepted, but it does not address the cryptographic trust relationship required between the client browser and the FortiGate's SSL inspection certificate.

DEnable NTLM authentication on the FortiGate unit. NTLM authentication suppresses the

NTLM authentication is an authentication protocol and has no direct relevance to suppressing web browser warnings related to untrusted SSL certificates during inspection.

Concept tested: FortiGate SSL inspection certificate trust

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/575290/ssl-tls-inspection

Topics

#SSL Inspection#Root Certificates#Certificate Trust#Browser Warnings

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full NSE4 Practice