296 questions total · 4pages · All types, answers revealed
A network engineer wants to inspect web traffic for malicious downloads and web-based threats passing through a FortiGate device. Where must this inspection profile be applied to take effect?
Security profiles must be attached to firewall policies to process traffic.
An administrator notices that configuration changes made via the CLI are not persisting after a device reboot. What is the most likely reason for this behavior?
Using 'abort' discards all uncommitted changes made within the current configuration session.
Why this answer
FortiGate saves configuration changes to running memory immediately, but they are only written to permanent flash storage when the command completes successfully. If an invalid command or virtual domain (VDOM) context was left incomplete, or if the write failed, changes may be lost. However, standard config changes auto-save.
If flash is full or in read-only mode, it fails. Alternatively, failing to enter 'end' properly or making changes in a temporary session can cause loss. Let's look at options regarding manual commit vs auto-save.
FortiGate auto-saves upon 'end'.
An administrator is configuring a FortiGate firewall and needs to ensure that packets matching an explicit allow policy are also logged. Where should the administrator enable logging for this specific policy?
Firewall policy logging is enabled per policy rule to track allowed or denied traffic.
Why this answer
Log settings for a firewall policy (such as logging all sessions or security events) are configured directly inside the individual firewall policy rule parameters.
Where can an administrator view real-time bandwidth consumption per interface on the FortiGate dashboard?
Correct. The Network Interfaces widget provides live throughput and status for all interfaces.
Why this answer
The Network Interfaces widget displays real-time bandwidth and traffic rates per interface.
An administrator needs to configure SNMP v3 monitoring on the FortiGate for integration with a network management system (NMS). Where is SNMP configured in the web-based manager?
Correct. SNMP v1/v2c/v3 communities, users, and trap receivers are configured under System > SNMP.
Why this answer
SNMP settings are configured under System > SNMP.
Which TWO actions should an end-user take to protect their physical workstation security?
Physical document protection is as important as digital security.
Why this answer
Locking the screen and keeping sensitive documents stored securely are fundamental physical security controls.
An enterprise network architect is designing a site-to-site VPN architecture to connect a branch office to headquarters using FortiGate devices. The branch office relies on a dynamic broadband connection with a frequently changing public IP address. Which VPN configuration approach should be implemented?
A dial-up IPsec VPN setup accommodates branch offices with dynamic public IPs by having the static headquarters listen for incoming connections from dynamic peers.
Why this answer
When one peer has a dynamic IP address, Main Mode IPsec VPNs with dynamic dial-up user settings or Aggressive Mode with dynamic ID peer IDs are typically used. In modern FortiOS, dial-up IPsec VPN configurations allow the dynamically addressed branch to initiate the tunnel to the static headquarters.
An administrator is reviewing log storage and management settings on the FortiGate. Which THREE storage options or destinations are supported for logging on a FortiGate? (Choose three)
Correct. FortiGate can store logs locally on internal flash storage or hard drives.
Why this answer
FortiGate supports logging locally to internal storage/hard drive, forwarding to FortiAnalyzer, and forwarding to Syslog servers.
Where in the FortiGate GUI can an administrator view a summary of detected security incidents, top applications, and top bandwidth users across the network?
FortiView provides visual dashboards for top applications, sources, destinations, and threats.
Why this answer
FortiView is the primary monitoring tool in the FortiGate GUI used to analyze traffic, threats, top applications, and users.
Which THREE practices represent fundamental cybersecurity hygiene for end users to protect corporate endpoints? (Choose three)
Patching closes known vulnerabilities exploited by malware.
Why this answer
Keeping software updated, avoiding unverified downloads, and locking screens are foundational hygiene steps.
Where can an administrator view a real-time list of top destination IP addresses accessed by internal users?
Correct. FortiView Destinations shows top destination addresses receiving traffic from the network.
Why this answer
FortiView Destinations provides real-time visibility into top destination IP addresses and domains.
An administrator is preparing to deploy a new FortiGate and needs to configure basic network parameters. Which TWO basic network settings must typically be configured on physical interfaces before deploying firewall policies? (Choose two)
Correct. Administrative access protocols must be explicitly enabled on interfaces to allow GUI/CLI management.
An administrator wants to verify which administrator is currently logged into the FortiGate and from which IP address. Which CLI command should be used?
Correct. This command lists currently logged-in administrators and their connection source IPs.
Why this answer
Active administrative sessions can be viewed using the get system admin status or system session list commands.
An administrator wants to check the operational status and firmware version of all connected FortiExtender devices managed by the FortiGate. Which menu path should they follow?
Managed FortiExtender units, switches, and APs appear under Security Fabric > Managed Devices.
Why this answer
Managed FortiExtender devices are monitored and configured under the Managed Devices menu in the FortiGate GUI.
An administrator wants to view top talkers by bandwidth usage over the past hour. Which FortiView view should be accessed?
Correct. FortiView Sources displays top source IP addresses generating network traffic.
Why this answer
FortiView Sources displays top talkers (source IP addresses) ranked by bandwidth consumption.
An organization wants to educate its employees on how to recognize sophisticated spear-phishing emails that use personalized details gathered from public professional networks. Which training approach is most effective for building practical resilience?
Practical simulations reinforce awareness and test behavioral readiness effectively.
Why this answer
Simulated phishing campaigns combined with immediate, contextual training help users recognize real-world tactics safely.
An administrator needs to restore a saved configuration file to the FortiGate via the CLI. Which command is used to restore configuration settings from a backup file stored on a TFTP server?
Correct. This command downloads and restores a configuration backup from a TFTP server.
Why this answer
The execute restore config command is used to restore configuration backups.
An administrator wants to customize the dashboard view by adding a new widget. What is the standard method to add widgets in the FortiGate GUI?
Correct. The Dashboard interface includes an 'Add Widget' button to customize displayed panels.
Why this answer
Widgets can be added by clicking the 'Add Widget' button on the Dashboard.
DPD checks peer liveness to ensure fast detection of broken tunnel connections.
Why this answer
DPD detects dead or unresponsive VPN peers by periodically sending hello/acknowledgment probes, allowing the FortiGate to tear down stale security associations and re-establish the tunnel.
Which THREE of the following statements accurately describe foundational security principles in enterprise environments? (Choose three)
Least privilege limits access scope to reduce potential damage from compromised accounts.
Why this answer
Least privilege, defense in depth, and separation of duties are core foundational security principles.
An administrator wants to ensure that administrative access to the FortiGate GUI is restricted to secure HTTPS connections only, while disabling insecure HTTP access. Where is this administrative access protocol configured on the FortiGate?
Admin access methods like HTTPS and SSH are configured per interface.
An administrator needs to view active hardware temperature and power supply statuses on the dashboard. Which widget should be added?
Correct. The Hardware Status widget displays physical sensor health readings.
Why this answer
The Hardware Status widget displays temperature sensors, fan speeds, and power supply statuses.
An administrator is troubleshooting log delivery failures to a remote syslog server. Which TWO troubleshooting commands or tools can be used from the FortiGate CLI to verify connectivity and log transmission?
Verifies basic IP reachability to the remote log server.
An administrator needs to verify the current date and time settings on the FortiGate to ensure log timestamps are accurate. Which menu path in the web-based manager is used to configure system time and NTP settings?
Correct. System time, timezone, and NTP server settings are configured under System > Settings.
Why this answer
System time and NTP servers are configured under System > Settings.
An administrator wants to inspect incoming files for unknown zero-day malware using advanced behavior analysis in a secure virtual environment before allowing them onto endpoints. Which Fortinet security component fulfills this requirement?
FortiSandbox analyzes files in a controlled environment to catch unknown malware.
Why this answer
FortiSandbox executes suspicious files in an isolated virtual sandbox environment to observe behavior and detect zero-day threats.
An administrator is troubleshooting a configuration synchronization failure in an HA cluster. Which CLI command forces an immediate configuration synchronization from the primary unit to the secondary unit?
Correct. This command forces the primary unit to push its configuration to secondary cluster members.
Why this answer
The execute ha synchronize command forces manual synchronization of configuration or sessions in an HA cluster.
An administrator needs to back up the FortiGate configuration and ensure that sensitive passwords are protected. Which TWO statements regarding FortiGate configuration backups are correct? (Choose two)
Correct. Encrypting configuration backups protects sensitive keys and credentials.
Why this answer
Configuration backups can be performed via the GUI or CLI, and administrators are prompted for an encryption password to secure sensitive data like pre-shared keys.
An organization is deploying FortiClient Endpoint Management Server (EMS) alongside FortiGate to enforce Zero Trust Network Access (ZTNA). A remote user's laptop connects to an unsecured public Wi-Fi hotspot. How does the Fortinet ZTNA solution ensure secure application access for this user without establishing a traditional full-tunnel VPN?
ZTNA leverages FortiClient EMS posture tags to authenticate and authorize access to specific enterprise applications via a proxy policy.
Why this answer
FortiClient ZTNA evaluates device posture (OS patches, antivirus status, registry checks) via EMS tags, and FortiGate acts as a ZTNA proxy, granting application-level access through explicit proxy rules only if posture tags match.
Within the Fortinet Security Fabric architecture, what is the primary role of an upstream FortiGate device acting as the root node compared to downstream internal segmentation firewalls?
The root FortiGate coordinates the Security Fabric, provides visibility across connected devices, and pushes synchronized configurations.
Why this answer
The root FortiGate in a Security Fabric orchestrates overall fabric topology, aggregates threat intelligence, and synchronizes settings downward to internal segmentation firewalls (ISF).
An IT auditor is reviewing network access controls and discovers that guest Wi-Fi users are placed on the same subnet as internal corporate workstations without any traffic isolation. Which security principle has been violated?
Placing guests on the corporate subnet without isolation violates network segmentation best practices.
Why this answer
Network segmentation isolates untrusted zones (like guest networks) from sensitive internal assets to limit the impact of a breach.
An administrator is hardening endpoint security using FortiClient and FortiGate integration. Which THREE core security functions can be enforced through this endpoint-to-firewall integration? (Choose three.)
FortiClient EMS evaluates security posture and applies tags that FortiGate uses to grant or deny application access.
Why this answer
FortiClient and FortiGate integration supports vulnerability scanning, compliance/posture checks via EMS tags, dynamic ZTNA access control, and automated quarantine of compromised endpoints.
An administrator is investigating a network performance degradation issue and needs to check hardware sensor health on a high-end FortiGate unit. Which THREE hardware parameters or components can be monitored via FortiGate hardware status commands or widgets? (Choose three)
Correct. Power supply operational states are tracked by hardware sensors.
Why this answer
Hardware health monitoring includes fan speeds, power supply status, and internal temperature sensors.
Which TWO characteristics describe effective password management principles? (Choose two.)
Password managers eliminate the need to memorize complex passwords and prevent reuse.
Why this answer
Effective password management relies on using password managers to generate long, unique passphrases or passwords for every account.
An administrator needs to reboot the FortiGate device remotely during a maintenance window without causing data corruption. Which CLI command should be executed?
Correct. execute reboot initiates a graceful system restart.
Why this answer
The execute reboot command safely restarts the FortiGate device.
Which THREE actions can a FortiGate Web Filtering profile take when a user attempts to access a website belonging to a blocked category? (Choose three.)
Blocking presents a replacement message explaining why access was denied.
Why this answer
When a web filter category is blocked, the FortiGate can block the page and show a replacement message, allow with a warning prompt, or monitor/log the event.
Which TWO authentication methods or servers can be integrated with a FortiGate for user identity verification? (Choose two.)
FortiGate integrates with LDAP and Active Directory for enterprise user authentication.
Why this answer
FortiGate supports integration with external authentication servers such as LDAP/Active Directory and RADIUS.
An administrator wants to verify which configuration revision history is currently active and wants to roll back to a previous revision. Where can configuration revisions be managed in the web-based manager?
Correct. Revision history allows administrators to view and roll back previous configuration versions.
Why this answer
Configuration revisions are managed under System > Configuration or via the administrator profile dropdown menu revision history.
An administrator notices that a specific software application is being blocked by Application Control. Upon checking the logs, the administrator wants to create an exception to allow this specific application while keeping the rest of the application control category blocked. How can this be achieved?
Application overrides allow granular allow/block exceptions for individual applications.
Why this answer
Application Control profiles support application overrides, allowing administrators to add specific allow or block exceptions for individual applications within a category.
Tunnel mode assigns a virtual IP address so clients can route traffic securely.
Which TWO behaviors are recognized indicators that an incoming email may be a phishing attempt? (Choose two)
Attackers manufacture urgency to bypass critical thinking.
Why this answer
Urgency, mismatched sender domains, and unexpected attachments are key indicators of phishing.
An enterprise network team notices that internal workstations are periodically querying known malicious command-and-control (C2) domains. However, direct external DNS queries are blocked. How might an advanced malware strain attempt to resolve these domains?
Malware can bypass local DNS blocks by using external public resolvers or encrypted DNS protocols.
Why this answer
Advanced malware often uses alternative lookup methods, such as utilizing hardcoded public DNS resolvers or tunneling protocols, to bypass internal DNS restrictions.
Which THREE methods can be used to back up or restore a FortiGate configuration? (Choose three.)
FortiManager manages device backups, revisions, and automated deployments.
Confidentiality protects sensitive data from unauthorized interception and eavesdropping.
Why this answer
Confidentiality ensures that data is readable only by intended parties, which is achieved through encryption, preventing casual sniffing on shared segments.
Which THREE of the following practices help protect end-user devices (endpoints) from malware and compromise? (Choose three)
Mindful browsing prevents the accidental introduction of malware onto the device.
Why this answer
Endpoint protection, keeping software updated, and avoiding unverified links or downloads are vital practices for endpoint security.
What is the primary function of FortiMail in an enterprise security architecture?
FortiMail provides dedicated email security and threat prevention.
Why this answer
FortiMail is a secure email gateway designed to protect organizations from spam, malware, phishing, and data loss via email.
What is the primary purpose of a firewall address group in FortiOS?
Address groups allow multiple subnets/IPs to be referenced in a single policy rule.
Why this answer
Firewall address groups combine multiple individual address objects into a single group, simplifying policy management when rules apply to multiple hosts or subnets.
An administrator is troubleshooting a DHCP server issue on the FortiGate and needs to see active IP address leases assigned by the built-in DHCP server. Which CLI command provides this information?
Correct. This command outputs all active IP leases assigned by the FortiGate DHCP server.
Why this answer
The execute dhcp lease-list command displays active DHCP leases assigned by the FortiGate interface.
A network security administrator needs to block peer-to-peer (P2P) file sharing applications across the corporate network. Which FortiOS security feature should be added to the firewall policy to identify and block these specific applications regardless of the ports they use?
Application Control detects and blocks applications by signature inspection across any port.
An organization is deploying FortiGate in Transparent mode instead of NAT mode. How does a Transparent mode FortiGate handle incoming packets at Layer 2?
Transparent mode bridges traffic at Layer 2 without routing or altering IP headers.
Why this answer
In Transparent mode, the FortiGate operates as a bridge (Layer 2 device) without modifying IP addresses, inspecting traffic as it passes between interfaces on the same subnet.
What is the primary function of a firewall policy ID on a FortiGate?
Policy IDs uniquely identify each rule in the firewall policy table.
Why this answer
Every firewall policy is assigned a unique policy ID number by FortiOS to identify, reference, and reorder rules in the policy list.
What is the primary function of FortiSandbox in an enterprise security architecture?
FortiSandbox executes files safely to detect advanced zero-day threats.
Why this answer
FortiSandbox runs suspicious, unknown files in an isolated virtual environment to observe their behavior and detect zero-day malware.
SNAT replaces private internal source IPs with the public IP of the WAN interface.
An end user receives an alert that their browser has blocked a potentially malicious website that tried to automatically download an executable file without user interaction. What term describes this type of silent threat?
Automatic background downloads of malicious files while browsing represent drive-by downloads.
Why this answer
A drive-by download occurs when malware is downloaded automatically without the user's explicit consent or knowledge when visiting a compromised website.
An administrator is examining the FortiGate routing table via the CLI. Which THREE types of routes can appear in the active routing table? (Choose three)
Correct. Dynamic routing protocols populate routes automatically.
Which TWO practices represent fundamental cybersecurity hygiene guidelines for everyday end users? (Choose two.)
Locking unattended screens prevents physical unauthorized access by opportunistic visitors.
Why this answer
End users should maintain strong, unique passwords and lock their screens when leaving workstations unattended.
An administrator needs to verify whether FortiGuard web filtering rating lookups are succeeding for specific categories. Which CLI command tests web filter rating lookups for a specific URL?
Correct. This diagnostic command queries FortiGuard to return the rating category for a given URL.
Why this answer
The diagnose webfilter FortiGuard lookup command tests URL categorization.
An administrator is reviewing firewall policies and notices that traffic matching a specific policy is being logged, but no traffic logs are appearing in Log & Report > Forward Traffic. FortiGate is configured to send logs to FortiAnalyzer. Where are the traffic logs being stored?
When FortiAnalyzer is connected, traffic logs are sent off-box to the analyzer.
Why this answer
When a remote logging server like FortiAnalyzer or FortiGate Cloud is enabled and configured successfully, traffic logs are offloaded and stored on that remote device rather than locally on the FortiGate flash memory.
An enterprise branch office has two distinct internet connections (Fiber and Cable). The administrator wants traffic to preferentially use the Fiber link, but automatically fail over to the Cable link if the Fiber link experiences packet loss exceeding 5%. Which FortiOS feature accomplishes this?
SD-WAN rules dynamically steer traffic based on real-time SLA metrics like packet loss.
Why this answer
SD-WAN performance SLAs monitor latency, jitter, and packet loss, allowing administrators to configure rule-based path selection and automatic failover.
A network administrator notices that a web filtering profile configured on a FortiGate is blocking a specific educational video streaming category, but the exception list needs to allow a single permitted URL within that category. Where in FortiOS should the administrator add this specific URL override?
URL filter table entries inside the Web Filter profile permit specific wildcard or exact URLs to bypass category blocks.
Why this answer
FortiOS Web Filtering profiles allow administrators to configure URL Filters with action types such as Exempt, Block, Allow, or Monitor to override category-based decisions.
An administrator is troubleshooting a packet loss issue and needs to inspect the kernel buffer drops and interface error counters. Which CLI command provides a summary of interface drop statistics?
Correct. This diagnostic command outputs driver-level statistics, including buffer drops and errors.
Why this answer
The get system interface physical or diagnose hardware deviceinfo nic commands provide drop counters and error statistics.
Which action is a best practice for managing passwords to prevent credential stuffing attacks?
This approach eliminates the risk associated with password reuse.
Why this answer
Using a unique, complex password for every service ensures that one breach does not lead to the compromise of other accounts.
When setting up a new online account for a business service, an employee is prompted to save a set of 10 backup recovery codes in case they lose access to their authenticator app. What is the best practice for handling these recovery codes?
Secure storage ensures availability for emergency recovery without exposing them to unauthorized access.
Why this answer
Recovery codes should be stored securely and privately, such as in an encrypted password manager, rather than on sticky notes or unsecured text files.
An administrator wants to verify whether the FortiGate device is operating in NAT mode or Transparent mode. Where can this operational mode be checked in the web-based manager?
Correct. The System Information widget displays the operating mode (NAT or Transparent).
Why this answer
System mode (NAT or Transparent) is displayed in the System Information dashboard widget.
Which cybersecurity practice is most effective in mitigating the impact of a catastrophic ransomware infection on critical enterprise databases?
Offsite or immutable backups allow organizations to recover encrypted files without negotiating with attackers.
Why this answer
Maintaining regular, immutable backups stored offline or in a segmented cloud repository ensures data can be restored without paying a ransom.
Peer ID ensures correct tunnel identification when authenticating devices with dynamic addresses.
Why this answer
Local ID allows peers to identify themselves during Phase 1 negotiation, which is especially useful when one or both peers use dynamic IP addresses and need a distinct identifier for authentication matching.
An administrator configures a firewall policy with Antivirus enabled in flow-based inspection mode. When a user attempts to download an infected file, how does the FortiGate handle the transfer?
Flow-based antivirus drops the malicious stream instantly upon detection.
Why this answer
In flow-based inspection, when malware is detected, the FortiGate interrupts and drops the connection stream immediately, replacing the file with a replacement message.
An administrator needs to modify the hostname of the FortiGate via the CLI. Which configuration context and command are used?
Correct. Global system settings like hostname are modified within the config system global context.
Why this answer
The hostname is configured under config system global using the set hostname command.
Which TWO types of objects can be created to group network resources for firewall policies on a FortiGate? (Choose two.)
Address groups combine multiple IP address objects into a single group for policies.
Why this answer
Administrators can create firewall address objects/groups and service objects/groups to organize policies.
Which TWO of the following indicators are commonly associated with a potential phishing email? (Choose two)
Mass phishing campaigns often use generic salutations because they target many recipients.
Why this answer
Phishing emails frequently employ artificial urgency to prompt rash actions and often feature sender addresses with subtle domain spoofing or misspellings.
An organization wants to ensure that no single administrator has the unchecked authority to approve and deploy high-risk firewall rule changes into production. Which security governance mechanism should be implemented?
Requiring one admin to create a rule and a different admin to approve/deploy it enforces separation of duties.
Why this answer
Separation of duties ensures that critical tasks require authorization from multiple distinct individuals to prevent misuse or error.
When configuring dynamic routing on a FortiGate using OSPF, what is the function of a designated router (DR) in a multi-access broadcast network?
The DR optimizes OSPF traffic by reducing full-mesh adjacencies on broadcast segments.
Why this answer
In OSPF broadcast networks, a Designated Router (DR) minimizes routing protocol traffic by acting as a central collection and distribution point for link-state advertisements (LSAs) among all routers on that segment.
An administrator wants to check the operational status of all physical and logical interfaces in a summary table view. Which menu path in the web-based manager should be opened?
Correct. Network > Interfaces displays all physical ports, VLANs, and software interfaces with status and IP details.
Why this answer
Interface configurations and status summaries are viewed under Network > Interfaces.
An administrator needs to modify the TCP session timeout for specific services. Where are global system timeout values configured in the CLI?
Correct. Global timer settings like TCP idle timeouts are configured under config system global.
Why this answer
Timeouts are configured under config system global using parameters like set tcp-idle-timer.
An organization requires high availability (HA) for two FortiGate devices to ensure continuous network uptime during hardware failures. Which operating mode synchronizes sessions, configuration, and routing state between the primary and secondary units in an active-passive cluster?
FGCP active-passive synchronization ensures session failover and seamless high availability.
Why this answer
FGCP (FortiGate Clustering Protocol) in an active-passive high availability configuration synchronizes session tables and configurations so the secondary unit can seamlessly take over if the primary fails.
Which TWO criteria can be used in a FortiGate firewall policy to match and control traffic? (Choose two.)
Service objects define the specific network ports and protocols permitted by the policy.
Why this answer
Firewall policies match traffic based on source/destination interfaces, source/destination addresses, services, schedules, and user identities.
Practice FORTINET-NSE123 by domain
Target a specific domain to shore up weak areas.