Based on the packet capture provided in the exhibit and Fortinet ' s Enterprise Firewall 7.6 inspection standards:

Web Filtering Effectiveness (B): The exhibit shows the Server Name Indication (SNI) extension within the Client Hello, specifically indicating the hostname www.fortinet.com. When a firewall policy is configured for SSL Certificate Inspection , the FortiGate does not decrypt the payload but instead relies on the SNI or the certificate ' s Subject/SAN fields to identify the website. Therefore, a web filtering profile can effectively categorize and block/allow this traffic based on the domain name found in the SNI.

TLS Version Support (D): The supported_versions extension is a feature introduced with TLS 1.3 to negotiate the version of the handshake. In the exhibit, the extension explicitly lists two versions: TLS 1.3 (0x0304) and TLS 1.2 (0x0303) . This tells the FortiGate exactly which protocols the client is capable of using for this session.

Why A is incorrect: Antivirus profiles require Deep SSL Inspection (full decryption) to scan the actual files and payload of the session. Since the policy is using Certificate Inspection , the FortiGate cannot see the cleartext data, rendering the antivirus profile ineffective for this encrypted traffic.

Why C is incorrect: While the Subject Alternative Name (SAN) is a common way to identify a site, it is found in the server ' s certificate. In this specific capture, the SNI (Server Name Indication) is already present in the Client Hello, which allows the FortiGate to apply security profiles even before the server ' s certificate is seen.