FCP-FGT-AD - Content inspection (20% of the exam) - Section 3.2

Identify FortiGate inspection modes and configure web filtering to control access to web content.

Compare flow-based and proxy-based inspection modes and explain how the choice affects which web filtering features are available. Configure a FortiGuard web filter profile to allow, block, or monitor URL categories, and apply it within a firewall policy.

web filteringflow-based inspectionproxy-based inspectionFortiGuard web filter

Practice question for this objective

Free sampleContent inspectionmedium

An administrator builds a firewall policy that references a web filter profile set to proxy-based inspection, while the policy itself has its inspection mode left at flow-based. When traffic matches the policy, how does FortiGate handle the web filter profile's proxy-based inspection?

AFortiGate applies the web filter profile using proxy-based inspection regardless of the policy inspection mode, because the profile setting takes precedence.
BFortiGate blocks all traffic on the policy until the inspection modes of the policy and the profile are made to match.
CFortiGate raises a configuration error and refuses to save the policy until the profile is changed to flow-based.
DFortiGate silently converts the profile to flow-based inspection and applies the web filter using flow-based logic for that policy. Correct

Understand that the firewall policy inspection mode, not the profile, determines whether web filtering runs as flow-based or proxy-based. The firewall policy inspection mode is authoritative for the security profiles it applies. A flow-based policy executes a referenced web filter profile using flow-based inspection, so proxy-specific options either map to their flow equivalent or are not enforced, rather than forcing the policy into proxy mode or dropping traffic.

Why A is wrong: This is tempting because it assumes the profile's own inspection mode wins, but the policy inspection mode governs how security profiles run, so a flow-based policy cannot execute a proxy-based profile as proxy.

Why B is wrong: This sounds cautious and secure, but FortiGate does not fail closed on a mode mismatch; it reconciles the profile to the policy mode rather than dropping traffic.

Why C is wrong: This is plausible because some mismatches are blocked at save time, but a web filter profile can be referenced by either policy mode, so the configuration commits without error.

Why D is correct: Correct: when the policy is in flow mode, FortiGate runs the web filter profile in flow-based mode, so any proxy-only behaviour in the profile is applied using the flow-based equivalent.

See more FCP-FGT-AD practice questions, answers explained.

Exam traps in Content inspection

Answers that look right on this material and are not. Each one is a distractor from a different question in the FCP-FGT-AD bank for this domain.

Flow-based inspection buffers each entire page in memory and reassembles it so the full page body can be scanned before delivery, just as proxy mode does.
Why it is wrong: This is tempting because flow mode does inspect web traffic, but flow-based inspection works on the packet stream without full page reassembly, so it cannot scan a complete reconstructed page body the way proxy mode can.
The FortiGuard category filter and the static URL filter are independent profiles that must each be applied to a separate firewall policy to take effect.
Why it is wrong: Tempting because both are real web filter features, but it is wrong: they are components configured inside one web filter profile, not separate profiles, and a single profile applied to a policy carries both.
The DNS filter inspects the full path of each HTTP request and blocks individual page paths once the connection to the web server is established.
Why it is wrong: This is tempting because path-level control sounds like DNS filtering, but the DNS filter only sees domain-name lookups and cannot inspect HTTP request paths, which are evaluated later by URL filtering or category filtering on the connection.

Examworthy is not affiliated with or endorsed by Fortinet. Original, blueprint-aligned practice material only.