scenario questions

What is the primary purpose of the FortiGuard distribution network in the Fortinet Security Fabric?

A junior administrator accidentally locked themselves out of the FortiGate CLI after multiple incorrect password attempts. What is the standard administrative method to recover access without losing the configuration?

A cybersecurity analyst is investigating a security breach where an attacker bypassed perimeter defenses by sending a weaponized PDF attachment directly to a high-ranking executive's personal email account used on a corporate laptop. What specific type of targeted attack does this represent?

An administrator needs to configure local administrator accounts with specific operational privileges. Which TWO elements are required or configurable when creating a new local administrator account? (Choose two)

An administrator is troubleshooting intermittent latency on a specific interface. They need to capture live packet data passing through that interface directly from the FortiGate CLI. Which command is used for packet capture?

A remote employee connects to an unsecured public Wi-Fi network at a coffee shop and accesses internal corporate resources without utilizing a VPN. Which foundational security principle is primarily compromised in this scenario?

An organization's security policy states that users should have only the access needed to perform their job, and that access should be reviewed regularly. A database administrator currently retains full administrative rights to a finance application even though her role changed six months ago and no longer requires those rights. Which principle is being violated?

An organization wants to enforce the Principle of Least Privilege for a new database containing sensitive customer records. Which user access configuration correctly implements this principle?

When configuring an IPsec VPN tunnel in FortiOS, what is the purpose of Phase 2 negotiation?

An administrator needs to verify the current firmware version running on the FortiGate. Where can this information be found immediately upon logging into the dashboard?

Where can an administrator view a summary of detected security threats, such as blocked malware and intrusion prevention events, in the FortiGate web-based manager?

Which TWO of the following actions should an end user take if they suspect their corporate credentials have been compromised? (Choose two)

An employee notices their computer screen locked with a message demanding cryptocurrency payment to restore encrypted files. What type of malware has infected the workstation?

An employee is designing a password for a new privileged system account. Which of the following practices represents the strongest password creation standard?

A remote worker is using a public Wi-Fi hotspot to access company resources. Which configuration provides the best protection for their traffic?

An administrator needs to check the status of FortiCare registration and feature licenses. Where in the web-based manager is this license summary displayed?

An attacker intercepts corporate communications by placing themselves between two communicating hosts, relaying messages and modifying them while both parties believe they are talking directly to each other. What is this attack called?

An end user receives an email from a display name matching their company executive, urging them to immediately click a link and purchase gift cards for a client meeting. Which foundational security concept and immediate action should the user apply?

Which TWO of the following practices represent essential foundational habits for maintaining strong personal and corporate password security? (Choose two)

Which TWO of the following characteristics differentiate SSL VPN from IPsec VPN when deploying remote access solutions on a FortiGate? (Choose two.)

Which TWO protocols can be enabled on a FortiGate interface for secure administrative access? (Choose two.)

Which TWO inspection modes are available on a FortiGate firewall for processing UTM security profiles? (Choose two.)

What is the primary function of a FortiGate hardware acceleration processor (FortiASIC)?

An administrator needs to restrict administrative access to the FortiGate CLI and GUI so that management connections are only accepted from a specific trusted internal management workstation subnet. Where is this source IP restriction configured?

An administrator notices that the FortiGate system disk is filling up rapidly with log files. Which action should be taken to ensure local storage does not run out of space while retaining historical logs?

Which TWO dashboard widgets are commonly used to monitor system performance and health on a FortiGate?

Which of the following scenarios describes a 'pretexting' social engineering attack?

Which TWO of the following are considered 'social engineering' techniques?

An administrator needs to quickly check the CPU and memory utilization of a FortiGate device directly from the web-based manager. Which dashboard widget provides this real-time system performance information by default?

An administrator suspects that a session is stuck in the FortiGate session table, preventing new connections. Which command allows viewing active sessions matching a specific source IP?

An administrator wants to configure a firewall policy so that specific internal users can only access the internet during non-work hours. Which object type should be added to the firewall policy to enforce this time restriction?

An administrator needs to ensure that administrative sessions to the FortiGate GUI automatically terminate after 15 minutes of inactivity. Where is this idle timeout setting configured?

When setting up a new FortiGate device, an administrator needs to configure basic network parameters before deploying it in production. Which THREE parameters must be configured for basic network connectivity?

An administrator wants to verify the amount of free space available on the system log disk. Which dashboard widget displays this metric?

What is the primary function of a FortiGate static route?

An administrator wants to ensure that all configuration changes made on a FortiGate are tracked with specific user accountability and revision history. Which Fortinet management tool provides centralized configuration revision control and rollback capabilities?

When configuring FortiGate High Availability (HA) in active-passive mode, what is the role of the heartbeat interfaces?

An administrator wants to verify the administrator access profile privileges assigned to a specific admin account. Where can access profiles be defined and edited?

An administrator wants to verify high availability (HA) cluster status and member synchronization. Which TWO commands or dashboard widgets provide this HA status? (Choose two)

An administrator is troubleshooting a scenario where internal users can browse safe websites, but HTTPS inspection using certificates is throwing browser security warnings for certain internal web applications. What is the most likely cause of this behavior when using Deep Packet Inspection (DPI) on FortiGate?

Which TWO strategies are recognized as effective defenses against social engineering attacks like phishing and pretexting? (Choose two.)

An internal auditor reviews network security logs and discovers that clear-text protocols such as Telnet and HTTP are actively used for managing core network devices. Which security principle is directly violated, and what is the recommended remediation?

An organization wants to prevent users from visiting malicious websites identified in real-time by a threat intelligence database. Which feature is most effective for this?

An employee receives a phone call from an individual claiming to be from the IT department, asking for their network password to resolve an urgent system ticket. The caller sounds professional and urgent. What best describes this type of attack?

An administrator configures a firewall policy with Web Filtering. When a user tries to access a newly created website whose category is unknown by the FortiGate, how does FortiGate handle the rating request?

An attacker intercepts legitimate communication between two parties and alters the message content while impersonating each party to the other. What type of cyber attack has occurred?

During a security awareness training session, an administrator explains how attackers use pretexting. Which scenario best exemplifies a pretexting attack?

Which TWO mechanisms are commonly utilized by attackers to establish persistence on a compromised workstation so they can retain access after a system reboot? (Choose two.)

Which TWO methods are effective ways to protect user accounts against credential-based attacks like credential stuffing and brute-forcing? (Choose two)

An administrator needs to ensure that internal network users cannot bypass corporate security policies by using unauthorized peer-to-peer file sharing or gaming applications. Which FortiGate security feature is specifically designed to identify and take action against these types of network protocols?

An IT administrator creates complex password policies requiring a mix of uppercase, lowercase, numbers, and special characters. Which security objective does this practice primarily support?

Which THREE components or protocols are involved in establishing and maintaining a FortiGate High Availability (HA) cluster using FGCP? (Choose three.)

An administrator wants to view historical web filtering and traffic logs on the FortiGate. Which TWO methods can be used to search and analyze stored logs? (Choose two)

Which dashboard widget displays the status of connected FortiGate security fabric devices and fabric topology?

An administrator is troubleshooting a certificate validation error when users connect to an SSL VPN portal. Where can the active SSL VPN server certificate be verified or changed in the web-based manager?

An administrator needs to export the current configuration of a FortiGate to a secure local file for backup purposes. Which menu path should the administrator navigate in the web-based manager?

An enterprise is deploying FortiGate High Availability (HA) in active-active mode. How does active-active mode differ from active-passive mode regarding session handling?

An organization is deploying FortiGate firewalls to segment internal network zones. What is the default action of a newly created firewall policy when traffic matches neither this policy nor any other rule?

Which TWO of the following behaviors are recommended when handling unexpected or suspicious email attachments? (Choose two)

A user reports that their workstation is running unusually slow and sending out large amounts of encrypted traffic to an unknown external IP. What is the most likely issue?

What is the primary function of a FortiGate firewall policy action set to 'Accept'?

Which THREE of the following actions represent safe habits when using public Wi-Fi hotspots? (Choose three)

Which TWO of the following are core components of the Fortinet Security Fabric architecture? (Choose two.)

Which Fortinet product acts as the centralized log management and reporting server that aggregates log data from multiple FortiGate devices across an enterprise network?

A network engineer wants to inspect web traffic for malicious downloads and web-based threats passing through a FortiGate device. Where must this inspection profile be applied to take effect?

An administrator is configuring a FortiGate firewall and needs to ensure that packets matching an explicit allow policy are also logged. Where should the administrator enable logging for this specific policy?

Where can an administrator view real-time bandwidth consumption per interface on the FortiGate dashboard?

Which TWO actions should an end-user take to protect their physical workstation security?

An enterprise network architect is designing a site-to-site VPN architecture to connect a branch office to headquarters using FortiGate devices. The branch office relies on a dynamic broadband connection with a frequently changing public IP address. Which VPN configuration approach should be implemented?

An administrator is reviewing log storage and management settings on the FortiGate. Which THREE storage options or destinations are supported for logging on a FortiGate? (Choose three)

Which THREE practices represent fundamental cybersecurity hygiene for end users to protect corporate endpoints? (Choose three)

Where can an administrator view a real-time list of top destination IP addresses accessed by internal users?

A company's security team notices a sudden spike in authentication failures for many user accounts within a short window, followed by successful logins from unfamiliar geographic locations using valid credentials. Which attack best matches this pattern?

An administrator is preparing to deploy a new FortiGate and needs to configure basic network parameters. Which TWO basic network settings must typically be configured on physical interfaces before deploying firewall policies? (Choose two)

An administrator wants to view top talkers by bandwidth usage over the past hour. Which FortiView view should be accessed?

An organization wants to educate its employees on how to recognize sophisticated spear-phishing emails that use personalized details gathered from public professional networks. Which training approach is most effective for building practical resilience?

An administrator needs to restore a saved configuration file to the FortiGate via the CLI. Which command is used to restore configuration settings from a backup file stored on a TFTP server?

When configuring an IPsec VPN tunnel between two FortiGate units, what is the function of Dead Peer Detection (DPD)?

Which THREE of the following statements accurately describe foundational security principles in enterprise environments? (Choose three)

A company's security team wants to reduce the damage an attacker could cause if a single employee account is compromised. They decide that every employee should have only the access needed to perform their daily job, and no more. Which security principle are they applying?

An administrator wants to ensure that administrative access to the FortiGate GUI is restricted to secure HTTPS connections only, while disabling insecure HTTP access. Where is this administrative access protocol configured on the FortiGate?

An administrator needs to view active hardware temperature and power supply statuses on the dashboard. Which widget should be added?

An administrator is troubleshooting log delivery failures to a remote syslog server. Which TWO troubleshooting commands or tools can be used from the FortiGate CLI to verify connectivity and log transmission?

An administrator needs to verify the current date and time settings on the FortiGate to ensure log timestamps are accurate. Which menu path in the web-based manager is used to configure system time and NTP settings?

An administrator wants to inspect incoming files for unknown zero-day malware using advanced behavior analysis in a secure virtual environment before allowing them onto endpoints. Which Fortinet security component fulfills this requirement?

An administrator needs to back up the FortiGate configuration and ensure that sensitive passwords are protected. Which TWO statements regarding FortiGate configuration backups are correct? (Choose two)

An organization is deploying FortiClient Endpoint Management Server (EMS) alongside FortiGate to enforce Zero Trust Network Access (ZTNA). A remote user's laptop connects to an unsecured public Wi-Fi hotspot. How does the Fortinet ZTNA solution ensure secure application access for this user without establishing a traditional full-tunnel VPN?

Within the Fortinet Security Fabric architecture, what is the primary role of an upstream FortiGate device acting as the root node compared to downstream internal segmentation firewalls?

An IT auditor is reviewing network access controls and discovers that guest Wi-Fi users are placed on the same subnet as internal corporate workstations without any traffic isolation. Which security principle has been violated?

An administrator is hardening endpoint security using FortiClient and FortiGate integration. Which THREE core security functions can be enforced through this endpoint-to-firewall integration? (Choose three.)

An administrator is investigating a network performance degradation issue and needs to check hardware sensor health on a high-end FortiGate unit. Which THREE hardware parameters or components can be monitored via FortiGate hardware status commands or widgets? (Choose three)

Which TWO characteristics describe effective password management principles? (Choose two.)

An administrator needs to reboot the FortiGate device remotely during a maintenance window without causing data corruption. Which CLI command should be executed?

Which THREE actions can a FortiGate Web Filtering profile take when a user attempts to access a website belonging to a blocked category? (Choose three.)

Which TWO authentication methods or servers can be integrated with a FortiGate for user identity verification? (Choose two.)

When configuring an SSL VPN tunnel mode connection for mobile workers, what does the FortiGate assign to the client machine to enable communication with internal subnets?

Which TWO behaviors are recognized indicators that an incoming email may be a phishing attempt? (Choose two)

An enterprise network team notices that internal workstations are periodically querying known malicious command-and-control (C2) domains. However, direct external DNS queries are blocked. How might an advanced malware strain attempt to resolve these domains?

Which THREE methods can be used to back up or restore a FortiGate configuration? (Choose three.)

A network administrator is setting up a corporate policy to prevent unauthorized internal users from sniffing traffic passing through a shared network segment. Which fundamental security principle is being addressed by implementing encrypted communication protocols like HTTPS and SSH?

Which THREE of the following practices help protect end-user devices (endpoints) from malware and compromise? (Choose three)

What is the primary function of FortiMail in an enterprise security architecture?

What is the primary purpose of a firewall address group in FortiOS?

An administrator is troubleshooting a DHCP server issue on the FortiGate and needs to see active IP address leases assigned by the built-in DHCP server. Which CLI command provides this information?

A network security administrator needs to block peer-to-peer (P2P) file sharing applications across the corporate network. Which FortiOS security feature should be added to the firewall policy to identify and block these specific applications regardless of the ports they use?

An organization is deploying FortiGate in Transparent mode instead of NAT mode. How does a Transparent mode FortiGate handle incoming packets at Layer 2?

A network administrator at a branch office is deploying a FortiGate 60F and wants to provide a single, unified dashboard that shows the real-time status of all Fortinet devices in the branch, including the FortiSwitch and FortiAP. Which Fortinet feature should the administrator enable to discover and display these devices automatically?

What is the primary function of a firewall policy ID on a FortiGate?

What is the primary function of FortiSandbox in an enterprise security architecture?

An organization is deploying a FortiGate firewall in NAT mode. By default, how does the FortiGate handle outbound traffic leaving the internal network for the internet in terms of source IP addressing?

An end user receives an alert that their browser has blocked a potentially malicious website that tried to automatically download an executable file without user interaction. What term describes this type of silent threat?

An administrator is examining the FortiGate routing table via the CLI. Which THREE types of routes can appear in the active routing table? (Choose three)

Which TWO practices represent fundamental cybersecurity hygiene guidelines for everyday end users? (Choose two.)

An administrator is reviewing firewall policies and notices that traffic matching a specific policy is being logged, but no traffic logs are appearing in Log & Report > Forward Traffic. FortiGate is configured to send logs to FortiAnalyzer. Where are the traffic logs being stored?

An enterprise branch office has two distinct internet connections (Fiber and Cable). The administrator wants traffic to preferentially use the Fiber link, but automatically fail over to the Cable link if the Fiber link experiences packet loss exceeding 5%. Which FortiOS feature accomplishes this?

A network administrator notices that a web filtering profile configured on a FortiGate is blocking a specific educational video streaming category, but the exception list needs to allow a single permitted URL within that category. Where in FortiOS should the administrator add this specific URL override?

An administrator is troubleshooting a packet loss issue and needs to inspect the kernel buffer drops and interface error counters. Which CLI command provides a summary of interface drop statistics?

Which action is a best practice for managing passwords to prevent credential stuffing attacks?

When setting up a new online account for a business service, an employee is prompted to save a set of 10 backup recovery codes in case they lose access to their authenticator app. What is the best practice for handling these recovery codes?

An administrator wants to verify whether the FortiGate device is operating in NAT mode or Transparent mode. Where can this operational mode be checked in the web-based manager?

Which cybersecurity practice is most effective in mitigating the impact of a catastrophic ransomware infection on critical enterprise databases?

When configuring an IPsec VPN tunnel between two FortiGate units, what is the purpose of establishing a local ID (Peer ID) in Phase 1?

An administrator configures a firewall policy with Antivirus enabled in flow-based inspection mode. When a user attempts to download an infected file, how does the FortiGate handle the transfer?

An administrator needs to modify the hostname of the FortiGate via the CLI. Which configuration context and command are used?

Which TWO types of objects can be created to group network resources for firewall policies on a FortiGate? (Choose two.)

Which TWO of the following indicators are commonly associated with a potential phishing email? (Choose two)

An organization wants to ensure that no single administrator has the unchecked authority to approve and deploy high-risk firewall rule changes into production. Which security governance mechanism should be implemented?

When configuring dynamic routing on a FortiGate using OSPF, what is the function of a designated router (DR) in a multi-access broadcast network?

An administrator wants to check the operational status of all physical and logical interfaces in a summary table view. Which menu path in the web-based manager should be opened?

An organization requires high availability (HA) for two FortiGate devices to ensure continuous network uptime during hardware failures. Which operating mode synchronizes sessions, configuration, and routing state between the primary and secondary units in an active-passive cluster?

A network administrator is troubleshooting an intermittent connectivity issue on a FortiGate 100F running FortiOS 7.2. They suspect that the problem is related to the session table filling up. Which CLI command should they use to view the current session count and the maximum session limit?

Which TWO criteria can be used in a FortiGate firewall policy to match and control traffic? (Choose two.)

How can an administrator quickly verify whether the FortiGate unit has a valid and active FortiCare support contract from the GUI?

An attacker leaves several branded USB flash drives labeled 'Confidential Salary Data 2026' in the parking lot of a targeted enterprise, hoping curious employees will plug them into corporate computers. What type of social engineering attack is being demonstrated?

What is the primary function of a FortiGate Virtual IP (VIP) object?

An administrator needs to allow remote users to access the corporate network securely over the internet. The administrator wants to use a FortiGate's built-in VPN functionality that provides a clientless web portal for users to access internal resources. Which VPN type should the administrator configure?

An administrator needs to test DNS resolution directly from the FortiGate command line interface to troubleshoot a FortiGuard connectivity issue. Which command should be used?

An IT team is reviewing security logs and discovers that a user account was successfully accessed from two geographically impossible locations within a ten-minute timeframe. What type of anomaly does this represent?

An administrator wants to view a chronological log of security threats and blocked virus events in real-time directly on the FortiGate GUI. Which FortiOS feature provides this live graphical and tabular logging interface?

An attacker calls the corporate helpdesk posing as a stressed executive traveling abroad, claiming they are locked out of their account and urgently need their password reset without going through standard verification protocols. This attack relies primarily on exploiting which vulnerability?

An administrator is setting up a new FortiGate firewall and needs to configure basic access control between the internal corporate network and the external public network. Which object type should the administrator create first to group internal IP addresses for policy creation?

When a FortiGate device inspects HTTPS traffic using deep inspection, how does the security engine handle the TLS/SSL encryption handshake between the client and the destination server?

When configuring an IPsec VPN tunnel between two FortiGate units using pre-shared keys (PSK), what is required for successful Phase 1 authentication?

A security analyst is investigating a security alert generated by FortiGate Intrusion Prevention System (IPS). The log indicates that a known exploit signature was detected and dropped. How does FortiGate IPS inspect network traffic to identify such patterns?

An enterprise updates its patch management policy to mandate that all operating systems and third-party software must be updated within 48 hours of critical vulnerability disclosures. What security vulnerability window is this policy designed to minimize?

Which Fortinet security product is specifically designed to protect web applications (such as public-facing e-commerce portals) against OWASP Top 10 vulnerabilities like SQL injection and cross-site scripting?

An office worker receives an email claiming to be from the internal HR department, urgently requesting them to click a link and verify their banking details to avoid a delay in payroll. What is the most appropriate initial action for the employee to take according to foundational cybersecurity best practices?

An administrator is troubleshooting high memory utilization on a FortiGate. They run 'get system performance status' and see that memory usage is in conserve mode. What immediate action does FortiOS take when entering conserve mode?

Which THREE steps are critical for an effective cybersecurity incident response plan?

Which THREE common indicators suggest that an email message might be a phishing attempt? (Choose three.)

An end user plugs in a USB keyboard purchased from an unverified online marketplace, and the computer immediately begins executing automated command-line instructions without user intervention. What type of hardware threat has occurred?

Which TWO security profiles can be attached to a FortiGate firewall policy to protect against malware and threats? (Choose two.)

Which TWO of the following principles are core tenets of the CIA triad in cybersecurity? (Choose two)

Which THREE security principles are foundational components of the classic Information Security Triad (CIA Triad)? (Choose three.)

An organization implements a policy requiring all software installations on corporate endpoints to be approved and pushed centrally by the IT department, preventing users from installing unverified applications. Which security principle is being enforced?

An administrator needs to protect internal servers against known vulnerability exploits and attack signatures traversing the network. Which security feature should be enabled in the firewall policy?

An administrator wants to prevent users from uploading confidential company documents to external cloud storage websites. Which Fortinet security profile feature inspects outbound traffic for specific file types or sensitive keywords?

Where in the FortiGate web-based manager can an administrator view current system alerts, warning logs, and administrative event logs?

Which TWO settings are required when configuring a basic static route on a FortiGate? (Choose two.)

An administrator wants to view active VPN tunnels and connected remote users on the dashboard. Which widget is designed for this purpose?

Which TWO logging destinations can receive log data from a FortiGate firewall? (Choose two.)

An employee notices their workstation acting sluggish, and several desktop files have had their extensions changed to an unfamiliar format accompanied by a ransom text file. What type of attack has occurred?

A company's security policy requires that all software patches and operating system updates be evaluated in a test environment before being deployed to production endpoints. Which risk is this policy primarily designed to mitigate?

What is the primary function of a FortiGate firewall policy destination setting?

An administrator needs to troubleshoot a routing issue and verify which route will be selected by the FortiGate for a specific destination IP. Which CLI command allows routing lookup simulation?

An administrator wants to see a real-time list of top applications generating traffic on the network. Which FortiView tab should be opened?

A company mandates that all sensitive corporate documents stored on cloud storage must be encrypted both while being uploaded over the internet and while sitting at rest on the storage servers. Which security triad pillars are primarily satisfied by this measure?

An administrator needs to monitor bandwidth consumption across different applications on the FortiGate. Which feature allows the administrator to view real-time traffic bandwidth by application and enforce traffic shaping guarantees?

What is the primary purpose of defining zones (interface zones) in FortiOS firewall configurations?

A security analyst is reviewing logs from a FortiGate and notices numerous entries indicating that traffic from the internal network to a specific external IP is being blocked by a firewall policy. The analyst wants to quickly identify which firewall policy is responsible for the block. Which FortiGate log field should the analyst examine to find the policy ID that matched the traffic?

Which security principle is enforced when an administrator restricts a user's access to only the specific data and applications required for their job function?

When configuring firewall policies on a FortiGate device, an administrator must define matching criteria and actions. Which THREE elements are mandatory components of a standard IPv4 firewall policy in FortiOS? (Choose three.)

Which TWO actions should an employee take immediately upon suspecting their corporate laptop has been compromised by malware? (Choose two.)

An administrator needs to test reachability and path MTU to a destination IP using ICMP packets with the Don't Fragment (DF) bit set. Which CLI command allows this?

Which TWO of the following measures contribute effectively to a robust 'Defense in Depth' security strategy for an enterprise? (Choose two)

An administrator needs to set up log forwarding from the FortiGate to a remote Syslog server. Which menu path in the web-based manager is used to configure remote logging?

An employee finds a USB flash drive labeled 'Q4 Salary Adjustments' left in the parking lot and plugs it into their corporate laptop to see whose pay increased. What attack vector does this situation demonstrate?

A company discovers that a former disgruntled employee still has active login credentials to internal collaboration tools weeks after their departure. Which administrative security control failure is primarily responsible for this exposure?

An administrator wants to check the operational status of FortiGate HA clustering. Which dashboard widget provides an overview of HA member health and role status?

A hospital's security team deploys network segmentation so that the radiology imaging VLAN cannot directly reach the billing VLAN. A vendor's maintenance laptop connected to the imaging VLAN is later found to be infected with ransomware. Which security benefit of segmentation does this design primarily provide in this situation?

When configuring a FortiGate interface to connect to an external ISP network that utilizes dynamic IP assignment via DHCP, which setting must be enabled on the interface parameters?

When configuring an SSL VPN portal on a FortiGate, what is the primary operational difference between SSL VPN Web Mode and Tunnel Mode?

Why is multi-factor authentication (MFA) considered a critical defense against password-based attacks?

An administrator wants to secure administrative access to the FortiGate. Which THREE best practices should be implemented?

What is the primary function of a FortiSwitch unit when integrated into the Fortinet Security Fabric?

An end user is browsing the internet and encounters a pop-up warning stating that their computer is infected with multiple viruses, prompting them to call a toll-free number immediately for technical support. What is the most accurate classification of this threat?

Which THREE of the following scenarios describe common forms of cybersecurity attacks against end users? (Choose three)

What is the primary function of a FortiAuthenticator device?

Which THREE of the following characteristics are typical of social engineering attacks? (Choose three)

An administrator notices that a FortiGate high availability (HA) cluster has experienced a failover. Which log category on the FortiGate or FortiAnalyzer should the administrator check to investigate the cause of the HA state transition?

An administrator wants to customize the dashboard view on the FortiGate web-based manager. Which TWO actions can the administrator perform to personalize the dashboard? (Choose two)

When configuring dynamic routing on a FortiGate using OSPF, what is the purpose of defining OSPF areas?

A system administrator needs to update the signature databases for Antivirus and IPS on an isolated FortiGate that lacks direct internet connectivity. Which Fortinet product can be deployed locally on the network to act as an offline update distributor?

A remote employee working from a coffee shop connects to an unsecured public Wi-Fi network to access corporate resources. Which security control must the employee engage first to protect data-in-transit from eavesdropping?

An administrator needs to back up the FortiGate configuration regularly and securely. Which method allows the administrator to encrypt the configuration file with a password before downloading it from the GUI?

A company implements a policy where remote workers must connect through a secure virtual private network (VPN) and authenticate using both a password and a push notification sent to their mobile device. What is the primary cybersecurity benefit of this dual-step authentication approach?

An administrator needs to verify the status of certificate inspection and CA certificates installed on the FortiGate. Where are SSL/SSH inspection profiles and local certificates managed in the web-based manager?

An organization adopts the principle of least privilege (PoLP) across its server infrastructure. How should user accounts and service accounts be configured to adhere to this principle?

An administrator needs to back up the current FortiGate configuration securely to a local PC via the GUI. Which option should the administrator select?

An administrator needs to view a graphical representation of bandwidth usage over the last 24 hours. Which dashboard widget provides this historical traffic graph?

An administrator is investigating a network routing issue on the FortiGate and needs to see the current active kernel routing table entries. Which CLI command provides this information?

A worker receives an email from an external partner containing a spreadsheet with macros enabled. When opened, the spreadsheet prompts the user to 'Enable Content' to view protected data. What foundational cybersecurity best practice should the user apply here?

An administrator needs to change the management IP address of the internal interface (e.g., port1) via the CLI. Which sequence of configuration commands is correct?

When configuring an IPsec VPN tunnel in FortiOS, what is the role of NAT Traversal (NAT-T)?

An administrator wants to check the status of HA (High Availability) synchronization between primary and secondary FortiGate units. Which CLI command should be used?

An administrator needs to review the exact CLI commands executed during a troubleshooting session or audit log history. Which log category records administrative CLI command execution?

Which THREE of the following are common indicators that a system has been compromised by malware?

An administrator needs to monitor real-time CPU and memory usage from the FortiGate GUI dashboard. Which widget should be added to the dashboard for this purpose?

An administrator wants to view real-time CPU utilization per system process. Which dashboard widget or view helps identify which process is consuming CPU resources?

An administrator wants to ensure that administrative access to the FortiGate web-based manager is secure. Which TWO configuration steps should be implemented? (Choose two)

An administrator wants to block specific types of USB or removable storage devices from connecting to corporate laptops. Which Fortinet component manages endpoint device control policies?

An administrator wants to allow remote workers to securely connect to the internal network using an SSL VPN web portal that presents a customized login page and bookmarks to internal resources. Which SSL VPN mode provides this browser-based access without requiring a pre-installed desktop client?

An administrator wants to ensure that internal users attempting to visit known phishing or malware-hosting domains are blocked automatically before establishing a connection. Which security profile should be added to the firewall policy?

A retail company wants to reduce the risk that stolen customer credit card numbers can be used if its database is breached. Which TWO practices best support this goal? (Choose two.)

Which Fortinet tool provides a centralized management pane of glass for provisioning, updating, and monitoring multiple FortiGate firewall policies and device configurations across an enterprise?

During an incident response review, it is discovered that an attacker gained access to an internal database by compromising a service account that had full administrative privileges across multiple disparate systems, far exceeding what was necessary for its routine function. Which security best practice was violated?

Which dashboard widget displays the current status and capacity of local storage (hard drive or log disk) on the FortiGate?

An administrator is configuring a new local administrator account with restricted privileges. Where in the web-based manager are administrator accounts and access profiles created and managed?

An enterprise is configuring a redundant multi-WAN architecture on a FortiGate. Which feature allows the FortiGate to automatically measure latency, jitter, and packet loss on multiple internet connections and dynamically steer traffic over the best performing path?

A new employee at a small accounting firm receives an email that appears to be from the firm's bank, asking them to click a link and re-enter their online banking credentials to avoid account suspension. The email address looks slightly misspelled, and the link points to a domain that is not the bank's real website. What type of attack is this?

When logging into the FortiGate Web-based Manager (GUI) for the first time, what is the default administrator username?

What is the primary function of a FortiSwitch port configured with FortiLink?

When navigating the FortiGate GUI, which THREE main functional areas or menu categories are typically visible in the standard menu tree?

Which THREE of the following are recognized signs of a potential phishing attempt?

An office worker is leaving their desk for a 15-minute lunch break. What is the most critical immediate security action they should take before walking away?

What is the primary function of a firewall inspection mode that processes packets at Layer 3 and Layer 4 using packet headers without reassembling application streams?

An employee finds a physical document containing sensitive customer records left unattended on a shared printer tray. What security awareness best practice does this situation highlight?

Which TWO threat intelligence services or features are delivered dynamically by the FortiGuard network? (Choose two.)

A threat actor infects a critical file server with ransomware, encrypting all business-critical documents and demanding a monetary ransom for the decryption key. However, the organization is able to restore all systems and data within hours without paying the ransom. Which foundational security practice made this successful recovery possible?

Which dashboard widget displays the overall hardware status, serial number, firmware version, and system uptime of the FortiGate?

An administrator needs to test whether a specific TCP port is open on a remote server directly from the FortiGate CLI. Which command can be used to test TCP connectivity?

An organization is deploying an SD-WAN architecture on a FortiGate. When multiple WAN interfaces are combined into an SD-WAN zone, how do firewall policies reference the destination or source of the traffic?

What is the primary function of a FortiGate firewall policy source interface setting?

Which TWO features or protocols are used in Fortinet SD-WAN deployments to optimize multi-path traffic routing? (Choose two.)

An administrator wants to verify the operational status and packet error rates of a specific physical interface (e.g., port2) via CLI. Which command should be used?

An administrator needs to perform a firmware upgrade on a standalone FortiGate. Which TWO best practices should be followed before initiating the upgrade? (Choose two)

A security analyst needs to ensure that endpoints connected to the corporate network have an active, up-to-date FortiClient security agent installed before granting network access. Which Fortinet component manages endpoint compliance and synchronization with the Fortinet Security Fabric?

A network administrator is deploying FortiGate next-generation firewalls at the perimeter and wants to inspect encrypted traffic for malware without breaking user privacy for banking and healthcare sites. The administrator plans to use SSL inspection but needs to avoid decrypting sensitive categories. Which FortiGate feature should be used to selectively bypass decryption for specific website categories?

What is the primary purpose of FortiToken in a Fortinet security solution?

An administrator wants to view a chronological list of all administrator logins, configuration changes, and system alerts. Which log category contains this information?

A security administrator is configuring a FortiGate to inspect traffic for malicious files. The administrator wants to ensure that files are analyzed in a sandbox environment to detect zero-day threats. Which Fortinet product should be integrated with the FortiGate to provide this sandboxing capability?

An administrator notices that users are accessing unauthorized social media websites during work hours. Which security profile feature should be configured on the FortiGate to block access to these specific categories of websites?

A remote worker receives a text message (SMS) from what appears to be their bank, stating that suspicious activity was detected and asking them to click a short link to confirm their identity. What term specifically describes this form of attack via SMS?

An employee notices that a physical access control badge reader at the office entrance has been tampered with and a small unauthorized recording device is attached nearby. This scenario primarily represents a threat vector targeting which aspect of security?

An end user receives an email from an external domain with a display name mimicking the company CEO, asking for an urgent wire transfer. What is the most accurate primary classification of this threat?

An employee receives an email claiming to be from the IT department requesting their network credentials to 'verify account security'. What is the most appropriate action?

An enterprise is establishing a multi-layered security strategy for its infrastructure. Which implementation best demonstrates the concept of 'Defense-in-Depth'?

What is the primary objective of a 'DDoS' attack?

An administrator wants to view top bandwidth-consuming applications on the FortiGate dashboard. Which feature or view provides this aggregated application visibility?

When creating a new password for corporate accounts, which practice aligns with modern cybersecurity best practices for end users?

Which TWO of the following statements correctly describe core concepts of the Fortinet Security Fabric? (Choose two.)

An employee receives an email stating their account will be deactivated within 24 hours unless they click an embedded link and verify their credentials immediately. What psychological manipulation tactic is the attacker primarily leveraging?

Which THREE protocols or technologies are commonly used to establish secure remote access VPNs on a FortiGate? (Choose three.)

An organization implements a Zero Trust Network Access (ZTNA) model for remote workers. Unlike traditional remote access, how does ZTNA handle user authentication and resource authorization?

An administrator suspects that a specific firewall policy rule is dropping legitimate traffic due to an incorrect security profile or action. Where can the administrator check the hit counters for each individual firewall policy in the web-based manager?

What is the primary purpose of conducting regular security awareness training for non-technical employees in an organization?

A new hire at a financial services firm receives an email that appears to come from the CEO, asking them to urgently purchase gift cards for a client appreciation event and to send the redemption codes by reply email. The message uses the CEO's correct name and photo but originates from an external address. Which type of attack is this?

When configuring an IPsec VPN tunnel between two FortiGate devices, what is the specific role of Phase 1 negotiation?

A user receives a phone call from someone claiming to be from the corporate IT helpdesk, urgently asking for their network password to resolve a critical security alert. What social engineering tactic is being used?

Which THREE parameters must be configured identically on both peers to successfully establish an IPsec Phase 1 tunnel? (Choose three.)

What is the primary function of a FortiGate interface configured in NAT mode?

An organization performs a risk assessment and decides to implement firewall rules, intrusion prevention systems (IPS), and encryption to reduce the likelihood and impact of a cyber attack. What risk management strategy are they employing?

An administrator needs to ensure that critical administrative login events and firewall configuration changes generate an immediate real-time alert email. Where are email alert settings configured on the FortiGate?

Which THREE features are provided by FortiClient EMS when integrated into the Fortinet Security Fabric? (Choose three.)

An administrator is setting up a FortiGate firewall and needs to define the security posture for traffic flowing from the internal network to the external Internet. Which object type should the administrator configure to enforce unified threat management features such as Antivirus, Web Filtering, and Intrusion Prevention on that traffic?

An administrator wants to ensure that specific internal users can access the internet while others cannot, based on their Active Directory group membership. How can this access control be implemented on a FortiGate?

An enterprise requires authentication of remote users connecting via SSL VPN against a Microsoft Active Directory server. Which Fortinet component can be deployed to synchronize user credentials and provide single sign-on (SSO) services?