Practice exam 1
55 questions
Open this course’s practice exams →Fortinet · Public course · v1.0.1
Fortinet NSE 4 - FortiOS 7.6 Administrator
Study FortiOS 7.6 firewall configuration, authentication, threat inspection, routing and VPNs with explained questions and eight practice exams.
700 flashcards · 440 practice questions
Open study modesLearn IT smarter. Your progress stays in your browser.
Choose topics, then use Flashcards, Learn, Write, Match, Practice Questions or Mock Exam when the course has suitable content.
Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.
Topics in this course
Initial configurationLogging and diagnosisFGCP high availabilityConnectivity and resourcesPublic cloud and FortiGate CNFFortiSASE and onboardingFirewall policiesSource and destination NATFirewall authenticationFortinet Single Sign-OnCertificates and encrypted trafficInspection modes and web filteringApplication controlAntivirusIntrusion preventionStatic routingSD-WANIPsec VPNsPractice exams
Fixed question sets within this course. Open study modes to take an exam and save results in your browser.
Practice exam 2
55 questions
Open this course’s practice exams →Practice exam 3
55 questions
Open this course’s practice exams →Practice exam 4
55 questions
Open this course’s practice exams →Practice exam 5
55 questions
Open this course’s practice exams →Practice exam 6
55 questions
Open this course’s practice exams →Practice exam 7
55 questions
Open this course’s practice exams →Practice exam 8
55 questions
Open this course’s practice exams →Flashcards
What is the usual factory operating mode of a physical FortiGate?
Initial configuration
NAT/route mode: it routes between interfaces as a Layer 3 gateway.
What local administrator name is typically present at factory defaults?
Initial configuration
admin. Replace shared administration with named accounts and appropriate administrator profiles.
What should happen at the first login to a physical FortiGate with an initially empty admin password?
Initial configuration
Set a strong administrator password before exposing management services.
What does the common factory address 192.168.1.99/24 represent?
Initial configuration
A configured FortiGate interface address for management, not a lease issued to the FortiGate by its own DHCP server.
Why must a factory-default IP plan be checked against the FortiGate model?
Initial configuration
Interface names, switch membership, management addressing, and DHCP defaults differ between models; cloud images also use different credentials.
What is the forwarding basis of transparent mode?
Initial configuration
Layer 2 bridging with firewall inspection and policy enforcement; it does not make all traffic unrestricted.
How is a transparent-mode FortiGate administered without acting as the clients' routed gateway?
Initial configuration
It uses a management IP and suitable management routing while bridging the production path.
Does NAT/route mode mean all forwarded traffic undergoes NAT?
Initial configuration
No. It identifies routed operation; NAT must be configured where the design requires translation.
What does an interface role such as LAN or WAN actually provide?
Initial configuration
It influences GUI presentation and suitable configuration options; it does not establish a security boundary by itself.
What should an initial deployment IP plan identify?
Initial configuration
Management, LAN, WAN and DMZ interfaces, addressing, gateways, VLANs, and the intended forward and return paths.
What route normally provides internet reachability with a statically addressed WAN?
Initial configuration
A default route, 0.0.0.0/0, toward the ISP next hop on the intended WAN interface.
When can a DHCP-addressed WAN obtain a default route automatically?
Initial configuration
When gateway/default-route installation from DHCP is enabled and a usable gateway is supplied.
Why test an external IP address before testing a public hostname during initial setup?
Initial configuration
It separates basic network reachability from DNS resolution; hostname failure alone does not identify the failing layer.
Why is accurate time important during initial FortiGate configuration?
Initial configuration
It supports log correlation, certificate validity checks and authentication troubleshooting; configure time zone and NTP.
What is a useful staged connectivity sequence for initial setup?
Initial configuration
Test the connected gateway, an external IP, DNS resolution, then FortiGuard service access.
Why does a successful FortiGate-originated ping not prove that a LAN client can browse?
Initial configuration
Client transit traffic additionally depends on its gateway, forwarding policy, route, and any required source NAT.
Which interface setting enables HTTPS, SSH or ping access to the FortiGate itself?
Initial configuration
allowaccess on the addressed interface, subject to other source restrictions and authentication.
What is the purpose of administrator trusted hosts?
Initial configuration
They restrict permitted administrator source addresses; enabling a management service alone does not override that restriction.
Which policy path controls traffic addressed to FortiGate management services?
Initial configuration
The local-in path. Ordinary forwarding policies control transit traffic through the firewall.
What does an administrator profile define?
Initial configuration
Read/write, read-only or no access to feature areas and relevant diagnostic permissions.
Why can the super_admin profile not be deleted or modified?
Initial configuration
It preserves full administrative authority and a means to administer the device; backup and restore require this authority.
Which account design suits a person who only needs to inspect logs?
Initial configuration
A named administrator with a read-only profile and restricted management sources.
What does an administrator idle timeout protect against?
Initial configuration
An unattended authenticated management session remaining usable indefinitely after inactivity.
What is the purpose of a trusted HTTPS management server certificate?
Initial configuration
It lets the administrator validate the FortiGate management server's identity; it does not grant forwarding permission.
Why preserve console access before changing management addressing or restrictions?
Initial configuration
Console access offers recovery if network-based HTTPS or SSH becomes unreachable.
What information does a DHCP server supply besides a client IP?
Initial configuration
Options including subnet mask, default gateway, DNS servers and lease duration.
How must a DHCP scope relate to its FortiGate interface network?
Initial configuration
Its client allocation range must belong to the intended interface subnet.
Which addresses should be excluded from a dynamic DHCP pool?
Initial configuration
Infrastructure and statically assigned addresses, including the interface gateway, to avoid conflicting assignments.
What does a DHCP reservation accomplish?
Initial configuration
It associates a client identity, commonly a MAC address, with a predictable address.
How does DHCP relay differ from a local DHCP server?
Initial configuration
Relay forwards requests to a DHCP server elsewhere rather than allocating addresses from an equivalent local pool.
What does a Windows client address in 169.254.0.0/16 suggest during DHCP troubleshooting?
Initial configuration
The client did not obtain the expected DHCP lease; inspect link, VLAN, requests, server/relay configuration and pool availability.
What should be checked when a client has a valid DHCP lease but no internet access?
Initial configuration
Supplied gateway and DNS, route selection, matching forwarding policy and any required NAT.
What is FortiCare primarily associated with?
Initial configuration
Support and firmware access under the applicable entitlement, rather than every FortiGuard security service.
What do FortiGuard subscriptions provide?
Initial configuration
Purchased security intelligence, databases or live lookups for particular services; one subscription does not activate every service.
Which two broad causes should be separated when FortiGuard updates or ratings fail?
Initial configuration
Invalid/missing entitlement and service reachability problems such as DNS, time, routing or outbound filtering.
What backup scope distinction matters with VDOMs?
Initial configuration
A whole-device/global backup differs from a backup of one VDOM; select the scope needed for recovery.
What must be retained along with an encrypted configuration backup?
Initial configuration
Its decryption password and compatible device-model/firmware information, stored so recovery is possible.
Why is a password-masked configuration export insufficient as the only recovery backup?
Initial configuration
Masked fields do not reproduce the original secrets; retain a compatible complete backup with usable credentials.
Why follow the supported firmware upgrade path rather than skipping intermediate releases?
Initial configuration
Required version hops perform supported configuration conversion; also check release notes, model support and known issues.
Why retain the earlier matching backup before a firmware downgrade?
Initial configuration
A newer configuration may be incompatible with the older firmware image.
What are the main stages from a firewall event to searchable log evidence?
Logging and diagnosis
An event occurs, a decision is made, a log is generated, and local or remote storage retains it.
Which setting determines whether permitted transit sessions create firewall traffic logs?
Logging and diagnosis
Traffic logging on the matching firewall policy; authorizing a remote collector does not enable policy logging.
How do forward and local traffic logs differ?
Logging and diagnosis
Forward logs concern traffic crossing FortiGate; local logs concern traffic involving FortiGate itself.
What do security logs add to a traffic investigation?
Logging and diagnosis
Profile-specific detections and actions, such as web-filter blocks, antivirus events, IPS detections or application-control decisions.
Which log family records administrative changes, VPN negotiation and HA role changes?
How should separate traffic and security records be correlated?
Logging and diagnosis
Use timestamp, device/VDOM, addresses, user, policy ID and session ID where available.
Why synchronize FortiGate, FortiAnalyzer and identity-server clocks?
Logging and diagnosis
Consistent time allows events from different devices to be placed in a reliable sequence.
Which log fields first identify the kind of record being examined?
Logging and diagnosis
type and subtype, followed by severity, VDOM, device identity and timestamps.
Which traffic-log fields help reconstruct a connection?
Logging and diagnosis
Source/destination IPs and ports, incoming/outgoing interfaces, policy ID, action, duration and byte counts.
Why preserve both original and translated addresses during log correlation?
Logging and diagnosis
NAT changes the tuple visible downstream; comparing only one form can miss the matching server or capture record.
What can sentbyte greater than zero and rcvdbyte equal to zero suggest?
Logging and diagnosis
One-way communication or an unanswered path; it does not alone prove whether the server, route or downstream filtering failed.
Why does an accepted traffic log not prove a successful web transaction?
Logging and diagnosis
Firewall acceptance does not ensure a useful server response or that every subsequent security-profile decision permits the content.
What is the severity order from most to least severe?
Logging and diagnosis
Emergency, alert, critical, error, warning, notice/notification, information, debug; the numeric values run from 0 through 7.
What does a warning severity threshold retain?
Logging and diagnosis
Warning and more severe records; routine informational records can be excluded.
Why check policy type and VDOM when interpreting policyid?
Logging and diagnosis
A policy identifier must be interpreted within its device, firewall context and policy type.
What are the limitations of memory logging?
Logging and diagnosis
It is volatile and capacity-limited, so it is useful for immediate troubleshooting rather than durable retention across restart.
What prerequisite distinguishes local disk logging from memory logging?
Logging and diagnosis
The model or VM must have supported local storage and the appropriate logging configuration.
Which common remote log destinations can preserve FortiGate evidence?
Logging and diagnosis
FortiAnalyzer, FortiAnalyzer Cloud, FortiGate Cloud and syslog, subject to their service and retention capabilities.
Why plan FortiAnalyzer quotas and retention around expected log volume?
Logging and diagnosis
Finite capacity and retention policies can remove useful history even when transmission succeeds.
How can raw/archive retention differ from analytics retention?
Logging and diagnosis
Raw retained records and indexed searchable analytics may have different lifetimes and availability.
What does an unauthorized FortiGate state on FortiAnalyzer require?
Logging and diagnosis
Approve or appropriately stage the device and verify its identity and intended ADOM before expecting authorized collection.
What does real-time versus scheduled log upload affect?
Logging and diagnosis
When records arrive at the collector; an intentional upload delay can explain a gap between event and receipt time.
How do reliability and encryption differ in remote logging?
Logging and diagnosis
Reliable delivery acknowledges and buffers records; encryption protects their contents in transit.
What does the seq_no confirmation mechanism support in reliable FortiAnalyzer logging?
Logging and diagnosis
It tracks received logs so FortiGate can clear confirmed records and retransmit outstanding records after an interruption.
Which viewer settings can hide an otherwise retained log?
Logging and diagnosis
The selected device/source, VDOM, time zone/range, category, filters and retention window.
What does FortiGate Clustering Protocol (FGCP) provide?
FGCP high availability
Compatible FortiGates operate as one logical firewall with coordinated configuration, primary selection and failover.
How is production traffic handled in active-passive HA?
FGCP high availability
One primary processes production traffic; secondary members are ready to take over.
How does active-active HA differ from independent equal-cost gateways?
FGCP high availability
The primary coordinates the cluster and distributes supported processing work to secondaries; it is not merely independent ECMP routing.
Why is active-active throughput not guaranteed to increase linearly with member count?
FGCP high availability
Only supported workloads are distributed, and traffic processing, inspection and coordination impose workload-specific limits.
Which compatibility factors should be checked before forming a physical FGCP cluster?
FGCP high availability
Same FortiGate model and matching firmware, operation mode and relevant hardware/storage configuration.
Which HA identity/security settings must be coordinated across members?
FGCP high availability
Group identity, password and compatible heartbeat configuration must allow the intended units to discover and join the same cluster.
How should corresponding production interfaces be connected in a conventional physical FGCP cluster?
FGCP high availability
Connect them to the same required Layer 2 production networks so either member can serve the logical firewall path.
Does FGCP configuration synchronization clone most licenses to secondaries?
FGCP high availability
No. Each member requires its applicable entitlements; most subscriptions and licenses are not synchronized.
What traffic does the HA heartbeat path carry?
FGCP high availability
Cluster discovery, health information and configuration/runtime synchronization.
Why provide redundant heartbeat paths?
FGCP high availability
Loss of all heartbeat communication can cause split brain, with members each believing they should be primary.
How does monitored production-interface health differ from heartbeat health?
FGCP high availability
Interface monitoring observes selected production links and affects primary election; heartbeat health establishes member communication.
What failure can remote link monitoring detect that physical link state may miss?
FGCP high availability
An unusable upstream path beyond the local cable, even while the local port remains physically up.
What is the normal primary-election order with override disabled?
FGCP high availability
Monitored-interface health, HA age when its difference exceeds the margin, device priority, then serial number.
What is the primary-election order with override enabled consistently?
FGCP high availability
Monitored-interface health, device priority, HA age when relevant, then serial number.
What is the common default HA age-difference margin?
FGCP high availability
300 seconds. Differences below the applicable margin are treated as a tie for the HA-age criterion.
Why is HA age not interchangeable with operating-system uptime?
FGCP high availability
HA age is election state; monitored-interface failures or member restarts reset it independently of a simple dashboard uptime comparison.
When can a higher-priority unit lose primary election?
FGCP high availability
When an earlier criterion favors its peer, such as healthier monitored links or significant HA age with override disabled.
Which direction of device priority wins an HA priority comparison?
FGCP high availability
Higher device priority wins; the normal default is 128.
Which serial number wins when all earlier HA election criteria tie?
What operational side effect can HA override cause after a preferred member recovers?
FGCP high availability
The preferred higher-priority member can reclaim primary, causing an additional failover.
Why should override settings be consistent across HA members?
FGCP high availability
They change the ordering of election criteria and are member-specific rather than automatically synchronized.
How does the primary maintain a common cluster configuration?
FGCP high availability
It synchronizes the required configuration to members and distributes subsequent changes.
Which familiar HA settings remain member-specific?
FGCP high availability
Hostname, device priority, override and reserved management configuration are among the settings not synchronized.
Does configuration synchronization guarantee identical local caches and inspection buffers?
FGCP high availability
No. Runtime-state synchronization depends on feature support, and some local or proxy state is not copied.
Which command provides cluster roles, health and synchronization status?
What is the purpose of comparing HA configuration checksums?
FGCP high availability
To identify synchronization differences and their scope before investigating recent changes or repair actions.
Why is recalculating a configuration checksum not proof of a resolved HA fault?
FGCP high availability
It may refresh diagnostic state without correcting the configuration difference or its underlying cause.
How can an administrator inspect a secondary from the primary CLI?
FGCP high availability
Use execute ha manage with the appropriate listed member identifier, then inspect that member's local state.
What does session-pickup add beyond configuration synchronization?
FGCP high availability
It synchronizes supported live session state so eligible established connections can survive takeover.
Which session type is the main case for ordinary session pickup?
FGCP high availability
Supported established TCP sessions; UDP/ICMP need the additional connectionless synchronization setting.
Which setting extends session synchronization to UDP/ICMP?
FGCP high availability
session-pickup-connectionless, in addition to ordinary session pickup.
What resources does live session synchronization consume?
FGCP high availability
Heartbeat bandwidth, CPU and memory; plan capacity for the expected session churn.
What tradeoff does delayed session synchronization introduce?
FGCP high availability
It reduces synchronization work, but recently created or short-lived sessions may not yet be copied at failover.
What is the purpose of dedicated session-sync interfaces?
FGCP high availability
They can reduce the load carried by shared heartbeat paths for session synchronization.
How does a new primary preserve the logical gateway's identity in ordinary physical HA?
FGCP high availability
It uses the applicable cluster virtual MAC addresses and sends gratuitous ARP to help adjacent switching converge.
Why can a management session fail even when client TCP session pickup works?
FGCP high availability
A session terminating locally on the failed member depends on local management state that is not guaranteed to survive.
What does a reserved out-of-band management interface provide?
FGCP high availability
A distinct member address, physical MAC identity and member-specific management routing, including access to a secondary.
How does in-band member management differ from reserved out-of-band management?
FGCP high availability
It uses a per-member management IP on a production data interface and shares that production connectivity.
Why may ha-direct or per-service settings be needed for reserved management traffic?
FGCP high availability
Some locally originated services do not automatically use the reserved management route or interface.
What is the usual uninterruptible HA upgrade sequence?
FGCP high availability
Upgrade secondaries first, transfer primary operation to an upgraded member, then upgrade and rejoin the former primary; recheck election and synchronization.
What symptom information should be recorded before changing a FortiGate configuration?
Connectivity and resources
Start time, recent changes, affected clients/applications, whether new or existing sessions fail, and the intended packet path.
Which baseline metrics help distinguish abnormal resource behavior?
Connectivity and resources
CPU, memory, session count, new-session rate, throughput and interface error counters compared with normal periods.
Which physical checks should precede security-profile troubleshooting?
Connectivity and resources
Link state, cable/transceiver condition, speed/duplex and error counters.
Why can a physically up port still fail to deliver the expected client's traffic?
Connectivity and resources
VLAN membership or logical path configuration may be wrong; link-up alone is not end-to-end connectivity.
What does checking ARP/neighbour resolution establish?
Connectivity and resources
Whether local next-hop address-to-link-layer resolution works on the expected network segment.
Why include the return route in a connectivity diagnosis?
Connectivity and resources
A valid outbound path does not ensure replies traverse the appropriate stateful firewall context back to the client.
Why is ping from the actual client often more informative than ping only from FortiGate?
Connectivity and resources
It exercises the client's gateway and transit path instead of just the firewall's locally generated traffic.
What does execute ping-options source select?
Connectivity and resources
The source IP for FortiGate-originated ping; use an address belonging to the intended FortiGate interface/context.
Why run execute ping-options reset after a source-specific test?
Connectivity and resources
It removes persistent test options so subsequent pings are not unintentionally sourced or constrained the same way.
Which command helps inspect a FortiGate physical port's hardware state and counters?
Connectivity and resources
diagnose hardware deviceinfo nic <interface>, for example diagnose hardware deviceinfo nic port1.
In diagnose sniffer packet any 'host 10.20.10.10' 4 20 a, what do the final arguments mean?
Connectivity and resources
4 is verbosity, 20 is packet count, and a requests absolute UTC timestamps.
Why is sniffer verbosity 4 useful for ingress/egress comparison?
Why use a narrow host/port/protocol sniffer filter?
Connectivity and resources
It isolates relevant traffic, reduces output volume and makes the expected packet sequence easier to interpret.
What does a zero sniffer packet count mean?
Connectivity and resources
Capture continues until stopped rather than ending after a finite number of packets.
What is the expected TCP connection sequence to trace through a stateful firewall?
Connectivity and resources
Client SYN enters, forwarded/translated SYN exits, SYN/ACK returns, and the response reaches the client.
What does no observed ingress packet suggest, after capture scope and offload visibility are accounted for?
Connectivity and resources
Investigate the upstream client path or whether the traffic actually reaches the expected interface.
What does ingress without the expected egress packet direct you to investigate?
Connectivity and resources
FortiGate processing stages such as route selection, policy, session lookup, reverse-path checks and translation.
What can an outbound SYN with no response suggest?
Connectivity and resources
A downstream destination/connectivity failure or an unusable return path; the capture alone does not distinguish every cause.
What should be investigated if replies enter FortiGate but never reach the client?
Connectivity and resources
Session state, reverse translation, routing and the processing decision for the return packet.
Why can CPU-based sniffing or debug flow miss active traffic?
Connectivity and resources
Eligible packets may be hardware-offloaded, so software-path visibility can be incomplete.
What does debug flow reveal beyond a packet capture?
Connectivity and resources
CPU processing decisions such as session lookup, route selection, policy matching, NAT and drop reasons.
How should a debug-flow test be bounded?
Connectivity and resources
Filter to the test endpoint, trace a finite packet count, reproduce once, then stop and disable debugging.
Which cleanup commands end a debug-flow test?
Connectivity and resources
diagnose debug flow trace stop, diagnose debug disable, and diagnose debug reset.
How do get system performance status and diagnose sys top complement each other?
Connectivity and resources
The first summarizes device resource/traffic state; the second identifies processes consuming CPU and memory.
Why inspect per-core CPU usage instead of relying only on the aggregate average?
Connectivity and resources
One saturated core can be hidden by lower usage on other cores.
Which workloads can raise FortiGate CPU demand?
Connectivity and resources
Inspection, encryption, logging, high packet rates and high new-session rates, depending on processing/offload support.
Which workload/state factors can create memory pressure?
Connectivity and resources
Sessions, proxy/file buffers, log queues and resource-consuming processes.
What does rising memory with steady traffic warrant investigating?
Connectivity and resources
Process/state growth or a software issue, distinguished from memory rising proportionally with genuine workload growth.
What are the usual FortiOS 7.6.0 memory conserve thresholds?
Connectivity and resources
Red 88% enters conserve mode, green 82% leaves it, and extreme 95% drops new sessions; verify actual configured values.
Why are conserve entry and exit thresholds different?
Connectivity and resources
Hysteresis prevents repeated transitions when memory usage fluctuates around one threshold.
What does av-failopen pass do in conserve mode?
Connectivity and resources
It bypasses the antivirus proxy and dependent profiles while the condition persists; unrelated engines need not be bypassed.
What does av-failopen off do in conserve mode?
Connectivity and resources
It blocks new applicable proxy sessions; existing sessions can continue but may terminate if they request more memory.
What is distinctive about av-failopen one-shot?
Connectivity and resources
Antivirus-proxy bypass persists after conserve-mode recovery until the setting changes or the unit restarts.
How does ips global fail-open control flow inspection in conserve mode?
Connectivity and resources
Disable, the default, drops new sessions requiring flow inspection; enable bypasses IPS-engine scans and permits packets.
How does extreme memory pressure affect ordinary fail-open choices?
Connectivity and resources
At the extreme threshold, new sessions are dropped regardless of ordinary proxy/flow fail-open choices.
Which cloud threats are not removed merely by deploying workloads in a public provider?
Public cloud and FortiGate CNF
Exposed management, malicious inbound traffic, vulnerable applications, exfiltration and lateral movement remain relevant.
Why can native security groups or network ACLs be insufficient for a content-inspection requirement?
Public cloud and FortiGate CNF
They provide native network controls but do not automatically supply every application-aware or payload-inspection capability.
Why are static address assumptions fragile in autoscaled cloud workloads?
Public cloud and FortiGate CNF
Resource IPs and membership can change; security design should account for dynamic resources and correct traffic steering.
What is north-south cloud traffic?
Public cloud and FortiGate CNF
Traffic entering or leaving the cloud environment, such as internet access to a workload or workload egress.
What is east-west cloud traffic?
Public cloud and FortiGate CNF
Traffic between workloads, subnets or connected cloud networks, including potential lateral movement.
What is the main architectural benefit of centralized cloud inspection?
Public cloud and FortiGate CNF
It can apply shared inspection and policy across connected networks through a dedicated inspection path.
What is the main placement characteristic of distributed cloud inspection?
Public cloud and FortiGate CNF
Inspection is deployed closer to individual workload networks rather than routing every protected network through one central design.
Who operates firmware and availability design for a customer-managed FortiGate-VM?
Public cloud and FortiGate CNF
The customer/cloud deployment team, using the applicable FortiOS and cloud architecture.
What should be verified when choosing a FortiGate-VM image and compute size?
Public cloud and FortiGate CNF
Supported marketplace image, instance type, required interfaces/resources and the intended licensing model.
What does BYOL mean in a FortiGate-VM deployment?
Public cloud and FortiGate CNF
Bring your own purchased license; it does not eliminate separate cloud infrastructure charges.
How does marketplace PAYG differ from BYOL?
Public cloud and FortiGate CNF
It bills the supported firewall offer through the marketplace plan; compute, storage and data-transfer costs still require consideration.
Why does a FortiGate-VM license price not describe the complete cloud deployment cost?
Public cloud and FortiGate CNF
Compute, storage, load balancers, data transfer and other provisioned resources can be billed separately.
What are the documented initial AWS FortiGate-VM HTTPS credentials?
Public cloud and FortiGate CNF
Username admin and the instance ID as the initial password; change that password immediately.
What extra credential is required for documented AWS SSH access?
Public cloud and FortiGate CNF
The selected AWS key, in addition to the deployment's administrator access requirements.
Why separate external and internal FortiGate-VM interfaces/subnets in a cloud design?
Public cloud and FortiGate CNF
It establishes the intended management and transit paths; route tables and policies must still steer and authorize workload traffic.
Why review AWS source/destination checks for a forwarding FortiGate-VM?
Public cloud and FortiGate CNF
The appliance forwards other endpoints' traffic, so native instance/NIC checks must permit the documented transit path.
Which credentials are used in the documented Azure marketplace/template FortiGate-VM login?
Public cloud and FortiGate CNF
The administrator credentials selected in the deployment parameters, not the AWS instance-ID credential convention.
Which three subnet roles appear in Fortinet's Azure single-VM example?
Public cloud and FortiGate CNF
External, internal/transit, and protected workload subnets.
What Azure routing step inserts the FortiGate into a protected subnet's traffic path?
Public cloud and FortiGate CNF
Associate the applicable UDR route table with the protected subnet and verify its intended destination routes/appliance next hop.
What license step is required in the documented Azure BYOL workflow before continuing?
Public cloud and FortiGate CNF
Upload the license and reboot the FortiGate-VM.
Why may a cloud public IP differ from the address configured inside FortiOS?
Public cloud and FortiGate CNF
The provider can map the public address to a private NIC address; configure based on addresses actually visible to the instance.
Why does cloud stateful inspection require a compatible return path?
Public cloud and FortiGate CNF
Replies must traverse the appropriate firewall/session context for session lookup and reverse translation.
Why can physical HA virtual-MAC behavior not simply be assumed in public-cloud HA?
Public cloud and FortiGate CNF
Cloud takeover can depend on APIs, route updates, address reassociation and load-balancer health rather than ordinary Layer 2 failover.
Why are instance-role/IAM permissions important to an AWS cloud HA design?
Public cloud and FortiGate CNF
The failover process may need authorization to update cloud routes or addressing; FGCP health alone does not grant those permissions.
What operational work does FortiGate CNF's managed infrastructure reduce?
Public cloud and FortiGate CNF
Fortinet operates the underlying firewall infrastructure and scaling rather than requiring the customer to operate every appliance component.
What is a high-level CNF deployment workflow?
Public cloud and FortiGate CNF
Subscribe, integrate protected cloud accounts, create a regional instance, attach endpoints, assign policy and steer traffic through inspection.
Why is CNF AWS cloud-account integration more than read-only discovery?
Public cloud and FortiGate CNF
Permissions support tasks such as endpoint deployment, resource address resolution and log delivery to S3.
Must every protected CNF AWS account be the billing account?
Public cloud and FortiGate CNF
No. Added workload accounts can differ from the billing account and need not each have the marketplace subscription.
What is the role of an AWS Gateway Load Balancer endpoint in a CNF design?
Public cloud and FortiGate CNF
It attaches protected VPC traffic to the managed inspection service; appropriate cloud routes must insert that path.
What east-west restriction is stated in the CNF 25.3.a Azure instance workflow?
Public cloud and FortiGate CNF
Azure east-west configurations are not supported in that documented workflow; do not apply the restriction to all FortiGate-VM designs.
What remote-work traffic pattern can bypass the office firewall?
FortiSASE and onboarding
Remote endpoints can reach SaaS and the internet directly, so office-edge inspection alone may not cover their traffic.
What drawbacks can arise from backhauling every remote connection through headquarters?
FortiSASE and onboarding
Additional latency, concentrated capacity needs and inconsistent security between paths or locations.
What does SASE combine architecturally?
FortiSASE and onboarding
WAN/connectivity functions with cloud-delivered security services.
How does SSE relate to SASE?
FortiSASE and onboarding
Security service edge is the security-service portion of the broader SASE architecture.
What does Fortinet's unified SASE approach combine?
FortiSASE and onboarding
FortiGate SD-WAN connectivity and FortiSASE cloud security.
What is the role of FortiSASE points of presence?
FortiSASE and onboarding
They provide distributed service locations for security enforcement near users/applications, subject to availability and actual path.
What assumption does zero trust reject?
FortiSASE and onboarding
An office IP address or an established VPN alone does not authorize every resource; evaluate identity, posture and intended access.
What does firewall as a service contribute to FortiSASE?
FortiSASE and onboarding
Network access policy and threat protection for traffic steered through the service.
What is the purpose of a secure web gateway?
FortiSASE and onboarding
Proxy and secure supported web traffic with appropriate web inspection and access controls.
What access principle does ZTNA apply to private applications?
FortiSASE and onboarding
Authorize approved application access using identity and relevant device/context information rather than broad network trust.
What is CASB's role in SaaS governance?
FortiSASE and onboarding
Provide supported SaaS visibility and controls over cloud application use and activity.
What security purpose does DLP serve?
FortiSASE and onboarding
Detect sensitive information and restrict unauthorized disclosure within supported inspected traffic or cloud activity.
What is FortiSASE Secure Internet Access (SIA)?
FortiSASE and onboarding
The access model protecting internet-bound traffic steered through the service.
What is FortiSASE Secure Private Access (SPA)?
FortiSASE and onboarding
Approved access to private resources through the appropriate supported ZTNA, NGFW or SD-WAN design.
What is FortiSASE Secure SaaS Access (SSA)?
FortiSASE and onboarding
Controls for SaaS use and data exposure, including supported CASB capabilities.
How do inline and API/out-of-band CASB differ?
FortiSASE and onboarding
Inline controls act on supported live inspected transactions; API-based controls address supported cloud data/activity without the same user traffic path.
Why do FortiSASE capabilities need to be checked for the chosen access mode and subscription?
FortiSASE and onboarding
Not every mode inspects every application or transaction; trust, deep inspection, policy and feature support still matter.
What tenant information does a preconfigured FortiClient onboarding installer include?
FortiSASE and onboarding
The tenant registration/invitation information, reducing the need for manual entry.
How does a generic/manual FortiClient installer enroll to the intended FortiSASE tenant?
FortiSASE and onboarding
Use the invitation code in Zero Trust Telemetry through the approved onboarding process.
Why use the tenant-supported FortiClient version rather than an arbitrary free VPN-only package?
FortiSASE and onboarding
FortiSASE endpoint enrollment and management require the supported agent capabilities and release compatibility.
Why is a managed FortiClient state not proof that internet traffic is inspected?
FortiSASE and onboarding
Endpoint-management registration is separate from access-tunnel establishment, steering and matching security policy.
How can endpoint posture and on-net/off-net rules affect FortiSASE access?
FortiSASE and onboarding
They can influence endpoint profiles and access configuration; validate the profile and posture relevant to the endpoint's current context.
Which roles do FortiSASE and the external identity provider have in SAML?
FortiSASE and onboarding
FortiSASE is the service provider; the external IdP authenticates the user and returns an assertion.
What should be inspected when SAML authentication succeeds but the user gets incorrect access?
FortiSASE and onboarding
Identity/group claims and FortiSASE group-to-policy authorization matching.
Why can PAC configuration require direct exclusions for IdP destinations?
FortiSASE and onboarding
Requiring the same unauthenticated proxy to reach the authentication service can create a dependency loop.
What does a DIRECT entry in a PAC file mean for the selected client request?
FortiSASE and onboarding
The proxy-aware client connects directly for that request, bypassing that proxy inspection path.
What is the traffic scope of agentless proxy SIA?
FortiSASE and onboarding
The web traffic actually sent by proxy-aware clients to the SWG; it is not a full-device tunnel for arbitrary applications.
Which DNS limitation is stated for the documented FortiSASE proxy mode?
FortiSASE and onboarding
That proxy mode does not support DNS filtering; do not assume every agent-mode capability applies to agentless proxy access.
How does a supported FortiGate secure-edge/LAN-extension site reach FortiSASE?
FortiSASE and onboarding
Through a supported VXLAN-over-IPsec connection, allowing site endpoints to use their gateway rather than each requiring FortiClient.
What is a useful FortiSASE operational troubleshooting sequence?
FortiSASE and onboarding
Connectivity, authentication, profile/group assignment, traffic steering, policy and destination access, checked with service logs and endpoint state.
What does a forward firewall policy decide?
Firewall policies
Whether a forwarded session is permitted or denied, and which applicable inspection and logging settings it uses. A permit policy does not create a route.
Which traffic attributes normally determine a new forward-policy match?
Firewall policies
Incoming and outgoing interfaces, source and destination addresses, service, schedule, and required identity. Every applicable category must match.
How do different firewall-policy match categories combine?
Firewall policies
Normally with AND logic. Matching the source address does not compensate for a wrong service or outgoing interface.
How do multiple ordinary address objects within one policy address field combine?
Firewall policies
Normally with OR logic: a host can match any listed object in that field. It does not need to belong to every listed subnet.
What does a source subnet plus an Employees group require?
Firewall policies
The session must match the subnet and the user must satisfy the group requirement. Authentication alone does not override the address restriction.
Where does a policy incoming-interface match come from?
Firewall policies
The interface on which the packet actually arrives in the relevant firewall context. Naming an address object after an interface does not change ingress.
What determines the outgoing interface used for ordinary policy matching?
Firewall policies
The forwarding path selected by routing or applicable steering. A policy for wan1 will not match a session whose selected egress is wan2.
What controls ordinary firewall-policy evaluation order?
Firewall policies
Configured sequence, rather than the numerical policy ID. Place specific exceptions ahead of broader overlapping rules.
What happens to a policy ID when the policy is moved?
Firewall policies
The ID remains the policy identifier; moving the policy changes its sequence position. A larger ID can be evaluated first.
What does move 30 before 4 under config firewall policy do?
Firewall policies
It moves policy ID 30 ahead of policy ID 4 in evaluation sequence. It does not rename either ID.
What does Policy 0 commonly indicate in a forward-policy denial?
Firewall policies
The session reached implicit deny because no applicable forward permit policy matched. Verify the log/debug context before applying that interpretation.
Why does a permitted TCP reply normally need no reverse permit policy?
Firewall policies
The reply matches the established stateful session. A reverse policy is required for independent new sessions initiated by the opposite side.
When is a separate reverse-direction ACCEPT policy needed?
Firewall policies
When the opposite side must initiate its own new sessions, rather than merely reply to an existing permitted session.
Why should a policy change be tested with a fresh connection?
Firewall policies
Existing sessions can retain selected policy and forwarding/NAT state. A new connection tests the selection made after the change.
What does an ordinary FQDN address object match?
Firewall policies
IP addresses FortiGate resolves for the configured name. It is not a web URL path filter.
Which port does a custom TCP service normally constrain?
Firewall policies
The destination server port. Restricting the client source port can accidentally reject sessions using ephemeral source ports.
Why is permitting the HTTPS service different from permitting one application?
Firewall policies
The service matches TCP port 443; many applications can use that port. Application control identifies applications using signatures and protocol information.
What does a zone contribute to policy configuration?
Firewall policies
It groups interfaces for policy administration. A zone alone does not create routes or grant forwarding permission.
Which interface object normally appears in a policy for SD-WAN members?
Firewall policies
The SD-WAN zone. SD-WAN steering then chooses an eligible member within the forwarding design.
Why can interface-pair display be misleading during an order investigation?
Firewall policies
Policies using multiple interfaces or any can make a grouped view conceal the complete sequence. Inspect sequence and actual configuration.
What should you check when an expected policy GUI setting is absent?
Firewall policies
Feature visibility, the applicable mode/platform, and the actual CLI configuration. A missing GUI field alone does not prove the setting is disabled.
What is the default policy inspection mode in the FortiOS 7.6 baseline?
Firewall policies
Flow-based inspection. Choose proxy-based processing when required by supported profile features.
How does flow-based inspection process traffic?
Firewall policies
It inspects traffic as it passes using stream-oriented processing. Flow inspection can block threats; it is not automatically a logging-only mode.
What distinguishes proxy-based inspection processing?
Firewall policies
It uses proxy processing and buffering appropriate to its supported features. Choose it for the traffic and feature requirements rather than assuming it is always safer.
What must agree between a policy and its security profile feature set?
Firewall policies
The inspection mode and supported profile feature set must be compatible. A profile name alone does not establish compatibility.
Does a firewall ACCEPT action guarantee that an attached security profile allows the content?
Firewall policies
No. Firewall authorization permits further processing; content inspection can still block an application, file or request.
What does a traffic log primarily describe?
Firewall policies
The session, including addresses, interfaces, policy identity, action, byte counts and translation information where applicable.
What does a security log primarily describe?
Firewall policies
A security decision such as malware detection or application blocking. Correlate it with the relevant traffic session.
Why can Security Events logging omit ordinary allowed sessions?
Firewall policies
It focuses on security events rather than a complete inventory of all permitted sessions. Use All Sessions for that requirement.
What does set logtraffic all request on an IPv4 firewall policy?
Firewall policies
Traffic logging for all sessions matching the policy, subject to the available and configured logging destination.
Why can complete byte counts arrive later when logging at session end?
Firewall policies
The final session record is written when the session ends. A long-running session may not yet have its complete end record.
What is the tradeoff of session-start logging?
Firewall policies
It supplies earlier visibility but adds records and cannot provide final session byte totals at the start.
Which fields help correlate a traffic acceptance with a security block?
Firewall policies
Session ID, timestamp, device/VDOM context and policy identity. The two records can describe successive decisions for the same session.
How is a policy UUID useful in log analysis?
Firewall policies
It identifies the policy beyond a displayed name or sequence position. Correlate it with the correct device and VDOM.
Which path handles HTTPS access to the FortiGate itself?
Firewall policies
The local-in management path. An ordinary LAN-to-WAN forwarding policy does not enable management access.
Why is a FortiGate-generated LDAP request different from a client-forwarded session?
Firewall policies
It is local-out traffic generated by FortiGate; the user forwarding policy does not govern it in the same way. Service source/interface settings can matter.
Why must you establish VDOM context before interpreting a policy ID?
Firewall policies
A policy belongs to its firewall context. The same displayed ID on another VDOM or device is not proof it is the same rule.
What does an explicit DENY policy do to matching traffic?
Firewall policies
It blocks traffic that matches its criteria. It is useful for a deliberate exception before a broader allow policy.
Why can enabled policy logging still produce no usable remote record?
Firewall policies
A logging destination and delivery path must also be configured and functioning. Policy logging is only one part of record delivery.
What does a weekday schedule restrict in a policy?
Firewall policies
The matching time condition. Correct interfaces, addresses, service and identity still must match.
What does source NAT change?
Source and destination NAT
The source address and, when PAT is used, the source port presented to the destination. It does not inherently change the destination.
What source does outgoing-interface SNAT normally present?
Source and destination NAT
The address of the selected egress interface. This lets private clients use that public identity when the design requires translation.
How can many clients share one translated address?
Source and destination NAT
Port address translation gives sessions distinct translated address/port combinations, tracked by FortiGate session state.
How are replies to a source-translated session restored to the client?
Source and destination NAT
FortiGate uses the existing session translation to map the reply destination back to the original client address and port.
What is a common reason to choose an IP pool instead of interface SNAT?
Source and destination NAT
To present a dedicated translated source required by a partner allowlist or a separate external identity for a client group.
What does an overload IP pool do?
Source and destination NAT
It lets clients share pool addresses using port translation. It is a common outbound SNAT choice.
Does a one-to-one IP pool perform PAT?
Source and destination NAT
No. It maps internal addresses to separate external addresses without port address translation.
How many simultaneous internal-address mappings can a one-to-one pool with two external addresses provide?
Source and destination NAT
Two. Each simultaneous internal-address mapping requires its own external address.
Does a one-to-one SNAT pool automatically publish an inbound server?
Source and destination NAT
No. A source-translation pool does not create an inbound VIP or an inbound permit policy.
What is the purpose of a fixed-port-range IP pool?
Source and destination NAT
Deterministic source-address/port allocation tied to configured internal and external ranges. It is distinct from a simple one-to-one address pool.
What is port block allocation?
Source and destination NAT
It allocates blocks of translated ports to clients, conserving public addresses and supporting attribution of port ranges to clients.
What upstream requirement applies to an SNAT pool address?
Source and destination NAT
Replies to the translated address must reach FortiGate through routing or appropriate ARP delivery. Creating the pool alone does not ensure that reachability.
Is an IP pool address the same as assigning an address to a physical interface?
Source and destination NAT
No. The pool supplies translation addresses; interface addressing and upstream delivery remain separate configuration concerns.
Where can you recover the original source when a remote server sees only the SNAT address?
Source and destination NAT
FortiGate session and log evidence can retain original and translated information. The remote server normally sees the translated source.
What must be enabled on a non-central NAT policy to use a selected IP pool?
Source and destination NAT
Enable NAT and IP-pool use, then select the pool with poolname. A pool definition alone does not select it for the policy.
What does destination NAT change?
Source and destination NAT
The destination address and optionally destination port. A VIP is the usual FortiGate object for publishing a mapped internal destination.
What does a static one-to-one VIP map?
Source and destination NAT
An external address to an internal mapped address. It is different from a one-to-one source-NAT pool.
What does enabling port forwarding on a VIP add?
Source and destination NAT
It narrows the mapping to a protocol and external port and can translate that port to a different internal server port.
How can several internal services share one external VIP address?
Source and destination NAT
Use non-overlapping port-forwarding mappings. The protocol/port definitions must avoid conflicting matches.
In non-central NAT mode, what should an inbound permit policy use as its destination for a published VIP?
Source and destination NAT
The configured VIP object. The policy still must match the source, interfaces, service and other conditions.
Which destination does routing evaluate after inbound DNAT?
Source and destination NAT
The mapped internal destination. The selected egress must lead toward that server.
Which service should a policy permit for external TCP 8443 translated to internal TCP 443?
Source and destination NAT
The mapped/internal service, HTTPS/TCP 443. The VIP handles matching external 8443.
What does the ordinary policy NAT switch control in a DNAT policy?
Source and destination NAT
Source NAT. The VIP performs destination NAT, so the policy NAT switch does not need to be enabled merely to activate the VIP.
How can an inbound VIP policy preserve the real client address at the server?
Source and destination NAT
Leave source NAT disabled when the return-route design supports it. The VIP still performs DNAT.
Why must a published server reply through the FortiGate that holds the session?
Source and destination NAT
That firewall must apply reverse translation so the client receives the expected public source address and port.
What is hairpin NAT access?
Source and destination NAT
An internal client reaches an internal server through the server public VIP. The policy must match the actual internal ingress and egress path.
When can hairpin access need source NAT?
Source and destination NAT
When the server could otherwise reply directly to the client and bypass the FortiGate session. SNAT can force replies back through the firewall.
What alternative can avoid public-VIP hairpin translation for internal users?
Source and destination NAT
Split DNS can return the internal server address to internal clients while external clients use the public mapping. Policies and routing still must allow the internal path.
Why is ping not a reliable test of a TCP-only port-forwarding VIP?
Source and destination NAT
The VIP may only map the configured TCP service. ICMP does not test whether that published application mapping works.
Why can an unused IP pool object still affect the network?
Source and destination NAT
With ARP Reply enabled, FortiGate can answer ARP for its pool addresses even if no policy references it. Review obsolete objects deliberately.
What risk do overlapping VIP mappings introduce?
Source and destination NAT
Ambiguous or unintended destination matching. Use distinct mappings and verify the actual translated destination.
Why does creating a public VIP address not establish ISP reachability?
Source and destination NAT
The upstream network still must route or deliver that address to FortiGate. Object creation cannot allocate or advertise an address on your behalf.
What does central NAT separate?
Source and destination NAT
Address translation rules from ordinary firewall authorization. Translation still needs a corresponding permit policy.
Where is outbound translation configured when central NAT is enabled?
Source and destination NAT
In the central SNAT table rather than by relying on the ordinary IPv4 policy NAT switch.
How are central SNAT rules evaluated?
Source and destination NAT
In configured order using applicable match criteria such as interfaces, original source, destination, protocol and ports.
Does a central SNAT rule authorize the matched traffic?
Source and destination NAT
No. It defines translation; a firewall policy must independently permit the session.
How does central DNAT differ from selecting a VIP in a non-central policy?
Source and destination NAT
An enabled translation object can apply independently of a VIP destination reference in the ordinary policy; the policy is built for the mapped destination according to that mode.
What should be reviewed before converting a firewall to central NAT?
Source and destination NAT
Existing policy NAT dependencies and VIP references. Mode conversion changes the policy/translation relationship.
Why can an old connection conceal a NAT configuration change?
Source and destination NAT
An established session can retain its original translation mapping. Test with a fresh connection and inspect session/log evidence.
What does a Policy 0 forward denial establish about NAT?
Source and destination NAT
It indicates an authorization/matching failure in that context, not proof that the NAT engine is broken. Trace translation, route and policy separately.
How does authentication differ from authorization?
Firewall authentication
Authentication establishes identity; authorization determines which resources that identity may access. A valid password does not guarantee a matching firewall policy.
Which GUI monitor helps inspect authenticated firewall users?
Firewall authentication
The Firewall Users monitor under Dashboard > Assets & Identities. Check username, group, source IP, authentication method and duration against the intended policy and observed traffic.
What makes a remote firewall user different from a local user?
Firewall authentication
The credentials are checked through a configured remote server, such as LDAP or RADIUS, rather than solely against a local FortiGate user record.
What identity object is normally referenced by a firewall policy?
Firewall authentication
A user group containing suitable local users or remote-server/group references. The group connects authentication results to policy authorization.
Why can adding a remote server without a group restriction be too broad?
Firewall authentication
It can authorize users beyond the intended directory group. Restrict remote-group matching where the policy requires a defined population.
What does a successful server credential test prove?
Firewall authentication
The tested credentials authenticated with that server. Policy group membership and traffic match conditions still need verification.
Are FortiGate administrator accounts automatically authenticated firewall users?
Firewall authentication
No. Management administrator identities and firewall access users have separate purposes and permissions.
What does the LDAP server field select?
Firewall authentication
The directory server to contact. Correct DNS or IP reachability and the appropriate port are prerequisites.
What does the LDAP distinguished name search base specify?
Firewall authentication
Where to search in the directory hierarchy, such as a domain or organizational unit. A wrong base can prevent finding the user.
What does LDAP cnid select?
Firewall authentication
The username attribute used to locate the user. For Active Directory logon names, sAMAccountName is a common choice.
Why might a correct LDAP password fail when cnid is wrong?
Firewall authentication
FortiGate can fail to locate the intended directory entry before it can validate that user password.
What does regular LDAP bind use?
Firewall authentication
A configured account to bind and search the directory hierarchy for users. Use an account with the read/search access required by the design.
How does simple LDAP bind differ from regular bind?
Firewall authentication
Simple bind uses the supplied naming construction rather than the same service-account subtree-search process. The directory structure and naming must suit that method.
What directory requirement applies to anonymous LDAP bind?
Firewall authentication
The directory must allow the necessary unauthenticated searches. Anonymous access cannot be assumed on a secured directory.
Why is a domain administrator account unnecessary for ordinary regular LDAP bind?
Firewall authentication
The task normally needs read/search access, not broad administrative control. Use the least-privilege account that can locate the required entries.
Does plain LDAP on TCP 389 provide TLS confidentiality by itself?
Firewall authentication
No. Use LDAPS or STARTTLS for TLS-protected transport according to the configuration.
What does STARTTLS do for an LDAP connection?
Firewall authentication
It upgrades the LDAP connection to TLS. It is distinct from assuming that all plain LDAP traffic is encrypted.
What is the usual LDAPS port?
Firewall authentication
TCP 636. A reachable port alone does not prove that certificate trust or server identity validation succeeds.
What does selecting an LDAP CA certificate help validate?
Firewall authentication
The issuer trust for the LDAP server certificate. Certificate identity, validity and other TLS checks must also succeed.
When LDAP server identity checking is enabled, why must the contacted name/IP match its certificate?
Firewall authentication
Server identity validation checks that the certificate represents the server being contacted. A trusted issuer alone does not repair a name mismatch.
What can cause LDAPS to fail after TCP 636 connects?
Firewall authentication
Certificate trust, identity, expiration or time-validation problems, as well as later bind/user checks. Separate transport from authentication stages.
What are useful stages for isolating LDAP authentication failure?
Firewall authentication
Network/TLS connection, bind and search, user-password validation, and required group membership. Fix the first failed stage.
What is FortiGate role in ordinary RADIUS authentication?
Firewall authentication
It is the RADIUS client sending requests to the authentication server. The server checks the request against its user and policy configuration.
What does RADIUS Access-Accept mean?
Firewall authentication
The server accepted the authentication request. FortiGate group and firewall authorization still determine the permitted network access.
What does RADIUS Access-Reject suggest?
Firewall authentication
Credentials or server authorization policy did not satisfy the request. It is different from a request never reaching the server.
What does RADIUS Access-Challenge request?
Firewall authentication
An additional authentication exchange. It is not the same as an immediate accept or final rejection.
What are the usual RADIUS authentication and accounting ports?
Firewall authentication
UDP 1812 for authentication and UDP 1813 for accounting. Older deployments can use 1645 and 1646.
What must match between the FortiGate RADIUS client and server?
Firewall authentication
The shared secret and the actual client source identity/IP expected by the server, along with compatible request settings.
Why can a RADIUS server reject an otherwise configured FortiGate client after a source-interface change?
Firewall authentication
The server can receive requests from a different source IP than its allowed-client entry expects. Check the actual source seen by the server.
How can Fortinet-Group-Name affect firewall authorization?
Firewall authentication
The vendor-specific attribute can supply a remote group string for deliberate FortiGate group matching. Access-Accept alone is not every-group membership.
Does traditional RADIUS/UDP provide full TLS transport encryption?
Firewall authentication
No. Protect the transport path and use secure transport where supported rather than assuming the shared secret encrypts the entire exchange.
What is active firewall authentication?
Firewall authentication
A workflow that asks the user for credentials, such as a captive portal. The user/application must be able to complete the authentication path.
Why can an arbitrary TCP application fail to display a captive-portal prompt?
Firewall authentication
It may not support the web authentication workflow. A suitable browser/portal path may be needed before that application can use authenticated access.
Does service ALL exclude DNS?
Firewall authentication
No. ALL includes DNS. The design must ensure required DNS can work before authentication where the workflow depends on it.
What is the default auth-on-demand behavior?
Firewall authentication
Implicitly. An unauthenticated session can fall through to a later otherwise matching policy without an identity requirement.
What does set auth-on-demand always change?
Firewall authentication
It triggers the matching authentication requirement instead of silently using the implicit unauthenticated fall-through described by the default behavior.
What is RADIUS SSO based on?
Firewall authentication
Identity information learned from relevant RADIUS accounting records, rather than an ordinary interactive credential prompt for every session.
How do idle and hard authentication timeouts differ?
Firewall authentication
Idle timeout depends on inactivity; hard timeout expires after the configured duration regardless of activity.
What happens with new-session authentication timeout after timer expiry?
Firewall authentication
New sessions require reauthentication while existing sessions can continue. It is not an inactivity timer reset by creating new sessions.
What is the global firewall authentication timeout default, and what can override its duration?
Firewall authentication
A 5-minute idle timeout is the default. A configured user-group authtimeout can override the global duration.
What does FSSO provide to FortiGate network policies?
Fortinet Single Sign-On
Directory user/IP/group mappings for identity-based network access. It does not automatically sign users into every authorized application.
Why is FSSO considered passive authentication?
Fortinet Single Sign-On
FortiGate learns an already established network identity instead of asking the user for firewall credentials for that mapping.
Which mapping fields are central to ordinary workstation FSSO?
Fortinet Single Sign-On
The workstation IP, directory user and relevant group information. They must match the identity and source address seen by FortiGate.
Does an observed directory logon alone guarantee an identity-based policy match?
Fortinet Single Sign-On
No. The logon must be collected, associated with the correct IP/groups, delivered to FortiGate and satisfy policy traffic conditions.
Which source IP must a workstation FSSO mapping correspond to?
Fortinet Single Sign-On
The IP FortiGate actually sees for the user traffic. Upstream translation or stale address information can break that association.
Where is a DC agent installed in DC-agent mode?
Fortinet Single Sign-On
On each domain controller whose relevant user logons must be monitored. Missing a DC can leave its logons unobserved.
What is the DC agent role?
Fortinet Single Sign-On
Monitor domain-controller user logon events and report the information to the collector agent. It is not the forward firewall policy engine.
Why should relevant domain controllers all be monitored?
Fortinet Single Sign-On
Users can authenticate against different DCs. Monitoring only one does not guarantee that logons handled elsewhere reach the collector.
What does the collector logon database contain?
Fortinet Single Sign-On
Collected user/workstation logon information used to build and deliver useful identity mappings to FortiGate.
What DNS-related responsibility does the collector have?
Fortinet Single Sign-On
It resolves workstation addresses as required for mappings. Stale DNS can associate a valid username with the wrong traffic IP.
What group-related responsibility does the collector have?
Fortinet Single Sign-On
It verifies/obtains directory group information and forwards relevant information according to filtering and the selected group-source design.
Why can collector workstation checks matter?
Fortinet Single Sign-On
They help verify workstation/logon state so stale identity records do not remain authoritative indefinitely. Dependencies vary by collection design.
What is the usual DC-agent-to-collector update port?
Fortinet Single Sign-On
UDP 8002. Verify the configured collector address and port on the agents.
What is the usual FortiGate-to-collector connection port?
Fortinet Single Sign-On
TCP 8000. FortiGate must reach and authenticate to the configured collector.
What does the collector shared secret protect in the connection setup?
Fortinet Single Sign-On
It is used for the configured FortiGate/collector authentication relationship. Matching IP reachability alone does not establish a valid authenticated connector.
What can the connector User Group Source choice determine?
Fortinet Single Sign-On
Whether group information is received from the collector or matched using the configured local LDAP group-source design. Align it with the deployment.
What connects received FSSO groups to a firewall policy?
Fortinet Single Sign-On
An FSSO user-group definition containing the appropriate received group information and referenced by the policy.
Does creating an FSSO connector permit user traffic by itself?
Fortinet Single Sign-On
No. It delivers identity information; an applicable firewall policy still must authorize the user and traffic.
Why must standard and advanced directory-access naming modes agree with group definitions?
Fortinet Single Sign-On
They represent and resolve group information differently. FortiGate group names/filters must match the configured collector and LDAP naming design.
What should be checked for nested-group authorization problems?
Fortinet Single Sign-On
The selected directory-access mode and group lookup/filter behavior. Do not assume every standard-mode group behaves like an advanced LDAP query.
What does a collector group filter limit?
Fortinet Single Sign-On
The identity/group information forwarded to FortiGate. An observed user can still lack the required forwarded group.
How does a collector group filter differ from a FortiGate policy user group?
Fortinet Single Sign-On
The filter controls delivered information; the FortiGate group determines which received identities satisfy policy authorization.
What does collector polling remove from the DC-agent design?
Fortinet Single Sign-On
The need for DC agents: the collector retrieves relevant logon information from monitored domain controllers through its polling method.
What does FortiGate direct polling remove?
Fortinet Single Sign-On
Both DC and collector agents. FortiGate itself reads the relevant Windows domain-controller Security Event log information.
What source does FortiGate agentless AD polling use for logon information?
Fortinet Single Sign-On
Windows Security Event log entries on domain controllers, with the required connectivity and access. It does not infer identity from arbitrary traffic byte counts.
Why can polling-based identity appear later than the directory logon?
Fortinet Single Sign-On
The collection method uses polling intervals and has its own detection/processing delay. Check actual events and poll success before changing policy.
What should guide the choice between DC agents and polling?
Fortinet Single Sign-On
Dependencies, installation requirements, detection delay, workstation checks and scalability for the environment. They collect identity rather than change the firewall permission model.
Why is IP-only mapping insufficient on a terminal server?
Fortinet Single Sign-On
Many users share the same source IP, so the firewall needs additional user differentiation.
How does the Terminal Server agent distinguish users on a shared host?
Fortinet Single Sign-On
It allocates/reports user-associated source-port information through the collector so sessions can be associated with the correct user.
Why can upstream NAT undermine workstation FSSO?
Fortinet Single Sign-On
It can make several employees appear from one source IP that no longer matches their individual workstation mappings.
How can DHCP changes cause an FSSO mismatch?
Fortinet Single Sign-On
The workstation traffic address can change while an older mapping remains. Verify updated IP/user information rather than extending stale lifetime.
How can stale DNS cause the collector and FortiGate to disagree?
Fortinet Single Sign-On
The collector can resolve a username workstation to an outdated IP while FortiGate sees traffic from the current address.
Why can fast user switching be challenging for IP-only identity?
Fortinet Single Sign-On
The active user can change on a host while its IP stays the same. Check which user/logon mapping is current rather than assuming the first mapping remains correct.
What does diagnose debug authd fsso server-status help inspect?
Fortinet Single Sign-On
The status of FortiGate FSSO server/collector connections. It does not by itself prove every user mapping is correct.
What does diagnose debug authd fsso list help inspect?
Fortinet Single Sign-On
The FSSO logon mappings known to FortiGate, including useful identity/IP/group information.
What does diagnose firewall auth list help inspect?
Fortinet Single Sign-On
FortiGate firewall authentication records. Compare the relevant user/IP/group with the traffic and intended policy.
Why does ping to the collector not prove working FSSO?
Fortinet Single Sign-On
ICMP reachability does not prove TCP 8000 connectivity, connector authentication or correct mapping/group delivery.
How should FSSO debug evidence be collected?
Fortinet Single Sign-On
Use a narrow affected-user/IP scope where supported, collect briefly and stop debug afterward. Avoid clearing all production logons as the first diagnostic step.
What is the purpose of configuring multiple collector agents?
Fortinet Single Sign-On
Collector connection redundancy. A reachable alternate must also receive the needed logon information to supply useful mappings.
What must DC/TS agents do for redundant collectors to have complete records?
Fortinet Single Sign-On
Report to all intended collectors with the correct addresses and ports. Adding an alternate collector on FortiGate alone does not replicate missing logons to it.
What does an X.509 certificate bind?
Certificates and encrypted traffic
A subject identity to a public key, under the issuing CA's digital signature. It does not contain the subject's private key or certify that its content is safe.
What establishes possession of a certificate's matching private key?
Certificates and encrypted traffic
The endpoint proves possession during authentication using the relevant cryptographic protocol. Merely presenting a public certificate is insufficient.
Which certificate field should contain the DNS names clients actually use?
Certificates and encrypted traffic
Subject Alternative Name (SAN). A certificate can have a valid signature yet fail hostname validation when the requested name is absent.
What is the role of a CA certificate imported on FortiGate?
Certificates and encrypted traffic
It allows FortiGate to validate certificate chains issued by that CA. It does not make clients trust certificates re-signed by FortiGate.
What is the role of the inspection CA certificate on a managed endpoint?
Certificates and encrypted traffic
It lets the endpoint trust replacement server certificates signed during outbound deep inspection. Distribute the public CA certificate; protect the signing private key.
What are the main checks when validating a server certificate?
Certificates and encrypted traffic
Check the requested identity, signature chain to a trusted root, validity dates, suitable key usage, and applicable revocation information. A good signature alone is insufficient.
How can an incomplete intermediate CA chain cause a trust failure?
Certificates and encrypted traffic
The verifier may be unable to build a chain from the leaf certificate to a trusted root even when the leaf signature is cryptographically correct.
What does a certificate revocation list report?
Certificates and encrypted traffic
Certificates revoked by an issuing CA. Revocation is distinct from expiration and hostname mismatch.
What does generating a CSR accomplish?
Certificates and encrypted traffic
It prepares a certificate request containing the public key and requested identity for a CA to sign. Keep the corresponding private key and import the issued certificate against it.
Why must an imported server certificate match its private key?
Certificates and encrypted traffic
FortiGate needs the matching key to act as that server identity. A public certificate alone cannot perform the server authentication operations.
What application visibility does certificate inspection provide?
Certificates and encrypted traffic
TLS-layer information such as a visible hostname and certificate information. It does not expose the encrypted HTTP body or URL path.
Why can certificate inspection block a website category but miss malware in its HTTPS download?
Certificates and encrypted traffic
The hostname can be classified while the file body remains encrypted. AV payload scanning requires suitable deep inspection and an attached AV profile.
What two connections does outbound deep inspection establish?
Certificates and encrypted traffic
A client-facing TLS connection and a separate server-facing TLS connection. FortiGate decrypts content for security engines and re-encrypts it for forwarding.
Which issuer does a client normally see during outbound deep inspection?
Certificates and encrypted traffic
The configured FortiGate or enterprise inspection CA, which signs the replacement server certificate.
Are flow/proxy inspection and certificate/deep inspection the same choice?
Certificates and encrypted traffic
No. Flow/proxy concerns security-engine processing; certificate/deep concerns encrypted-payload visibility. Both flow and proxy policies support deep SSL inspection.
Which SSL inspection use case fits users accessing many external servers?
Certificates and encrypted traffic
Multiple Clients Connecting to Multiple Servers. This is the usual outbound internet-inspection model.
Which SSL inspection use case fits inspecting traffic to a published server you control?
Certificates and encrypted traffic
Protecting SSL Server, using that server's certificate and matching private key. It preserves the intended server identity rather than re-signing arbitrary sites.
How should Fortinet_CA_Untrusted be treated on endpoints?
Certificates and encrypted traffic
Do not distribute it as a trusted root. It preserves an upstream server-trust failure in the replacement certificate presented to the client.
Why does trusting the inspection CA on clients not fix an untrusted upstream server?
Certificates and encrypted traffic
FortiGate validates the real server through its own trust store. The client trust store only governs trust of FortiGate's replacement certificate.
What does Server certificate SNI check = Enable do on a name mismatch?
Certificates and encrypted traffic
It checks SNI against CN/SAN and uses the certificate CN for URL filtering when mismatched. It is not the separate CA-chain validation decision.
What does Server certificate SNI check = Strict do?
Certificates and encrypted traffic
It closes the connection when SNI and the returned certificate CN/SAN mismatch.
What does Server certificate SNI check = Disable disable?
Certificates and encrypted traffic
The SNI-to-certificate-name comparison. It does not mean that every other certificate or security check is disabled.
What is the default handling of a server certificate issued by an untrusted CA in the 7.6.0 SSL-profile documentation?
Certificates and encrypted traffic
Allow. The administrator can select Block; Ignore applies only to full inspection and re-signs the certificate as trusted.
How do Keep Untrusted & Allow and Trust & Allow differ during deep inspection?
Certificates and encrypted traffic
Both allow the connection, but the former preserves the trust failure and the latter signs a trusted replacement. Trust & Allow changes what the client sees of the original failure.
What are the documented default actions for expired, revoked and validation-failed certificates in 7.6.0?
Certificates and encrypted traffic
Block for each. Read the actual profile in a scenario because the administrator can change these actions.
How does the default validation-timeout action differ between certificate and deep inspection?
Certificates and encrypted traffic
Certificate inspection defaults to Allow; deep inspection defaults to Keep Untrusted & Allow, according to the 7.6.0 SSL-profile documentation.
What port does the built-in read-only certificate-inspection profile cover?
Certificates and encrypted traffic
HTTPS on TCP 443. Clone or create a profile to add known non-standard HTTPS ports or enable inspection of all ports.
How does flow-mode deep inspection treat SSL protocol-port mapping?
Certificates and encrypted traffic
It scans all ports regardless of the Inspect all ports switch or mapped-port list. Certificate inspection has different port-selection behavior.
How does proxy-mode deep inspection select ports?
Certificates and encrypted traffic
With Inspect all ports disabled, it scans the mapped protocol ports. Enabling Inspect all ports broadens inspection to all ports.
How does certificate inspection select ports in flow and proxy policies?
Certificates and encrypted traffic
Both honor the protocol mapping when Inspect all ports is disabled and inspect all ports when it is enabled.
What does an SSL deep-inspection exemption remove?
Certificates and encrypted traffic
Encrypted payload visibility for the exempt session. It does not create firewall permission or remove the need for a matching accepting policy.
Why should SSL exemption logging be enabled when diagnosing missing payload visibility?
Certificates and encrypted traffic
It distinguishes an intentionally exempt session from a policy/profile-selection or trust failure. Without that evidence, an original server issuer can be misinterpreted.
Why can a certificate-pinned app fail even after the operating system trusts the inspection CA?
Certificates and encrypted traffic
It expects a specific server certificate or public key and can reject FortiGate's substituted certificate. The app may also maintain an independent trust store.
What application behavior should be tested before granting a deep-inspection exception?
Certificates and encrypted traffic
Confirm pinning, mutual TLS, independent trust stores or unsupported implementations with the actual app. Scope a necessary exception narrowly.
What must be enabled to inspect SSH payloads?
Certificates and encrypted traffic
SSH deep scan and appropriate port selection. SSH is distinct from TLS; SSH file AV inspection also requires the supported proxy-mode settings.
How do Any and Specify differ for the SSH inspection port setting?
Certificates and encrypted traffic
Any searches traffic regardless of port for SSH packets; Specify limits the search to the chosen TCP port and can reduce processing work.
What HTTP/3 action is fixed when certificate inspection is selected?
Certificates and encrypted traffic
Bypass, and it cannot be changed in that profile. Full SSL Inspection exposes Inspect, Bypass and Block choices, subject to platform support.
Why does blocking QUIC sometimes restore HTTPS inspection?
Certificates and encrypted traffic
A capable client may fall back from HTTP/3 over UDP to TCP-based HTTP. Fallback is client behavior and is not guaranteed.
Why must flow-mode ECH controls documented for 7.6.3 not be assumed in a 7.6.0 exam scenario?
Certificates and encrypted traffic
They are explicitly a later maintenance-release addition. The documentation version tree can contain later features despite a 7.6.0 URL prefix.
Why does a CA warning only on a blocked HTTPS page not prove allowed traffic is deeply inspected?
Certificates and encrypted traffic
Certificate inspection can serve a FortiGate-signed replacement page. Inspect permitted traffic separately and correlate the certificate with the policy action.
Does replacing the FortiGate HTTPS administration certificate change the inspection CA?
Certificates and encrypted traffic
No. Management identity and the CA selected in an SSL/SSH inspection profile are separate settings.
What evidence should be checked first for an HTTPS inspection failure?
Certificates and encrypted traffic
Identify the matched policy and profiles, actual port/protocol, exemptions, SSL log reason, observed issuer and endpoint/FortiGate time. Correct routing alone does not establish decryption.
What distinguishes flow-based from proxy-based inspection?
Inspection modes and web filtering
Flow processes a traffic stream using IPS-engine techniques; proxy reconstructs and handles application content. Flow can still buffer when its scanner requires it; proxy enables additional content controls.
What must match between a web-filter profile and its firewall policy?
Inspection modes and web filtering
The profile Feature set and policy inspection mode: flow with flow, proxy with proxy. Select an appropriate SSL profile as well.
Which inspection mode supports daily web-category usage quotas in 7.6.0?
Inspection modes and web filtering
Proxy. A flow policy cannot gain quotas simply by enabling GUI feature visibility.
Which physical hardware limitation affects proxy features in the 7.6 baseline?
Inspection modes and web filtering
Affected physical FortiGate models with 2 GB RAM or less lack proxy-related features. A GUI switch cannot restore unsupported hardware capabilities.
Does the physical 2 GB proxy restriction automatically apply to a FortiGate VM with small assigned RAM?
Inspection modes and web filtering
No. The documented physical-model restriction should not be generalized solely from VM RAM allocation; Fortinet recommends at least 4 GB for VM operation.
What does a FortiGuard web category describe?
Inspection modes and web filtering
A website classification. The category is not itself an enforcement action; the web profile determines whether to allow, monitor, block or use an interactive action.
What supplies online FortiGuard web ratings?
Inspection modes and web filtering
An active Web Filtering subscription and working service connectivity. Local static rules are a separate control.
How do category Allow and Monitor differ?
Inspection modes and web filtering
Both permit the category; Monitor additionally creates a web-filter category event. Forward-traffic logging is configured independently.
What does web-category Warning let a browser user do?
Inspection modes and web filtering
Read a warning and choose whether to continue. The replacement-page path and certificate trust must work for HTTPS interaction.
What does the Authenticate action require before category access?
Inspection modes and web filtering
Suitable user authentication through the configured interaction path. A non-browser client may be unable to complete the challenge.
What category precedence applies when local, external and built-in ratings are enabled and applicable?
Inspection modes and web filtering
Local category first, then external/remote category, then built-in FortiGuard category. This is distinct from static URL rule actions.
What does a local web-rating override change?
Inspection modes and web filtering
The effective category assigned to a website on the FortiGate. It does not change the public FortiGuard rating or automatically bypass all inspection.
What does a web-profile override change?
Inspection modes and web filtering
The effective filtering profile for eligible users/groups/IPs for a defined duration. It is distinct from changing a website's category.
Which interactive actions are unsupported for flow local/remote web categories?
Inspection modes and web filtering
Warning and Authenticate. Do not assume every built-in category action is available for local or remote category types.
Which pattern types are available for static URL filtering?
Inspection modes and web filtering
Simple, wildcard and regular expression. They have different matching semantics and should be tested against the exact request.
Does a simple URL entry for www.vendor.test automatically match vendor.test and files.vendor.test?
Inspection modes and web filtering
No. A simple entry strictly matches its configured context; subdomains and other hostname forms need appropriate entries or patterns.
What is the risk of a broad wildcard URL pattern?
Inspection modes and web filtering
It can match unintended domains or paths. Test the actual matches and place deliberate specific exceptions ahead of broad rules.
Does a matching static URL Allow entry guarantee final web access?
Inspection modes and web filtering
No. Allow continues to later applicable FortiGuard, content and other checks, which can still block the request.
How does static URL Monitor differ from static URL Allow?
Inspection modes and web filtering
It continues filtering like Allow but records the matching URL-rule event.
What does static URL Block do?
Inspection modes and web filtering
It denies the matching request and can provide a replacement message. It is a web-filter decision within otherwise accepted traffic.
How does static URL Exempt differ from Allow?
Inspection modes and web filtering
Exempt bypasses specified scanning/filter operations rather than continuing all of them. Its default GUI scope is broad; CLI selections can narrow it.
Where can selected Exempt operations be narrowed?
Inspection modes and web filtering
In the CLI set exempt selection for the URL-filter entry, choosing operations such as FortiGuard filtering or antivirus. The GUI does not show these individual selections.
How can a miscategorized supplier be allowed while retaining AV?
Inspection modes and web filtering
Apply a local web-rating override to a suitable allowed category, or a deliberately selective category exemption. A broad Exempt may remove unnecessary additional inspection.
Which category actions support proxy usage quotas?
Inspection modes and web filtering
Monitor, Warning and Authenticate. Quotas can limit daily time or transferred volume.
When do daily category usage quotas reset?
Inspection modes and web filtering
At midnight. Once the configured allowance is exhausted, access to that category is blocked.
Why is a volume quota not equivalent to a bandwidth shaper?
Inspection modes and web filtering
A quota limits cumulative use over its interval; a shaper controls traffic rate. A daily byte allowance is not a per-second bandwidth limit.
What is the risk of an IP-based web-profile override on a shared address?
Inspection modes and web filtering
More than the requesting user may receive the override. Choose the user/group/IP scope to match the intended exception.
What identity alignment matters for users allowed to override blocked categories?
Inspection modes and web filtering
The eligible user group should also be specified consistently as the source identity in policies using the profile. Creating an eligible group alone does not ensure the intended traffic matches.
How is a rating error different from Unrated?
Inspection modes and web filtering
A rating error means the rating request failed; Unrated is a valid classification result. They need separate interpretation and handling.
What does Allow websites when a rating error occurs do?
Inspection modes and web filtering
It permits access despite the failed rating. It does not repair licensing, DNS or FortiGuard reachability and does not remove static URL rules.
How are different domain and IP categories combined when rating both is enabled?
Inspection modes and web filtering
FortiOS uses hard-coded category rating weights to choose the effective category. It does not simply compare which local configured action looks stricter.
Why can IP ratings complicate shared-hosting troubleshooting?
Inspection modes and web filtering
One destination IP may serve multiple sites. Investigate the domain and IP results rather than assuming the hostname rating alone governed the decision.
Why can a recent rating change and a test result disagree?
Inspection modes and web filtering
FortiGate caches ratings. A cached older rating can persist until refreshed; first examine cache and service behavior rather than weakening the policy.
What service details should be checked for repeated FortiGuard rating failures?
Inspection modes and web filtering
License, DNS, reachability and configured anycast/protocol/port settings, together with failed-request and latency evidence. Error-allow changes handling, not service health.
Which CLI command reports FortiGuard web-rating diagnostic information?
Inspection modes and web filtering
diagnose debug rating. Use its server and request evidence to investigate rating failures instead of treating an Unrated category as a connection error.
Which command lists web-filter categories on FortiGate?
Inspection modes and web filtering
get webfilter categories. Category classification and configured category action remain separate concepts.
Why does certificate inspection not support a path-specific HTTPS rule reliably?
Inspection modes and web filtering
The HTTP path is encrypted. Deep inspection is needed to expose paths such as /research versus /games on one host.
Why can a forward traffic Accept log coexist with a URL-filter block?
Inspection modes and web filtering
The firewall permits the connection before the security engine learns and evaluates the web request. The later web-filter event identifies the block.
Which web-filter event fields identify the effective decision?
Inspection modes and web filtering
Inspect action, policyid, profile, hostname/URL, category and message. They distinguish a static URL block, category denial and other causes.
What should be checked when expected web-filter events are absent?
Inspection modes and web filtering
Matched policy, web and SSL profile selection, logging, exemptions and the real protocol, including QUIC. Absence of a log alone does not establish permission.
Which proxy-only web feature records users' search terms?
Inspection modes and web filtering
Log all search keywords. Flow supports safe search, but the logging feature is listed as proxy-only in 7.6.0.
Which settings under Web Filter Proxy Options also work in flow mode?
Inspection modes and web filtering
HTTP POST Action and Remove Cookies. The GUI grouping does not mean every option in that group is proxy-only.
What HTTPS prerequisite matters for category warning/authentication replacement pages?
Inspection modes and web filtering
The client must trust the CA signing the FortiGate replacement page. Working DNS or routing does not remove that certificate requirement.
What is a useful first test before blocking a business-relevant category?
Inspection modes and web filtering
Monitor representative traffic and review category/application impact. Then scope the intended block and test both permitted and denied cases.
Why is a firewall service object insufficient to identify an application?
Application control
It matches transport protocol and ports, not the application carried inside them. Many apps and tunnels can share TCP 443 or use non-standard ports.
Which engine provides application-control decoding and signature matching?
Application control
The IPS engine. Application control is nevertheless supported in both flow and proxy policies.
What is an application sensor in profile-based NGFW mode?
Application control
A security profile defining application/category actions and overrides. Attach it to the accepting firewall policy that actually carries the traffic.
What does application-control Allow do?
Application control
It passes the recognized application without an application-control log. Independent traffic logging and other security engines can still apply.
What does application-control Monitor do?
Application control
It allows the recognized application and logs its application-control event. It is useful for observing impact before blocking.
What does application-control Block do?
Application control
It denies and logs the recognized application. An accepting firewall policy does not cancel that later security decision.
Why is application-control Quarantine broader than Block?
Application control
It blocks and temporarily bans traffic from the source address, rather than only stopping the detected application session. Shared source addresses can widen its impact.
What is an application override used for?
Application control
An explicit action for selected application signatures. Override entries are evaluated before the broad category segment.
What is a filter override used for?
Application control
It selects application signatures by attributes such as behavior, vendor, technology, risk, protocol or category. It is useful for a class of applications rather than one named signature.
What is an application-control segment?
Application control
A group of application signatures evaluated together for the best match. Overrides create segments/CLI entries; the category section supplies the default segment.
How does segment order affect application matching?
Application control
Segments are considered sequentially. Internal signature priority within a segment is separate from that segment order.
Does moving signature rows within one segment determine their matching priority?
Application control
No. The engine uses signature tie breakers within the segment, so GUI row order is not the deciding factor there.
Which wins the custom-versus-FortiGuard application-signature tie breaker?
Application control
Custom signatures take precedence over FortiGuard signatures. This is one factor in matching, not a reason to create broad custom signatures casually.
What does application signature weight help resolve?
Application control
Overlapping matches within a segment. More specific predefined application signatures generally have higher weight than broad protocol signatures.
Can administrators directly configure predefined application weights?
Application control
No. FortiGuard signature analysts define those weights. Use the installed signature information when investigating a match.
Which command shows installed application information including weight?
Application control
get application name status. Inspect the application ID, category, attributes and weight rather than inferring specificity from its display name.
What is the final application-ID tie breaker after other matching factors tie?
Application control
The larger signature ID is preferred. A larger ID alone does not outrank earlier tie breakers.
How do signature visibility and pattern count influence overlapping application matches?
Application control
Non-hidden signatures are preferred at the visibility step; more pattern/PCRE clauses are preferred at the pattern-count step. Earlier matching factors still take precedence.
Why may an HTTPS application be recognizable without deep inspection?
Application control
Some signatures use visible TLS metadata and other traffic characteristics. This does not expose encrypted content or guarantee identification of every function.
Why can a generic app be identified while its upload function is missed?
Application control
The function-specific signature may need decrypted HTTP requests or payload. Check deep inspection and exemptions before assuming a faulty signature action.
What parent/child dependency matters when permitting an app but restricting one function?
Application control
The required parent must remain permitted or monitored so the child function can be reached and recognized. Blocking the parent can stop all dependent functions.
What does application port enforcement check?
Application control
Whether a recognized application uses the default ports defined by its signature. An otherwise allowed app can be blocked on a non-default port.
Does application port enforcement replace the firewall service match?
Application control
No. The firewall must first permit the connection. Application recognition and port enforcement act on the accepted traffic afterward.
What does Network Protocol Enforcement configure?
Application control
Permitted network protocols for chosen server ports and the action for violations. It checks decoded protocol use, rather than trusting the service object name.
When can unconfirmed traffic be a protocol-enforcement violation?
Application control
When no service is confirmed and the decoders have ruled out all protocols permitted on that server port. Lack of immediate recognition alone is not the full condition.
How does application port enforcement differ from network protocol enforcement?
Application control
Port enforcement asks whether a recognized app uses its normal ports. Protocol enforcement asks whether traffic on a specified port uses an allowed protocol.
Which signature-action factor is considered before application weight for overlapping matches within a segment?
Application control
The signature with more pre/post-match signature actions is preferred at that step. This precedes weight and is separate from GUI row or segment ordering.
Where are applications matched in policy-based NGFW?
Application control
Directly in security-policy application criteria. Do not assume a profile-based sensor is required in that different policy model.
What do SSL Inspection & Authentication policies do in policy-based NGFW?
Application control
They pre-match traffic to establish inspection and identity information before the application/category security-policy decision.
Which inspection and NAT model does policy-based NGFW use?
Application control
Flow inspection and central NAT. The NGFW mode is selected per VDOM.
What application event fields help identify a block?
Application control
Application name/ID, category, action, policy ID and sensor, with endpoints/session information. Correlate any port-violation evidence as well.
Why can a traffic Accept log coexist with an application Block event?
Application control
The firewall accepted the connection before the engine identified and denied its application. Correlate the same session rather than discarding the security event.
What should be checked when a newly created sensor has no effect?
Application control
Confirm the real matched policy references it and inspect traffic visibility. A profile that is merely created does not enforce its actions.
What should be checked when only a generic SSL app is logged?
Application control
Whether the desired specific signature needs decryption, whether SSL exemptions apply, and whether the application signature package is current.
What should be checked before changing a category action for one unexpectedly blocked app?
Application control
Look for an earlier matching application/filter override and port/protocol-enforcement settings. Those can explain the decision even when the broad category is permitted.
Why test with a new application session after changing inspection settings?
Application control
Existing sessions can retain prior policy/session state. A fresh test with correlated logs is better evidence of the current configuration.
What does signature-based AV compare?
Antivirus
Transferred content against the local virus database, including content patterns. It is different from simply checking a filename extension or destination category.
Why can changing a malicious file evade a hash-only list?
Antivirus
The changed bytes produce a different hash. Content signatures and other detection methods can complement exact-file hash intelligence.
What does Virus Outbreak Prevention add to AV?
Antivirus
Online FortiGuard malware-hash intelligence, supplementing local definitions without waiting for the next local AV database update. It needs the appropriate service license and connectivity.
What does an external malware blocklist contain?
Antivirus
Organization-supplied malware hashes such as MD5, SHA1 or SHA256, retrieved from a remote list. It is not a list of web categories or destination ports.
Where does an EMS malware threat feed obtain its intelligence?
Antivirus
FortiClient EMS gathers malware hashes detected by managed FortiClients; FortiGate can use the feed in an AV profile. It is supported in both flow and proxy mode.
What is the documented order when local AV, EMS, external hashes and outbreak prevention all apply?
Antivirus
Local AV database, EMS threat feed, external malware blocklist, then FortiGuard outbreak prevention. If both blocked hash feeds match, EMS takes precedence over the external list for reporting.
What does AV Engine AI detection add?
Antivirus
A trained model identifies suspicious file features to help detect malware beyond known signatures. The package needs an active AV subscription; an AI verdict is still a detection decision rather than a guarantee.
Does a clean AV result prove a file is safe?
Antivirus
No. It means the configured techniques did not detect a threat within their available visibility and scan envelope. New threats, encrypted contents or bypassed content can remain risks.
What does Content Disarm and Reconstruction do?
Antivirus
It removes active content from supported documents while preserving readable textual content. It can remove useful macros, media or links even without a known-virus match.
Which protocols support baseline CDR?
Antivirus
HTTP, SMTP, POP3 and IMAP, with appropriate inspection configuration. The 7.6.0 feature requires proxy mode.
Which HTTP request method supports CDR in 7.6.0?
Antivirus
HTTP GET; HTTP POST is not supported. Download sanitization therefore does not establish upload sanitization.
Which mail-delivery options are incompatible with CDR?
Antivirus
SMTP splice and client-comfort mode. A CDR deployment must use compatible protocol handling rather than assuming all proxy options combine.
Why align AV profile feature set with the policy inspection mode?
Antivirus
The selected mode determines available processing paths and features. Attaching a profile does not turn a flow policy into proxy inspection.
Which file protocols are supported by both flow and proxy AV?
Antivirus
HTTP, FTP, IMAP, POP3, SMTP, NNTP and CIFS. Protocol enablement, scanability and SSL visibility still matter.
Which listed AV protocols require proxy inspection in 7.6.0?
Antivirus
MAPI and SSH file inspection. Do not assume their proxy support exists in a flow policy.
What important limitations apply to proxy AV on CIFS?
Antivirus
It cannot detect infections inside some archives or oversized files. CIFS support alone does not promise inspection of every representation.
What does AV need to scan files inside HTTPS or encrypted mail/file protocols?
Antivirus
Suitable deep SSL inspection, compatible trust and no applicable payload exemption, together with the enabled AV protocol. Certificate inspection alone leaves file contents encrypted.
Who selects the flow AV scan method?
Antivirus
The IPS engine algorithm, based on the file. The administrator does not select default versus legacy scan mode for flow AV.
How does proxy default AV handle eligible files?
Antivirus
WAD can scan simple eligible content in process, stream supported oversized archives for best-effort inspection, or buffer other content for scanunit within applicable limits.
What does proxy legacy AV disable?
Antivirus
Stream-based scanning. Oversized archives and content not handled by WAD in process follow buffered scanunit processing and its limits.
What is the documented mode for a newly created AV profile in 7.6.0?
Antivirus
Flow-based by default. Inspect the actual profile in an operational scenario because its mode can be changed.
What does a Protocol Options profile control?
Antivirus
Protocol handling and resource-related settings such as port mapping, scan-size and decompression limits. Its scan envelope is separate from malware signatures.
Why can custom-port HTTP evade expected proxy inspection?
Antivirus
The protocol port mapping may not include the actual service port. Check this mapping as well as any encrypted-protocol coverage.
Does flow protocol identification depend on proxy protocol-port mapping?
Antivirus
No. Flow identifies traffic independently of that mapping. Firewall permission and SSL visibility remain separate requirements.
Does oversized-file logging mean oversized files are blocked?
Antivirus
No. Logging records the condition; pass/bypass versus block must be configured and interpreted separately.
What can happen when a flow AV scan buffer exceeds oversize-limit with action pass?
Antivirus
The AV session can be cleared and the file bypassed from AV scanning. A completed transfer is not necessarily a fully scanned transfer.
Does proxy default mode guarantee full scanning of all large archives?
Antivirus
No. Only supported archives use the best-effort streaming path; unsupported content follows buffering and applicable limits.
Why does decompressed size matter even for a small downloaded archive?
Antivirus
A compact archive can expand greatly, consuming memory and exceeding inspection limits. The compressed download size is not the whole resource cost.
Why is recognizing a password-protected archive insufficient to scan its contents?
Antivirus
The encrypted inner files remain inaccessible without the password. Decide how to handle unscannable archives instead of treating recognition as a clean verdict.
How can archive nesting affect AV inspection?
Antivirus
Nested containers can exceed configured depth or decompression limits. Review the effective limit action rather than assuming every inner object was inspected.
What should be assessed before raising AV scan limits?
Antivirus
Available RAM and concurrent transfer workload. Larger per-session buffers can increase total memory pressure and conserve risk.
What does proxy client comforting do?
Antivirus
It sends a small amount of data while processing continues to keep the client transfer active. Some bytes can reach the client before the AV verdict.
Why can AV stop a download without showing a replacement page?
Antivirus
Delivery may already have started, so detection terminates the connection and leaves a partial file. Correlate the virus action rather than judging by the page alone.
Does post-transfer sandbox analysis hold the first recipient until the verdict?
Antivirus
No. Analysis occurs after transfer and can improve later intelligence. It does not provide the same first-transfer decision gate as inline scanning.
What is the operational purpose of inline sandbox scanning?
Antivirus
Hold a supported file while analysis returns a decision, then apply the configured outcome. Timeout and error actions determine what happens without a verdict.
Which inspection mode supports FortiSandbox inline AV in the 7.6.0 baseline?
Antivirus
Proxy. Flow inline support was added in 7.6.4, so a later feature page must not be treated as baseline support.
How do sandbox timeout actions block and log-only differ?
Antivirus
Block denies the file when no timely verdict arrives; log-only permits it with an event. Log-only does not mean the sandbox declared the file clean.
Which submission limits matter before promising inline sandbox coverage?
Antivirus
Supported file types and upload-size limits, plus service reachability and verdict timing. Inline configuration alone does not make every transfer eligible.
What policy prerequisite exists for downloading updated AV definitions?
Antivirus
At least one enabled policy must use a security profile with AV scanning enabled. Also verify the subscription, installed package versions and update connectivity.
Which CLI command shows installed FortiGuard package versions?
Antivirus
diagnose autoupdate versions. Compare AV engine/database and service status when investigating outdated detection.
Why must an EICAR lab test be correlated with a FortiGate virus event?
Antivirus
Endpoint AV, web filtering or IPS could stop it first. A blocked test alone does not identify FortiGate AV as the enforcing engine.
What should be checked first when all AV test samples pass?
Antivirus
Actual policy/profile matching, enabled protocol scanning, AV action and log evidence. Then investigate visibility, update health and limits relevant to the transfer.
What does an IPS signature identify?
Intrusion prevention
An attack pattern or suspicious behavior in inspected traffic. Its action and status determine how a match is handled, rather than the signature name alone.
What does an IPS protocol decoder do?
Intrusion prevention
Understands protocol structure and identifies abnormal patterns that violate protocol requirements. It provides protocol-aware analysis rather than only port matching.
What is the role of an IPS sensor?
Intrusion prevention
It selects signatures or filters and their actions/settings for use by a policy. The IPS engine performs the checks specified by the attached sensor.
What does the IPS target attribute client or server describe?
Intrusion prevention
The vulnerable endpoint role being protected. It is not simply whether the packet travels into or out of the firewall.
How are attributes within one IPS filter combined?
Intrusion prevention
A signature must satisfy the specified attributes, such as server target, high severity and HTTP protocol. The filter is not a union of every signature matching any one attribute.
What happens when an IPS update adds a signature matching an existing filter?
Intrusion prevention
The filter can automatically include it. Dynamic selection reduces manual maintenance but can change coverage and enforcement after updates.
What is a CVE-pattern IPS filter useful for?
Intrusion prevention
Selecting installed signatures tagged with specified vulnerability identifiers or a CVE pattern. It links coverage to vulnerabilities rather than requiring a fixed manually selected signature list.
Where should a narrow IPS exception be placed relative to an overlapping broad entry?
Intrusion prevention
Before the broad matching entry. Sensor entries are evaluated top to bottom; a lower exception is not a guaranteed override.
What does IPS action Default mean?
Intrusion prevention
Use the signature-defined default action. It does not universally mean Block; examine the installed signature default.
How does IPS signature status differ from action?
Intrusion prevention
Status decides whether the signature is enabled, disabled or uses its default status. Action decides what to do when an active signature matches.
What does IPS Monitor do?
Intrusion prevention
Permits the matching traffic and logs the detection. It is an intentional observation mode rather than a blocking guarantee.
How does IPS Reset differ from Block?
Intrusion prevention
Block drops matching traffic; Reset terminates the session, using a TCP reset where appropriate. Neither action creates firewall permission.
What broader effect can IPS Quarantine have?
Intrusion prevention
It blocks and temporarily isolates the attacker/source according to the configured duration. Its impact extends beyond just dropping a detected packet.
How can an individual-signature IP exemption narrow a false-positive exception?
Intrusion prevention
Limit the exception to the known source/destination subnets. This preserves the sensor for other traffic instead of removing the entire profile.
What tradeoff accompanies IPS packet logging?
Intrusion prevention
It preserves packet evidence but uses storage/resources and can capture sensitive content. Use it selectively on a supported logging platform.
What visibility is normally needed for HTTPS payload exploit signatures?
Intrusion prevention
Suitable deep SSL inspection. Some outer-protocol or destination-reputation checks can work without decryption, but that does not establish payload exploit coverage.
Where are IPS rate-count thresholds configured?
Intrusion prevention
On individual signatures, not IPS filters. Rate settings include count, duration, mode and a tracking key.
How does continuous IPS rate mode trigger a blocking action?
Intrusion prevention
The action engages as soon as the configured count is reached. Read the selected mode rather than treating every threshold as a periodical count per interval.
How does periodical IPS rate mode use rate-duration?
Intrusion prevention
It evaluates the signature incident count within that duration. Count and duration together define the intended rate threshold.
How does source-IP rate tracking differ from destination-IP tracking?
Intrusion prevention
Source tracking separates activity by origin; destination tracking aggregates activity against each target. Aggregation can expose distributed attacks but can also include legitimate busy-target activity.
What does outgoing botnet C&C IP protection evaluate?
Intrusion prevention
Connections to known botnet command-and-control IP addresses. A C&C IP event does not necessarily mean a payload exploit signature matched.
How does botnet IP blocking complement DNS filtering?
Intrusion prevention
They use different evidence: destination IP reputation versus queried domain reputation. Neither alone guarantees that every C&C mechanism is detected.
Why do IPS rate signatures not replace a DoS policy?
Intrusion prevention
DoS policies handle network/transport anomalies and flood thresholds at a different stage. Content IPS and upstream volumetric capacity protection address different parts of an attack.
What should guide IPS sensor scope?
Intrusion prevention
The protected systems, vulnerable roles, applications and protocols. Select relevant coverage and measure impact instead of enabling every signature and logging option everywhere.
Why is internal-only traffic still a candidate for IPS?
Intrusion prevention
Compromised internal hosts can attack other systems. Location inside the network is not proof that traffic lacks exploits.
What tradeoff does the extended IPS database introduce?
Intrusion prevention
Additional signature coverage and resource requirements. Package availability and full/slim coverage depend on the physical or VM platform.
Can every IPS-inspected session be assumed hardware offloaded?
Intrusion prevention
No. NTurbo/IPSA availability and supported paths depend on the model and traffic. Diagnose actual offload before interpreting CPU or capture evidence.
What does IPS engine-count 0 mean?
Intrusion prevention
Automatic engine selection by FortiGate, the recommended default. It does not disable IPS or force zero running engines.
Why can both a too-small and too-large IPS socket buffer be harmful?
Intrusion prevention
Too small can frequently overload inspection buffering; too large increases memory use and can increase conserve pressure. Tune against a measured workload and model limits.
What happens by default when the IPS raw-socket buffer is full?
Intrusion prevention
fail-open is disabled, so affected sessions are dropped. Verify the effective setting rather than assuming inspection automatically bypasses.
What is the cost of enabling IPS raw-buffer fail-open?
Intrusion prevention
Eligible traffic can continue without IPS-engine scanning during overload. It trades inspection for availability rather than increasing detection capacity.
Does NTurbo overload honor enabled IPS fail-open by bypassing inspection?
Intrusion prevention
No. NTurbo-offloaded sessions do not support this fail-open behavior; traffic can drop under NTurbo overload regardless of the setting.
Which setting controls flow inspection behavior during conserve mode?
Intrusion prevention
config ips global / set fail-open. Disabled drops new sessions needing flow inspection; enabled bypasses IPS-engine scans during ordinary conserve conditions.
Why can proxy av-failopen not predict flow inspection behavior in conserve mode?
Intrusion prevention
They govern different processing paths: proxy AV uses av-failopen; flow-based inspection uses config ips global / set fail-open. Check the actual policy mode and engine state.
What does IPS signature hold time do after updates?
Intrusion prevention
New signatures can run in Monitor during the configured holding period, then enforce after it expires. A detected event with signature-is-on-hold text explains allowed traffic despite a blocking sensor intent.
Which read-only checks help investigate IPS resource pressure?
Intrusion prevention
get system performance status, show ips global and diagnose test application ipsmonitor 1. Engine restart or bypass toggles alter live protection and are different from observation.
What creates a connected route on FortiGate?
Static routing
An addressed, active interface creates a route for its directly attached subnet. A separate static route is normally unnecessary for that subnet.
Which three elements define a typical Ethernet static route?
Static routing
The destination prefix, outgoing interface and reachable next-hop gateway define the path. Route preferences decide between competing paths.
What does the IPv4 default route 0.0.0.0/0 match?
Static routing
It matches every IPv4 destination, but ordinary destination routing uses it only when no more-specific usable route matches.
Why can a route-based VPN route omit an Ethernet-style gateway?
Static routing
It can point directly to the VPN virtual interface. The tunnel encapsulation provides the next stage rather than an adjacent Ethernet router.
Does adding a route authorize forwarded traffic?
Static routing
No. A route supplies a path; an applicable accepting firewall policy must independently authorize the traffic.
How does local-out routing differ from forwarding a LAN session?
Static routing
Local-out traffic is generated by FortiGate, such as an LDAP request. Its source/interface selection can depend on service settings, and a LAN forwarding policy does not govern it in the same way.
Why must a static route gateway be reachable through its specified interface?
Static routing
FortiGate must deliver packets to that next hop. A syntactically configured route cannot provide a working path if the next hop is unusable.
What does longest-prefix matching compare?
Static routing
It compares the specificity of matching installed destination routes. A matching /24 is preferred over a /16 or /0 regardless of their different-prefix distance values.
When does administrative distance decide between routes?
Static routing
It compares competing route sources for the same destination prefix. Lower numerical distance is generally preferred.
What does numerical priority choose between equal-distance static routes?
Static routing
For the same prefix and equal distance, lower numerical priority is preferred for ordinary forwarding. Equal priority can permit ECMP if other prerequisites hold.
How do the default distances of connected, DHCP default and manual static routes compare?
Static routing
The usual defaults are connected 0, DHCP-learned default 5 and manually configured static 10. Explicit configuration can change these preferences.
Which default distances help identify eBGP, OSPF, RIP and iBGP preference?
Static routing
Common defaults are eBGP 20, OSPF 110, RIP 120 and iBGP 200. These compare candidates for the same prefix and are configurable.
Why is an OSPF cost not directly comparable to a static-route priority?
Static routing
They are different selection properties. Protocol metrics select within their protocol; administrative distance compares route sources, and static priority distinguishes comparable static paths.
What does S mean in a FortiGate routing-table entry?
Static routing
It identifies a static route. The route prefix, next hop and outgoing interface describe the forwarding path.
In S 10.40.0.0/24 [10/0], what does [10/0] represent?
Static routing
The bracket represents administrative distance and metric. The metric zero is not the static route priority.
How do the routing database and active routing table differ?
Static routing
The database includes candidate routes; the active table shows selected usable routes. A configured candidate is not proof of the forwarding path.
What does diagnose ip route list help inspect?
Static routing
It displays kernel forwarding-route information. Compare it with routing-table and candidate-database evidence when diagnosing installation versus forwarding.
Which command displays the active FortiGate routing table?
Static routing
get router info routing-table all displays active routing information. Use the relevant VDOM and interpret route codes, prefixes and interfaces.
Which command inspects route detail for a specific destination?
Static routing
get router info routing-table details <destination-ip> provides more focused route information for the intended destination.
Where are policy routes inspected separately from ordinary routes?
Static routing
Use diagnose firewall proute list. A matching usable policy route can affect traffic even when a destination-only route table suggests another path.
What extra fields can make a policy route more selective than a static route?
Static routing
Source address, incoming interface and service/protocol can be matched in addition to destination. The resulting path must still be usable.
What takes precedence when a usable policy route matches a new session?
Static routing
The matching policy route can select the path before ordinary destination routing. Its existence does not remove reachability or firewall permission requirements.
Why can a destination-only route lookup miss a real forwarding decision?
Static routing
The live session may match a source-, protocol- or ingress-specific policy route. Supply the relevant tuple and inspect policy routes too.
What source property does reverse path forwarding validate?
Static routing
It checks whether the source is reachable through an acceptable route associated with the incoming interface, helping reject spoofed or invalid source paths.
How does feasible-path source checking differ from strict source checking?
Static routing
Feasible-path checking accepts a suitable return path through the incoming interface. Strict checking requires the best return path to use that interface.
Why may a higher-distance backup not solve an RPF failure?
Static routing
It may remain an unselected candidate rather than an installed usable return path. Active-table eligibility matters, not just the configured route list.
Which setting enables strict source checking in a VDOM?
Static routing
Under config system settings, set strict-src-check enable enables strict source validation. Investigate asymmetry before changing this security behavior.
Why should a route-change test create a fresh connection?
Static routing
Existing sessions can retain cached forwarding and NAT state. A new session more directly tests current route selection.
What can preserve-session-route affect?
Static routing
It can affect whether established sessions retain their previous route after changes. Do not assume every packet independently selects the newly preferred path.
Which static-route attributes should match for an ECMP design?
Static routing
Comparable static paths need the same destination prefix, administrative distance and numerical priority, with usable compatible routes.
Does ECMP normally split every packet of one TCP connection across WANs?
Static routing
No. It typically assigns sessions according to the configured algorithm, keeping a session on its selected path.
What does source-IP ECMP hashing group together?
Static routing
Traffic from the same source is associated with the same path assignment. It can produce uneven link use when a few sources generate most traffic.
What does source-destination ECMP hashing add to source-only hashing?
Static routing
It uses both source and destination, allowing a client reaching different destinations to receive different path assignments.
What does weighted ECMP change?
Static routing
It changes the relative distribution of path assignments among eligible members. It does not guarantee equal instantaneous byte counts.
What does usage-based spillover do?
Static routing
It sends sessions to another eligible link when a configured usage threshold is exceeded. It differs from always distributing using a fixed hash.
Why can equal session counts still yield unequal WAN byte counts?
Static routing
Sessions transfer different amounts of data. One large transfer can dominate a link even when assignments are balanced.
Why may a preferred static route survive an upstream internet outage?
Static routing
The local interface and next hop can remain usable while the wider path fails. Link monitoring or SD-WAN health checks are needed to detect that failure.
What is the purpose of a less-preferred blackhole route to a remote VPN subnet?
Static routing
It discards traffic to that subnet when the working VPN route is unavailable, preventing fallback through a broad internet default.
How can a specific blackhole route beat an available default route?
Static routing
Longest-prefix matching still applies. A matching remote /24 blackhole is more specific than an internet /0, even with a higher distance.
What must accompany a backup route for useful failover?
Static routing
The backup must be reachable and monitored appropriately, and its selected interface must have matching policy authorization, suitable NAT and a working return path.
What does an SD-WAN member represent?
SD-WAN
It is a participating physical WAN or supported virtual interface, such as an IPsec tunnel, available for steering.
What does an SD-WAN zone provide?
SD-WAN
It groups members for policy and route administration. The zone alone does not create a usable route or authorize traffic.
What is the role of a performance SLA?
SD-WAN
It measures path reachability and/or quality against configured requirements used in steering and monitoring.
What is the role of an explicit SD-WAN rule?
SD-WAN
It identifies a traffic requirement and selects among eligible members using its configured strategy and measurements.
Which dependencies form a basic dual-ISP SD-WAN deployment?
SD-WAN
Configure members/gateways, a zone, usable routes, accepting policies with suitable NAT, and health checks/rules as needed. These are separate dependencies.
Why can a referenced WAN interface resist conversion into an SD-WAN member?
SD-WAN
Existing objects or policies can depend on its current role. Review and update dependencies before moving it into the intended zone.
What is an SD-WAN underlay?
SD-WAN
It is the transport connectivity, such as broadband, MPLS or another WAN service, over which traffic or overlays travel.
What is an SD-WAN overlay?
SD-WAN
It is connectivity carried over an underlay, commonly IPsec tunnels used for private network traffic.
Does adding a physical WAN to SD-WAN encrypt its traffic?
SD-WAN
No. SD-WAN supplies path selection; a mechanism such as IPsec supplies encryption when an encrypted overlay is required.
What normal best-route condition allows an SD-WAN service rule to participate?
SD-WAN
By default, the best route to the destination must point to SD-WAN. Advanced configured routing options can alter this interaction.
What route condition applies to an SD-WAN member selected by a rule?
SD-WAN
That member must have a valid route to the destination. Its route need not always be the single best route.
Why can a more-specific route outside SD-WAN defeat an all-destination SD-WAN rule?
SD-WAN
Ordinary best-route integration can direct the destination outside SD-WAN. A broad selector does not automatically override that route.
Can an SD-WAN rule make a member with no usable destination route eligible?
SD-WAN
Not under ordinary routing integration. Steering selects among eligible paths; it does not create the missing route.
What does latency measure?
SD-WAN
Latency measures delay along the observed path. It is different from variation in delay and the percentage of lost packets.
What does jitter measure?
SD-WAN
Jitter measures variation in delay. Voice can be impaired by high jitter even when average latency looks acceptable.
What does packet loss measure?
SD-WAN
It is the proportion of probes or packets that do not arrive. An alive target can still have unacceptable loss.
How do active and passive quality measurements differ?
SD-WAN
Active checks generate probes to a target. Supported passive measurements derive quality from observed traffic.
How does alive status differ from meeting an SLA target?
SD-WAN
Alive indicates reachability according to the check. Passing the SLA means meeting configured quality thresholds, which can fail on an alive member.
Why is a local ISP gateway sometimes a weak SLA target?
SD-WAN
It may respond while problems beyond that gateway break the required application path. Choose a representative reachable target.
How can an unstable probe server create a misleading WAN diagnosis?
SD-WAN
The target itself can fail or respond poorly, making healthy transport paths appear bad. Correlate target health and alternative observations.
What do probe intervals and fail/recovery counts influence?
SD-WAN
They affect how quickly a health state changes and how stable it is. Aggressive settings can increase flapping.
Why must multiple-target health-check logic be read explicitly?
SD-WAN
The configured decision and route-update logic determine how target failures affect eligibility. One failed target does not imply a universal outcome.
Which business preference does a Manual SD-WAN strategy express?
SD-WAN
It uses an ordered preference among eligible members rather than simply picking the lowest measured latency.
Which business preference does Best Quality express?
SD-WAN
It prefers the best measured eligible member according to the selected quality criterion. The criterion can be latency, jitter or another supported metric.
Which business preference does Lowest Cost (SLA) express when load balancing is disabled?
SD-WAN
It prioritizes SLA compliance, then favors a lower-cost eligible passing member. Best absolute quality is not necessarily the chosen outcome.
What does member cost represent in Lowest Cost steering?
SD-WAN
It is an administrator-defined preference/ranking value, not an automatically calculated ISP invoice.
What does set load-balance enable do in an explicit Lowest Cost mode sla rule?
SD-WAN
It distributes traffic across members satisfying the SLA instead of applying the ordinary cheapest-passing-member outcome.
How is older Maximize Bandwidth terminology treated in the 7.6 baseline?
SD-WAN
Load balancing is configured within Manual or Lowest Cost rule designs; do not assume older standalone strategy names and CLI are interchangeable.
How do explicit-rule and implicit-rule default hashing differ?
SD-WAN
The explicit load-balancing rule uses round-robin hashing by default; the implicit rule defaults to source-IP hashing. Read the relevant rule configuration.
What traffic reaches the implicit SD-WAN rule?
SD-WAN
Traffic not selected by an explicit service rule can use the implicit rule, subject to routing and member eligibility.
Why can a specific application rule be hidden by an earlier broad rule?
SD-WAN
The earlier broad selector can take the intended traffic before the specific rule. Review rule order and actual application matching.
Why may an application-steered session initially appear on a different path?
SD-WAN
Application identification may require initial packets. Inspect recognition and steering state before concluding the explicit application rule cannot match.
What does diagnose sys sdwan health-check show?
SD-WAN
It provides health-check state and quality evidence for SD-WAN paths. Correlate it with route and traffic observations.
What does diagnose sys sdwan service help inspect?
SD-WAN
It provides service-rule and steering information, useful for determining rule matching and selected members.
Why does equal SD-WAN distribution not guarantee equal bytes?
SD-WAN
Assignments and workloads differ in transfer size and duration. Balanced sessions do not require identical byte counts.
What must be checked when a member is alive but fails a voice SLA?
SD-WAN
Check quality thresholds, rule eligibility and fallback. The member can remain usable for other traffic, depending on configuration.
What happens if no member passes the required SLA?
SD-WAN
The result depends on configured fallback and available candidates. Do not assume all designs drop traffic or always choose the cheapest failing link.
Why should an SD-WAN failover lab test degraded quality as well as cable removal?
SD-WAN
Hard link failure and alive-but-poor quality exercise different monitoring and steering conditions. Both matter for real application continuity.
Why can an SD-WAN path change alter public source identity?
SD-WAN
Traffic can use a different WAN address or source-NAT mapping. Remote allowlists and session continuity may depend on that identity.
Which evidence together validates a useful SD-WAN decision?
SD-WAN
Verify route/member eligibility, actual rule match, SLA state, selected interface, forwarding permission and bidirectional application traffic. A green dashboard alone is insufficient.
Which IPsec protection protocol does FortiOS support for VPN tunnels?
IPsec VPNs
FortiOS uses ESP and does not support AH as a selectable tunnel protocol. AH is a standards concept, not a FortiGate alternative.
What protections can ESP provide?
IPsec VPNs
ESP can provide confidentiality, integrity/authentication and replay protection, depending on the negotiated cryptographic parameters.
What changes when IPsec uses tunnel encapsulation?
IPsec VPNs
The original private-address packet is carried inside a new outer packet between the VPN gateways.
What does IKE negotiate?
IPsec VPNs
IKE authenticates peers and negotiates security associations and keying parameters used by the VPN.
Which transport ordinarily starts IKE negotiation?
IPsec VPNs
IKE ordinarily begins over UDP 500. When NAT traversal is needed, UDP 4500 is used as required.
How is native ESP identified on an IPv4 WAN capture?
IPsec VPNs
ESP uses IP protocol 50. This is an IP protocol number, not TCP or UDP port 50.
What does NAT-T change for ESP transport?
IPsec VPNs
With NAT detected and NAT-T enabled, ESP is encapsulated in UDP 4500 to traverse translation devices.
What do NAT keepalives preserve?
IPsec VPNs
They help preserve a translation mapping. They do not measure the protected application’s health.
What does Diffie-Hellman exchange and derive?
IPsec VPNs
Peers exchange public values and derive a shared secret locally using their private values. The shared secret itself is not sent.
Why is authentication necessary with a DH exchange?
IPsec VPNs
It establishes the identity of the peer participating in key agreement. Key agreement alone is not proof that the intended remote gateway participated.
Which phase establishes the IKE relationship in the exam’s terminology?
IPsec VPNs
Phase 1 establishes the authenticated IKE relationship and its cryptographic parameters. Protected traffic SAs are negotiated separately.
Which gateway attributes must be checked in Phase 1?
IPsec VPNs
Verify the remote gateway, local interface/address and IKE version together with identity and authentication settings.
What distinguishes a known-peer definition from a dialup listener?
IPsec VPNs
A known peer uses a configured IP or supported name; a dialup listener accepts an initiating peer whose address is not known in advance.
Who normally initiates against a dialup listener?
IPsec VPNs
The dialup client initiates toward the known listener gateway. The listener accepts the peer according to its identity/authentication design.
What must agree when VPN peers use a preshared key?
IPsec VPNs
The PSK and compatible authentication expectations must agree. Correct gateway addresses alone do not authenticate a mismatched secret.
What must certificate-authenticated VPN peers validate?
IPsec VPNs
They need appropriate certificates, the associated private keys, issuer trust and acceptable peer identity according to the configured authentication design.
Can a peer-ID mismatch break negotiation with a correct PSK?
IPsec VPNs
Yes. The configured identity expectations are an independent gate; matching the PSK does not satisfy an incompatible peer ID.
What do AES256 and SHA256 represent in a classic proposal?
IPsec VPNs
AES256 describes encryption and SHA256 describes integrity/authentication. They are different negotiated components.
Why must both peers have compatible proposals and DH groups?
IPsec VPNs
They must agree on acceptable cryptographic parameters to establish the intended relationship. Merely offering a stronger but incompatible setting does not repair negotiation.
Which IKE version offers Main Mode and Aggressive Mode?
IPsec VPNs
IKEv1 offers those modes. IKEv2 uses a different exchange structure and has no Main/Aggressive choice.
How does IKEv1 Aggressive Mode expose identity differently from Main Mode?
IPsec VPNs
Aggressive Mode provides more identity information early in the exchange. Main Mode uses more exchanges and protects identity later in negotiation.
Does a dynamic peer address always require IKEv1 Aggressive Mode?
IPsec VPNs
No. Peer-identification and dialup-definition design matter, and IKEv2 does not use those modes at all.
What is the purpose of a Phase 1 key lifetime?
IPsec VPNs
It controls rekeying timing for that relationship. Expiry does not mean an administrator must manually re-enter a PSK.
What does Phase 2 define?
IPsec VPNs
It defines protected traffic selectors and ESP/security-association parameters for carrying user traffic.
How are local and remote selectors mirrored across peers?
IPsec VPNs
Each peer’s local protected subnet is the other peer’s remote subnet, and vice versa. The definitions must describe compatible traffic.
Can traffic selectors constrain more than subnet addresses?
IPsec VPNs
Yes. Supported selectors can constrain hosts, ranges, protocol and ports as well as subnet pairs.
Do broad Phase 2 selectors automatically authorize all covered hosts?
IPsec VPNs
No. Selectors define what an SA can carry; firewall policies independently control permitted forwarding.
Why can Phase 1 be up while Phase 2 fails?
IPsec VPNs
Phase 2 has its own selectors, ESP proposals and PFS/DH requirements, or may not yet have a traffic/negotiation trigger.
What does a pair of unidirectional IPsec SAs support?
IPsec VPNs
One SA handles each direction. Bidirectional protected traffic requires the appropriate directional SA state.
How can one Phase 1 serve multiple protected subnet pairs?
IPsec VPNs
Multiple Phase 2 definitions can reference it through phase1name, each defining its own compatible selectors.
What does PFS add to Phase 2 keying?
IPsec VPNs
It adds a fresh DH exchange for the relevant rekeying rather than relying solely on existing IKE keying material.
What does Phase 2 auto-negotiate enable?
IPsec VPNs
It initiates/maintains SA negotiation without waiting for interesting user traffic, useful when a standby tunnel should be ready.
What does Phase 2 key-lifetime expiry normally trigger?
IPsec VPNs
It triggers rekeying according to the negotiated settings, rather than requiring manual PSK entry for each expiry.
What does phase1name connect in a Phase 2 configuration?
IPsec VPNs
It binds the Phase 2 definition to the intended Phase 1 tunnel object. Correct selectors cannot repair a reference to the wrong tunnel.
What should be reviewed after using the IPsec wizard?
IPsec VPNs
Inspect generated VPN objects, addresses, routes and policies, and verify peer compatibility and the protected subnet choices. Wizard completion alone is not connectivity proof.
What is a route-based VPN’s forwarding interface?
IPsec VPNs
It is a virtual interface named for the tunnel, used by the remote-subnet route and accepting forward policies.
Which policy authorizes a new connection initiated by a local LAN host toward a route-based VPN?
IPsec VPNs
An accepting LAN-to-tunnel policy matching the intended source, destination and service authorizes local initiation.
Which policy authorizes a remotely initiated route-based VPN connection?
IPsec VPNs
An accepting tunnel-to-LAN policy authorizes the remote initiation. Replies to an already permitted session use state.
Does the reply to an existing accepted VPN session require a new independent reverse initiation policy match?
IPsec VPNs
Stateful return handling associates it with the existing session. A reverse-direction policy is needed to authorize independent initiation from that side.
Why is SNAT normally disabled in a non-overlapping site-to-site design?
IPsec VPNs
It preserves the expected private source addresses and selector/return-path design. Translation should be enabled only for a deliberate requirement.
When can NAT be a deliberate site-to-site VPN design choice?
IPsec VPNs
It can address requirements such as overlapping networks, provided translated identities, selectors, routing and policies are designed consistently.
Can Phase 1 establish before a LAN forwarding policy exists?
IPsec VPNs
Yes. IKE is traffic to/from the FortiGate VPN endpoint; missing forward permission can block user payload without preventing endpoint negotiation.
Which action belongs to an ordinary route-based VPN forward policy?
IPsec VPNs
Use ACCEPT on policies referencing the tunnel interface. Legacy policy-based Action IPsec is a different VPN model.
How many logical pairwise connections does a single-path full mesh of n sites require?
IPsec VPNs
It requires n(n-1)/2 connections. For six sites, that is fifteen logical site pairs.
What distinguishes a partial mesh from a full mesh?
IPsec VPNs
A partial mesh connects selected pairs. Communication between unconnected sites needs a permitted transit path rather than a nonexistent direct connection.
What must a hub support for spoke-to-spoke traffic?
IPsec VPNs
It needs appropriate routes, protected selectors and accepting tunnel-to-tunnel policies for the transit traffic.
What failure point remains when a single-WAN peer connects to a dual-WAN peer?
IPsec VPNs
The single-WAN side remains a shared failure point. The topology protects against selected dual-WAN-side failures, not every underlay outage.
How many WAN cross-pair paths are possible with two WANs at each of two peers?
IPsec VPNs
Four interface pairs are possible if all are configured. Physical/provider independence still needs to be assessed.
Why are two ISP labels not proof of independent VPN paths?
IPsec VPNs
Links can share cabling, power, upstream infrastructure or another common dependency. Logical tunnel count alone does not eliminate those failure points.
What is the FortiOS 7.6 default DPD mode?
IPsec VPNs
The CLI documents on-demand as the default. Read an explicit setting in the scenario rather than assuming a different mode.
When does DPD on-demand probe peer liveness?
IPsec VPNs
It probes when outbound IPsec traffic is not receiving a peer response. It is different from on-idle probing of an idle relationship.
What does DPD on-idle add compared with on-demand?
IPsec VPNs
It checks an idle peer relationship according to its configured timers instead of waiting for the on-demand traffic condition.
What different questions do DPD and an application-path SLA answer?
IPsec VPNs
DPD concerns peer liveness. An appropriate SLA can measure whether the usable protected application path meets reachability/quality needs.
What static preferences can express a primary/backup tunnel design?
IPsec VPNs
Prefer a lower-distance same-prefix route, or equal distance with different numerical priority according to the intended design. Equal distance/priority can instead permit multipath.
Why should standby Phase 2 negotiation be tested before failure?
IPsec VPNs
A tunnel that must negotiate only after takeover can add delay or reveal incompatibility then. SA readiness and successful backup data flow must be validated.
What determines VPN failback after a preferred path recovers?
IPsec VPNs
Route preference, monitoring/negotiation and session-preservation behavior matter. Established sessions do not universally move immediately on recovery.
How do VPN event logs and forwarding traffic logs differ?
IPsec VPNs
VPN events describe negotiation, SA and liveness changes; traffic logs describe protected user sessions and policy decisions. Correlate names, endpoints and time.
What does increasing encryption with no increasing decryption suggest?
IPsec VPNs
Outbound protection is happening without observed protected replies. Investigate remote processing, host response and return paths rather than assuming local inbound success.
What can small packets working while large transfers stall indicate?
IPsec VPNs
It can indicate MTU, fragmentation or TCP MSS issues caused by encapsulation/path constraints. Confirm with targeted evidence before changing cryptography.
What should be protected when sharing VPN diagnostic output?
IPsec VPNs
Some output can contain sensitive key material and identifiers. Scope and stop debug collection and redact secrets before sharing.
Practice questions
These are original study questions. Multiple-response practice uses exact-set scoring in the app, with no partial credit.
1. A branch already uses its existing router as every host's gateway. You must insert inspection without changing host IP addressing. Which deployment mode is the best fit?
Initial configuration
✓ Correct answer
- Transparent mode
Transparent mode bridges the existing Layer 2 path while enforcing policy. A new routed gateway/subnet changes host configuration, while an explicit proxy requires application configuration and does not inspect the whole inserted path.
Open this question’s page →2. A technician claims that every physical FortiGate starts with the same internal ports and DHCP scope. Which response is accurate?
Initial configuration
✓ Correct answer
- Check model-specific defaults before configuring access
Factory interface and DHCP settings vary by model. The management address is configured on an interface, switch membership is not universal, and AWS credentials are specific to that cloud deployment.
Open this question’s page →3. A lab interface has this configuration: config system interface edit "port1" set allowaccess ping https next end An administrator can use HTTPS but cannot open SSH to port1. What should be checked first?
Initial configuration
✓ Correct answer
- SSH is not enabled in the interface allowaccess list
The interface allows ping and HTTPS but not SSH. A transit policy cannot enable a local service, HTTPS enablement does not move SSH to its port, and the supplied configuration does not establish a password issue.
Open this question’s page →4. An auditor logs in over HTTPS and reads logs, but backup restoration is unavailable. What is the most likely cause?
Initial configuration
✓ Correct answer
- The administrator profile lacks super_admin authority
The administrator profile is the relevant local authority gate. Encryption affects backup protection, a transit rule does not grant administrative permission, and local restoration is not enabled by a support-contract renewal.
Open this question’s page →5. An administrator's trusted-host subnet is 10.99.0.0/24. HTTPS works from 10.99.0.25 but fails from a routed source 10.20.0.25, despite the interface allowing HTTPS. Which explanation fits?
Initial configuration
✓ Correct answer
- The source restriction excludes the second management network
Trusted hosts restrict administrator source addresses independently of enabled interface services. They are not return-traffic rules; routed management does not universally require NAT, and roles do not enforce this boundary.
Open this question’s page →6. A junior engineer changes a port role from LAN to WAN and expects existing unwanted transit traffic to stop. What should actually be used to control that traffic?
Initial configuration
✓ Correct answer
- An appropriate forwarding firewall policy
Forwarding policies control transit permissions. An interface role and route do not authorize or block the selected traffic; web filtering covers its inspected scope, and local-in policies govern traffic addressed to FortiGate.
Open this question’s page →7. In a lab, port2 is 10.20.10.1/24. A DHCP range is configured as 10.20.20.100–10.20.20.199. What must be corrected?
Initial configuration
✓ Correct answer
- The allocation range must match port2's intended subnet
The scope is outside the interface network. Changing the gateway to a pool endpoint does not fix the mismatch, HTTPS is management access, and relaying to itself is not the remedy.
Open this question’s page →8. A central server should allocate addresses to a remote VLAN. The remote FortiGate must forward DHCP requests without maintaining its own allocation pool. Which function fits?
Initial configuration
✓ Correct answer
- DHCP relay
Relay delivers DHCP requests to a server beyond the broadcast domain. A local server allocates independently; a normal route or source NAT alone does not implement DHCP relay.
Open this question’s page →9. A client receives the correct IP, mask and gateway. It reaches a public IP address but cannot resolve public hostnames. What is the best next check?
Initial configuration
✓ Correct answer
- The DNS options supplied to the client and resolver reachability
IP reachability narrows the failure to name resolution. Check the supplied DNS and its path before changing the address scope, arbitrary policy order or a management certificate.
Open this question’s page →10. A WAN uses DHCP. After renewal it has an address but no default route. Which configuration should be investigated?
Initial configuration
✓ Correct answer
- Whether DHCP gateway/default-route installation is enabled
A DHCP WAN installs a gateway route only when the relevant option and lease information permit it. Interface roles, management SSH and client reservations do not install that default route.
Open this question’s page →11. The FortiGate can ping an internet IP. A LAN client has a correct gateway but its private source address exits WAN untranslated, and the ISP does not route that private subnet. Which change addresses this stated failure?
Initial configuration
✓ Correct answer
- Configure source NAT on the applicable client forwarding path
The client transit path needs source translation in this design. A FortiGate-originated ping tests another path; management settings and lease renewal cannot make the private address internet-routable.
Open this question’s page →12. A purchased FortiGuard service is valid, but its update server name does not resolve from the FortiGate. What should be fixed first?
Initial configuration
✓ Correct answer
- FortiGate DNS resolution and reachability to the resolver
FortiGate service lookups use its DNS and local-out connectivity. Client lease renewal and arbitrary client transit-policy changes do not fix the stated firewall-originated resolution failure; replacing a valid contract misses the cause.
Open this question’s page →13. A recovery plan requires restoring all VDOMs and global system settings. The only file available contains one VDOM. What is missing?
Initial configuration
✓ Correct answer
- A compatible whole-device backup with the required scope
Recovery requires compatible configuration data covering global settings and all intended VDOMs. A partial VDOM/global export omits required settings; firmware alone does not reproduce the configuration.
Open this question’s page →14. The only configuration export available replaces passwords with FortinetPasswordMask. What is the main recovery limitation?
Initial configuration
✓ Correct answer
- Original secrets are not available in the export
Masking removes recoverable original credential values from that export. It does not imply all interface settings are deleted, and firmware or account authority cannot reconstruct unavailable secrets.
Open this question’s page →15. Fortinet's supported upgrade path specifies two intermediate builds before the target. The engineer proposes jumping directly to the target to save downtime. What is the best response?
Initial configuration
✓ Correct answer
- Follow the required hops because configuration conversion is version-dependent
The supported path accounts for configuration conversion and compatibility. Hostname and management-service settings do not replace it; restoring a newer configuration into older firmware introduces the downgrade risk.
Open this question’s page →16. After a downgrade, several settings from the newer release are rejected. Which recovery asset should have been retained?
Initial configuration
✓ Correct answer
- The earlier backup matching the older firmware
The older image may not accept a newer configuration. A matching earlier backup is useful for rollback; masked secrets, screenshots and client leases do not provide complete compatible recovery.
Open this question’s page →17. A valid IPS database service stopped updating after an upstream firewall change. Which evidence best separates licensing from network failure?
Initial configuration
✓ Correct answer
- Valid entitlement plus failed service reachability through the new outbound path
Valid entitlement plus a failed service-specific path identifies network failure. An unrelated ping or client download tests a different destination/path; entitlement alone does not establish update reachability.
Open this question’s page →18. A lab management network needs secure remote access. Which three checks are independently relevant? Select three answers.
Initial configuration
✓ Correct answers
- The addressed interface permits HTTPS or SSH
- The management source passes trusted-host/local-in restrictions
- The account authenticates with sufficient privileges
Service enablement, source restrictions and authentication/privilege are separate gates. A transit policy cannot substitute for local management authorization, and DHCP relay is not a prerequisite for an addressed management connection.
Open this question’s page →19. An initial setup has interface IPs and a static default route, but service-name lookups fail and event times differ from identity-server logs. Which two settings directly address those symptoms? Select two answers.
Initial configuration
✓ Correct answers
- Working DNS configuration
- Correct time configuration and NTP synchronization
Working DNS repairs name resolution, while correct time and synchronization support log correlation. Reservations alone do not supply DNS configuration; management timeout and profile choice do not correct these symptoms.
Open this question’s page →20. For a lab LAN 10.20.10.0/24 with FortiGate 10.20.10.1, which two DHCP choices are appropriate? Select two answers.
Initial configuration
✓ Correct answers
- Allocate clients from 10.20.10.100–10.20.10.199
- Supply 10.20.10.1 as their intended default gateway
The range is in the interface subnet and excludes the gateway. The gateway option provides the intended next hop. Reassigning the gateway creates a conflict, the other subnet mismatches the LAN, and browsing by name still needs DNS.
Open this question’s page →21. Which three elements make an encrypted configuration backup usable for recovery? Select three answers.
Initial configuration
✓ Correct answers
- Availability of the backup decryption password
- Compatible device-model and firmware information
- A backup covering the required global/VDOM scope
Scope, decryptability and compatibility are necessary recovery considerations. Masked values cannot reproduce secrets, and restore can restart or alter reachability, so a recovery path must be planned.
Open this question’s page →22. After the last required firmware upgrade hop, which three checks validate operational recovery? Select three answers.
Initial configuration
✓ Correct answers
- Verify logging and security-service updates
- Verify interfaces, routes and forwarding policies
- Test representative VPN/client traffic
Validation must cover forwarding, dependent VPN/client behavior and evidence/security services. GUI login tests only management, and immediate deletion of recovery backups removes rollback options.
Open this question’s page →23. An administrator changes a configuration and a VPN then renegotiates. Which log family is the best starting point for these operations?
Logging and diagnosis
✓ Correct answer
- Event logs
Event logs record administrator and subsystem activity such as VPN negotiation. Forward traffic, antivirus and web-filter records answer different questions and may provide supplementary evidence.
Open this question’s page →24. A traffic record reports an accepted session, while a correlated web-filter record reports blocked content. Which conclusion is justified?
Logging and diagnosis
✓ Correct answer
- The session was permitted before a security-profile decision blocked content
A firewall permit and a later content block can coexist. Correlate session/device/time fields; acceptance is not a guarantee of content delivery, and neither corruption nor another device follows from these actions alone.
Open this question’s page →25. A branch uses only memory logging. After an unexpected reboot, its pre-reboot history is unavailable. Which design change addresses the retention problem?
Logging and diagnosis
✓ Correct answer
- Send logs to a suitable remote destination
A remote destination can retain received records across a reboot. Larger memory buffers and more policy logging remain volatile; an upload schedule without a destination cannot provide durable storage.
Open this question’s page →26. A logging destination retains warning and more severe records. Routine information-level traffic records are absent. What explains this?
Logging and diagnosis
✓ Correct answer
- The severity threshold filters the informational records
Warning thresholds can exclude less-severe informational records. Severity is not the permit/deny action; filtered records do not prove a log-generation failure or identity change.
Open this question’s page →27. A FortiGate reaches the FortiAnalyzer address, but the collector lists it as unauthorized. What is the most direct next action?
Logging and diagnosis
✓ Correct answer
- Authorize or correctly add the FortiGate identity on FortiAnalyzer
Authorize or correctly stage the expected FortiGate identity/ADOM. Policy logging controls generation and retention controls history; neither those settings nor transit NAT replaces collector authorization.
Open this question’s page →28. A FortiGate is authorized, but an operator searching the wrong ADOM finds no records. Which check most directly addresses this situation?
Logging and diagnosis
✓ Correct answer
- Select the ADOM containing the expected device and search its records
Search the ADOM containing the device. Retention in another context, policy renumbering and transport reliability cannot repair incorrectly scoped viewing.
Open this question’s page →29. During a short FortiAnalyzer outage, reliable logging retains unconfirmed items. After reconnecting, seq_no advances and the queue clears. What does this indicate?
Logging and diagnosis
✓ Correct answer
- The collector confirmed additional records and outstanding logs were cleared
The sequence confirmation tracks delivery and allows confirmed cached records to clear. It does not alter policy logging, guarantee unlimited storage or establish transport encryption.
Open this question’s page →30. An engineer enables reliable TCP logging and claims encryption is therefore guaranteed. What should be verified?
Logging and diagnosis
✓ Correct answer
- The actual secure/encrypted logging configuration and trust settings
Verify actual secure transport and trust configuration. A TCP handshake or acknowledgement establishes delivery-related behavior, while disk capacity establishes retention; none alone establishes encryption.
Open this question’s page →31. A packet capture shows a connection attempt to the log server, but no successful handshake or received logs. What has been demonstrated?
Logging and diagnosis
✓ Correct answer
- Only that the observed connection attempt reached the capture point
A capture must be interpreted at the stage actually observed. A connection attempt is not proof of completed transport, trust, device authorization, policy log generation or retention.
Open this question’s page →32. A forward traffic record contains sentbyte=4500 and rcvdbyte=0 for a failed client request. Which investigation is best supported?
Logging and diagnosis
✓ Correct answer
- Check the destination and return path rather than assume a successful transaction
Investigate the destination and return path. Acceptance does not prove a completed transaction; the byte counts alone do not prove missing NAT or a successful response.
Open this question’s page →33. Logs arrive each evening with earlier event timestamps because scheduled upload is configured. What is the most accurate interpretation?
Logging and diagnosis
✓ Correct answer
- Arrival delay may be intentional rather than a transmission failure
Upload timing can separate event and receive times. Check the configured schedule before diagnosing loss; it does not enable policy logging, establish clock corruption or imply a bypassed firewall.
Open this question’s page →34. A week-long collector outage exhausts the branch's finite logging buffers. Why can reliable logging still have gaps?
Logging and diagnosis
✓ Correct answer
- Acknowledged delivery does not create unlimited queue or storage capacity
Reliability can preserve outstanding records within available capacity, but an extended outage can exhaust finite buffers. Authorization, TCP and encryption do not grant unlimited storage.
Open this question’s page →35. A FortiGate is authorized on FortiAnalyzer, but a test session produces no expected record. Which two independent generation/delivery checks are relevant? Select two answers.
Logging and diagnosis
✓ Correct answers
- Traffic logging is enabled on the matching policy
- The connector/upload path actually delivers generated records
Check both policy log generation and actual delivery. Acceptance, authorization and a long retention period each address a different prerequisite and do not demonstrate both stages.
Open this question’s page →36. A retained log cannot be found in the GUI. Which three search controls should be checked before concluding that it never existed? Select three answers.
Logging and diagnosis
✓ Correct answers
- The selected log device/source and VDOM
- The time range and time-zone interpretation
- Category and severity/search filters
Device/VDOM, time interpretation and viewer filters can hide retained records. Extending retention or changing transport does not by itself correct the selected search context.
Open this question’s page →37. Which three fields or field groups help correlate a traffic log with a security-profile event for the same connection? Select three answers.
Logging and diagnosis
✓ Correct answers
- Session ID when available
- Device/VDOM and timestamp
- Client/destination addresses and policy ID
Connection and context identifiers support correlation. Severity measures importance and is not unique to a connection; administrator privileges do not identify a client security event.
Open this question’s page →38. A branch lacks durable local storage and must retain evidence across restarts. Which two planning choices address that requirement? Select two answers.
Logging and diagnosis
✓ Correct answers
- Size destination quotas and retention for expected log volume
- Use a supported remote collector or cloud logging destination
Remote storage provides durable received evidence, and quotas/retention determine its usable history. Memory is volatile, disk support varies, and cloud retention depends on service plans.
Open this question’s page →39. A physical cluster is planned for predictable redundancy with one traffic-processing unit and a ready standby. Which mode fits?
FGCP high availability
✓ Correct answer
- Active-passive FGCP
Active-passive uses one primary and standby members. Independent ECMP is not FGCP standby operation, transparent mode alone supplies no HA, and active-active does not guarantee linear performance.
Open this question’s page →40. Both units have healthy monitored links and override disabled. FGT-A's HA age is 900 seconds and priority 100; FGT-B's age is 400 seconds and priority 200. The age margin is 300 seconds. Which unit is preferred?
FGCP high availability
✓ Correct answer
- FGT-A because its significant HA-age advantage is considered before priority
With override disabled, the 500-second HA-age difference exceeds the margin and favors the older HA member. Priority is later, lower age is not preferred, and differing priorities do not prevent election.
Open this question’s page →41. Override is disabled and monitored links are equally healthy. FGT-A has HA age 800 seconds and priority 100; FGT-B has age 650 seconds and priority 200. Margin is 300 seconds. Which criterion decides between them?
FGCP high availability
✓ Correct answer
- FGT-B's higher device priority after HA age is treated as a tie
The 150-second age difference is below the margin, so priority is evaluated and higher wins. Age need not be exactly equal to tie; election is deterministic rather than random.
Open this question’s page →42. Override is enabled consistently and monitored links are equally healthy. FGT-A has priority 220 and HA age 200 seconds; FGT-B has priority 100 and HA age 2000 seconds. Who is preferred?
FGCP high availability
✓ Correct answer
- FGT-A because priority precedes HA age with override enabled
Override places priority before HA age once link health ties. Higher priority wins; firmware must be compatible, not used as a preferred-version election rule.
Open this question’s page →43. FGT-A has priority 255 but a failed monitored production interface. FGT-B has priority 100 and healthy monitored interfaces. Override is enabled. What is the correct prediction?
FGCP high availability
✓ Correct answer
- FGT-B is preferred because monitored-link health precedes priority
Monitored-interface health is evaluated before device priority even with override enabled. Matching device priorities is unnecessary, and heartbeat-path preference is not a substitute for primary election criteria.
Open this question’s page →44. Monitored-link health, applicable HA age and device priority all tie. Which remaining criterion selects the primary?
FGCP high availability
✓ Correct answer
- Higher serial number
The higher serial number is the final primary-election tiebreaker after the stated criteria tie. Heartbeat-interface priority selects a heartbeat path, and OS uptime is not interchangeable with election HA age.
Open this question’s page →45. After cluster formation, an administrator changes FGT-A's device priority and expects FGT-B's priority to change automatically. What explains the result?
FGCP high availability
✓ Correct answer
- Device priority is member-specific and not synchronized
Device priority is deliberately member-specific. Override changes its election order; priorities need not match and are not derived from interface addressing.
Open this question’s page →46. A secondary reports out of sync after a policy change. Which action is the best diagnostic first step?
FGCP high availability
✓ Correct answer
- Compare configuration checksums and investigate the differing scope
Checksum comparison helps locate the synchronization issue. Override changes election, recalculation alone does not prove repair, and factory reset is disproportionate before identifying the cause.
Open this question’s page →47. A TCP transfer survives failover, but a UDP stream does not. Ordinary session-pickup is enabled and the topology has converged. Which additional configuration is relevant?
FGCP high availability
✓ Correct answer
- Enable the supported connectionless session-pickup setting
The additional connectionless setting synchronizes eligible UDP/ICMP state. Configuration or priority does not copy it; delayed synchronization can leave recent state uncopied rather than guaranteeing preservation.
Open this question’s page →48. Delayed session synchronization is enabled. A newly created short-lived connection is interrupted when the primary immediately fails. Which explanation fits?
FGCP high availability
✓ Correct answer
- The session may not have been copied before takeover
Delayed synchronization trades reduced workload for possible uncopied recent sessions. Priority and configuration sync do not recreate missing live state or every inspection buffer.
Open this question’s page →49. After a physical HA takeover, neighboring switches still need to learn the new forwarding location. Which cluster behavior assists convergence?
FGCP high availability
✓ Correct answer
- Use cluster virtual MAC identity and send gratuitous ARP
The cluster VMAC and gratuitous ARP preserve gateway identity and update neighboring learning. Changing client gateways or waiting solely for DHCP does not provide the documented takeover behavior.
Open this question’s page →50. The cluster WAN route fails, yet an administrator still reaches both members through reserved management ports. What can be concluded?
FGCP high availability
✓ Correct answer
- Management reachability does not prove production forwarding is healthy
Reserved management has member-specific routing separate from production forwarding. Reachability does not repair WAN routes, make independent gateways, or automatically move all local services.
Open this question’s page →51. An engineer adds each reserved member management address to FortiManager as an unrelated firewall. What is the normal management approach for the logical cluster?
FGCP high availability
✓ Correct answer
- Manage the cluster through its shared cluster address
The shared cluster address identifies the coordinated firewall to FortiManager. Independent management/policy assumptions or disabling sync conflict with the common cluster configuration.
Open this question’s page →52. In the usual uninterruptible HA upgrade, which operation occurs before upgrading the former primary?
FGCP high availability
✓ Correct answer
- An upgraded secondary takes over primary operation
Secondaries upgrade first and an upgraded member takes over before the former primary upgrades. Simultaneous reboot defeats this rolling sequence, and priority equality is not its prerequisite.
Open this question’s page →53. A recovered preferred member retakes primary and users observe a second interruption. Which enabled HA feature could explain that behavior?
FGCP high availability
✓ Correct answer
- Override preferring its higher device priority
Override can prefer the recovered member by higher device priority. Checksum, delayed session synchronization and reserved management addressing do not establish this election preference.
Open this question’s page →54. During a test, client TCP sessions survive a member failure but the administrator's GUI session to that member ends. What is the best interpretation?
FGCP high availability
✓ Correct answer
- Eligible transit session pickup does not guarantee local management-session continuity
Locally terminated management state can be interrupted even when supported transit connections survive. This observation does not establish DHCP failure or lost configuration.
Open this question’s page →55. Which three preparations help form a supported physical FGCP cluster? Select three answers.
FGCP high availability
✓ Correct answers
- Connect corresponding production interfaces to the required common Layer 2 networks
- Use compatible same-model members and matching firmware
- Coordinate group/password/heartbeat settings
Hardware/firmware compatibility, common HA membership settings and usable production topology are fundamental. Licenses are generally individual, and mismatched operation modes are not a redundancy technique.
Open this question’s page →56. Which two measures reduce different HA single points of failure? Select two answers.
FGCP high availability
✓ Correct answers
- Provide redundant heartbeat connectivity
- Provide redundant surrounding switching, power and upstream paths
Redundant heartbeat paths protect communication; surrounding redundancy protects power and production connectivity. Priority cannot replace a lost heartbeat path, and active-active does not remove external single points of failure.
Open this question’s page →57. Which three settings may remain different per member without representing an ordinary synchronized-policy error? Select three answers.
FGCP high availability
✓ Correct answers
- Hostname
- Device priority
- Reserved management interface configuration
Hostname, priority and reserved management are member-specific exceptions. Ordinary shared forwarding policies and production routing belong to the synchronized cluster configuration.
Open this question’s page →58. Which three observations should be collected to explain an unexpected failover? Select three answers.
FGCP high availability
✓ Correct answers
- HA role/selection history and synchronization state
- Monitored-interface and heartbeat health
- HA/system events showing the trigger
Role/history, monitored and heartbeat health, and HA events help explain the trigger. Priority alone ignores earlier criteria, and OS uptime alone does not establish HA age.
Open this question’s page →59. Which two statements correctly limit claims of seamless session failover? Select two answers.
FGCP high availability
✓ Correct answers
- Some proxy/local state or peer behavior can still interrupt an application
- Supported synchronized session state and topology convergence are prerequisites
Application continuity depends on supported live state, network convergence and peers. Configuration alone, one test, and election priority cannot guarantee preservation of every traffic type.
Open this question’s page →60. Before and after an HA firmware hop, which three checks support a dependable upgrade? Select three answers.
FGCP high availability
✓ Correct answers
- Recheck firmware consistency, roles, routes/VPNs and representative traffic
- Confirm member health and synchronization before starting
- Retain a compatible backup and member management access
Health, recovery access and operational validation reduce upgrade risk. Firmware is not the first fix for an unresolved physical heartbeat fault, and GUI reachability does not validate production continuity.
Open this question’s page →61. A user reports intermittent loss, and a physical port's error counters increase rapidly during the complaint. What is the best first investigation?
Connectivity and resources
✓ Correct answer
- Check the cable/transceiver and speed/duplex/link conditions
Rising physical counters directly support cable/transceiver and speed/duplex investigation. Routing, session-limit or signature changes do not repair the evidenced link fault.
Open this question’s page →62. A new client VLAN cannot obtain expected connectivity even though its switch uplink and FortiGate port both show link-up. What must still be verified?
Connectivity and resources
✓ Correct answer
- VLAN tagging/membership and the logical interface path
Check VLAN tagging and the logical interface path despite link-up. A route or accept policy does not deliver traffic from a wrongly placed VLAN, and physical link state is not universal VLAN permission.
Open this question’s page →63. A FortiGate-originated test fails only when sourced from an address on an isolated management network. What makes the test more representative of the intended routed path?
Connectivity and resources
✓ Correct answer
- Select an appropriate existing interface source and reset ping options afterward
Source selection changes the locally generated test path. Use an address belonging to FortiGate and clean up options; arbitrary spoofed sources, WAN management services and universal conclusions are inappropriate.
Open this question’s page →64. Interpret this lab command: diagnose sniffer packet any 'host 192.0.2.20 and tcp port 443' 4 20 a Which interpretation is correct?
Connectivity and resources
✓ Correct answer
- Capture matching packets on any interface at verbosity 4, stop after 20, and use absolute UTC timestamps
The arguments are interface/filter, verbosity, packet count and timestamp format. The command is a filtered finite capture, not a probe generator or a reversed-argument specification.
Open this question’s page →65. A newly reproduced software-processed SYN is absent from a correctly scoped FortiGate ingress capture; acceleration visibility has been accounted for. What should be checked next?
Connectivity and resources
✓ Correct answer
- The client's upstream path to the expected FortiGate interface
With capture scope and software visibility established, investigate the upstream path first. Forwarding policy, NAT and return routing are later stages and cannot explain the initial packet never reaching the observed ingress.
Open this question’s page →66. A SYN enters FortiGate, but no expected outbound SYN appears. Which tool can expose the firewall's route/policy/NAT decision for the CPU-processed test?
Connectivity and resources
✓ Correct answer
- A narrowly filtered debug-flow trace
Debug flow shows CPU processing decisions across route, policy, NAT and drops. A route listing or final log has narrower scope; a remote capture does not expose internal decision stages.
Open this question’s page →67. The capture shows a translated SYN leaving WAN repeatedly and no SYN/ACK returning. What is the most appropriate next investigation?
Connectivity and resources
✓ Correct answer
- Destination reachability and the downstream/return route
Egress SYNs without replies direct investigation downstream or to return routing. They do not prove a destination failure versus filtering, but the observed packet already passed initial ingress/forwarding and has a destination IP.
Open this question’s page →68. A SYN/ACK reaches WAN, but the expected LAN response does not leave. Which checks are best aligned with the observation?
Connectivity and resources
✓ Correct answer
- Session/reverse-NAT state and the return packet's route/processing
The response reached WAN, so inspect return processing, session state and reverse translation toward LAN. Earlier lookup/ingress steps and certificate replacement do not directly explain this missing return egress.
Open this question’s page →69. A filtered debug-flow trace explicitly reports a policy denial for a new client session. What should be inspected next?
Connectivity and resources
✓ Correct answer
- The matching policy conditions and ordering for that tuple
The explicit deny directs attention to matching policy conditions and order. Certificate changes, offload and arbitrary route changes do not grant the required forwarding authorization.
Open this question’s page →70. Debug flow reports a failed reverse-path check rather than an explicit policy denial. What should be investigated?
Connectivity and resources
✓ Correct answer
- Source reachability through the expected incoming route/interface
A reverse-path failure concerns route consistency for the source/ingress path. Destination-policy order, NAT and an IPS sensor do not by themselves correct that source route.
Open this question’s page →71. A long-lived accelerated session transfers data, but ordinary CPU debug flow shows no packets. What is the most accurate conclusion?
Connectivity and resources
✓ Correct answer
- Hardware offload can explain incomplete debug visibility
Offloaded traffic can bypass the observed software processing path. An empty trace does not prove no traffic, and changing operating mode is not a visibility diagnosis.
Open this question’s page →72. An eight-core system averages modest CPU usage, but one core remains near saturation during failures. What does this show?
Connectivity and resources
✓ Correct answer
- Aggregate CPU averages can hide a bottleneck on one core
Per-core saturation can coexist with a lower aggregate average. It does not prove conserve mode or universal acceleration, and low average CPU alone cannot exclude a bottleneck.
Open this question’s page →73. Memory rises continuously while traffic and session counts remain stable. What is the best response before restarting the device?
Connectivity and resources
✓ Correct answer
- Record process/resource evidence and investigate unexplained growth
Steady workload with rising memory warrants process/state investigation. Threshold changes do not solve the cause, a session surge contradicts the stated evidence, and deleting logs loses useful observations.
Open this question’s page →74. The FortiGate exits conserve mode, but antivirus-proxy bypass remains until an administrator changes the failopen setting. Which setting explains this?
Connectivity and resources
✓ Correct answer
- av-failopen one-shot
One-shot intentionally preserves proxy bypass after recovery. Pass resumes once the condition resolves, off blocks applicable new proxy sessions, and IPS fail-open is the flow-engine control.
Open this question’s page →75. Memory reaches the configured extreme threshold while proxy and flow fail-open settings permit bypass. What happens to new sessions?
Connectivity and resources
✓ Correct answer
- They are dropped under extreme-memory handling
Extreme handling drops new sessions regardless of ordinary proxy and flow fail-open choices. Those bypass settings do not supersede extreme-memory protection.
Open this question’s page →76. Conserve mode is active with av-failopen off. Which two behaviors are documented for applicable proxy traffic? Select two answers.
Connectivity and resources
✓ Correct answers
- Existing applicable sessions may terminate if they request more memory
- New applicable proxy sessions are blocked
Off blocks new applicable proxy sessions; existing sessions may continue unless more memory is needed. It neither guarantees that all existing sessions immediately end or always survive nor unconditionally disables unrelated engines.
Open this question’s page →77. Which two statements correctly describe flow-based inspection in conserve mode? Select two answers.
Connectivity and resources
✓ Correct answers
- ips global fail-open disable drops new flow-inspected sessions
- ips global fail-open enable bypasses IPS-engine scans and permits packets below extreme handling
The IPS global fail-open setting controls the flow-engine conserve decision. It is distinct from proxy av-failopen; enabling bypass does not preserve scans or override extreme-memory new-session drops.
Open this question’s page →78. A finite debug-flow lab test is complete. Which two actions are appropriate? Select two answers.
Connectivity and resources
✓ Correct answers
- Stop the flow trace and disable/reset debugging
- Restore any temporarily disabled acceleration on the scoped test policy
End diagnostic collection and restore temporary test changes. Broad tracing/session deletion creates unnecessary impact, and filtering does not make diagnostic work completely cost-free.
Open this question’s page →79. Which three observations help distinguish load growth from a resource defect? Select three answers.
Connectivity and resources
✓ Correct answers
- Repeated process CPU/memory samples
- Session and new-session rates compared with normal periods
- Traffic volume and recent configuration changes
Repeated process/resource samples, session-rate baselines and traffic/change evidence distinguish workload from unexplained growth. A lone aggregate CPU value or a post-reboot screenshot lacks the required trend/context.
Open this question’s page →80. A client has a correct address but fails at the network layer. Which three checks should precede changing malware signatures? Select three answers.
Connectivity and resources
✓ Correct answers
- Link/error and VLAN conditions
- ARP/neighbour resolution to the intended next hop
- Forward and return route selection
Physical/logical connectivity, neighbor resolution and bidirectional routing must work before content controls can matter. Signature dates and category overrides do not repair a network-layer path.
Open this question’s page →81. A cloud design requires customer-controlled IPsec termination, SD-WAN and detailed FortiOS NAT/routing behavior. Which solution is the best fit?
Public cloud and FortiGate CNF
✓ Correct answer
- FortiGate-VM
FortiGate-VM supplies customer-controlled FortiOS networking and inspection. CNF has a different managed-service feature set; native route tables, security groups and a load balancer alone do not supply the stated FortiOS IPsec/SD-WAN behavior.
Open this question’s page →82. A cloud FortiGate-VM's public GUI is reachable, but protected workload traffic never appears in a correctly scoped new-session capture. What should be checked first?
Public cloud and FortiGate CNF
✓ Correct answer
- Workload subnet routing and cloud traffic steering to the appliance
Verify the workload traffic path and native transit restrictions. Management reachability tests another path; an appliance policy cannot inspect traffic that never arrives, and management-only routes do not establish workload steering.
Open this question’s page →83. A new AWS FortiGate-VM accepts its documented initial HTTPS login. Which credential detail remains relevant when configuring SSH access?
Public cloud and FortiGate CNF
✓ Correct answer
- AWS SSH also requires the selected AWS key
The documented AWS SSH workflow also uses the selected AWS key. A valid HTTPS password or license does not substitute for it; AWS documents the instance ID as the initial password.
Open this question’s page →84. An Azure UDR contains intended destination routes through the appliance, but it is not associated with the protected subnet. What is the likely result?
Public cloud and FortiGate CNF
✓ Correct answer
- The protected subnet does not use that UDR solely because it exists
The route table must be associated with the intended subnet. A valid license or reachable public management address does not apply traffic steering to workload subnets.
Open this question’s page →85. A cloud public address is mapped by the provider to the VM's private NIC address. What should a FortiGate traffic diagnosis account for?
Public cloud and FortiGate CNF
✓ Correct answer
- The address tuple actually visible inside the instance
Provider mapping can change what the VM sees. Correlate public and private tuples rather than assume direct public ownership; translation still needs a correct stateful return path.
Open this question’s page →86. FGCP reports a healthy AWS cross-zone takeover, but required cloud route updates fail with permission errors. What should be investigated?
Public cloud and FortiGate CNF
✓ Correct answer
- The instance role/IAM permissions used by the cloud failover integration
Cloud failover may need authorized API changes to routes/addresses. FortiOS routes and management addressing do not grant AWS API permissions; ordinary physical Layer 2 takeover assumptions are insufficient for this cross-zone design.
Open this question’s page →87. A team grants CNF access only to read resource metadata. Endpoint creation and S3 log delivery then fail. Which conclusion follows?
Public cloud and FortiGate CNF
✓ Correct answer
- The documented integration needs permissions beyond read-only discovery
CNF integration includes endpoint deployment and logging operations. Read-only access is insufficient for those tasks; the failures do not establish universal endpoint limitations, account equality or customer-managed infrastructure.
Open this question’s page →88. An exam practice scenario explicitly uses the CNF 25.3.a Azure creation workflow. It requires east-west workload inspection. What limitation must be considered?
Public cloud and FortiGate CNF
✓ Correct answer
- That documented Azure CNF workflow excludes east-west configurations
The restriction is scoped to the cited CNF Azure workflow. It does not imply all Azure FortiGate-VM designs lack east-west inspection, and AWS examples or a FortiOS baseline do not establish CNF service parity.
Open this question’s page →89. A CNF instance and endpoint are active, but inter-VPC traffic takes a route that bypasses the inspection VPC. What change addresses the security gap?
Public cloud and FortiGate CNF
✓ Correct answer
- Correct the transit and route design to insert inspection
Correct the route design to insert inspection. Capacity and stronger policy/signatures cannot inspect traffic routed around the service.
Open this question’s page →90. Which three steps remain customer responsibilities in a managed CNF deployment? Select three answers.
Public cloud and FortiGate CNF
✓ Correct answers
- Integrate protected cloud accounts with required permissions
- Assign appropriate policy sets and endpoint placement
- Configure workload traffic routing through inspection
Customers configure accounts, policy/attachments and traffic paths. Managed infrastructure reduces underlying appliance operations but does not automatically insert every workload path.
Open this question’s page →91. Which two checks are essential for a stateful cloud inspection path? Select two answers.
Public cloud and FortiGate CNF
✓ Correct answers
- Return routing reaches a compatible session/firewall context
- Forward routing delivers intended traffic to inspection
Both directions must fit the stateful design. GUI reachability, a second running VM or a display role does not guarantee routing symmetry or cloud route installation.
Open this question’s page →92. A workload firewall requirement includes inspecting traffic content and detecting lateral attacks. Which two statements should guide design? Select two answers.
Public cloud and FortiGate CNF
✓ Correct answers
- Native security groups do not automatically replace every content-inspection capability
- East-west routes must actually pass the intended inspection path
Native controls and network inspection have different capabilities, and east-west steering is required for lateral traffic. Policies cannot inspect bypassed packets; hosting and north-south protection do not prove workload/east-west coverage.
Open this question’s page →93. FortiClient displays that an endpoint is managed, but an allowed browser test produces no FortiSASE traffic logs. What should be checked next?
FortiSASE and onboarding
✓ Correct answer
- Access-tunnel state, actual traffic steering and matching logging/security policy
Registration, installer receipt and profile assignment are management-stage checks. Verify the access tunnel, actual traffic steering and relevant policy/logging path to establish enforcement.
Open this question’s page →94. An unmanaged browser follows a FortiSASE PAC file. A custom non-proxy-aware TCP application works without SWG logs. Which explanation is most likely?
FortiSASE and onboarding
✓ Correct answer
- The application is outside the proxy steering path
PAC steering applies to proxy-aware clients and does not tunnel every application. Success is not proof of inspection, and DNS filtering is not a universal traffic-redirection mechanism.
Open this question’s page →95. During SAML login, FortiSASE redirects the browser to Microsoft Entra ID, which authenticates the user and returns an assertion. Which role description is correct?
FortiSASE and onboarding
✓ Correct answer
- FortiSASE is the SP and Entra ID is the IdP
Entra ID authenticates as IdP; FortiSASE consumes the assertion as SP. The browser transports redirects rather than acting as IdP, and successful authentication still requires access authorization.
Open this question’s page →96. A user completes IdP authentication but receives the wrong private-application access. What is the best next investigation?
FortiSASE and onboarding
✓ Correct answer
- SAML group claims and FortiSASE group/policy matching
Check group claims and authorization after authentication succeeds. Renewing accepted credentials, reinstalling the same onboarding package or changing service location does not correct the stated group/policy mismatch.
Open this question’s page →97. A PAC file sends the IdP sign-in URL through a proxy that first requires that same sign-in. Users cannot finish authentication. What configuration should be checked?
FortiSASE and onboarding
✓ Correct answer
- Required IdP exclusions/direct access in the PAC authentication path
Check required direct exclusions so the user can reach the IdP before the proxy authentication completes. Requiring the unresolved login first or removing IdP reachability preserves the dependency loop.
Open this question’s page →98. An agentless proxy user receives certificate warnings only when deep inspection intercepts permitted HTTPS. Which prerequisite is relevant?
FortiSASE and onboarding
✓ Correct answer
- Trust in the required inspection CA on that client
The client must trust the inspection CA used to sign intercepted server certificates. Changing IdP, merely permitting TCP or distributing a PAC file does not establish that trust.
Open this question’s page →99. A design document claims agentless access can never reach any private application. What is the appropriate assessment?
FortiSASE and onboarding
✓ Correct answer
- Check the supported SPA design and service release; agentless private web access exists in supported designs
Support depends on the selected SPA feature, application and independent service release. Supported private web access invalidates the blanket prohibition, but it does not imply full-device or arbitrary-protocol proxy access.
Open this question’s page →100. A small supported site should steer traffic through its FortiGate gateway into FortiSASE without installing FortiClient on every site device. Which on-ramp fits?
FortiSASE and onboarding
✓ Correct answer
- Supported FortiGate secure-edge/LAN-extension connectivity
The supported secure-edge/LAN-extension on-ramp connects the site gateway using VXLAN over IPsec. A PAC is proxy-client steering; management registration or an application rule alone does not establish the site tunnel.
Open this question’s page →101. A tenant supports authenticated onboarding, but the procedure differs from another tenant's release. Which approach is sound?
FortiSASE and onboarding
✓ Correct answer
- Check the tenant's supported release and feature enablement before applying the procedure
FortiSASE features and onboarding evolve independently of the FortiOS baseline and can require enablement. Unsupported client assumptions and management-state shortcuts do not verify the selected tenant workflow.
Open this question’s page →102. Which two statements correctly distinguish CASB access models? Select two answers.
FortiSASE and onboarding
✓ Correct answers
- Inline CASB acts on supported live transactions in its inspection path
- API/out-of-band CASB can inspect supported cloud data/activity without the same user traffic path
Inline and API controls have different paths and supported activities. Neither guarantees universal coverage; bypassed inline traffic and unsupported applications/actions remain outside the relevant control scope.
Open this question’s page →103. Which three checks validate managed endpoint access beyond receiving an installer? Select three answers.
FortiSASE and onboarding
✓ Correct answers
- The expected user authenticates and establishes the access tunnel
- Allowed/blocked tests match steering and security-policy logs
- The endpoint registers online with its intended management profile
Registration/profile, authenticated tunnel and policy/path evidence validate separate stages. Filenames and managed status alone do not establish the full traffic enforcement path.
Open this question’s page →104. A remote-work design requires safe internet browsing and approved private-application access. Which two selections align with those needs? Select two answers.
FortiSASE and onboarding
✓ Correct answers
- SIA for internet-bound traffic
- SPA using the suitable supported private-access architecture
SIA and SPA address different destinations and policy paths. Location alone is not authorization, SaaS controls do not automatically grant private access, and unconditional backhaul ignores the stated design tradeoffs.
Open this question’s page →105. A general LAN-to-WAN permit appears before an overlapping contractor restriction. New contractor sessions use the general permit. Which change directly makes the restriction effective?
Firewall policies
✓ Correct answer
- Move the contractor restriction above the general permit
Sequence determines ordinary first match, so the specific restriction must precede the broad permit. Route distance changes path selection; renaming an ID and logging do not change evaluation order.
Open this question’s page →106. A policy permits source subnet Finance and requires group Finance-Users. A user outside that subnet has valid membership and credentials. Why does this policy not match?
Firewall policies
✓ Correct answer
- The source address and group requirements both must match
Different match categories combine with AND. Group membership does not waive the source address condition; multiple objects within a field usually use OR, not intersection of all subnets.
Open this question’s page →107. A fresh client connection matches all policy fields except dstintf. Routing selects wan2, but the policy names wan1. What should be investigated first?
Firewall policies
✓ Correct answer
- Check why routing chose wan2 and whether a permit covers that egress
The selected egress must match dstintf. Reordering the same mismatched policy, enabling SNAT, or widening its service does not make wan1 match a packet routed through wan2.
Open this question’s page →108. An established client TCP connection is permitted from LAN to DMZ. Only its server replies are required. Which additional policy is normally necessary?
Firewall policies
✓ Correct answer
- No reverse permit is needed for replies matching the session
Stateful replies use the existing permitted session. Separate reverse permission is needed for independent server initiation, not these replies; local-in rules address traffic terminating on FortiGate.
Open this question’s page →109. A server must both reply to client sessions and initiate independent backup sessions toward LAN. Which two statements are correct? Select two answers.
Firewall policies
✓ Correct answers
- Replies can use the existing permitted session
- Server initiation needs matching reverse-direction authorization
Replies are associated with existing state, whereas independent initiation needs a matching reverse forward policy. Local-in access concerns FortiGate itself, not transit backup traffic.
Open this question’s page →110. After tightening a policy, an already open browser connection still transfers data. New connections follow the new restriction. What best explains this observation?
Firewall policies
✓ Correct answer
- The existing session can retain its selected state
Established sessions can retain policy and forwarding state, while new sessions trigger new selection. Neither IDs nor logging grant permission; state is not restricted to DNS.
Open this question’s page →111. A policy uses an ordinary FQDN address object for portal.example.net. Which traffic characteristic does that object represent?
Firewall policies
✓ Correct answer
- Resolved destination IP addresses for that name
FQDN address objects represent resolved addresses. URL paths, certificate trust and application identification require other mechanisms. The lab hostname is illustrative, not a source reference.
Open this question’s page →112. A custom service for a web server requires destination TCP 443 and source TCP 443. Normal browsers are denied. Which change is most appropriate?
Firewall policies
✓ Correct answer
- Remove the unintended source-port restriction
Clients normally use ephemeral source ports, so requiring source 443 rejects their requests. An address object does not fix a port condition; a reverse policy is unrelated to a forward SYN mismatch.
Open this question’s page →113. A LAN-to-WAN policy permits HTTPS, but one cloud storage application must be blocked while other HTTPS continues. Which additional policy setting fits?
Firewall policies
✓ Correct answer
- An application-control profile blocking that application
HTTPS is a port service, not a unique application. Application control supplies application-specific enforcement; subnet names, schedules and numerical IDs do not identify the requested application.
Open this question’s page →114. An operator puts two interfaces in a zone and creates a zone-based permit. Traffic still has no path to the destination. Which explanation is correct?
Firewall policies
✓ Correct answer
- Grouping interfaces does not create the needed route
A zone helps policy administration but does not invent routing reachability. Logging and interface grouping cannot substitute for a usable path.
Open this question’s page →115. During an ordering investigation, what are two useful checks? Select two answers.
Firewall policies
✓ Correct answers
- Inspect the complete evaluation sequence
- Check overlapping policies using multiple interfaces or any
Complete sequence and broader interface scopes reveal overlaps that a single interface-pair view can hide. Numerical ID order is not sequence, and a grouped subset can omit relevant policies.
Open this question’s page →116. An applicable ACCEPT policy has a web-filter profile. Traffic logs show accepted session processing and a correlated security event shows a blocked category. Which interpretation is best?
Firewall policies
✓ Correct answer
- Firewall authorization succeeded, then inspection blocked content
Authorization and content inspection are successive decisions. Correlated acceptance and a later profile block can coexist; acceptance does not guarantee every request or payload is allowed.
Open this question’s page →117. The audit needs records of ordinary allowed sessions, but a policy logs only Security Events. What should be selected?
Firewall policies
✓ Correct answer
- All Sessions with a working logging destination
All Sessions requests a fuller session inventory, and records need a functioning destination. Denying traffic or changing objects/mode does not satisfy the original allowed-session logging requirement.
Open this question’s page →118. An administrator needs early visibility of long-running connections and also their eventual byte totals. Which two statements are correct? Select two answers.
Firewall policies
✓ Correct answers
- Session-start logging can provide an earlier record
- End-of-session records can provide completed totals
Start records improve timeliness; end records supply completed session totals. Starting a record cannot know future traffic, and a policy ID is unrelated to termination timing.
Open this question’s page →119. Which two facts should be established before correlating a security event with a forward traffic log? Select two answers.
Firewall policies
✓ Correct answers
- Check the session ID and timestamps together
- Confirm the same device and VDOM context
Session/time plus device/VDOM context supports correlation. Names can be reused and many different sessions can reach the same destination, so those fields alone are insufficient.
Open this question’s page →120. The FortiGate GUI works from LAN, but a workstation cannot browse the internet. What does the GUI test establish?
Firewall policies
✓ Correct answer
- The management access path to FortiGate works
GUI access terminates on FortiGate and tests management reachability. It does not prove workstation transit permission, inspection outcome or the WAN return path.
Open this question’s page →121. Which two statements accurately compare inspection modes? Select two answers.
Firewall policies
✓ Correct answers
- Flow mode inspects traffic as it passes
- Proxy mode uses buffering for supported features
Both modes can enforce security; flow processes streams and proxy buffers/proxies as required by features. Neither mode removes authorization requirements.
Open this question’s page →122. A profile feature requires proxy processing, but its policy is flow-based. What should the operator validate?
Firewall policies
✓ Correct answer
- Validate both the profile feature set and policy inspection mode
The feature must be supported by the profile feature set and policy mode. Translation, names and traffic logging do not supply proxy processing.
Open this question’s page →123. A debug record reports a forward-policy check failure at Policy 0 for a new session. Which next action is most useful?
Firewall policies
✓ Correct answer
- Compare the observed tuple and identity with the permit criteria.
Policy 0 in this forward context indicates unmatched authorization. Compare the actual ingress/egress, addresses, service and identity with the permit rules. One matching field is insufficient; a pool change or reordering a mismatched egress rule does not resolve the missing match.
Open this question’s page →124. A firewall policy uses two source subnet objects and service HTTPS. All other policy fields match. Which two clients satisfy the stated address and service conditions? Select two answers.
Firewall policies
✓ Correct answers
- A client in the first subnet using TCP 443
- A client in the second subnet using TCP 443
Either listed source object can match, but the service condition must also match. Outside sources and SSH-only sessions fail the specified fields. Other applicable fields are assumed valid.
Open this question’s page →125. What does this command change? config firewall policy move 30 before 4 end
Firewall policies
✓ Correct answer
- It places policy 30 earlier than policy 4
The move command changes sequence using existing IDs. It does not renumber policies, alter route metrics or redefine stateful reply handling.
Open this question’s page →126. A policy name appears unchanged in central logs after rule reordering. Which field can identify the same configured policy independently of its display position?
Firewall policies
✓ Correct answer
- The policy UUID
Policy UUID identifies a policy beyond its display sequence or name. Client ports, route preference and grouped GUI headings serve different purposes. Confirm device/VDOM context too.
Open this question’s page →127. A forward traffic log explicitly shows action=accept, sent bytes, and zero received bytes. Which conclusion is justified by that record alone?
Firewall policies
✓ Correct answer
- The logged session was permitted, but the return path still needs investigation
Allowed transmission is not end-to-end success. Zero receive evidence warrants return/server investigation; it does not prove ingress never happened or that an ACCEPT record was DENY.
Open this question’s page →128. Two virtual domains each have policy ID 12. A centralized search mixes their records. What is needed to avoid attributing traffic to the wrong policy?
Firewall policies
✓ Correct answer
- Use the device/VDOM and policy identity together
Policy identity needs its device and VDOM context. Name length and destination ports are insufficient; merging independent route tables does not correct attribution.
Open this question’s page →129. A FortiGate LDAP request fails even though the employee LAN-to-WAN policy allows LDAP. Why is checking only that policy insufficient?
Firewall policies
✓ Correct answer
- The LDAP request is local-out traffic with service-specific source/path considerations
FortiGate-generated requests use local-out handling and require appropriate source/interface settings and reachability. Reordering a client transit rule, adding a reverse client rule or changing a user group does not establish that generated request path.
Open this question’s page →130. For an ordinary new IPv4 forwarded connection, which two tasks remain separate? Select two answers.
Firewall policies
✓ Correct answers
- Routing must select a usable forwarding path
- The firewall policy must authorize the matching traffic
Routing supplies the path and the firewall policy supplies authorization. A policy cannot create a missing route, and destination matching alone does not satisfy the remaining policy criteria.
Open this question’s page →131. A partner requires Finance clients to use 203.0.113.20 as their external source instead of wan1 interface address. Upstream delivery is already correct and central NAT is disabled. What configuration fits?
Source and destination NAT
✓ Correct answer
- An IP pool selected by the Finance SNAT policy
An IP-pool SNAT policy controls the source shown to the partner. A VIP is destination translation; an object or route alone does not replace the source address.
Open this question’s page →132. An overload pool has one external address. Two clients contact the same server service simultaneously. How can FortiGate distinguish their translated sessions?
Source and destination NAT
✓ Correct answer
- It uses distinct translated source-port mappings
Overload uses PAT and session state to distinguish shared-address sessions. One-to-one capacity rules do not apply, and usernames or arrival guesses are not the tuple mapping mechanism.
Open this question’s page →133. A one-to-one pool contains two external addresses. Three different internal addresses need concurrent mappings. What limitation should be recognized?
Source and destination NAT
✓ Correct answer
- Only two internal addresses can have simultaneous one-to-one mappings
One-to-one disables PAT and needs a separate external address per simultaneous internal-address mapping. It neither creates addresses nor derives capacity from destination ports.
Open this question’s page →134. Which two statements distinguish an SNAT pool from an inbound VIP? Select two answers.
Source and destination NAT
✓ Correct answers
- A VIP maps the destination of incoming traffic
- An SNAT pool supplies translated source addresses
VIPs provide destination mappings and pools provide source identities. Neither object alone grants forwarding permission or creates the other object.
Open this question’s page →135. A working private LAN-to-DMZ route and permit policy are in place. Both networks know the return route, and there is no address overlap. What NAT choice normally preserves endpoint addresses?
Source and destination NAT
✓ Correct answer
- Leave NAT disabled for this routed internal path
NAT is optional when routing and authorization already satisfy the internal path. Translation objects do not create routes and would unnecessarily change endpoint identity here.
Open this question’s page →136. An SNAT pool is selected and packets leave with the correct public source, but replies never reach FortiGate. What is the strongest next check?
Source and destination NAT
✓ Correct answer
- Whether upstream delivery reaches the translated address
The outgoing capture confirms source translation, making upstream return delivery the relevant next check. Logging mode cannot deliver replies; stateful SNAT replies do not require a per-client VIP or an independent reverse permit.
Open this question’s page →137. A non-central VIP maps TCP 8443 to server TCP 443. Which two configuration choices are appropriate? Select two answers.
Source and destination NAT
✓ Correct answers
- Set the VIP external port to 8443
- Set the policy destination to the VIP
The VIP matches the external port and is selected as policy destination in non-central mode. Service matching must permit the mapped port 443; client source ports are normally ephemeral.
Open this question’s page →138. In a non-central NAT deployment, a VIP is configured and selected in an inbound policy with NAT disabled. Is DNAT disabled by that policy setting?
Source and destination NAT
✓ Correct answer
- No; the VIP performs DNAT while the switch controls SNAT
The ordinary NAT switch governs source translation. A VIP can perform DNAT without SNAT, preserving client identity; no automatic pool or global switch behavior follows.
Open this question’s page →139. Lab VIP203.0.113.30:8443 maps to 10.20.20.10:443. After DNAT, which destination is used to select the route toward the server?
Source and destination NAT
✓ Correct answer
- 10.20.20.10
Routing uses the mapped destination after DNAT. The public VIP, client source and SNAT pool serve different fields and do not identify the internal server route.
Open this question’s page →140. An external client sends a TCP SYN through a VIP. The server receives it but replies through a different router. Which condition is missing?
Source and destination NAT
✓ Correct answer
- A return path through the FortiGate session
The reply must traverse the firewall holding the translation so reverse NAT produces the expected public source. A reverse permit is not normally required for established replies; port size and IDs do not repair asymmetry.
Open this question’s page →141. Which two settings in this excerpt define the destination port translation? Select two answers. config firewall vip edit "Portal" set portforward enable set protocol tcp set extport 8443 set mappedport 443 next end
Source and destination NAT
✓ Correct answers
- mappedport identifies the internal server port
- extport identifies the incoming external port
External and mapped port fields define ingress and internal ports. Protocol chooses the transport protocol; it does not fix client source ports or reverse the port meanings.
Open this question’s page →142. An internal client and server share a subnet. The client uses the server public VIP, but the server reply bypasses FortiGate. Which change can deliberately maintain the NAT return path?
Source and destination NAT
✓ Correct answer
- Configure appropriate hairpin SNAT
SNAT can make the server reply to FortiGate, preserving stateful reverse translation. DNAT alone leaves the directly reachable client source visible; rule order and reverse permission do not force the server to use FortiGate.
Open this question’s page →143. What can split DNS do for internal access to a published application?
Source and destination NAT
✓ Correct answer
- Return the internal address to internal clients
Split DNS can direct internal clients to the internal address, avoiding the public hairpin mapping. It does not allocate IPs, expand VIP protocols or replace firewall authorization.
Open this question’s page →144. A TCP 443 port-forwarding VIP does not respond to ICMP echo. The HTTPS application has not yet been tested. What is the best conclusion?
Source and destination NAT
✓ Correct answer
- Ping alone does not test the configured TCP application mapping
A TCP-only mapping does not inherently handle ICMP. Test the published TCP service and trace its path before diagnosing server power, routing or requiring unrestricted services.
Open this question’s page →145. Which two checks are necessary when publishing a server without SNAT? Select two answers.
Source and destination NAT
✓ Correct answers
- The server return path traverses FortiGate
- The permit policy matches the VIP and mapped service in non-central mode
Correct inbound authorization and a stateful return path are required. Client ephemeral ports need not equal the server port; an SNAT pool is not required when source identity is intentionally preserved.
Open this question’s page →146. An administrator removes the policy that used a pool but leaves an ARP-enabled pool object. What should be considered?
Source and destination NAT
✓ Correct answer
- FortiGate can still answer ARP for the pool addresses
ARP-enabled IP pools can respond without policy references. Removing the rule does not by itself remove the address behavior; DHCP service is unrelated.
Open this question’s page →147. Several servers must share one public address using different TCP listening ports. Which design best fits?
Source and destination NAT
✓ Correct answer
- Non-overlapping port-forwarding VIPs
Distinct port-forwarding mappings can publish separate services through one public address. Overlaps are conflicting; SNAT and source groups do not perform this inbound destination selection.
Open this question’s page →148. Which two observations help isolate a NAT issue from a policy issue? Select two answers.
Source and destination NAT
✓ Correct answers
- Inspect the translated destination after ingress processing
- Inspect the firewall matching/deny result for that path
Translation evidence and policy decisions isolate separate stages. VIP creation cannot establish upstream delivery, and ping does not prove the external mapped TCP service path.
Open this question’s page →149. Central NAT is enabled. An operator changes the ordinary IPv4 policy NAT switch and expects a different outbound source. Where should the relevant translation rule be inspected?
Source and destination NAT
✓ Correct answer
- The central SNAT table
Central NAT places outbound translation in central SNAT rules. Local-in management, VPN selectors and administrative protocols do not control this central source-translation decision.
Open this question’s page →150. Two central SNAT rules overlap: a specific Finance rule and a broad all-source rule. Finance uses the broad translated address because that rule is evaluated first. What change addresses the observed matching cause?
Source and destination NAT
✓ Correct answer
- Place the intended specific central SNAT rule earlier
The broad first match prevents the intended translation. Moving the specific central SNAT rule earlier fixes that order; changing forward authorization, disabling the desired pool or editing a comment does not.
Open this question’s page →151. A central SNAT rule matches a client, but no forward permit policy authorizes its path. What is the expected authorization result?
Source and destination NAT
✓ Correct answer
- Traffic still needs a matching firewall permit
Central SNAT defines translation and does not grant access. All forwarded sessions still require applicable authorization; logging and pool existence do not create implicit permission.
Open this question’s page →152. Which two statements are important when converting from non-central NAT to central NAT? Select two answers.
Source and destination NAT
✓ Correct answers
- Review existing VIP references and policy NAT dependencies
- Move source translation into central SNAT rules
Conversion changes VIP/policy relationships and places source translation in central SNAT. Ordinary policy SNAT settings do not remain the controlling rules, and central translation does not replace firewall authorization.
Open this question’s page →153. In central DNAT operation, the enabled translation object maps a public address to an internal server. How should the ordinary permit policy be designed for that mode?
Source and destination NAT
✓ Correct answer
- Match the mapped destination as required by central DNAT
Central DNAT can apply independently of selecting the VIP in the ordinary policy, so authorization is built for the mapped destination. It still needs policy permission, with normal client source-port behavior.
Open this question’s page →154. Which pool best fits deterministic source-address/port allocation tied to explicitly configured internal and external ranges?
Source and destination NAT
✓ Correct answer
- Fixed port range
Fixed-port-range allocation is designed around configured internal/external ranges and deterministic address/port mapping. A one-to-one pool lacks PAT; VIPs translate destinations, and interface SNAT is a different choice.
Open this question’s page →155. A service provider wants clients assigned translated port blocks so public addresses can be shared and mappings attributed. Which pool concept fits?
Source and destination NAT
✓ Correct answer
- Port block allocation
PBA allocates translated port blocks to clients. VIPs, FQDN address objects and certificates do not perform that source port allocation.
Open this question’s page →156. Changing an SNAT pool mapping has no effect on an established download, but new connections use the new mapping. What should be examined?
Source and destination NAT
✓ Correct answer
- The session retained its previous NAT state
An existing session can preserve its translation while new sessions use new selection. That does not imply a permanent lock, protocol restriction or remote control of IDs.
Open this question’s page →157. Which two conclusions follow from an outgoing capture showing the private client source changed to the intended pool IP? Select two answers.
Source and destination NAT
✓ Correct answers
- The observed outbound session underwent SNAT
- Return delivery to the translated address still must work
The capture establishes outbound source translation, but successful return delivery is a separate requirement. It neither proves a reply nor implies DNAT through a VIP.
Open this question’s page →158. Lab policy uses set nat enable and set ippool enable but names the wrong existing pool. The partner rejects the observed source, while routing and authorization work. Which change directly fits the evidence?
Source and destination NAT
✓ Correct answer
- Select the intended pool with poolname
The selected pool controls the public source presented by this policy. Logging, arbitrary client ports and reverse authorization do not correct a wrong translated identity.
Open this question’s page →159. A user passes an LDAP credential test but cannot match a Finance-only policy. Interfaces and service are correct. What should be checked next?
Firewall authentication
✓ Correct answer
- Check the remote group membership and policy group match
Successful credential validation does not establish Finance membership. Verify the group constraint; a password reset or longer record lifetime cannot supply membership, and LDAP acceptance does not imply every-group access.
Open this question’s page →160. A remote-server reference is added to a firewall group without restricting the remote group. What is the important authorization risk?
Firewall authentication
✓ Correct answer
- The group can include more authenticated users than intended
Unrestricted remote-server matching can be broader than the intended directory group. It does not change account passwords or transform a forward policy into local-in management.
Open this question’s page →161. Lab LDAP configuration contains: set cnid "sAMAccountName" set dn "ou=Finance,dc=lab,dc=local" Users in another OU are not found despite correct passwords. Which field should be investigated first?
Firewall authentication
✓ Correct answer
- The LDAP search base dn
A base scoped to the Finance OU can exclude users outside it. Correct naming attributes and transport do not expand that search hierarchy, and an authentication timer does not locate missing directory entries.
Open this question’s page →162. FortiGate can reach the LDAP server, but a user cannot be located when cnid selects an attribute that does not contain the entered logon name. Which change fits the failure stage?
Firewall authentication
✓ Correct answer
- Use the username attribute matching the entered logon name
A correct identifier attribute lets the search locate the intended entry. Timers and broad NAT changes do not solve a search-attribute mismatch, and reachability is already established.
Open this question’s page →163. Which two facts are required for a regular LDAP bind design? Select two answers.
Firewall authentication
✓ Correct answers
- A service account with suitable read/search rights
- A search base and username attribute that locate intended users
Regular bind searches through a configured account and correct directory scope/attribute. Broad domain administration and destination translation are not inherent requirements.
Open this question’s page →164. An LDAP service supports both STARTTLS and LDAPS, with required ports reachable. Policy requires encrypted directory transport. Which two choices meet that requirement? Select two answers.
Firewall authentication
✓ Correct answers
- STARTTLS according to the server configuration
- LDAPS with appropriate certificate validation
STARTTLS and LDAPS provide TLS transport. Password length and firewall address-object type do not encrypt plain LDAP transport.
Open this question’s page →165. LDAPS TCP 636 connects successfully and LDAP server identity checking is enabled. FortiGate trusts the issuer, but the certificate identifies dc2.lab.local while the configured server name is dc1.lab.local. What remains wrong?
Firewall authentication
✓ Correct answer
- The server certificate identity does not match the contacted name
With identity checking enabled, issuer trust and server-name matching are separate requirements. The user search attribute and bind password do not fix the certificate identity, and TCP reachability does not waive TLS validation.
Open this question’s page →166. An LDAPS service-account bind fails, before the user entry is searched. Which next check best fits?
Firewall authentication
✓ Correct answer
- The service-account credentials and directory bind rights
Bind must succeed before regular search/user validation. Website signatures, VIP ports and final network byte totals do not validate service-account access.
Open this question’s page →167. Anonymous LDAP bind is selected against a directory that disallows unauthenticated searches. What is the appropriate design conclusion?
Firewall authentication
✓ Correct answer
- Select a supported authenticated bind design with required permissions
The directory must permit the chosen bind method. FortiGate policy names/IDs and web prompts do not grant directory search rights; an authenticated bind design is needed here.
Open this question’s page →168. A RADIUS server sees no request from FortiGate. Which investigation should precede resetting the user password?
Firewall authentication
✓ Correct answer
- Network reachability and the actual RADIUS client source/path
No observed request points first to delivery/client configuration. Password and group evaluation follow server receipt; management profiles and publication are unrelated.
Open this question’s page →169. A RADIUS server receives the request and returns Access-Reject. Which investigation matches that observation?
Firewall authentication
✓ Correct answer
- User credentials and server authentication/policy rules
Reject shows the request reached the server but was not accepted under credentials/policy. It is not simply missing receipt or a storage/object-type requirement.
Open this question’s page →170. A valid RADIUS response is Access-Accept with a remote group value that does not match the firewall group constraint. What should be corrected?
Firewall authentication
✓ Correct answer
- Correct the remote group/VSA match used for authorization
The returned group must satisfy the policy authorization constraint. Removing all restrictions broadens access beyond the requirement; password and timer changes do not repair the group-string mismatch.
Open this question’s page →171. A RADIUS request now leaves through a loopback source, but the server only allows the old interface IP as a client. Which two checks are appropriate? Select two answers.
Firewall authentication
✓ Correct answers
- Check the actual source IP received by the server
- Update the allowed-client definition and matching secret as required
The server must recognize the actual client identity and shared secret. Acceptance is not every-group authorization, and IP pools do not replace identity groups.
Open this question’s page →172. Which RADIUS response can request another authentication exchange rather than immediately accepting or rejecting?
Firewall authentication
✓ Correct answer
- Access-Challenge
Access-Challenge requests an additional exchange. Accept is acceptance, accounting concerns records, and a FortiGate traffic-log action is not a RADIUS response.
Open this question’s page →173. Which distinction is correct for ordinary RADIUS ports?
Firewall authentication
✓ Correct answer
- UDP 1812 is authentication and UDP 1813 is accounting
The usual authentication/accounting ports are 1812/1813 respectively. Legacy ports can differ, but reversing these roles or requiring HTTPS for traditional UDP RADIUS is incorrect.
Open this question’s page →174. Which two statements distinguish active credential authentication from RADIUS SSO? Select two answers.
Firewall authentication
✓ Correct answers
- Active authentication requests credentials through a supported workflow
- RADIUS SSO can learn identity from accounting records
Active authentication prompts through an appropriate path, whereas RADIUS SSO can use accounting-derived identity. Both still need valid identity/group policy authorization; VIPs are not username mappings.
Open this question’s page →175. A group-based permit is followed by a broad matching unauthenticated permit. Default auth-on-demand is in use, and the user sees no prompt. What explains this?
Firewall authentication
✓ Correct answer
- The session can fall through to the unauthenticated rule
Default implicitly behavior can use the later unauthenticated permit. No prompt does not establish server failure or impossibility of HTTPS authentication; routes do not store group passwords.
Open this question’s page →176. An operator intentionally wants the matching firewall authentication requirement triggered instead of implicit unauthenticated fall-through. Which setting is relevant?
Firewall authentication
✓ Correct answer
- set auth-on-demand always
auth-on-demand always changes that authentication behavior. Source validation, translation and traffic logging serve different functions. Check prerequisite access and policy design too.
Open this question’s page →177. A browser needs DNS before it can open the named captive portal. Which design fits this dependency?
Firewall authentication
✓ Correct answer
- Permit narrow DNS and portal prerequisites before identity-protected traffic.
A narrow prerequisite path permits portal resolution and authentication while protecting the remaining access. Broad unauthenticated ALL access removes that protection. Requiring the portal before its own DNS dependency creates a circular path, and ALL does not exclude DNS.
Open this question’s page →178. A non-web application is started by an unauthenticated user but cannot show a web credential form. What should the operator consider?
Firewall authentication
✓ Correct answer
- Provide a supported browser/portal authentication path first
The user needs a supported way to complete authentication, often a browser portal. Waiting, extending a timer or reordering the same requirement cannot make an arbitrary application render a web form.
Open this question’s page →179. Global auth-timeout is 10 minutes with hard-timeout. The user continuously transfers traffic beyond 10 minutes. What should be expected of the authentication timer?
Firewall authentication
✓ Correct answer
- The configured duration still expires regardless of activity
Hard timeout is duration-based despite activity. Idle timeout is the activity-dependent alternative; it does not automatically change identity method or depend solely on DNS.
Open this question’s page →180. An authenticated user starts a long download with new-session timeout 5 minutes. After 6 minutes, the user starts a separate connection requiring identity. Which two outcomes describe that mode? Select two answers.
Firewall authentication
✓ Correct answers
- The new session can require reauthentication
- The existing download can continue
New-session timeout applies reauthentication to new sessions after expiry while existing sessions can continue. It is neither a new-session-created inactivity reset nor mandatory termination of all existing transfers.
Open this question’s page →181. The global firewall authentication duration is 5 minutes, but the applicable user group has an explicitly configured authtimeout. What should be inspected before predicting expiry?
Firewall authentication
✓ Correct answer
- Inspect the group override and global timeout type
A configured group authtimeout can override the duration; the global timeout type governs the expiry behavior. Ignoring the override, treating new sessions as unconditional resets, or substituting a transport-session timer gives the wrong prediction.
Open this question’s page →182. A user idle timeout expires, yet the directory password remains valid. Why might a new protected session still require authentication?
Firewall authentication
✓ Correct answer
- The FortiGate authentication record and directory credentials are separate
Valid credentials can remain usable even when the firewall authentication record expires. Record expiry does not inherently delete directory users, change credentials or remove routes.
Open this question’s page →183. An operator uses diagnose test authserver ldap with a disposable lab password. What practical handling is appropriate?
Firewall authentication
✓ Correct answer
- Treat terminal/session history as potentially containing that password
Credential test arguments can expose passwords in captured terminal/history. Use disposable lab credentials and protect output; diagnostic testing does not require domain administration or make secrets public-safe.
Open this question’s page →184. An administrator disconnects a firewall authentication record. Which result should not be assumed?
Firewall authentication
✓ Correct answer
- The administrator management GUI session was also logged out
Firewall user records and management administrator sessions are distinct. Disconnecting the former does not inherently log out the latter or invalidate the directory password.
Open this question’s page →185. Finance users authenticated by DC1 appear in both the collector database and FortiGate. Finance users authenticated by DC2 are absent even from the collector database. What is the strongest first investigation?
Fortinet Single Sign-On
✓ Correct answer
- Whether DC2 logons are monitored and reported
The collector is missing DC2 logons before policy authorization occurs. Check collection coverage and reporting. A working DC1 delivery path contradicts a globally failed shared connector; policy membership and group names cannot create absent collector events.
Open this question’s page →186. DC-agent updates are intended for a collector at 10.0.0.10, but the agent points to 10.0.0.11. Which fix fits the failed collection stage?
Fortinet Single Sign-On
✓ Correct answer
- Correct the collector destination address/port in the agent
Reports must reach the intended collector. Group authorization, group lookup credentials and record lifetime do not correct the agent destination.
Open this question’s page →187. Which two protocol/port associations describe the usual DC-agent architecture? Select two answers.
Fortinet Single Sign-On
✓ Correct answers
- DC agent updates to collector use UDP 8002
- FortiGate collector connection uses TCP 8000
The usual DC-agent update channel is UDP 8002, while FortiGate connects to the collector using TCP 8000. The other associations swap the roles of these channels.
Open this question’s page →188. FortiGate can ping the collector but the FSSO connector cannot authenticate. What should be checked next?
Fortinet Single Sign-On
✓ Correct answer
- TCP 8000 reachability and matching connector secret
Ping establishes ICMP reachability only. The connector needs its TCP connection and matching secret. DNS, group filtering and stale-record checks affect mapping content rather than establishing this authenticated connection.
Open this question’s page →189. The collector lists a user, but the required Finance group is excluded by its group filter. Which outcome is plausible on FortiGate?
Fortinet Single Sign-On
✓ Correct answer
- The user can be known yet not satisfy the Finance policy group
A group filter limits delivered information. A known user can therefore lack the Finance group needed by the policy. A username, local policy reference or service match does not recreate that excluded group membership.
Open this question’s page →190. A user and correct IP appear in FortiGate FSSO output, but the policy expects a different group naming form. What should be investigated?
Fortinet Single Sign-On
✓ Correct answer
- Check collector directory mode and FortiGate group-name/source configuration
Group naming and source must agree with the directory-access design. A longer record lifetime, agent reinstall or password reset does not convert the delivered group into the expected naming form.
Open this question’s page →191. Which two conditions remain necessary after an FSSO mapping reaches FortiGate? Select two answers.
Fortinet Single Sign-On
✓ Correct answers
- The required identity/group must satisfy the policy
- Traffic interfaces, addresses and service must also match
Identity is one part of policy matching; traffic criteria remain independent. FSSO does not universally log users into applications or route their traffic through the collector.
Open this question’s page →192. Many Remote Desktop users share one server IP and receive the wrong per-user network access. Which component addresses this identity limitation?
Fortinet Single Sign-On
✓ Correct answer
- A Terminal Server agent with user/source-port mappings
The TS agent differentiates users sharing an IP through port associations. A single address pool or longer stale mapping does not provide that per-user differentiation.
Open this question’s page →193. FortiGate FSSO evidence for a terminal host includes separate user-associated source-port ranges. What do those ranges help identify?
Fortinet Single Sign-On
✓ Correct answer
- Which user originated a shared-host session
The TS-agent source-port association attributes a shared-IP session to its user. These ranges do not specify application listening ports, polling preference or user passwords.
Open this question’s page →194. An upstream router NATs many workstations to one address before FortiGate. The collector reports their individual private workstation IPs. What is the core mismatch?
Fortinet Single Sign-On
✓ Correct answer
- The observed traffic source differs from the mapped workstation identities
Ordinary workstation FSSO needs the source IP FortiGate sees. Upstream NAT collapses the individual addresses; connector settings, longer lifetime and group renaming do not reconstruct that distinction.
Open this question’s page →195. After DHCP assigns a workstation a new IP, the collector still associates its user with the old IP. What should be corrected?
Fortinet Single Sign-On
✓ Correct answer
- The stale identity/address mapping and its update path
The identity map must reflect the current workstation address. Policy renaming or changing a working secret does not update it; retaining the old record longer preserves the mismatch.
Open this question’s page →196. The collector resolves WS17 to an old address while a capture shows WS17 traffic from its current address. Which investigation best fits?
Fortinet Single Sign-On
✓ Correct answer
- DNS resolution and workstation mapping freshness
The observed discrepancy is between resolved and actual workstation addresses. Check DNS and mapping freshness. Group naming, a working connector secret and policy order do not correct that address resolution.
Open this question’s page →197. Which two statements correctly compare collector polling with FortiGate direct polling? Select two answers.
Fortinet Single Sign-On
✓ Correct answers
- Collector polling still uses a collector but does not require DC agents
- Direct polling can read Windows Security Event logs without a collector agent
The methods collect identity using different components. Direct polling is agentless in this design, while collector polling keeps the collector; neither substitutes for forwarding authorization.
Open this question’s page →198. A small deployment wants FortiGate itself to read relevant AD logon events without DC or collector agents. Which design fits?
Fortinet Single Sign-On
✓ Correct answer
- FortiGate direct AD polling
FortiGate direct polling reads relevant domain-controller Security Event logs without DC or collector agents. Collector polling retains a collector, and DC/TS-agent designs also use agents.
Open this question’s page →199. A polling deployment has a delay between directory logon and mapping visibility. Firewall policy has not changed. What should be examined first?
Fortinet Single Sign-On
✓ Correct answer
- Polling event availability, access and interval/status
Logon detection depends on available events, access and polling timing. Policy sequence, stale-record lifetime and policy service do not speed up the event collection stage.
Open this question’s page →200. A collector receives the logon event and resolves the current workstation IP, but its directory queries cannot obtain the required group information. Which responsibility is directly implicated?
Fortinet Single Sign-On
✓ Correct answer
- Directory group verification/lookup
The missing step is directory group verification or lookup. The scenario confirms event receipt and IP resolution; a later policy service test cannot supply the collector group-query result.
Open this question’s page →201. Two redundant collectors are configured on FortiGate, but agents report only to the primary. After primary failure, users disappear from the alternate. What is missing?
Fortinet Single Sign-On
✓ Correct answer
- Agents must report needed logons to the alternate collector too
An alternate needs actual reports to populate its logon database. A timeout or filter cannot create missing events, and adding a connector address alone does not replicate the primary database.
Open this question’s page →202. Which two checks make collector redundancy useful? Select two answers.
Fortinet Single Sign-On
✓ Correct answers
- Confirm required DC/TS reports reach all intended collectors
- Confirm FortiGate can reach and authenticate to the alternate
Useful redundancy needs both identity reports and an authenticated FortiGate connection. Adding an address does not copy logons, and ping alone cannot prove the relevant TCP connection and secret.
Open this question’s page →203. Which command most directly inspects FortiGate collector connection status?
Fortinet Single Sign-On
✓ Correct answer
- diagnose debug authd fsso server-status
FSSO server-status examines collector/server connections. Pool, route and VPN listings serve other subsystems and do not directly show FSSO connector authentication.
Open this question’s page →204. Which command most directly lists the FSSO logon mappings FortiGate knows?
Fortinet Single Sign-On
✓ Correct answer
- diagnose debug authd fsso list
FSSO list provides logon mappings. VIP, HA and SD-WAN commands inspect different components and cannot establish user/IP/group delivery.
Open this question’s page →205. The collector reports the correct user/IP/groups and the FortiGate mapping agrees, but only SSH is denied by a policy allowing HTTPS. What is the strongest next check?
Fortinet Single Sign-On
✓ Correct answer
- The firewall policy service condition
Correct identity does not waive service matching. SSH does not satisfy HTTPS; rebuilding the collection chain or clearing all users ignores the confirmed working stages.
Open this question’s page →206. A new user signs in on a host without changing its IP. The old identity remains associated with traffic. What should be investigated?
Fortinet Single Sign-On
✓ Correct answer
- Inspect current logon mapping and fast-user-switch/shared-host behavior
The same IP can represent a changed active user, requiring current logon/shared-host state. Retaining stale records, changing an otherwise working secret or altering a service does not establish the active identity.
Open this question’s page →207. Which two observations separate FSSO collection from final authorization? Select two answers.
Fortinet Single Sign-On
✓ Correct answers
- The collector can observe a logon before the required group reaches FortiGate
- A correct FortiGate mapping can still fail a policy service match
Collection, delivered group mapping and policy matching are separate stages. Observed logons and valid credentials do not imply unrestricted application or rule access.
Open this question’s page →208. For one affected user, which troubleshooting sequence is most useful?
Fortinet Single Sign-On
✓ Correct answer
- Trace DC event, collector mapping, delivery, FortiGate record and policy match.
Following the identity chain isolates the first failed stage. A connector can work while a mapping is missing or stale. Policy edits and longer lifetimes before checking collection can retain the wrong association or mask the cause.
Open this question’s page →209. A policy uses certificate inspection and AV. A blocked website category works, but a test file from an allowed HTTPS host passes. Which change supplies the missing visibility?
Certificates and encrypted traffic
✓ Correct answer
- Apply suitable deep SSL inspection and client CA trust
Deep inspection exposes the encrypted file body to AV. More traffic logging or a scanner-mode change cannot decrypt it, and certificates are not firewall address objects.
Open this question’s page →210. Managed browsers accept deep inspection, but one mobile application rejects its substituted certificate. What should be investigated first?
Certificates and encrypted traffic
✓ Correct answer
- Certificate pinning or app-specific trust requirements
Pinning or a separate app trust store explains rejection despite OS trust. NAT and DHCP relay do not resolve substituted-certificate validation; trusting the untrusted inspection CA defeats its purpose.
Open this question’s page →211. A company wants inbound TLS inspection for its own published server while clients see the expected server identity. Which configuration fits?
Certificates and encrypted traffic
✓ Correct answer
- Protecting SSL Server with its certificate and private key
Protecting SSL Server uses the controlled server identity and matching private key. Certificate-only inspection and Exempt do not provide payload inspection; outbound replacement signing is a different use case.
Open this question’s page →212. A flow policy uses full inspection. TCP 8443 is decrypted although HTTPS mapping lists only 443. What explains this?
Certificates and encrypted traffic
✓ Correct answer
- Flow deep inspection scans all ports irrespective of mapping
Flow deep inspection scans all ports. NAT has no automatic port conversion rule of that kind, AV modes do not determine decryption, and denied traffic is not the inspection case.
Open this question’s page →213. A proxy full-inspection profile has Inspect all ports disabled and HTTPS mapping 443. A service on 8443 lacks decryption. Which narrowly scoped change fits?
Certificates and encrypted traffic
✓ Correct answer
- Add 8443 to the HTTPS mapping
Proxy deep inspection honors mapping unless all-ports inspection is enabled. Adding the known port addresses the cause without changing unrelated application actions or suppressing trust checks.
Open this question’s page →214. An SSL profile uses Server certificate SNI check = Strict. SNI and the certificate SAN/CN do not match. What is expected?
Certificates and encrypted traffic
✓ Correct answer
- The connection closes
Strict closes a mismatched connection. Using CN on mismatch describes Enable; inspection mode and CA renewal are separate settings.
Open this question’s page →215. SNI disagrees with the certificate name and Server certificate SNI check is Enable. Which name is used for URL filtering?
Certificates and encrypted traffic
✓ Correct answer
- The server certificate CN.
In the documented Enable mode, an SNI/name mismatch falls back to the server certificate CN for URL filtering. It does not always retain the mismatched SNI, perform reverse-DNS selection, or choose the first SAN arbitrarily.
Open this question’s page →216. A user trusts the inspection CA, but FortiGate rejects an upstream chain issued by a private CA. Which change targets the upstream validation problem?
Certificates and encrypted traffic
✓ Correct answer
- Install the appropriate CA certificate in FortiGate's trust store.
FortiGate must trust the upstream issuer chain. Endpoint trust of replacement certificates is a separate relationship; duplicating that CA or changing a name-check setting does not supply the upstream issuer trust.
Open this question’s page →217. An administrator receives an issued certificate after generating a CSR. What must be retained to use it as FortiGate's identity?
Certificates and encrypted traffic
✓ Correct answer
- The matching private key associated with the request.
The issued certificate matches the key associated with its original request. Its public certificate alone cannot prove possession, and an unrelated or newly generated key does not match it.
Open this question’s page →218. A policy is intended to inspect multiple local clients connecting to external HTTPS servers, rather than protect a published SSL server. One allowed session shows the original public certificate issuer. Which conclusion is justified?
Certificates and encrypted traffic
✓ Correct answer
- Certificate-only inspection or an exemption should be investigated.
For the stated outbound multi-client use case, an original public issuer suggests no replacement certificate was presented for this session. Check certificate-only mode and exemptions. Endpoint trust and policy acceptance alone do not prove decryption, and issuer identity does not establish certificate expiry.
Open this question’s page →219. Deep inspection allows a validation failure using Trust & Allow. What changes for the client?
Certificates and encrypted traffic
✓ Correct answer
- FortiGate presents a trusted re-signed certificate
Trust & Allow changes the client-facing trust view. Keep Untrusted & Allow preserves the failure; neither action changes public CA status or skips firewall matching.
Open this question’s page →220. A user sees a FortiGate CA warning only when a website is blocked. Allowed sites show their original issuer. Which explanation fits?
Certificates and encrypted traffic
✓ Correct answer
- Certificate inspection signs HTTPS replacement pages
Certificate inspection can sign a replacement page without decrypting all allowed content. Browser CA checks still apply; a single block does not globally change inspection mode.
Open this question’s page →221. In the 7.6.0 SSL-profile documentation, an upstream CA is untrusted. Which default action is listed?
Certificates and encrypted traffic
✓ Correct answer
- Allow
The documented untrusted-CA default is Allow. Block is configurable; Ignore is a full-inspection choice, not the default, and upstream CAs are not automatically trusted.
Open this question’s page →222. An SSL profile uses certificate inspection. Why is its HTTP/3 action unavailable for editing?
Certificates and encrypted traffic
✓ Correct answer
- HTTP/3 is fixed to Bypass in that inspection method.
Certificate inspection fixes HTTP/3 to Bypass. Changing the policy processing mode or endpoint trust does not change the inspection method; full inspection exposes other actions. HTTP/3 uses QUIC over UDP.
Open this question’s page →223. Blocking UDP QUIC does not restore access for one client. What is the best interpretation?
Certificates and encrypted traffic
✓ Correct answer
- TCP fallback is not guaranteed by blocking QUIC
Fallback depends on client support and behavior. NAT cannot guarantee it; failure does not establish a routing bypass or rule out TCP inspection.
Open this question’s page →224. A correctly named, unexpired server certificate is listed as revoked by its issuing CA. Which distinction matters?
Certificates and encrypted traffic
✓ Correct answer
- Revocation can invalidate an otherwise correctly signed certificate
Revocation is an independent validity issue. Name and date checks do not cancel it, and CRLs list revocations rather than private keys.
Open this question’s page →225. The FortiGate GUI uses a new management HTTPS certificate, but outbound deep inspection still uses the old inspection CA. Why?
Certificates and encrypted traffic
✓ Correct answer
- Management identity and the SSL-profile signing CA are configured separately.
Management HTTPS identity and the SSL-profile CA are separate configurations. A service permit or reboot does not merge those roles or change the profile signing CA.
Open this question’s page →226. A reference URL begins with /fortigate/7.6.0/new-features/ but its title ends in 7.6.3. How should an exam author treat its new flow ECH controls?
Certificates and encrypted traffic
✓ Correct answer
- Exclude them from assumed 7.6.0 baseline behavior
The explicit feature release determines applicability. The version-tree prefix is not proof of baseline support, nor does it imply removal or a NAT dependency.
Open this question’s page →227. Before broad outbound deep-inspection deployment, which two trust preparations are appropriate? Select two answers.
Certificates and encrypted traffic
✓ Correct answers
- Distribute the public inspection CA to managed endpoint trust stores
- Protect the inspection signing CA's private key
Endpoints need the public signing CA, and the private key must be controlled. Trusting the untrusted CA hides upstream failures; distributing the signing key creates unnecessary key exposure.
Open this question’s page →228. Which two failures can reject a certificate whose leaf signature is cryptographically valid? Select two answers.
Certificates and encrypted traffic
✓ Correct answers
- The requested hostname is absent from SAN
- The chain cannot reach a trusted root
Identity mismatch and chain failure are independent certificate checks. Service-object names and traffic logging do not invalidate a certificate signature or identity.
Open this question’s page →229. Which two profile settings directly explain why an accepted HTTPS session remains encrypted to AV? Select two answers.
Certificates and encrypted traffic
✓ Correct answers
- Certificate inspection is selected
- The session matches a deep-inspection exemption
Certificate inspection and SSL exemption remove payload visibility. Log destination and source-address matching alone do not prevent decryption.
Open this question’s page →230. Which two statements about TLS port coverage are correct for 7.6.0? Select two answers.
Certificates and encrypted traffic
✓ Correct answers
- Certificate inspection in either mode honors mapping unless all-ports is enabled
- Flow deep inspection scans all ports regardless of mapping
Flow deep inspection and certificate inspection have different mapping rules. Proxy deep inspection honors mapping, and the built-in certificate profile is read-only and covers 443.
Open this question’s page →231. A supported proxy policy must scan SFTP file transfers. Which two related settings must be considered? Select two answers.
Certificates and encrypted traffic
✓ Correct answers
- SSH deep scan and appropriate SSH port coverage
- An AV profile with supported SSH file inspection
SSH payload visibility and supported AV configuration are required. HTTPS certificate mapping and web quotas do not decrypt or scan SSH file content.
Open this question’s page →232. Which two observations help isolate a certificate failure rather than merely proving IP connectivity? Select two answers.
Certificates and encrypted traffic
✓ Correct answers
- The SSL event identifies a validation or SNI failure
- The client certificate viewer shows the presented issuer
SSL events and the presented certificate directly examine trust/inspection. Link and DHCP status establish earlier connectivity prerequisites, not certificate validity.
Open this question’s page →233. A URL matches a static Allow entry, but its Gambling category is blocked. What is expected?
Inspection modes and web filtering
✓ Correct answer
- The category block can still deny access
Static Allow continues later filtering; Exempt is the bypass action. Neither the policy action nor the website category is rewritten by Allow.
Open this question’s page →234. A user needs a daily 30-minute allowance for a monitored category. Which deployment supports it on 7.6.0?
Inspection modes and web filtering
✓ Correct answer
- A supported proxy policy with a matching proxy web profile
Category usage quota is a proxy feature. Feature visibility, SSL inspection, shaping or an IP override cannot add that capability to flow.
Open this question’s page →235. A supplier's public category is wrong. Its downloads must retain AV inspection. Which change best addresses this?
Inspection modes and web filtering
✓ Correct answer
- Use a local rating override to an allowed category
A local rating override changes classification while keeping other controls. Broad Exempt and AV removal weaken inspection; Allow still encounters the denied category.
Open this question’s page →236. An expired Web Filtering subscription causes rating errors. What does enabling error-allow accomplish?
Inspection modes and web filtering
✓ Correct answer
- Requests with failed ratings may pass
Error-allow changes availability behavior during a failed lookup. It does not repair licensing, reclassify all sites or remove independent static rules.
Open this question’s page →237. A flow policy references a proxy-feature-set web profile. Which check should precede changing category actions?
Inspection modes and web filtering
✓ Correct answer
- Align the profile feature set with policy mode
Mode/profile compatibility is a prerequisite. Routes, category action changes and management certificates do not correct that mismatch.
Open this question’s page →238. A simple static entry blocks www.vendor.test. Traffic to files.vendor.test still passes the static stage. Why?
Inspection modes and web filtering
✓ Correct answer
- The simple hostname entry does not cover other subdomains
Simple matching does not automatically include every hostname variant. Authentication, proxy-only behavior and AV inheritance are not the rule described.
Open this question’s page →239. A broad URL Block pattern overlaps a required specific exception. Which ordering should be tested?
Inspection modes and web filtering
✓ Correct answer
- Place the specific deliberate exception before the broad match
Specific exceptions should precede broad matching entries. Category severity and routing do not establish URL-filter exception ordering.
Open this question’s page →240. Both domain and public IP rating are enabled and return different categories. What determines the effective result?
Inspection modes and web filtering
✓ Correct answer
- FortiOS category rating weights.
The effective category follows FortiOS rating weights. Neither domain nor IP automatically wins in every case, and changing an action does not replace the category-weight selection rule.
Open this question’s page →241. A correct new category rating is visible at FortiGuard, but one FortiGate still enforces the previous category. What should be examined?
Inspection modes and web filtering
✓ Correct answer
- The cached rating and refresh behavior
Cached web ratings can explain this difference. DHCP, management identity and IPS engine sizing do not determine the stored category result.
Open this question’s page →242. A web category uses Monitor. A forward traffic log is also enabled. What distinguishes the web action?
Inspection modes and web filtering
✓ Correct answer
- It permits and creates a category web-filter event
Monitor permits while logging the category decision. It neither blocks, broadly exempts nor changes the public rating.
Open this question’s page →243. A daily volume quota has been exhausted. Traffic is currently below the bandwidth limit. Why can category access still be blocked?
Inspection modes and web filtering
✓ Correct answer
- Quota measures cumulative use rather than current rate
Cumulative allowance and traffic rate are different controls. Low throughput does not imply TLS failure, and quotas are neither routing distances nor deny-policy mechanisms.
Open this question’s page →244. A temporary web-profile override applies to an IP used by several users. What risk follows?
Inspection modes and web filtering
✓ Correct answer
- Other users behind that address may receive the exception.
An IP-scoped override can extend access to other users sharing that address. It does not automatically differentiate those users or require each to request it, and it does not rewrite public category ratings.
Open this question’s page →245. An HTTPS rule should permit /research but block /games on one host. Certificate inspection sees the host but no path. What is needed?
Inspection modes and web filtering
✓ Correct answer
- Suitable deep SSL inspection
Path matching requires decrypted HTTP information. Routes and quotas do not expose the path; a second rule for the same visible hostname cannot distinguish encrypted paths.
Open this question’s page →246. A traffic event says action=accept, while a web event for the same session says action=blocked. Which interpretation fits?
Inspection modes and web filtering
✓ Correct answer
- The later web-filter decision denied an accepted connection
A firewall accept and later UTM denial can coexist. Correlate session fields; accept does not cancel the security event, and no route removal is established.
Open this question’s page →247. Synthetic event: type="utm" subtype="webfilter" policyid=25 profile="staff" action="blocked". Which field identifies the enforcing security engine?
Inspection modes and web filtering
✓ Correct answer
- subtype="webfilter"
Subtype identifies the web-filter engine. Policy ID and profile locate configuration; action records the result but does not uniquely identify which engine enforced it.
Open this question’s page →248. No web-filter event appears for a test site. The tested traffic matched an earlier accepting policy without a web profile. What should change first?
Inspection modes and web filtering
✓ Correct answer
- Correct policy matching or attach the intended profile there
The actual matched policy must apply the control. Cache, URL action and AV limits cannot make an unattached web profile process that traffic.
Open this question’s page →249. A browser reaches a category Warning page over HTTPS but reports an untrusted issuer. Which preparation targets this?
Inspection modes and web filtering
✓ Correct answer
- Trust the CA signing the replacement page on the client.
The client must trust the CA signing the HTTPS interaction page. Upstream validation on FortiGate, traffic logging and hostname policy actions do not install that signing-CA trust on the endpoint.
Open this question’s page →250. An affected physical FortiGate with 2 GB RAM lacks proxy web quotas. Which conclusion is appropriate?
Inspection modes and web filtering
✓ Correct answer
- The documented model limitation prevents that proxy feature
The physical-model restriction cannot be bypassed by GUI visibility. It should not be generalized solely by VM RAM, and a URL exception does not enable proxy capability.
Open this question’s page →251. A denied request has a valid Unrated classification, not a rating-error message. Which change directly investigates the observed policy decision?
Inspection modes and web filtering
✓ Correct answer
- Inspect the configured Unrated category action
Unrated is a category result. Error-allow handles failed lookups, while DHCP and IPS selection do not target this web classification decision.
Open this question’s page →252. A research exception should last two hours for one authenticated analyst, while normal policy resumes afterward. Which feature best expresses the need?
Inspection modes and web filtering
✓ Correct answer
- A timed user-scoped web-profile override
A timed user override changes effective filtering for the intended person. Permanent classification changes, AV bypass and routing are broader or unrelated controls.
Open this question’s page →253. A web-filter feature appears under Proxy Options, but the policy is flow. Which setting is documented as supported there?
Inspection modes and web filtering
✓ Correct answer
- Remove Cookies
Remove Cookies is one of the limited proxy-grouped options supported in flow. Java removal, keyword logging and quotas are proxy-only in the baseline.
Open this question’s page →254. Which two web-filter features require proxy mode in the 7.6.0 comparison? Select two answers.
Inspection modes and web filtering
✓ Correct answers
- Web-profile overrides
- Category usage quotas
Quotas and profile overrides require proxy. Static URL and category filtering are supported in both inspection modes.
Open this question’s page →255. Which two statements distinguish static URL Allow from Exempt? Select two answers.
Inspection modes and web filtering
✓ Correct answers
- Allow continues to later filtering
- Exempt can bypass selected operations
Allow continues; Exempt bypasses configured checks. Allow is not a category override, and Exempt does not create firewall permission.
Open this question’s page →256. A broad GUI URL exemption restored supplier access. Which two consequences should be reviewed? Select two answers.
Inspection modes and web filtering
✓ Correct answers
- Whether AV scanning has also been bypassed.
- Whether a narrower category-only change would suffice.
Broad selected exemptions can bypass AV as well as web classification, so check their scope and whether a narrower rating/profile change preserves scanning. Exempt does not change the public rating, and its broad scope does not guarantee AV remains active.
Open this question’s page →257. Which two observations favor a FortiGuard service failure rather than an ordinary blocked category? Select two answers.
Inspection modes and web filtering
✓ Correct answers
- Logs show a rating-error message
- Rating diagnostics show failed or lost requests
Rating-error events and failed lookup evidence point to service health. A valid denied category and a local URL match describe successful policy enforcement.
Open this question’s page →258. Which two checks directly establish web-profile applicability to a test connection? Select two answers.
Inspection modes and web filtering
✓ Correct answers
- Profile Feature set agrees with policy inspection mode.
- The matched policy references the intended web profile.
Mode compatibility and attachment to the matched policy establish applicability. A profile or address object merely existing does not activate web filtering for the test connection.
Open this question’s page →259. Which two statements about category overrides are correct? Select two answers.
Inspection modes and web filtering
✓ Correct answers
- A local rating override changes local classification
- Applicable local categories precede external and built-in categories
Local classification and category precedence are the mechanisms. The public service is unchanged, and rating override does not inherently remove antivirus.
Open this question’s page →260. For local/remote categories in a flow profile, which two actions are explicitly not supported in the baseline? Select two answers.
Inspection modes and web filtering
✓ Correct answers
- Warning
- Authenticate
The flow comparison excludes Warning and Authenticate for these category types. Block and Monitor remain valid category-control actions.
Open this question’s page →261. A firewall service named HTTPS permits TCP 443. An unwanted tunnel also uses that port. Which control identifies and restricts the tunnel?
Application control
✓ Correct answer
- An application sensor with relevant signatures.
Application-control signatures identify and restrict the carried tunnel. Port permission and traffic logging do not identify its application; certificate inspection alone does not supply an application-sensor decision.
Open this question’s page →262. An administrator wants to inventory collaboration apps before deciding which to restrict. Which category action fits?
Application control
✓ Correct answer
- Monitor
Monitor permits and produces application events. Allow lacks the application log; Block and Quarantine disrupt the inventory traffic.
Open this question’s page →263. The parent collaboration app is blocked, while its permitted child messaging function never works. Which change best supports permitting messaging only?
Application control
✓ Correct answer
- Permit the required parent and control child functions explicitly
The child depends on parent access. TTL, broader port access and management-certificate trust do not remove the parent application block.
Open this question’s page →264. A policy permits TCP 2121. Recognized FTP is Monitor, but non-default-port enforcement is enabled and the installed signature defines port 21. Why is the session blocked?
Application control
✓ Correct answer
- The app is recognized on a non-default signature port
Port enforcement can block an otherwise monitored app on a non-default port. Monitor itself allows; no automatic port conversion or deny-policy requirement exists.
Open this question’s page →265. Configuration excerpt: config default-network-services edit 1 set port 80 set services http set violation-action block next end A decoder confirms FTP on server port 80. What follows?
Application control
✓ Correct answer
- The protocol violation is blocked.
The entry permits HTTP on server port 80 and blocks a confirmed different decoded protocol. A transport port match or broad application-category permission does not cancel protocol enforcement, and the configuration does not redefine FTP defaults.
Open this question’s page →266. Two signatures match in one application segment. An administrator moves a GUI row to the top without changing segment membership. What should they expect?
Application control
✓ Correct answer
- Internal tie breakers still determine the best match.
Within one segment, the internal signature tie breakers remain decisive. GUI row placement does not override weight, and the broad category segment does not unconditionally supersede earlier explicit segments.
Open this question’s page →267. Installed data shows a specific app weight 10 and generic SSL weight 1. All earlier tie breakers are equal. What does the weight comparison favor?
Application control
✓ Correct answer
- The specific application signature.
With earlier factors tied, higher weight favors the specific signature. GUI row position is not the weight rule, and the later ID tie breaker cannot override a differing weight.
Open this question’s page →268. A cloud-storage application is identified, but an HTTPS upload-specific rule never triggers. Certificate inspection is applied. What is the best next investigation?
Application control
✓ Correct answer
- Whether that function signature needs decrypted requests
TLS metadata can identify a broad app while encrypted request content hides a function. Proxy-only assumptions, a deny path and application IDs in routes do not resolve visibility.
Open this question’s page →269. A scenario shows application IDs directly in security policies and central NAT. Which NGFW model best fits?
Application control
✓ Correct answer
- Policy-based NGFW
Direct application policy criteria and central NAT fit policy-based NGFW. Flow alone does not distinguish modes, and neither transparent nor proxy mode follows from these facts.
Open this question’s page →270. Synthetic event: subtype="app-ctrl" appid=12345 action="block" policyid=31. A correlated traffic event says Accept. Which conclusion fits?
Application control
✓ Correct answer
- Application control denied traffic accepted by policy 31
A later application action can deny an accepted connection. The traffic accept does not invalidate it; appid identifies a signature, not a transport port.
Open this question’s page →271. The category is Monitor but one app remains blocked. An earlier override segment matches that app with Block. What should be investigated first?
Application control
✓ Correct answer
- The matching override action and segment order.
The matching explicit override precedes the category segment. Monitor allows and logs; changing only the later category action or rearranging rows inside the unchanged Block segment does not remove that earlier decision.
Open this question’s page →272. Application Quarantine is considered for a source address shared by a business proxy. What consequence matters most?
Application control
✓ Correct answer
- Other traffic from that source can be temporarily banned
Quarantine affects the source address more broadly than one function. Certificate revocation and route creation are unrelated.
Open this question’s page →273. No decoder has confirmed a protocol on port 80. Which additional condition supports a protocol violation when only HTTP is permitted?
Application control
✓ Correct answer
- The decoder has ruled out HTTP
Ruling out all permitted protocols supports the violation. Early incomplete classification, hostname text and normal ephemeral source ports alone do not establish it.
Open this question’s page →274. A sensor works on a test policy, but production traffic matches an earlier accepting policy without it. What resolves enforcement?
Application control
✓ Correct answer
- Apply the intended control to the matched path or correct policy matching
The matched policy must apply the sensor in profile mode. Unused copies and ARP changes do not attach it; predefined weights are not administrator-configurable.
Open this question’s page →275. Which two facts about application actions are correct? Select two answers.
Application control
✓ Correct answers
- Monitor allows and logs
- Allow lacks an application-control event
Monitor and Allow differ in application logging. Block does not open traffic, and Quarantine can ban the source more broadly.
Open this question’s page →276. Which two are documented internal application-signature tie breakers? Select two answers.
Application control
✓ Correct answers
- Custom versus FortiGuard signature status.
- Application weight.
Custom-signature precedence and weight are internal matching factors. GUI row order inside a segment and the ordering of firewall service references do not determine the signature tie breakers.
Open this question’s page →277. Which two requirements fit policy-based NGFW? Select two answers.
Application control
✓ Correct answers
- Flow inspection
- Central NAT
Policy-based NGFW uses flow and central NAT, with applications directly in security policies. The other choices describe incompatible or profile-based assumptions.
Open this question’s page →278. Which two checks are separate from an application Allow action? Select two answers.
Application control
✓ Correct answers
- Non-default-port enforcement can still deny recognized traffic
- The firewall must permit the connection
Firewall permission and configured port enforcement remain relevant. Application Allow neither overrides firewall deny nor disables TLS trust checks.
Open this question’s page →279. Which two observations support investigating encrypted visibility? Select two answers.
Application control
✓ Correct answers
- Only generic SSL is logged where a payload-specific app is expected
- The session matches a deep-inspection exemption
Generic SSL and an exemption point to limited payload visibility. An unattached sensor and firewall deny are earlier applicability/permission issues rather than decryption evidence.
Open this question’s page →280. Which two configurations express different enforcement mechanisms? Select two answers.
Application control
✓ Correct answers
- Block recognized FTP when it uses a non-default signature port
- Permit only HTTP on server port 80 and block protocol violations
Application port enforcement and network protocol enforcement inspect different relationships. A service label does not validate payload and app Allow cannot bypass firewall deny.
Open this question’s page →281. A flow AV profile exposes no default/legacy scanner selector. Which explanation is correct?
Antivirus
✓ Correct answer
- The IPS engine chooses the scan method for each file
Flow AV uses engine-selected methods; proxy retains the scanner choice. Missing licensing, HTTP-only behavior and routing-policy controls are not the documented explanation.
Open this question’s page →282. A proxy AV policy changes from default to legacy. Which capability is disabled?
Antivirus
✓ Correct answer
- Stream-based scanning
Legacy disables stream-based scanning while buffered AV remains. SSL visibility and firewall matching are separate controls.
Open this question’s page →283. The same test is blocked over HTTP but passes over HTTPS under certificate inspection. What should be changed or verified first?
Antivirus
✓ Correct answer
- Suitable deep inspection and endpoint trust
The observed difference points to encrypted payload visibility. Names, global size increases and an unnecessary route do not decrypt the file.
Open this question’s page →284. An HTTP download on TCP 8088 matches the correct proxy AV policy, but protocol options map HTTP only to 80. Which focused correction fits?
Antivirus
✓ Correct answer
- Add the known HTTP port to protocol mapping
The proxy protocol mapping should cover the service. Category actions, removing AV and management timeout do not correct the scan envelope.
Open this question’s page →285. Oversized-file logging is enabled and a transfer completes. What is needed before concluding it was fully scanned?
Antivirus
✓ Correct answer
- Inspect oversize action and the actual scanner path.
An oversize log does not establish complete scanning or blocking. Inspect the effective action and scanner path; traffic acceptance and completed delivery alone do not prove archive coverage.
Open this question’s page →286. A flow file exceeds the AV scan buffer limit and oversize action is pass. Which outcome is documented?
Antivirus
✓ Correct answer
- The AV session can be cleared and the file bypassed
Flow pass can bypass after the limit is exceeded. Proxy WAD, mandatory hold and automatic inline submission do not follow from this setting.
Open this question’s page →287. A 2 MB compressed archive expands to hundreds of megabytes. Why might scanning be incomplete?
Antivirus
✓ Correct answer
- Expanded-size or nesting limits can be reached
Resource limits apply to decompression and nested content. Compressed size alone is insufficient; certificate expiry and inherent safety do not follow.
Open this question’s page →288. A password-protected archive passes after its container is recognized. Which interpretation is safest under a pass-unscannable policy?
Antivirus
✓ Correct answer
- Its encrypted contents may not have been scanned
Container recognition does not decrypt contents. Neither password recovery nor reconstruction nor a clean inner verdict is established.
Open this question’s page →289. A proxy CDR policy sanitizes downloaded Office documents. An application uploads one with HTTP POST. Which baseline limitation matters?
Antivirus
✓ Correct answer
- CDR supports HTTP GET but not POST
The stated CDR web support is GET, not POST. FTP-only support, universal method coverage and automatic extension blocking are incorrect.
Open this question’s page →290. A document loses macros after CDR but no virus name appears. What explains this?
Antivirus
✓ Correct answer
- CDR removes active content independent of a known-virus hit
Sanitization can remove active functionality without a signature detection. This does not imply database corruption or that every macro is malware.
Open this question’s page →291. A supported file is sent to FortiSandbox after delivery and is later found malicious. Why did the first user receive it?
Antivirus
✓ Correct answer
- Post-transfer analysis did not gate the first transfer
Post-transfer submission can improve later protection but does not hold the first recipient. Inline behavior, deny-policy requirements and client database control are not the cause.
Open this question’s page →292. Inline scanning uses log-only for timeout. A submitted file times out and is delivered. Which conclusion follows?
Antivirus
✓ Correct answer
- It was allowed without a timely sandbox verdict
The configured timeout action allows with a log. A clean verdict, a different mode and license renewal do not follow.
Open this question’s page →293. A design for FortiOS 7.6.0 requires flow-based FortiSandbox inline AV, citing a 7.6.4 feature. What should be corrected?
Antivirus
✓ Correct answer
- Use baseline-supported proxy inline inspection or revise the release requirement.
Flow inline support was added later, so the 7.6.0 design needs its supported proxy inline path or a deliberate release change. A profile-only change does not backport engine support; post-transfer submission differs from inline withholding, and certificate-only inspection does not expose the file.
Open this question’s page →294. A test download is stopped by endpoint AV and there is no correlated FortiGate virus event. What has the test established?
Antivirus
✓ Correct answer
- Endpoint protection acted, but FortiGate AV enforcement is not demonstrated
The endpoint result does not establish the FortiGate verdict. Missing evidence cannot prove either correct firewall enforcement or that AV is disabled.
Open this question’s page →295. An active AV license and network connectivity exist, but no enabled policy uses AV scanning. Which documented update prerequisite is missing?
Antivirus
✓ Correct answer
- At least one enabled policy with AV scanning.
The documented prerequisite is an enabled policy using AV scanning. An unused profile, logging alone or a firmware download does not meet it.
Open this question’s page →296. An EMS threat feed and an external malware blocklist contain the same file hash. Both feed actions are explicitly Block, and local AV did not match. Which detection source is reported first under the documented order?
Antivirus
✓ Correct answer
- EMS threat feed.
The documented order checks local AV, then EMS, then the external hash list, then outbreak prevention. With local AV clean and both feed actions set to Block, the EMS hit blocks and is reported first; the later checks do not take precedence.
Open this question’s page →297. A team wants MAPI file AV in a flow-only 7.6.0 policy. Which conclusion fits the protocol matrix?
Antivirus
✓ Correct answer
- MAPI requires proxy inspection in this baseline
MAPI is proxy-only in the matrix. Flow has no legacy selector, and routing does not add protocol scanning support.
Open this question’s page →298. A proxy begins sending client-comforting bytes, then AV detects malware. The browser receives a partial file and a reset. What should be examined?
Antivirus
✓ Correct answer
- The virus event and configured transfer behavior.
Client comforting can release some data before detection, followed by a reset. Correlate the virus event with the configured transfer behavior. Partial delivery and no replacement page do not prove an allowed verdict; changing comforting first skips the action evidence.
Open this question’s page →299. Which two protocols require proxy AV in the 7.6.0 comparison? Select two answers.
Antivirus
✓ Correct answers
- MAPI
- SSH file inspection
MAPI and SSH require proxy. HTTP and SMTP are supported by both modes with appropriate visibility and settings.
Open this question’s page →300. Which two statements describe CDR? Select two answers.
Antivirus
✓ Correct answers
- It can remove legitimate active document content
- It requires proxy inspection in the baseline
CDR removes active content and requires proxy. Macro preservation and baseline POST support contradict the feature.
Open this question’s page →301. Which two actions help ensure an inline file is not delivered merely because analysis failed? Select two answers.
Antivirus
✓ Correct answers
- Configure the error action to Block
- Configure the verdict-timeout action to Block
Blocking errors and timeouts denies without a verdict. Log-only and post-transfer do not impose that delivery gate; eligibility and service design still matter.
Open this question’s page →302. Which two observations specifically point to size or decompression limits in the AV scan envelope? Select two answers.
Antivirus
✓ Correct answers
- Logs indicate a decompression limit was reached.
- Only files above the oversize threshold pass without detection.
Decompression-limit events and threshold-dependent results point to the scan envelope. An old signature package or consistently missing HTTPS decryption requires a different investigation; neither establishes a size/decompression boundary.
Open this question’s page →303. Which two methods use malware-hash intelligence? Select two answers.
Antivirus
✓ Correct answers
- Virus Outbreak Prevention
- External malware blocklist
Outbreak prevention and external lists use file hashes. Quotas measure use and CDR sanitizes active content rather than matching those hashes.
Open this question’s page →304. Which two pieces of evidence directly support FortiGate AV enforcement in a lab test? Select two answers.
Antivirus
✓ Correct answers
- A correlated virus event with a blocking action
- The matched policy references the tested AV profile
The AV event and applicable profile support the conclusion. Endpoint-only and earlier category-block evidence identify other enforcement paths.
Open this question’s page →305. A Linux web server publishes HTTP. Which filter direction best represents the vulnerable endpoint role?
Intrusion prevention
✓ Correct answer
- Server-target coverage relevant to Linux and HTTP
The target is the vulnerable server role. Client initiation does not turn it into a client target; unrelated UDP coverage and mere firewall acceptance do not provide exploit inspection.
Open this question’s page →306. One IPS filter specifies target server, severity high and protocol HTTP. Which installed signature is selected?
Intrusion prevention
✓ Correct answer
- A high-severity HTTP signature with server target
The specified filter attributes are combined. Partial or conflicting matches do not meet all three conditions.
Open this question’s page →307. A narrow Monitor exception sits below a broad Block entry that includes the same signature. The false positive remains blocked. What should be reviewed?
Intrusion prevention
✓ Correct answer
- Move the justified narrow exception before the broad entry
Sensor ordering can make the broad entry apply first. DNS cache and logging do not change signature action precedence.
Open this question’s page →308. An enabled signature has action Default and its installed default is Pass. What is expected when it matches?
Intrusion prevention
✓ Correct answer
- The signature default permits the match
Action Default follows the signature, while status controls activation separately. Neither Reset nor policy deletion follows.
Open this question’s page →309. A selected IPS rule has status Disable and action Block. What does this combination establish?
Intrusion prevention
✓ Correct answer
- That entry does not actively inspect with the disabled signature
Status and action are separate; a disabled signature does not become active merely because its configured action is Block. Other entries and firewall ports are unaffected.
Open this question’s page →310. Synthetic IPS event: action="detected" msg="signature is on hold". The sensor is intended to block this attack. What explains the result?
Intrusion prevention
✓ Correct answer
- The new signature is being monitored during hold time
Hold time uses monitoring before enforcement. The event does not prove a block, an AV size condition or permanent sensor disablement.
Open this question’s page →311. An IPS entry uses rate-mode periodical, rate-count 100, rate-duration 60 and rate-track src-ip. One source reaches the threshold within 60 seconds. Which interpretation fits?
Intrusion prevention
✓ Correct answer
- The threshold is evaluated for that source within the duration
The configured periodical source tracking evaluates incidents per source over the duration. Global aggregation, decompression and hold time are different settings.
Open this question’s page →312. Many different sources each make few attempts against one server. A rate signature must aggregate those attempts at the target. Which tracking key fits?
Intrusion prevention
✓ Correct answer
- Destination IP.
Destination-IP tracking combines attempts aimed at the target across sources. Source or pair-based grouping divides those sources, and source MAC is not the stated IPS rate-tracking key.
Open this question’s page →313. A C&C event identifies a known malicious destination IP on encrypted traffic without deep inspection. Which conclusion is justified?
Intrusion prevention
✓ Correct answer
- Destination IP reputation can act without decrypted payload
IP reputation can operate on visible destination addresses. Full payload inspection, DNS enforcement and document sanitization do not follow.
Open this question’s page →314. config ips global set engine-count 0 end What does this mean?
Intrusion prevention
✓ Correct answer
- FortiGate selects the appropriate engine count automatically
Zero is automatic selection. It does not disable IPS, force one engine or change database selection.
Open this question’s page →315. CPU is high after enabling packet logging for every IPS signature. Which measured first adjustment preserves signature coverage?
Intrusion prevention
✓ Correct answer
- Reduce unnecessary packet logging and reassess load
Reducing expensive unneeded logging can preserve detection coverage. Blanket removal, blind buffer maximization and permanent bypass do not address the observed logging change responsibly.
Open this question’s page →316. The IPS raw-socket buffer fills on a non-NTurbo path and fail-open is disabled. What is the documented behavior?
Intrusion prevention
✓ Correct answer
- Affected sessions are dropped.
With IPS raw-buffer fail-open disabled on this non-NTurbo path, affected sessions drop. Full scanning cannot be guaranteed after the buffer fills; bypass requires the eligible fail-open setting. Proxy AV handling does not override this IPS raw-buffer behavior.
Open this question’s page →317. A confirmed NTurbo data path is overloaded. IPS fail-open is enabled. Why can traffic still drop?
Intrusion prevention
✓ Correct answer
- NTurbo-offloaded sessions do not support this fail-open bypass
The NTurbo exception allows drops regardless of fail-open. TLS expiry, DNS categories and a universal packet-log block are not the mechanism.
Open this question’s page →318. During ordinary conserve mode, new sessions require flow-based inspection. ips global fail-open is disabled. What should be expected?
Intrusion prevention
✓ Correct answer
- Those new sessions are dropped
Flow conserve behavior uses the IPS global fail-open setting. Proxy controls do not override it and conserve does not automatically convert inspection modes.
Open this question’s page →319. Memory reaches the configured extreme threshold. Ordinary flow and proxy fail-open choices favor bypass. What governs new-session handling?
Intrusion prevention
✓ Correct answer
- New sessions are dropped at the extreme threshold
Extreme memory overrides ordinary fail-open choices for new sessions. Unrated classifications and disabling engines are not the documented outcome.
Open this question’s page →320. A larger socket-size reduces buffer overload but memory use rises sharply. Which tradeoff should be investigated?
Intrusion prevention
✓ Correct answer
- Increased buffering can cause conserve pressure
The buffer consumes memory and can worsen conserve frequency. It is not cost-free; web cache and disk claims are unsupported.
Open this question’s page →321. Synthetic log: subtype="ips" action="dropped" attackid=23456 policyid=42 profile="web-server". Which field locates the matching attack signature?
Intrusion prevention
✓ Correct answer
- attackid=23456
Attack ID identifies the signature. Policy and profile locate configuration; action reports the result.
Open this question’s page →322. A volumetric flood saturates the upstream WAN link before FortiGate. Which limitation applies to local IPS?
Intrusion prevention
✓ Correct answer
- It cannot restore upstream bandwidth already consumed
Inspection cannot create upstream capacity. More signatures, packet logging and decryption do not remove that bottleneck.
Open this question’s page →323. Which two distinctions are essential when interpreting an IPS entry? Select two answers.
Intrusion prevention
✓ Correct answers
- Status controls signature activation
- Default action follows the installed signature default
Activation and action are separate. Enable does not universally force Block; Default action does not mean disabled status.
Open this question’s page →324. Which two statements about IPS rate configuration are correct? Select two answers.
Intrusion prevention
✓ Correct answers
- Rate thresholds are configured on individual signatures
- Destination tracking can aggregate distributed activity against a target
Individual signatures expose rate settings, and destination tracking aggregates target activity. Filters lack that setting and source tracking separates origins.
Open this question’s page →325. Which two actions preserve broader coverage while investigating one false positive? Select two answers.
Intrusion prevention
✓ Correct answers
- Use a justified narrow IP exemption on the individual signature
- Place a narrow exception before an overlapping broad entry
Narrow exemptions and correct ordering limit the exception. Removing all profiles and trusting location discard coverage without isolating the cause.
Open this question’s page →326. Which two constraints matter for an IPS performance design? Select two answers.
Intrusion prevention
✓ Correct answers
- Hardware acceleration applies only to supported models and paths
- Extended-database coverage and resource use depend on the platform
Platform-specific packages and acceleration must be assessed. Universal coverage and cost-free packet logging are false assumptions.
Open this question’s page →327. Which two statements about memory and overload behavior are correct? Select two answers.
Intrusion prevention
✓ Correct answers
- Flow conserve inspection uses ips global fail-open
- Extreme memory drops new sessions despite ordinary bypass choices
Flow control and extreme-memory override are correct. Proxy settings do not override NTurbo overload; fail-open bypass is loss of inspection.
Open this question’s page →328. Which two operations are observational rather than intentionally changing IPS protection? Select two answers.
Intrusion prevention
✓ Correct answers
- get system performance status
- diagnose test application ipsmonitor 1
Performance and engine-information commands observe state. Bypass and restarts alter live inspection and require controlled troubleshooting.
Open this question’s page →329. The active table contains 10.60.8.0/24 with distance 100 through wan2 and 0.0.0.0/0 with distance 10 through wan1. A new ordinary-routed session targets 10.60.8.25. Which path is selected?
Static routing
✓ Correct answer
- The /24 through wan2.
The /24 is the longest matching installed prefix. Distance does not let a less-specific default outrank it. Overlap alone does not create ECMP, and firewall policy IDs do not rank routes.
Open this question’s page →330. Two usable static routes to 10.80.0.0/16 have distance 10 and priorities 3 and 30. Which route is preferred for a new ordinary lookup?
Static routing
✓ Correct answer
- The route with priority 3.
Lower numerical priority wins between equal-distance static routes for the same prefix. A higher priority value is less preferred; configuration order is not this selection rule. Unequal priority does not express equal-cost forwarding.
Open this question’s page →331. A manual default through wan1 has distance 10. After wan2 receives a DHCP lease with Retrieve default gateway enabled, a default through wan2 appears at distance 5. Why do fresh internet sessions prefer wan2?
Static routing
✓ Correct answer
- Its same-prefix default has lower distance.
Both paths cover /0, so the DHCP default at distance 5 beats the manual default at 10. DHCP does not turn the route into a more-specific destination prefix or reorder policies. This is a distance result, not a universal last-learned rule.
Open this question’s page →332. A newly configured interface is active at 10.15.20.1/24. Which path should already exist for ordinary forwarding to a host in 10.15.20.0/24?
Static routing
✓ Correct answer
- A connected route for 10.15.20.0/24.
An active addressed interface creates its connected subnet route. An ISP route, blackhole or dynamic neighbor is not required to create that local path. Policies and host reachability remain separate requirements.
Open this question’s page →333. An administrator adds a correct route to a remote server network but creates no accepting forward policy. What does the route prove?
Static routing
✓ Correct answer
- It supplies a potential forwarding path, while permission still requires a policy.
Routing identifies where traffic can go; a matching accepting policy independently decides whether transit traffic is permitted. Neither security signatures nor destination translation objects are created by an ordinary route.
Open this question’s page →334. A LAN client can reach an LDAP server through the firewall, but a FortiGate-originated LDAP authentication request fails because the server only permits a particular client IP. What is the most relevant next check?
Static routing
✓ Correct answer
- LDAP local-out source/interface selection and routing.
FortiGate-originated traffic is local-out and may use a different source/interface from a forwarded client session. A successful LAN policy test does not establish the LDAP request source. Browser trust and an unrelated VIP do not diagnose this source restriction.
Open this question’s page →335. Which observations can explain why a configured static route is absent from the active routing table? Select two answers.
Static routing
✓ Correct answers
- A better-distance candidate for the same prefix is selected.
- Its outgoing interface is down.
Interface usability and competing same-prefix route preference affect installation. An absence of user traffic, firewall policy IDs and a working gateway ARP refresh do not determine whether the route is active. Candidate/database presence alone is insufficient.
Open this question’s page →336. Interpret this entry: S 10.40.0.0/24 [10/0] via 192.0.2.1, wan1. Which statement is correct?
Static routing
✓ Correct answer
- It is static, with distance 10 and metric 0.
S identifies a static route and the bracket represents distance/metric. Priority must be checked in the relevant route details rather than inferred from metric zero. The bracket is not an SLA measurement, and a static next-hop entry is not a connected route code.
Open this question’s page →337. A candidate appears in get router info routing-table database but not in get router info routing-table all. What is the best interpretation?
Static routing
✓ Correct answer
- It is known as a candidate but has not been selected as an active usable route.
The candidate database and selected active table serve different purposes. A candidate is not proof of packet forwarding. The database is routing information rather than address objects, and the active table can contain connected, static and learned routes.
Open this question’s page →338. A route lookup for the destination alone shows wan1, but a real Finance client consistently uses wan2. A source-specific policy route is configured. Which check best reproduces the live decision?
Static routing
✓ Correct answer
- Include the source/ingress/protocol context and inspect diagnose firewall proute list.
Policy routing can match source, ingress and service context before ordinary destination routing. A destination-only lookup can miss those conditions. Rechecking only default distances, renumbering a policy or dismissing the capture ignores the configured steering mechanism.
Open this question’s page →339. Which statements describe a usable matching policy route? Select two answers.
Static routing
✓ Correct answers
- It can select a path using source and incoming interface.
- It can take precedence over ordinary destination-based routing.
Policy routes can use additional tuple/context fields and precede ordinary routing when they match and are usable. They do not grant firewall permission, repair next-hop reachability or erase session state.
Open this question’s page →340. A packet enters wan2, while strict-src-check is enabled and the best active route to its source uses wan1. The packet is rejected before a useful forward session establishes. Which explanation fits?
Static routing
✓ Correct answer
- Strict source validation rejects the mismatched best return path.
Strict RPF requires the best return path to agree with the incoming interface. This is a source-validation issue, not proof of a destination blackhole, a universal secondary-WAN prohibition or a blanket NAT requirement. Investigate routing/asymmetry before weakening checks.
Open this question’s page →341. An asymmetric design has an installed suitable route to a source through wan2, but its best return route uses wan1. Which distinction matters when predicting source validation?
Static routing
✓ Correct answer
- Feasible checking can accept a suitable path; strict requires the best.
Feasible-path and strict checking evaluate return-path suitability differently. Both concern the source. A configured but uninstalled backup is not equivalent to an installed feasible path, and feasible checking still validates source reachability.
Open this question’s page →342. A higher-distance backup route to a source subnet exists only as a candidate. Why may it fail to satisfy feasible-path RPF for packets arriving through that backup interface?
Static routing
✓ Correct answer
- It may not be installed as a usable return path.
RPF depends on eligible source-routing evidence, not simply configuration existence. Higher distance can leave a backup unselected. Policy sequence, prefix length and DNAT are separate mechanisms and do not explain this candidate-versus-installed distinction.
Open this question’s page →343. After changing route preference, which steps produce a meaningful forwarding test? Select two answers.
Static routing
✓ Correct answers
- Create a fresh session for the test flow.
- Inspect the active route and the session selected interface.
Fresh sessions and active/session evidence reveal current selection. Existing sessions can cache route/NAT state. A global session purge is unnecessary for a scoped test, and configuration alone does not establish installation or forwarding.
Open this question’s page →344. Which configuration expresses ECMP between two comparable usable static defaults?
Static routing
✓ Correct answer
- Equal destination prefix, distance and priority on both paths.
For comparable static ECMP paths, prefix, distance and priority must align. Different distances express preference, not this equal-cost design. Policy IDs and descriptions do not supply routing equivalence, and unequal prefixes remain different matching scopes.
Open this question’s page →345. An ECMP design uses source-IP hashing. One workstation opens many connections to many servers. Why may they all use the same WAN?
Static routing
✓ Correct answer
- The algorithm groups assignments by source address.
Source-only hashing can keep one client on one path across destinations. That behavior is compatible with the algorithm. Equal byte totals are not promised, destination service port is not the stated hash key, and this observation does not establish drops.
Open this question’s page →346. An administrator wants one client reaching different servers to have more path-assignment diversity than source-only hashing permits. Which setting best fits an ECMP lab outside SD-WAN?
Static routing
✓ Correct answer
- set v4-ecmp-mode source-dest-ip-based
Source-destination hashing uses both endpoints and can distribute that client’s different destination pairs. Strict RPF controls source validation, logtraffic controls logging, and AV fail-open controls inspection under memory conditions.
Open this question’s page →347. Which observations are compatible with session-based ECMP? Select two answers.
Static routing
✓ Correct answers
- Different sessions can use different eligible paths.
- Equal session assignments can still produce unequal byte counts.
ECMP assigns sessions and sessions carry different amounts of data. Per-packet alternation and byte-perfect splitting are not ordinary guarantees. Stateful translation and return routing still apply.
Open this question’s page →348. A bandwidth design should prefer one WAN until a configured usage threshold is exceeded, then place sessions on another eligible WAN. Which ECMP behavior matches that requirement?
Static routing
✓ Correct answer
- Usage-based spillover.
Usage-based spillover responds to a configured usage threshold. Prefix matching chooses destination scope, source hashing makes fixed-key assignments, and RPF checks source reachability; those do not implement the specified threshold behavior.
Open this question’s page →349. Both ECMP WANs have similar session counts, but wan1 carries substantially more bytes. What is the best first interpretation?
Static routing
✓ Correct answer
- Session sizes differ; inspect workloads before declaring a fault.
A few large sessions can dominate byte use despite similar session counts. Hashing does not equalize session sizes, and static priority is a route preference rather than a byte-quota mechanism.
Open this question’s page →350. wan1 remains physically up and its adjacent gateway answers ping, but internet access beyond that gateway has failed. The preferred static default remains installed. What should the design add?
Static routing
✓ Correct answer
- Remote path monitoring with configured route withdrawal.
A health check that observes the failed path can drive withdrawal/exclusion. Distance chooses among available routes but does not detect a remote outage. Policy numbering and connected routes for remote internet hosts do not solve that measurement gap.
Open this question’s page →351. A VPN design has a working 10.90.0.0/24 tunnel route at distance 10, a same-prefix blackhole at distance 250 and an internet default at distance 5. When the tunnel route disappears, what happens to traffic for 10.90.0.20?
Static routing
✓ Correct answer
- The /24 blackhole discards it.
The surviving /24 blackhole is more specific than /0, so lookup selects it despite the different-prefix distance. The inactive primary permits the same-prefix backup to take over; differently sized prefixes do not form ECMP merely because both match.
Open this question’s page →352. Which choices help a primary/backup static-route design provide useful failover? Select two answers.
Static routing
✓ Correct answers
- Authorize traffic on both possible egress paths.
- Monitor failures beyond the local interface when the requirement includes upstream outages.
Backup forwarding needs policies and appropriate failure detection. Distance/priority does not measure path quality, NAT source identity can change across WANs, and an untested standby path can hide failures.
Open this question’s page →353. A selected backup path sends packets out wan2 after failure, but replies never return. What remains to validate?
Static routing
✓ Correct answer
- The translated source, upstream/remote return route and return capture.
Egress selection is only one part of a bidirectional stateful path. Source translation and remote/upstream return reachability must work. Configuration presence, descriptive names and unrelated application actions do not establish the missing reply path.
Open this question’s page →354. Which commands inspect different relevant routing layers? Select two answers.
Static routing
✓ Correct answers
- get router info routing-table database inspects candidate routing information.
- diagnose firewall proute list inspects policy routes.
The routing database and policy-route list expose different routing mechanisms. Web categories and update versions are security-service diagnostics, and an address-object listing is not active route evidence.
Open this question’s page →355. An application fails through a firewall. Which sequence best separates no-route, wrong-route, RPF and policy-deny causes?
Static routing
✓ Correct answer
- Check tuple/RPF/steering, active route, matching policy and replies.
Following the tuple, source-validation and steering evidence separates forwarding failures before checking authorization and replies. Configuration alone does not prove route installation or policy acceptance; an old session can retain earlier state.
Open this question’s page →356. Which paired route facts correctly separate destination selection from route-source preference? Select two answers.
Static routing
✓ Correct answers
- A longer matching installed prefix beats a less-specific prefix in ordinary lookup.
- For the same prefix, lower administrative distance generally prefers one route source.
Prefix specificity and same-prefix administrative distance answer different questions. OSPF metric is protocol-specific; policy IDs do not rank route prefixes. A default is broad and normally least specific, not superior to connected subnet matches.
Open this question’s page →357. A new zone contains wan1 and wan2, but there is no default route toward the zone and no accepting LAN policy. What does zone creation alone provide?
SD-WAN
✓ Correct answer
- An administrative grouping of members.
The zone groups members for policy/route administration. It does not supply missing routes, grant firewall permission or encrypt ordinary WAN traffic. Those dependencies must be configured separately.
Open this question’s page →358. Which two objects have different SD-WAN responsibilities? Select two answers.
SD-WAN
✓ Correct answers
- An explicit rule identifies traffic and applies a strategy.
- A performance SLA measures path health/quality.
Measurements and traffic steering are separate objects. Zones do not create every route, costs are configured rankings, and health checks do not authorize traffic.
Open this question’s page →359. A private /24 has its best route through a dedicated non-SD-WAN VPN interface. An internet SD-WAN rule matches all destinations. Under default routing integration, why can the private flow still use that dedicated tunnel?
SD-WAN
✓ Correct answer
- The best route points outside SD-WAN, so the broad rule does not automatically override it.
Default integration considers SD-WAN steering when the best path points to SD-WAN. Neither a broad selector nor a member cost automatically replaces a best route outside SD-WAN. Health probing does not change zone membership.
Open this question’s page →360. The best path is through an SD-WAN zone. A rule prefers member 2, but member 2 has no valid route to this destination. What is the relevant limitation?
SD-WAN
✓ Correct answer
- The selected member needs its own valid destination path.
Rule selection still requires usable member routing. Preference, quality and cost do not create connected or destination routes. Inspect both best-route integration and the member route rather than treating them as the same condition.
Open this question’s page →361. Which two statements correctly describe underlay and overlay? Select two answers.
SD-WAN
✓ Correct answers
- Broadband can provide an underlay transport.
- IPsec tunnels can provide an encrypted overlay.
The underlay transports traffic; an IPsec overlay adds tunnel connectivity/encryption over it. Membership alone does not encrypt traffic, overlay is a network construct, and the tunnel still depends on underlay reachability.
Open this question’s page →362. A voice target allows latency up to 80 ms, jitter up to 15 ms and loss up to 1%. Member A measures 30/8/0 and cost 5; B measures 15/3/0 and cost 50. With Lowest Cost and load balancing disabled, which member is preferred?
SD-WAN
✓ Correct answer
- A, because both meet the SLA and A costs less.
Both satisfy every threshold, so the non-balancing Lowest Cost rule favors A’s lower configured cost. B would suit a different best-quality objective. Passing an SLA does not automatically enable load balancing, and costs need not be equal.
Open this question’s page →363. A voice rule uses Lowest Cost with load balancing disabled and a jitter SLA threshold of 15 ms. Members A (cost 5) and B (cost 50) are both routing eligible. A remains alive but its jitter rises to 25 ms; B still passes the SLA. Which member should this rule choose for new matching sessions?
SD-WAN
✓ Correct answer
- A fails the voice target, leaving B as the passing path.
Quality eligibility is evaluated before cost preference for this rule. An alive link can fail jitter without a physical outage. Other traffic or configured fallback can still use it; the voice result is not a blanket ban on the interface.
Open this question’s page →364. Both members are eligible. A Manual rule lists wan2 before wan1, while wan1 currently has lower latency. With no additional quality strategy overriding the preference, which outcome matches Manual?
SD-WAN
✓ Correct answer
- Prefer wan2 according to the ordered list.
Manual expresses an ordered member preference among eligible candidates. It is different from Best Quality. Lower latency does not override every strategy, and neither packet-by-packet randomness nor equal delays is required by the stated configuration.
Open this question’s page →365. A rule should optimize the measured jitter of a real-time application rather than prefer the cheapest acceptable path. Which strategy is the most direct fit?
SD-WAN
✓ Correct answer
- Best Quality using jitter.
Best Quality optimizes the configured measurement. Lowest Cost uses acceptable quality then cost preference, Manual uses ordered preference, and route distance does not itself compare live jitter.
Open this question’s page →366. Interpret this explicit-rule excerpt: config system sdwan config service edit 7 set mode sla set load-balance enable next end end Assume routing, members, health checks and SLA references are correctly configured. At least two members pass the referenced SLA, while another alive member fails it. What does enabling load balancing change?
SD-WAN
✓ Correct answer
- Traffic can be distributed across members satisfying the SLA.
With explicit load balancing enabled in Lowest Cost/SLA, qualified members can share traffic without the ordinary cheapest-passing-only outcome. Alive status alone is insufficient, and this is not the Best Quality single-member strategy. The abbreviated extract assumes the other rule requirements exist.
Open this question’s page →367. Which two interpretations of live quality evidence are correct? Select two answers.
SD-WAN
✓ Correct answers
- An alive path can still fail an SLA because packet loss is excessive.
- Low average latency does not prove jitter is acceptable.
Reachability, loss, delay variation, physical link state, route actions and firewall permission are distinct observations. Read the configured target logic and rule behavior rather than turning an SLA failure into a universal route or policy conclusion.
Open this question’s page →368. A performance check targets only the directly adjacent ISP gateway. The gateway stays responsive while the public application path fails. Which change improves the measurement’s relevance?
SD-WAN
✓ Correct answer
- Use a stable reachable target representative of the required path.
A representative target can observe failures beyond the adjacent gateway. Cost ranking and traffic-log retention do not measure that path. A destination-NAT publication object is unrelated to selecting an appropriate probe target.
Open this question’s page →369. All WANs show poor SLA results at the same moment, but the chosen probe server is overloaded while several other destinations work. What should be investigated before replacing the WAN links?
SD-WAN
✓ Correct answer
- The probe target and corroborating path evidence.
A failing target can create misleading results across otherwise healthy paths. Corroborate its health and the observed application route. Policy IDs and equal cost do not diagnose server overload, and a measurement should not be interpreted as universal proof of WAN failure.
Open this question’s page →370. Which settings deserve review when an SLA state repeatedly flaps between good and bad? Select two answers.
SD-WAN
✓ Correct answers
- Probe interval and fail/recovery counts.
- Target reliability and representativeness.
Detection timing and target quality directly influence stable state transitions. Log retention, an unrelated inspection mode and equal session sizes do not set the health-check decision.
Open this question’s page →371. A member responds to probes but has 8% loss against a voice SLA allowing 1%. Another bulk-traffic rule has different requirements. Which conclusion is justified?
SD-WAN
✓ Correct answer
- The member is alive but fails this voice SLA; other rule eligibility must be checked separately.
Reachability and target compliance differ, and each rule can express different traffic requirements. This evidence does not show physical failure or require deleting policies. A separate rule is not automatically governed by this voice target.
Open this question’s page →372. Every member fails a configured quality target, but some are still reachable. What determines the exact forwarding result?
SD-WAN
✓ Correct answer
- The rule’s fallback behavior, eligible candidates and routing configuration.
No-passing-member behavior must be read from the configured strategy/fallback and candidate paths. Neither mandatory dropping nor mandatory cheapest-failing selection is universal, and traffic-log configuration does not select fallback.
Open this question’s page →373. An implicit rule is configured with source-IP hashing. Why can a single busy client make WAN usage look uneven?
SD-WAN
✓ Correct answer
- The same source can retain one path assignment while generating a large workload.
Source hashing and workload sizes can create uneven bytes without a fault. The implicit rule remains steering logic, byte equality is not guaranteed, and other sources can use another eligible member.
Open this question’s page →374. Which two rule-specific facts should be read before assuming an older load-balancing example applies to FortiOS 7.6? Select two answers.
SD-WAN
✓ Correct answers
- Load balancing can be configured inside Manual or Lowest Cost rule designs.
- The explicit and implicit rules have different default hash behavior.
Current strategy configuration and rule-specific algorithms matter. Older standalone naming and a universal source-IP default are unsafe assumptions. Load balancing does not inherently bypass security inspection.
Open this question’s page →375. Traffic uses SD-WAN, but an administrator’s specific voice rule shows no matches. Which first check is most relevant?
SD-WAN
✓ Correct answer
- Rule selectors/order, actual application identification and whether traffic uses the implicit rule.
Member use proves some forwarding, not that this explicit rule matched. Inspect traffic identification, earlier broad matches and the implicit path. AV naming and an unrelated DHCP renewal do not explain the steering selector.
Open this question’s page →376. A broad internet rule precedes a narrow training-application rule. The narrow rule’s traffic counters remain empty. Which change should be evaluated with controlled tests?
SD-WAN
✓ Correct answer
- Put the intended specific rule before the matching broad rule.
Rule sequence can allow the broad selector to take traffic before the specific requirement. Policy numbering is a different mechanism. Blackholing or globally disabling NAT changes reachability without fixing the rule-order issue.
Open this question’s page →377. A session initially appears on the implicit path, then application steering evidence identifies it as the application in an explicit rule. Which factor can explain that initial observation?
SD-WAN
✓ Correct answer
- Application classification can require initial packets.
Application recognition may not be available on the first packet. Inspect subsequent identification/steering state. The observation does not imply universal inability to recognize encrypted applications, mandatory manual assignment or a required drop.
Open this question’s page →378. Which two observations provide useful live evidence for the steering and quality of an SD-WAN flow? Select two answers.
SD-WAN
✓ Correct answers
- Service-rule output correlated with the selected member and traffic log.
- Health-check/SLA output for the relevant path.
Correlated service/member traffic evidence and relevant SLA status establish steering and quality. A name or intended preference does not prove the actual decision, and a local gateway ping does not establish the monitored end-to-end path.
Open this question’s page →379. Which diagnostic pair best separates SD-WAN quality from ordinary route availability?
SD-WAN
✓ Correct answer
- diagnose sys sdwan health-check and get router info routing-table all
Health-check output exposes quality/reachability measurements, while the routing table exposes selected paths. The other pairs inspect security ratings, translation/identity or basic system/certificate state rather than both steering dependencies.
Open this question’s page →380. The selected member changes from wan1 to wan2 and the partner’s IP allowlist starts rejecting new sessions. What should be checked?
SD-WAN
✓ Correct answer
- The new public source address/NAT mapping and partner allowlist.
Different WANs can present different public source identities. Routing success does not guarantee partner authorization after that change. Rule titles, interface index and an unrelated inspection mode do not repair the allowlist mismatch.
Open this question’s page →381. An SD-WAN lab succeeds after cable removal but fails during high jitter while the port stays up. What gap does that reveal?
SD-WAN
✓ Correct answer
- The design has not successfully validated quality-based eligibility and fallback under degradation.
Hard failure and alive-but-degraded quality exercise different conditions. Validate thresholds, targets, steering and fallback under the actual degradation. A shared public IP is not a universal repair, and quality measurement does not require a cable outage.
Open this question’s page →382. An administrator migrates wan1 into a zone while existing policies still reference its previous interface use. What should be done before assuming conversion is a one-click change?
SD-WAN
✓ Correct answer
- Review interface dependencies and the intended zone routes/policies.
Interface dependencies affect conversion and later policy matching. Review references, routing and policy design. A display rename or gateway replacement does not resolve those dependencies, and automatic preservation of the old standalone design cannot be assumed.
Open this question’s page →383. Which two checks remain necessary after a service rule reports the expected preferred member? Select two answers.
SD-WAN
✓ Correct answers
- Replies and any required NAT must complete the bidirectional path.
- The flow must match an accepting policy for its actual egress.
Steering is one stage; authorization, translation and reply reachability still matter. A displayed decision is not a remote response, and neither routing nor policies are replaced by the rule.
Open this question’s page →384. A private application requires encrypted tunnels while public web traffic should leave directly through internet WANs. Which design expresses these separate requirements?
SD-WAN
✓ Correct answer
- Use an IPsec overlay for private destinations and appropriate SD-WAN rules/routes for direct internet access.
An encrypted overlay and direct-internet steering can coexist with suitable routing/policies. Physical SD-WAN membership is not encryption, blackholing removes access, and TLS certificate inspection does not create site-to-site network encryption.
Open this question’s page →385. An administrator wants an IPsec tunnel using AH instead of ESP on FortiOS. Which statement correctly describes the supported choice?
IPsec VPNs
✓ Correct answer
- FortiOS IPsec uses ESP and does not support AH as a selectable tunnel protocol.
FortiOS supports ESP for IPsec VPN rather than AH. Disabling NAT-T does not add AH support; policy numbering is unrelated. UDP 4500 is NAT traversal transport, not the AH protection protocol.
Open this question’s page →386. A WAN firewall rule permits TCP port 50 but blocks IP protocol 50. IKE over UDP 500 succeeds, while a native ESP path fails. Which change addresses the transport misunderstanding?
IPsec VPNs
✓ Correct answer
- Permit native ESP as IP protocol 50 where the design requires it.
Native ESP is IP protocol 50, not TCP/UDP port 50. IKE’s UDP 500 is separate. Selector values do not change ESP into a TCP service, and TCP 500 does not permit the intended native encapsulation.
Open this question’s page →387. A translation device sits between two VPN gateways. NAT is detected and NAT-T is enabled. Which outer transport should be considered for protected traffic?
IPsec VPNs
✓ Correct answer
- UDP 4500 encapsulation.
NAT-T encapsulates ESP in UDP 4500 when required. Native protocol numbers are not UDP port assignments. TCP 443 is not the stated IPsec transport, and NAT traversal does not change FortiOS into AH support.
Open this question’s page →388. During Diffie-Hellman key agreement, which information is exchanged to derive the secret?
IPsec VPNs
✓ Correct answer
- Public DH values; each peer keeps its private value and derives the secret locally.
DH exchanges public values and derives the shared secret using private values that remain local. Sending the completed secret or private keys would defeat the key-agreement design. LAN user passwords are not the DH exchange.
Open this question’s page →389. A design performs key agreement but does not validate the expected VPN peer identity. What security purpose is still missing?
IPsec VPNs
✓ Correct answer
- Authenticating who participates in the key agreement.
Key agreement and peer authentication solve different problems. Authentication establishes that the intended peer participates. Latency measurement, fixed source ports and default routes cannot supply cryptographic peer identity.
Open this question’s page →390. Which settings belong to establishing the Phase 1 relationship? Select two answers.
IPsec VPNs
✓ Correct answers
- The remote gateway and local WAN interface.
- IKE version and peer authentication/proposals.
Phase 1 defines the endpoint, IKE and authentication/cryptographic relationship. Web quotas and VIP service mapping are separate security/translation functions. Protected traffic selectors are a Phase 2 function, not the Phase 1 endpoint relationship.
Open this question’s page →391. A configuration excerpt has set ike-version 2. An engineer proposes switching its Main Mode to Aggressive Mode to fix negotiation. Which interpretation is correct?
IPsec VPNs
✓ Correct answer
- IKEv2 has no Main/Aggressive mode choice; diagnose its actual parameters instead.
Main and Aggressive Mode are IKEv1 terminology. They are not settings to repair an IKEv2 relationship. Neither subnet masks nor an invented ESP TCP port follow from those modes.
Open this question’s page →392. Does a dialup client's dynamic WAN address by itself require IKEv1 Aggressive Mode?
IPsec VPNs
✓ Correct answer
- Dynamic addressing alone does not determine the IKEv1 mode; peer identification matters. IKEv2 has no Main/Aggressive choice.
Dynamic addressing alone is not the deciding condition for IKEv1 mode; the peer-identification design matters. Neither automatic Aggressive Mode nor ignoring identity configuration follows from a changing address. IKEv2 does not use the Main/Aggressive choice.
Open this question’s page →393. Peers reach each other over UDP 500 but offer no compatible Phase 1 encryption/integrity or DH parameters. What is the most appropriate next action?
IPsec VPNs
✓ Correct answer
- Compare and align mutually supported Phase 1 proposals and DH settings.
Transport reachability is not cryptographic agreement. The peers need compatible offers. A unilateral stronger but incompatible proposal, forwarding permission or route description does not solve that negotiation failure.
Open this question’s page →394. Both peers have correct public addresses and the same PSK, but logs show rejection of the expected peer ID. What should be investigated?
IPsec VPNs
✓ Correct answer
- The configured local/peer identities and matching authentication definition.
Identity expectations are independent of matching the PSK. Inspect what each side sends and accepts. Web ratings and descriptive switch labels do not supply the configured IKE identity.
Open this question’s page →395. Which requirements apply to certificate-authenticated VPN peers? Select two answers.
IPsec VPNs
✓ Correct answers
- Appropriate certificate/private-key identities and acceptable peer authentication settings.
- Trust in the relevant issuing CA and required certificate validation.
Certificate authentication needs usable identities/keys and valid trust/peer checks. A certificate-only design does not universally require a PSK. An unrelated inspection CA or disabled validation does not establish the intended VPN peer identity.
Open this question’s page →396. Phase 1 is established, but the peers have mismatched Phase 2 protected subnets and PFS settings. What does the Phase 1 success establish?
IPsec VPNs
✓ Correct answer
- The IKE relationship is up, while Phase 2 can still fail independently.
An IKE relationship does not prove compatible traffic SAs, selectors, policy or host replies. Phase 2 must be negotiated successfully and forwarding dependencies verified. Phase 1 does not automatically widen selectors or configure hosts.
Open this question’s page →397. At site A, local selector is 10.11.0.0/24 and remote selector is 10.22.0.0/24. Which corresponding site-B subnet definition describes the same traffic pair?
IPsec VPNs
✓ Correct answer
- Local 10.22.0.0/24 and remote 10.11.0.0/24.
Each side calls its own protected network local. The peer reverses local and remote perspective. Broad/public-only definitions are not the specified pair, and IKE/NAT-T ports are not the subnet addresses in this example.
Open this question’s page →398. Several subnet pairs should share one authenticated gateway relationship. Which two statements support that configuration? Select two answers.
IPsec VPNs
✓ Correct answers
- Multiple Phase 2 definitions can reference one Phase 1.
- Each Phase 2 can express its own compatible protected selectors.
Phase 2 definitions bind to the intended Phase 1 and can define different subnet pairs. Separate public IPs are not inherent, phase1name identifies the VPN relationship, and policy authorization still constrains the carried traffic.
Open this question’s page →399. Both peers negotiate broad 0.0.0.0/0 traffic selectors. A protected workstation attempts a service denied by the accepting-policy design. What do the broad selectors imply?
IPsec VPNs
✓ Correct answer
- The SA can potentially carry a broad traffic scope, but policy authorization still applies.
Selectors define SA carriage scope, not authorization. Broad selectors do not override policy, change operation mode or configure administrator source restrictions. Verify the actual forward policy.
Open this question’s page →400. Why does a design enable PFS for the relevant Phase 2 rekeying?
IPsec VPNs
✓ Correct answer
- To add a fresh DH exchange rather than rely solely on existing IKE keying material.
PFS adds fresh DH key agreement for the relevant rekeying. It neither transmits the private/shared secret, removes compatibility requirements nor creates authorization policy.
Open this question’s page →401. A backup tunnel should have its traffic SAs ready before user traffic needs it. Which two points are correct? Select two answers.
IPsec VPNs
✓ Correct answers
- Backup selectors, proposals and policies still need to be validated with real traffic.
- Phase 2 auto-negotiate can initiate/maintain negotiation without waiting for user traffic.
Auto-negotiate improves SA readiness, while a useful backup still depends on compatibility and forwarding. It does not grant service authorization, change IKE version/mode or establish that a remote application responded.
Open this question’s page →402. An established VPN reaches its configured key lifetime. What should an administrator normally expect?
IPsec VPNs
✓ Correct answer
- Rekeying according to the negotiated relationship/settings.
Key lifetimes control rekeying rather than recurring manual secret entry. Route deletion and automatic removal of protection are not the stated lifetime behavior. Inspect rekey compatibility if the tunnel fails at renewal.
Open this question’s page →403. Why does bidirectional IPsec protection involve directional SA state?
IPsec VPNs
✓ Correct answer
- An IPsec SA is unidirectional, so a pair handles the two directions.
Directional SAs carry the cryptographic state for each direction. They are not merely policy labels; ESP is not TCP port 50, and both gateways can send protected traffic using the relevant SA.
Open this question’s page →404. Which two checks should follow a completed IPsec wizard? Select two answers.
IPsec VPNs
✓ Correct answers
- Review generated VPN objects, protected subnets, routes and policies.
- Verify compatible peer settings and test bidirectional protected traffic.
The wizard creates configuration that still needs review and testing. It does not prove remote host behavior or redundancy, and deleting referenced objects blindly can break the generated design.
Open this question’s page →405. A route-based tunnel named Branch-B is up. Which route expression should normally direct the remote protected /24 into it?
IPsec VPNs
✓ Correct answer
- A remote-subnet route using device Branch-B.
The tunnel virtual interface is the route-based forwarding device. A VIP, invalid private-host internet gateway or security-profile label does not replace the remote-subnet tunnel route.
Open this question’s page →406. Which accepting policy authorizes a new connection initiated by a local LAN host toward the remote protected subnet?
IPsec VPNs
✓ Correct answer
- LAN to the route-based tunnel interface, with matching addresses and service.
Local initiation needs permission from the LAN ingress to the selected tunnel egress. A reverse initiation policy, local management access or category classification is not that forward authorization. Return packets for the accepted session use state.
Open this question’s page →407. Which two statements distinguish new initiation from stateful replies across a VPN? Select two answers.
IPsec VPNs
✓ Correct answers
- A tunnel-to-LAN policy can authorize independent remote initiation.
- Replies belonging to an existing accepted session use stateful handling.
Policy direction governs independent initiation, while session state handles permitted replies. IKE success is not user authorization, and a forwarding policy does not repair incompatible Phase 2 parameters.
Open this question’s page →408. The two sites use non-overlapping private subnets and should preserve original source identities. What is the usual source-NAT choice on their site-to-site forward policies?
IPsec VPNs
✓ Correct answer
- Keep SNAT disabled unless a deliberate translation requirement exists.
Ordinary non-overlapping site-to-site designs preserve private addresses with NAT disabled. VPN carriage does not inherently require public translated inner sources. Pools and VIPs do not replace the configured identity/selector design or authenticate peers.
Open this question’s page →409. IKE establishes even though no LAN-to-tunnel accepting policy has been created. Which conclusion is correct?
IPsec VPNs
✓ Correct answer
- Endpoint negotiation can succeed while user forwarding remains unauthorized.
IKE terminates at the VPN gateways, separate from transit LAN payload permission. Missing forward policy can block user traffic without preventing Phase 1. There is no implied hidden allow policy, permission bypass or AH support.
Open this question’s page →410. A route-based VPN policy references a tunnel virtual interface. An older note says its action must be IPsec. Which action model is appropriate here?
IPsec VPNs
✓ Correct answer
- Use an ACCEPT forward policy for the route-based interface design.
Route-based policies accept traffic toward/from the tunnel interface. Legacy policy-based Action IPsec is a different model. Denial or a security-profile exemption does not supply ordinary route-based forwarding authorization.
Open this question’s page →411. Interpret this abbreviated Phase 2 excerpt: edit "B-LAN" set phase1name "Site-B" set src-subnet 10.11.0.0 255.255.255.0 set dst-subnet 10.22.0.0 255.255.255.0 Which two statements follow? Select two answers.
IPsec VPNs
✓ Correct answers
- It describes the local 10.11.0.0/24 to remote 10.22.0.0/24 subnet scope.
- The Phase 2 definition is associated with the Site-B Phase 1 object.
phase1name binds the Phase 2 and the subnet fields express its protected scope. The excerpt does not create policy, set the public WAN address or route every unrelated destination. A compatible mirrored peer and remaining dependencies are still required.
Open this question’s page →412. A Phase 2 definition has correct subnet selectors but references the wrong Phase 1 object through phase1name. What should be corrected?
IPsec VPNs
✓ Correct answer
- Bind it to the intended gateway relationship.
phase1name binds Phase 2 to its owning IKE/gateway relationship. Changing selectors, policy order or the Phase 2 display name does not repair that reference.
Open this question’s page →413. A VPN configuration includes a static route to 10.22.0.0/24 using device Site-B, but the host’s actual destination is 10.23.0.20. The tunnel SAs are up. What should be checked first?
IPsec VPNs
✓ Correct answer
- Whether the intended destination has a correct route and matching selectors/policy.
A route and selectors for one /24 do not establish a path or authorization for another. Cryptographic strength and a dashboard refresh do not add the missing destination coverage. Inspect the exact tuple rather than treating SA state as universal reachability.
Open this question’s page →414. A full mesh has six sites with one logical connection for each site pair. How many logical connections are required?
IPsec VPNs
✓ Correct answer
- 15.
The pair count is n(n-1)/2, so 6×5/2 = 15. Six counts sites, twelve is not the pairwise formula, and thirty double-counts both directions of each logical pair. Redundant underlay paths are a separate count.
Open this question’s page →415. Two sites in a partial mesh have no direct tunnel, but should communicate through a third site. What must the design provide?
IPsec VPNs
✓ Correct answer
- A permitted transit path with suitable routes, selectors and policies.
Partial mesh omits selected direct pairs, so the transit design must carry and authorize the traffic. It is not a full mesh. Rekey timing and keepalives for a nonexistent direct path cannot supply transit connectivity.
Open this question’s page →416. Which three dependencies must a hub verify for spoke-to-spoke IPsec transit? Select three answers.
IPsec VPNs
✓ Correct answers
- Compatible protected selectors for the transit traffic.
- Accepting tunnel-to-tunnel forwarding policies.
- Routes that select the intended destination tunnel.
Hub transit needs a path, traffic-SA scope and forwarding permission. Management access is a separate local-in flow, and an IKE relationship is not a substitute for authorizing protected user traffic.
Open this question’s page →417. Site A has two independent WANs and two tunnels to site B, but B has one WAN. Which failure remains a common outage for both tunnels?
IPsec VPNs
✓ Correct answer
- Failure of B’s single WAN connection.
Both logical tunnels depend on B’s one underlay, so its failure defeats that partial redundancy. A validated second A-side path can cover a single A-WAN failure; a valid A-side preference change and ordinary supported rekey are not the identified common physical dependency.
Open this question’s page →418. Both VPN gateways have two WAN links. If every WAN cross-pair is intentionally configured, how many pairwise underlay paths are possible?
IPsec VPNs
✓ Correct answer
- Four.
Two interfaces at A combined with two at B produce 2×2 = 4 cross-pairs. Directional SA state is separate from physical pairing. IKE version does not constrain this simple topology count to one.
Open this question’s page →419. Which two observations warn that nominally redundant VPN paths share a failure point? Select two answers.
IPsec VPNs
✓ Correct answers
- Both ISPs use the same local cable route.
- Both tunnels terminate at a peer with one WAN or one shared dependency.
Physical/provider and remote-underlay sharing can defeat redundancy. Names and route preference distinguish configuration objects or selection, not independent fault domains.
Open this question’s page →420. A FortiOS 7.6 Phase 1 extract omits an explicit DPD line in a defaults-based question. Which documented default should be recognized?
IPsec VPNs
✓ Correct answer
- on-demand.
The 7.6 CLI documents DPD on-demand as default. An explicit setting can change it, but neither on-idle nor disable is the stated default. Web-filter actions are not DPD modes.
Open this question’s page →421. When does DPD on-demand initiate the relevant peer-liveness checking?
IPsec VPNs
✓ Correct answer
- When outbound IPsec traffic receives no response from the peer.
On-demand DPD responds to outbound traffic with no peer response. Periodic idle probing, rekey lifetime and NAT keepalives serve different conditions; sending a keepalive alone is not a DPD acknowledgment.
Open this question’s page →422. The VPN peer answers DPD, but the protected application server beyond it is unreachable. What additional measurement is appropriate?
IPsec VPNs
✓ Correct answer
- A representative protected-path/application reachability or SLA test.
DPD checks peer liveness, not all downstream hosts or quality. Test the intended protected path and diagnose forwarding. AH is unsupported, and changing rekey timing does not establish application health.
Open this question’s page →423. Which two route designs can express preference between usable same-prefix tunnel paths? Select two answers.
IPsec VPNs
✓ Correct answers
- A lower-distance primary and higher-distance backup.
- Equal-distance static paths with lower numerical priority on the intended primary.
Distance or comparable static priority can express preference. Equal prefix/distance/priority can permit ECMP rather than a single preferred path. Policy numbering and descriptions do not set routing preference.
Open this question’s page →424. Two usable tunnel routes have the same prefix, distance and numerical priority. What should be considered instead of assuming one is a strict standby?
IPsec VPNs
✓ Correct answer
- The paths can qualify for multipath/ECMP if other prerequisites hold.
Equal route attributes can allow multipath. Alphabetic names and PFS do not define route preference, and equal-cost paths are not inherently un-installable. Verify the actual active table and intended forwarding design.
Open this question’s page →425. Failover takes longer than expected because the backup Phase 2 starts negotiating only after the primary fails. Which improvement is relevant?
IPsec VPNs
✓ Correct answer
- Evaluate auto-negotiate and validate standby SA readiness and data flow.
A pre-negotiated validated standby can reduce the negotiation delay. NAT changes, names and eliminating detection do not create ready compatible traffic SAs. Read the relevant monitoring and route design as well.
Open this question’s page →426. The preferred VPN recovers, but established sessions continue using the backup while new sessions can select the preferred path. Which interpretation is reasonable?
IPsec VPNs
✓ Correct answer
- Session preservation and cached forwarding can make established-session behavior differ from new selection.
Routing preference and existing session state can yield different failback behavior. An immediate universal move is not guaranteed. Recovery can restore route eligibility; PFS governs keying rather than route/session failback.
Open this question’s page →427. A backup tunnel has compatible SAs and a selected remote-subnet route, but no accepting policy permits LAN traffic through its interface. What blocks useful failover?
IPsec VPNs
✓ Correct answer
- Missing forwarding authorization for the selected backup path.
A route and SA do not grant permission. The actual backup egress must be covered by accepting policy, directly or through a correct zone design. Strengthening compatible keying, adding descriptions or matching names does not repair that permission gap.
Open this question’s page →428. Which two records/evidence sets answer different VPN operational questions? Select two answers.
IPsec VPNs
✓ Correct answers
- VPN events show negotiation, SA and DPD changes.
- Forward traffic logs show protected user-session policies/actions.
VPN and traffic evidence must be correlated because they describe different layers. SA readiness, local GUI reachability and translation keepalives do not establish a protected application response.
Open this question’s page →429. The tunnel’s outbound encrypt counter rises during a client test, but the inbound decrypt counter remains unchanged. Which branch should be investigated next?
IPsec VPNs
✓ Correct answer
- Remote processing, host response and return-path delivery of protected replies.
The counters show outbound protection without observed inbound protected responses. Investigate the remote forward/host/return path. Outbound encryption or IKE establishment is not local LAN response evidence, and restarting IKE before checking the missing reply path does not isolate that forwarding failure.
Open this question’s page →430. Inbound decrypt counters increase, but the expected decrypted packet is not delivered to the local LAN host. Which checks are most relevant?
IPsec VPNs
✓ Correct answer
- The local post-decryption route/policy path, selector/context and host delivery.
Observed decryption narrows the failure to subsequent handling or delivery. Rechecking only initial IKE reachability or increasing DH strength ignores local forwarding. Decryption does not override policy or ensure host receipt.
Open this question’s page →431. Small pings succeed through a VPN, but larger TCP transfers stall. Which hypothesis should be tested with packet evidence before changing proposals?
IPsec VPNs
✓ Correct answer
- MTU/fragmentation or TCP MSS constraints on the encapsulated path.
Encapsulation reduces usable path size and can expose fragmentation/MSS problems. Small-packet success is not a large-transfer test. Selectors do not resize by file, and unsupported AH is not the solution.
Open this question’s page →432. Which two outer-WAN observations are relevant before diagnosing an IPsec cryptographic mismatch? Select two answers.
IPsec VPNs
✓ Correct answers
- Whether UDP 500/4500 reaches the intended gateway and returns.
- Whether native ESP protocol 50 or required NAT-T transport is permitted by the underlay.
Confirm bidirectional endpoint/encapsulation transport before interpreting negotiation failure. Unrelated web UI behavior, names and an unrelated LAN allocation detail do not establish that the required outer packets cross the path.
Open this question’s page →433. An engineer wants to share raw diagnose vpn tunnel list output with an external reviewer. What handling is appropriate?
IPsec VPNs
✓ Correct answer
- Scope the collection, stop any debug and inspect/redact sensitive key material before sharing.
Read-only diagnostics can still reveal sensitive material. Use a scoped collection and redact relevant secrets; stop debug after reproduction. A read-only label is not a confidentiality guarantee, and unbounded collection or sharing the PSK is unnecessary.
Open this question’s page →434. Which command is the most focused initial check for the established IKE gateway relationships?
IPsec VPNs
✓ Correct answer
- diagnose vpn ike gateway list
The IKE gateway list exposes the IKE relationship state. Web categories and address objects do not provide that negotiation state. SD-WAN health checks may measure an application/path but are not a replacement for inspecting the IKE gateways.
Open this question’s page →435. Which command is appropriate for inspecting selectors and directional counters for one named tunnel?
IPsec VPNs
✓ Correct answer
- diagnose vpn tunnel list name Site-B
The named tunnel-list output provides focused VPN/SA information including relevant selectors and counters. Identity groups, DNS settings and the routing table answer other questions and do not supply that SA/counter detail.
Open this question’s page →436. A FortiGate-originated ping to a remote private host fails while a correctly authorized LAN client works through the tunnel. Which two details should be checked? Select two answers.
IPsec VPNs
✓ Correct answers
- Whether that local-out source fits the protected selectors and remote return path.
- The source address/interface selected for the FortiGate-originated test.
Local-out source selection can differ from a forwarded LAN client and must fit the tunnel/return design. A LAN success does not make every source equivalent. A VIP is not universally required, and IKEv2 has no Aggressive Mode choice.
Open this question’s page →437. Two sites have overlapping private networks and need controlled access through a VPN. What is the best design-level response?
IPsec VPNs
✓ Correct answer
- Deliberately plan translated identities, selectors, routes and policies rather than enabling NAT blindly.
Overlapping addressing requires an explicit resolution strategy, potentially NAT, with consistent protected/translated identities and return paths. Encryption does not make ambiguous addresses unique. Removing paths or sending private traffic indiscriminately to the internet does not supply the required controlled connectivity.
Open this question’s page →438. Phase 2 selectors intentionally cover TCP 443 between two subnet pairs. A host attempts TCP 8443 with correct routes and a broad firewall policy. Which dependency should be checked?
IPsec VPNs
✓ Correct answer
- Whether the negotiated selector’s service/protocol scope can carry TCP 8443.
Selectors can constrain protocol/ports independently of accepting policy. Permission does not enlarge a negotiated SA, route preference does not translate ports, and descriptive names do not define selector scope.
Open this question’s page →439. A full mesh reduces dependence on one transit hub, but all sites still use a single common upstream link. What conclusion is justified?
IPsec VPNs
✓ Correct answer
- Direct tunnels do not remove the shared upstream failure point.
Logical connectivity and underlay independence are different design dimensions. Full mesh does not guarantee provider resilience or imply dual WANs. Configuration names cannot create distinct physical paths.
Open this question’s page →440. Which three checks demonstrate a useful redundant VPN rather than only two green tunnel icons? Select three answers.
IPsec VPNs
✓ Correct answers
- Successful protected data flow through each intended tunnel.
- Observed route/policy selection and controlled primary failure.
- Verified recovery behavior and new-versus-existing session expectations.
Data-plane tests, selection during failure and recovery/session checks verify independent requirements. Naming and IKE readiness alone cannot establish protected forwarding or predictable failover/failback.
Open this question’s page →Sources and content
Published for public study on StudyByteLearn with the maintainer's permission. No permission for further redistribution is granted. Rights in the supplied source material remain with their respective holders. · Updated 2026-10-20
Created by Codex AI agents on 2026-10-20 using the completed FortiOS 7.6 study guide, its Fortinet source register, and the official FortiOS 7.6 Administrator blueprint. Every item received an author accuracy pass and a separate AI peer review; the primary agent applied and rechecked scenario, distractor and source refinements. All 18 task groups and their listed details were mapped to learning items. Reviewers were AI agents; no human instructor sign-off is recorded. Actual StudyByteLearn importer, reference integrity and exact-set scoring were validated; see the accompanying review and validation records.