StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Certificates and encrypted traffic

Practice question 215 of 440 · medium

SNI disagrees with the certificate name and Server certificate SNI check is Enable. Which name is used for URL filtering?

Choose the single best answer.

  1. A.The original client SNI despite the detected mismatch.
  2. B.The destination IP's reverse-DNS name.
  3. C.The server certificate CN.
  4. D.The first SAN entry regardless of the documented fallback.
Show the answer and explanation

✓ Correct answer

  • The server certificate CN.

In the documented Enable mode, an SNI/name mismatch falls back to the server certificate CN for URL filtering. It does not always retain the mismatched SNI, perform reverse-DNS selection, or choose the first SAN arbitrarily.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.