The utility's security team is finalizing separate firewall policies for two different traffic types crossing the same FortiGate: general corporate web browsing on the billing segment, and the OT vendor's certificate-pinned application on the substation segment. Which pairing of inspection choices best matches each traffic type's needs?
Select an answer to reveal the explanation.
Short Explanation
Different traffic, different needs — that's the whole idea behind mixing inspection choices instead of picking one setting for everything. Corporate web browsing benefits from deep inspection's full visibility, while the OT vendor's pinned app needs to be left alone or only lightly inspected so it doesn't break. Matching the setting to the traffic beats forcing one blanket rule everywhere.
Full Explanation
Deep inspection gives corporate web browsing on the billing segment full content visibility — antivirus, web filtering, and other profile checks against decrypted payloads — which is appropriate there because ordinary browsing traffic has no certificate-pinning constraint to break. The OT vendor's application, by contrast, fails whenever its pinned certificate is substituted, so that traffic needs either an SSL exemption or a certificate-inspection-only approach so its handshake completes with the real destination's actual certificate intact. Applying deep inspection uniformly everywhere 'for consistency' ignores that consistency is not itself a security goal when it actively breaks a legitimate OT application; FortiOS is explicitly designed to let SSL inspection settings differ per policy for exactly this reason. Applying certificate inspection everywhere for simplicity would leave the billing segment without payload-level malware detection it could otherwise have, trading away real protection for administrative convenience. Blanket 'never decrypt' at the substation segment ignores that a targeted exemption is more precise than avoiding SSL inspection settings altogether, and doesn't address the billing segment's needs at all. The practical check is to review each policy's SSL/SSH inspection profile individually and confirm it matches that segment's actual traffic characteristics rather than assuming one profile should serve every policy.