Fortinet Exam FCP_FGT_AD-7.4 Topic 13 Question 4 Discussion

Actual exam question for Fortinet's FCP_FGT_AD-7.4 exam

Question #: 4
Topic #: 13

A network administrator has configured an SSL/SSH inspection profile defined for full SSL inspection and set with a private CA certificate. The firewall policy that allows the traffic uses this profile for SSL inspection and performs web filtering. When visiting any HTTPS websites, the browser reports certificate warning errors.

What is the reason for the certificate warning errors?

AThe SSL cipher compliance option is not enabled on the SSL inspection profile. This setting is required when the SSL inspection profile is defined with a private CA certificate.

BThe certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.

CThe browser does not recognize the certificate in use as signed by a trusted CA.

DWith full SSL inspection it is not possible to avoid certificate warning errors at the browser level.

Show Suggested Answer

Suggested Answer: C

by Hui at Sep 12, 2024, 03:59 PM

Limited Time Offer

25%

Off

Get Premium FCP_FGT_AD-7.4 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Brittani

2 months ago

Oof, that's a classic SSL/SSH inspection dilemma. The browser's gonna throw a fit if it doesn't recognize the certificate. C is the way to go, no doubt about it.

upvoted 0 times

...

Bobbye

2 months ago

Haha, looks like the network admin forgot to consider the browser's trust issues. Option C all the way, my friend. Next time, they should just use a publicly trusted CA, am I right?

upvoted 0 times

Nickie

29 days ago

I agree, using a publicly trusted CA would have been a better choice to prevent certificate warning errors.

upvoted 0 times

...

Miesha

30 days ago

Yeah, the network admin should have used a publicly trusted CA to avoid these issues.

upvoted 0 times

...

Danica

1 months ago

That's true, using a publicly trusted CA would avoid these certificate warning errors.

upvoted 0 times

...

Bethanie

1 months ago

Yeah, the network admin should definitely consider using a publicly trusted CA next time.

upvoted 0 times

...

Jesusa

1 months ago

Option C is correct, the browser does not recognize the certificate as signed by a trusted CA.

upvoted 0 times

...

Yong

1 months ago

Option C is definitely the reason for the certificate warning errors. The browser doesn't recognize the certificate as signed by a trusted CA.

upvoted 0 times

...

Annabelle

2 months ago

That's a good point, Chantay. It could be a combination of both issues causing the certificate warning errors.

upvoted 0 times

...

Daryl

2 months ago

Well, this is a tricky one. Option D sounds a bit too pessimistic, don't you think? With full SSL inspection, there should be a way to avoid those pesky certificate warnings. I'm gonna go with C.

upvoted 0 times

...

Rachael

2 months ago

Hmm, I'm not sure about this one. The SSL cipher compliance option is important, but I don't think that's the root cause of the issue. I'm leaning towards option C as well.

upvoted 0 times

...

Ruth

2 months ago

The certificate warning errors are clearly due to the private CA certificate used by the firewall. The browser doesn't recognize it as a trusted CA, so it's throwing those warnings. Option C seems like the right answer here.

upvoted 0 times

Elza

1 months ago

That makes sense. So enabling the SSL cipher compliance option should resolve the certificate warning errors.

upvoted 0 times

...

Jenifer

1 months ago

A) The SSL cipher compliance option is not enabled on the SSL inspection profile. This setting is required when the SSL inspection profile is defined with a private CA certificate.

upvoted 0 times

...

Marnie

1 months ago

But why wouldn't the browser recognize the private CA certificate?

upvoted 0 times

...

Stefania

2 months ago

Option C) The browser does not recognize the certificate in use as signed by a trusted CA.

upvoted 0 times

...

Joaquin

2 months ago

Option A) The SSL cipher compliance option is not enabled on the SSL inspection profile. This setting is required when the SSL inspection profile is defined with a private CA certificate.

upvoted 0 times

...

Eloisa

2 months ago

Option C) The browser does not recognize the certificate in use as signed by a trusted CA.

upvoted 0 times

...

Chanel

2 months ago

Option C) The browser does not recognize the certificate in use as signed by a trusted CA.

upvoted 0 times

...

Chantay

2 months ago

But could it also be because the SSL cipher compliance option is not enabled on the SSL inspection profile?

upvoted 0 times

...

Galen

3 months ago

I agree with Annabelle. The browser needs to trust the CA that signed the certificate for SSL inspection to work properly.

upvoted 0 times

...

Annabelle

3 months ago

I think the reason for the certificate warning errors is because the browser does not recognize the certificate in use as signed by a trusted CA.

upvoted 0 times

...