StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Certificates and encrypted traffic

Practice question 216 of 440 · medium

A user trusts the inspection CA, but FortiGate rejects an upstream chain issued by a private CA. Which change targets the upstream validation problem?

Choose the single best answer.

  1. A.Import only the endpoint inspection CA while leaving the upstream issuer untrusted.
  2. B.Install the appropriate CA certificate in FortiGate's trust store.
  3. C.Install the same inspection CA a second time on the endpoint.
  4. D.Enable only SNI checking while retaining the missing issuer CA.
Show the answer and explanation

✓ Correct answer

  • Install the appropriate CA certificate in FortiGate's trust store.

FortiGate must trust the upstream issuer chain. Endpoint trust of replacement certificates is a separate relationship; duplicating that CA or changing a name-check setting does not supply the upstream issuer trust.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.