Select Two (Multi-Select) Questions

An organization implements strict role-based access control and regular auditing

Why it fails: Role-based access control with auditing is a defensive control, not an attack against end users. It tempts because it concerns access and identity, the same territory attackers target, but the stem asks for offensive scenarios such as phishing or credential theft, so a mitigation cannot qualify.

A network administrator configures automated offboarding checklists for departed employees

Why it fails: Automated offboarding checklists are an administrative control that removes access, not an attack on end users. It tempts because departed-employee accounts are a genuine attack vector, but the checklist itself is the defence, whereas the stem requires scenarios describing attacks such as phishing or pretexting.

Convert the dashboard into a command-line terminal emulator.

Why it fails: The dashboard is a graphical widget canvas; terminal access is provided separately through the CLI console widget, which is added rather than converting the dashboard itself. It is tempting because the CLI console widget appears on the dashboard by default, but it remains a distinct widget, not a transformation of the dashboard.

Delete physical firewall ports from the dashboard interface view.

Why it fails: Physical ports are hardware interfaces configured under Network settings; the dashboard only controls widget placement and visibility, so ports cannot be removed there. It is tempting because hiding unused interface widgets is a common dashboard customisation, but that hides the widget, not the underlying physical port.

Modify core FortiOS kernel code directly from the dashboard widget settings.

Why it fails: The dashboard exposes only widget layout, visibility and settings; FortiOS kernel code is compiled firmware and cannot be edited from any GUI widget. It is tempting because administrators familiar with source-level customisation may assume deep configuration is possible, but kernel modification requires vendor-supplied firmware images, not dashboard controls.

The system boot time remains consistent with previous months.

Why it fails: Consistent boot time is normal behaviour, not evidence of compromise. It is checked when diagnosing boot configuration or hardware faults. Malware indicators include unexpected processes, unusual outbound connections and modified system files, none of which this observation reflects.

The computer performs regular daily virus definition updates.

Why it fails: Routine daily virus definition updates are a sign of healthy endpoint protection, not compromise. Malware typically disables or blocks updates to avoid detection, so their absence is the indicator. This option is tempting because update activity is security-related, but it describes normal patching behaviour rather than a compromise symptom.

Enable Telnet for administrative CLI access.

Why it fails: Telnet transmits credentials and session data in cleartext, so enabling it exposes administrative CLI logins to interception on the network. SSH provides encrypted administrative CLI access and is the correct secure alternative. Telnet is tempting for legacy compatibility with older management tooling, but it cannot satisfy a secure-management requirement.

Use default admin accounts with blank passwords.

Why it fails: Default accounts with blank passwords allow anyone reaching the management interface to authenticate without credentials, entirely defeating access control. Default credentials must be changed and strong authentication enforced. The temptation is convenience during initial setup, but leaving them active on a production FortiGate exposes the web-based manager to trivial compromise.

Disable password complexity requirements globally.

Why it fails: Disabling password complexity weakens administrative credentials, making brute-force and dictionary attacks against the web-based manager feasible. Complexity requirements should be enforced, not removed. Administrators are tempted to disable them to simplify logins or avoid lockouts, but that directly contradicts the hardening objective for exposed management interfaces.

IPsec VPN operates exclusively at Layer 7 of the OSI model using HTTP/HTTPS protocols.

Why it fails: IPsec VPN operates at Layer 3, encapsulating IP packets via ESP or AH, not at Layer 7 with HTTP/HTTPS. The Layer 7 description fits SSL VPN, which tunnels over TLS on 443, so this option inverts the actual protocol-layer distinction between the two.

SSL VPN requires Internet Key Exchange (IKE) phase 1 and phase 2 negotiation parameters.

Why it fails: IKE phase 1 and phase 2 negotiation belongs to IPsec VPN, not SSL VPN, which establishes its tunnel through TLS handshakes instead. Requiring IKE parameters describes the IPsec remote-access design, where peers negotiate security associations before traffic flows.

IPsec VPN cannot be terminated on a FortiGate device without an active FortiClient EMS license.

Why it fails: FortiGate terminates IPsec VPN natively through its own IKE daemon and tunnel configuration; no FortiClient EMS licence is involved. EMS licensing governs endpoint management and compliance features, which is a separate concern from whether the firewall can terminate an IPsec tunnel.

Kernel Debugger

Why it fails: The Kernel Debugger is a hidden diagnostic CLI tool, not a GUI menu category, so it never appears in the standard menu tree. It is tempting because it is a genuine FortiGate feature, and would be correct when troubleshooting kernel-level issues from the console.

BIOS Utility

Why it fails: BIOS Utility configures motherboard firmware before any operating system loads, so it cannot appear in FortiGate's web management menu tree. It is tempting because BIOS settings do affect hardware boot behaviour, but FortiOS menus expose configuration areas such as Network, Policy & Objects, and Security Profiles instead.

Telnet remote terminal management protocol

Why it fails: Telnet is an unencrypted remote terminal protocol for device administration; it carries no path-quality measurement, link selection or packet steering. Fortinet SD-WAN uses performance SLAs and application steering to route traffic across multiple WAN links, which Telnet cannot influence.

POP3 email retrieval protocol

Why it fails: POP3 retrieves email from a mailbox server; it performs no link monitoring, jitter or latency measurement, and cannot influence WAN path selection. Fortinet SD-WAN optimises routing through health checks and application-aware steering, functions entirely unrelated to mail retrieval.

SNMP v1 network monitoring traps

Why it fails: SNMPv1 traps report device events to a monitoring station; they neither measure WAN link quality nor steer traffic across paths. Fortinet SD-WAN selects links using SLA probes and application steering, so passive monitoring traps cannot perform the optimisation the question requires.

SD-WAN performance SLA group

Why it fails: An SD-WAN performance SLA group bundles health-check probes for link monitoring, not network resources for policy matching. It is tempting because SD-WAN objects do appear in policy configuration, but as the target of an SD-WAN rule's traffic steering, not as an address or service grouping.

High availability heartbeat group

Why it fails: An HA heartbeat group defines the interfaces and priorities used for cluster synchronisation and failover between FortiGate units, not a policy-matchable resource set. It is tempting because it is a genuine FortiGate group object, but it belongs to HA configuration rather than firewall address or service grouping.

Antivirus signature group

Why it fails: Antivirus signature groups consolidate detection signatures within a security profile; they cannot be referenced as a source or destination in a firewall policy. It is tempting because signature groups are reusable objects, but their purpose is content inspection, not grouping hosts, addresses or services for policy matching.

Static route table

Why it fails: A static route table governs packet forwarding decisions at layer 3; it holds no inspection engine, so it cannot be attached to a policy as a malware or threat profile. It is tempting because routing is configured on the FortiGate alongside policies, and it would be correct if the question asked how traffic reaches a next-hop gateway.

DHCP server scope

Why it fails: A DHCP scope defines the address pool, lease times and gateway options handed to clients; it inspects no traffic and cannot be attached to a firewall policy as a profile. It is tempting because DHCP is configured per interface on the FortiGate, and it would be correct if the question asked how internal hosts obtain IP addresses automatically.

DNS server forwarding list

Why it fails: A DNS forwarding list configures which DNS servers the FortiGate queries for name resolution; it performs no content inspection and is not attachable as a security profile. It is tempting because DNS filtering is a security-adjacent function, and it would be correct if the question asked how the firewall resolves external domain names.

It relies entirely on offline flat-file backups for threat intelligence exchange.

Why it fails: Threat intelligence in the Security Fabric is exchanged in real time over network links and APIs, not via offline flat files. Flat-file exchange describes air-gapped or manual indicator import workflows, which would be chosen only where no live Fabric connectivity exists.

It requires manual command-line scripting on every downstream device to share threat intelligence feeds.

Why it fails: Security Fabric devices share threat intelligence automatically through Fabric Connectors and the Fabric Management channel, requiring no per-device CLI scripting. Manual scripting describes standalone, unintegrated deployments, which is what the Fabric is designed to replace.

It only supports Fortinet hardware appliances and excludes integration with third-party APIs or virtual machines.

Why it fails: The Security Fabric integrates third-party APIs, virtual machines and multi-vendor devices through Fabric Connectors and Fabric APIs, so hardware-only support is false. Hardware-only designs suit isolated appliance estates, but the Fabric's purpose is open ecosystem integration.

Telnet plain-text management

Why it fails: Telnet sends management credentials in cleartext and establishes no encrypted tunnel, so it cannot serve as a secure remote-access VPN transport. It is tempting because Telnet is a familiar remote-access protocol for reaching devices, but FortiGate administration over a VPN should use SSH, and Telnet is not a VPN technology.

HTTP unencrypted web browsing

Why it fails: HTTP transmits credentials and payloads in cleartext, so it cannot tunnel or encrypt remote-access traffic the way IPsec or TLS-based VPN protocols do. It is tempting because HTTP is ubiquitous for web access, and a browser-based SSL VPN portal does use HTTPS, but plain HTTP itself provides no secure tunnel.

Active BGP peer uptime metrics

Why it fails: BGP peer uptime is a routing-protocol metric reported by get router info bgp, not a hardware sensor. It is tempting because BGP monitoring matters for connectivity troubleshooting, but the question targets chassis sensors such as temperature, fan speed and power supply status exposed by hardware status commands.

SSL VPN tunnel encryption keys

Why it fails: SSL VPN tunnel encryption keys are cryptographic session material, not a hardware sensor, so no hardware status command or widget reports them. It is tempting because VPN monitoring is a common FortiGate task, and would be correct when inspecting active tunnel status rather than physical component health.

An active FortiSandbox cloud subscription registration key.

Why it fails: A FortiSandbox cloud subscription key enables file detonation and is licensed separately; it is not a matching criterion or action within a policy. It is the correct element to verify when sandbox inspection of suspicious files is required, not for building a standard IPv4 policy.

A mandatory Web Filtering security profile attached directly to the policy.

Why it fails: Security profiles are optional attachments; a policy is valid with only incoming interface, outgoing interface, source, destination, schedule, service and action defined. Attaching Web Filtering is the right step when URL category enforcement is required, not a mandatory component of every IPv4 policy.

Explicit proxy authentication realms

Why it fails: Explicit proxy authentication realms are configured under web proxy settings for user authentication, not as basic physical interface parameters. It is tempting because both appear in FortiGate network configuration, and would be correct when defining proxy-based user authentication policies rather than interface IP, mask and administrative access.

BGP AS number and neighbor peer groups

Why it fails: BGP AS numbers and peer groups are dynamic routing configuration, applied after interface IP addressing and administrative access are set; they are not basic interface parameters. It tempts administrators planning routed WAN topologies, where BGP peering is genuinely required, but only once the underlying interfaces already pass traffic.

SSL VPN client certificate revocation lists

Why it fails: Certificate revocation lists belong to SSL VPN authentication, configured under VPN settings rather than on physical interfaces. It tempts engineers hardening remote-access portals, where CRL checking is genuinely required, but the stem asks for the interface parameters needed before firewall policies can reference those interfaces.

Firewall policy object routes

Why it fails: Firewall policy objects are referenced by policy routes, but the objects themselves never appear as route entries in the active routing table. It is tempting because policy routes do appear there, yet those are distinct from the address and service objects a policy references.

Security Fabric telemetry routes

Why it fails: Security Fabric telemetry is exchanged over existing Fabric links and does not install entries in the active routing table. It is tempting because FortiGate does display Fabric topology information, but that appears in Fabric-specific output, not among the connected, static, dynamic and policy route types shown by get router info routing-table.

Relying entirely on a single powerful perimeter firewall with no internal security controls

Why it fails: A single perimeter firewall creates a hard outer shell with no internal segmentation, so one breach exposes everything; defence in depth requires layered controls across network, endpoint, identity and data. It tempts because perimeter firewalls genuinely block external threats, and would suit a small flat network with minimal internal east-west traffic.

Eliminating all system logs and monitoring to maximize user privacy

Why it fails: Deleting logs and monitoring removes the visibility layer that detection and incident response depend on, undermining Defence in Depth. Logging is tempting to cut for privacy or storage savings, but retained audit and telemetry data is what the strategy requires.

Disabling all endpoint antivirus solutions to improve computer processing speed

Why it fails: Removing endpoint antivirus strips a core defensive layer, leaving malware unchecked on hosts and directly weakening Defence in Depth. Antivirus is tempting to disable for performance, yet layered endpoint protection is exactly what the strategy requires.

System time zone offset in hours

Why it fails: Phase 1 requires matching pre-shared keys, encryption and hashing algorithms, and lifetimes; the time zone offset is irrelevant because IKE compares absolute UTC timestamps, not local clock displays. It is tempting because clock skew can break certificate validity, but that is a PKI concern, not a Phase 1 parameter.

FortiGate administrator username

Why it fails: Administrator usernames are local authentication credentials for managing each FortiGate, unrelated to IKE negotiation. It is tempting because both peers need admin accounts, but Phase 1 matching concerns encryption, hashing, authentication method, Diffie-Hellman group and lifetime, not management logins.

POP3

Why it fails: POP3 retrieves email from a mailbox and has no role in device administration, so it cannot be enabled as a management protocol. It is tempting because it appears in FortiGate service lists for mail scanning, and would be relevant when configuring email filtering rather than admin access.

Telnet

Why it fails: Telnet transmits the admin session, including the password, unencrypted, so anyone capturing traffic can read it; SSH provides the encrypted CLI alternative. It is tempting because it offers the same command-line interface, and would suit a lab or console-adjacent link where interception is impossible.

HTTP

Why it fails: HTTP carries administrative traffic in cleartext, so credentials and session data cross the network readable; HTTPS is the secure web equivalent. It is tempting because the GUI is reached over a browser, and HTTP would be acceptable only on an isolated out-of-band management segment.

Writing passwords on a physical notepad kept inside a locked desk drawer

Why it fails: A physical notepad in a locked drawer is still plaintext at rest, readable by anyone with drawer access, and cannot be rotated or audited. It is tempting as an offline store immune to remote attack, which suits air-gapped recovery codes, but it fails the foundational habit of using a password manager with unique credentials.

Reusing the same strong master password across all banking and work systems for ease of recall

Why it fails: Reusing one master password across banking and work systems means a single breach compromises every account, defeating credential isolation. It is tempting because one strong, memorable secret reduces recall burden, which suits a password manager's vault unlock, but it violates the foundational habit of unique credentials per system.

Changing passwords every single week regardless of whether a compromise is suspected

Why it fails: Weekly forced rotation drives users toward predictable increments and weaker recall, and modern guidance drops arbitrary expiry absent compromise evidence. It is tempting as a containment measure after a suspected breach, where immediate rotation is correct, but routine weekly changes are not a foundational password-security habit.

The message includes a link to the corporate intranet home page via the internal DNS domain.

Why it fails: A link resolving to the internal DNS domain for the corporate intranet is a legitimate internal resource, not a phishing indicator. It tempts because links are commonly malicious, but spoofed or lookalike external domains are the indicator; a genuine internal hostname does not indicate phishing.

The email is addressed specifically to your correct full corporate title and department.

Why it fails: Correctly addressing your real title and department suggests the sender knows your organisation, which is not a recognised phishing indicator; generic or wrong salutations are. It tempts because targeted spear-phishing can personalise content, but accurate internal details alone do not indicate a phishing attempt.

The email contains standard company newsletter updates sent through an official mailing platform.

Why it fails: Official newsletters distributed through an established corporate mailing platform are legitimate bulk mail, not a phishing indicator. It tempts because mass mailing can resemble spam, yet the trusted platform and expected newsletter content remove the suspicion that spoofed senders or unsolicited lures would create.