Fortinet NSE 4 Network Security Professional NSE4 NSE4 Questions 76–150 | Page 2/4

MCQeasy

Refer to the exhibit. A network administrator configured an IPsec VPN between the main office and a branch office. Remote users at the branch office report that they cannot access resources in the main office. The tunnel status shows up on both sides. What is the most likely cause of the connectivity issue?

A.The phase1 keylife is longer than the phase2 keylife, causing rekey issues.

B.The 'set net-device disable' prevents the tunnel from being used for routing.

C.The phase2 configuration does not specify the local and remote subnets to protect.

D.The phase2 proposal does not match the phase1 proposal.

AnswerC

Without 'set src-addr-type' and 'set dst-addr-type', the tunnel does not know which traffic to encrypt.

Why this answer

The phase2 configuration in an IPsec VPN must explicitly define the local and remote subnets (proxy IDs) that the tunnel is meant to protect. Without these subnets, the IPsec security associations (SAs) cannot be established for the actual traffic, even if the tunnel status shows as up (phase1 is complete). The tunnel status only indicates that IKE phase1 negotiation succeeded, but without phase2 proxy IDs, no traffic will be encrypted or routed through the tunnel, causing connectivity failures.

Exam trap

The trap here is that candidates assume a tunnel status of 'up' means the VPN is fully functional, but in reality, phase1 success alone does not guarantee that phase2 has been negotiated with the correct proxy IDs, and traffic will still fail without proper subnet definitions.

How to eliminate wrong answers

Option A is wrong because phase1 keylife being longer than phase2 keylife is not inherently problematic; phase2 keylife is typically shorter and rekey events are independent, so this does not prevent traffic flow. Option B is wrong because 'set net-device disable' is a FortiGate command that disables the virtual IPsec interface, which would prevent the tunnel from being used for routing, but the exhibit (not shown) does not indicate this command is present, and the tunnel status shows up, which would not be possible if net-device were disabled. Option D is wrong because phase2 proposals do not need to match phase1 proposals; phase1 and phase2 are separate negotiation phases with different parameters (encryption, authentication, DH groups) and mismatches between them do not cause phase2 to fail as long as each phase's proposals are consistent within themselves.

Full explanation →

MCQeasy

A junior admin is creating firewall policies and wants to ensure that all traffic not explicitly permitted is denied. Which FortiGate mechanism provides this behavior by default?

A.The security profile group

B.The default route

C.The last explicit deny policy in the policy list

D.The implicit deny rule

AnswerD

The implicit deny rule is a built-in, invisible final policy on every FortiGate firewall; any session that does not match an explicit allow or explicit deny policy is automatically dropped and logged. This rule cannot be deleted or disabled, ensuring that the firewall always enforces a default-deny posture for all unpermitted traffic. It is the true answer to the question because it is automatically applied, requiring no configuration, and it closes the gap that would otherwise allow traffic to pass unchecked.

Why this answer

The implicit deny rule is a default, hidden policy at the end of the FortiGate firewall policy list that denies all traffic not explicitly permitted by any user-created policy. This behavior is inherent to the FortiGate operating system and ensures a default-deny posture without requiring manual configuration. It is always present and cannot be deleted or moved, providing a safety net that blocks any unmatched traffic.

Exam trap

The trap here is that candidates may think the last explicit deny policy (Option C) is the default mechanism, but FortiGate's implicit deny rule is always present and active by default, whereas an explicit deny policy must be manually added and is not a default behavior.

How to eliminate wrong answers

Option A is wrong because a security profile group is a collection of security profiles (e.g., antivirus, web filter) applied to a firewall policy, not a mechanism that denies traffic by default. Option B is wrong because the default route controls where traffic is forwarded, not whether it is permitted or denied; it does not enforce access control. Option C is wrong because while an explicit deny policy can be added to the policy list, it is not present by default; the implicit deny rule is the built-in mechanism that denies all unmatched traffic without requiring any explicit policy.

Full explanation →

Multi-Selectmedium

An administrator is configuring a dial-up IPsec VPN for remote users. Which TWO settings are required on the FortiGate for the dial-up server? (Choose two.)

Select 2 answers

A.Set 'mode-cfg' to enable on Phase 1

B.Set 'peer type' to 'any' on Phase 1

C.Set 'aggressive mode' on Phase 1

D.Set 'auto-negotiate' to enable on Phase 2

E.Set 'pfs' to enable on Phase 2

AnswersA, B

Mode-config is used to assign IP addresses to clients.

Why this answer

'mode-cfg' (Mode Config) enables the FortiGate to assign IP addresses and other network settings to remote VPN clients dynamically, which is essential for a dial-up IPsec VPN server. Option B is correct because setting 'peer type' to 'any' allows the FortiGate to accept connections from any remote peer without predefining a specific peer IP, which is required for a dial-up scenario where remote users have dynamic IP addresses.

Exam trap

The trap here is that candidates often confuse 'aggressive mode' as a requirement for dial-up VPNs because it is commonly used with pre-shared keys and dynamic peers, but FortiGate does not require it; the mandatory settings are mode-cfg and peer type any.

Full explanation →

MCQmedium

An admin wants to block access to malicious websites using FortiGuard Web Filtering. Which policy configuration is necessary to apply the web filter profile to HTTP/HTTPS traffic?

A.Configure a DNS filter instead of a web filter

B.Create a policy with action DENY and a web filter profile

C.Create an allow policy for HTTP/HTTPS and apply a web filter profile

D.Use an application control profile to block malicious sites

AnswerC

Creating an allow policy for HTTP/HTTPS and attaching a web filter profile is the correct approach because the web filter profile inspects every allowed web request and compares each URL against FortiGuard categories or a custom block list. If a site is categorized as malicious or matches a blocked URL pattern, the web filter blocks the connection while still permitting access to other legitimate sites. This is the built-in mechanism for controlling web access based on URL reputation and content classification.

Why this answer

FortiGate requires an explicit allow policy for HTTP/HTTPS traffic to pass through the firewall before a web filter profile can inspect and block malicious URLs. The web filter profile is applied as a security policy feature on an allow policy, not on a deny policy, since deny policies drop traffic before inspection can occur. Without an allow policy, the traffic would be blocked by default, and the web filter would never see the traffic to apply its filtering rules.

Exam trap

The trap here is that candidates often think a deny policy can have a web filter profile applied to block malicious sites, but FortiGate only applies security profiles on allow policies, and deny policies simply drop traffic without inspection.

How to eliminate wrong answers

Option A is wrong because a DNS filter is used to block domains based on DNS queries, not to inspect HTTP/HTTPS content for malicious URLs; FortiGuard Web Filtering requires a web filter profile, not a DNS filter. Option B is wrong because a policy with action DENY drops all traffic before any security profiles, including web filter profiles, can be applied; web filter profiles can only be attached to allow policies where traffic is permitted and then inspected. Option D is wrong because an application control profile is designed to identify and control application traffic (e.g., Facebook, YouTube), not to block malicious websites based on URL categories; that is the function of a web filter profile.

Full explanation →

Multi-Selecthard

An administrator receives reports that some internal users can access Facebook despite a web filtering profile that blocks the 'Social Networking' category. The policy is configured with deep inspection. Which THREE checks should the administrator perform to troubleshoot this issue?

Select 3 answers

A.Check if the users are using HTTPS and if the SSL inspection profile has an exemption for Facebook

B.Ensure that the antivirus profile is enabled on the policy

C.Check if the users are accessing Facebook via an SSL VPN tunnel that bypasses the policy

D.Verify that the web filtering profile is applied to the correct policy and that the policy order is correct

E.Confirm that the 'Social Networking' category is not set to 'Monitor' instead of 'Block'

AnswersA, C, D

When users connect to Facebook over HTTPS, FortiGate must decrypt the TLS session (or at least inspect the Server Name Indication) to determine the destination domain and apply URL category filtering. If the SSL inspection profile configured on the policy includes a certificate exemption for Facebook (often added to avoid certificate pinning errors or breakage), the firewall skips decryption entirely and cannot see the SNI or the full URL. As a result, the web filter is effectively blind to the HTTPS session, and the Social Networking category is never matched, allowing the traffic even though the profile is set to Block.

Why this answer

The troubleshooting should focus on three main areas: (A) SSL inspection exemption – if users access Facebook via HTTPS and the SSL inspection profile exempts Facebook traffic, it bypasses the web filter; (C) SSL VPN bypass – traffic through an SSL VPN tunnel may not match the policy if the tunnel interface is not covered; (D) policy application and order – the web filtering profile must be applied to the correct policy and the policy order must be such that this policy is enforced before any conflicting policy. Option E is a valid check, but since the category is already set to 'Block' in the profile, the issue is more likely related to the other three.

Exam trap

A common pitfall is assuming that simply applying a web filtering profile with a block action is sufficient, overlooking SSL inspection exemptions, VPN bypasses, or policy misapplication. The three key checks are verifying SSL inspection exemptions (A), ensuring traffic isn't bypassing via SSL VPN (C), and confirming the correct policy and order (D). Checking the category action (E) is secondary because the profile is already set to block.

Full explanation →

MCQmedium

An administrator wants to aggregate two physical interfaces (port1 and port2) on a FortiGate to increase bandwidth and provide redundancy. Which interface type should be created?

A.Aggregate interface

B.Loopback interface

C.VLAN interface

D.Software switch interface

AnswerA

Aggregate interfaces (LAG) provide increased bandwidth and redundancy.

Why this answer

An aggregate interface (also known as a Link Aggregation Group or LAG) combines multiple physical interfaces into a single logical link, increasing bandwidth and providing redundancy. This is the correct choice because it directly supports the administrator's goal of aggregating port1 and port2 on a FortiGate, using the IEEE 802.3ad standard (LACP) or static aggregation.

Exam trap

The trap here is that candidates often confuse a software switch interface with link aggregation, but a software switch simply bridges ports at Layer 2 without the load-balancing and failover mechanisms of an aggregate interface.

How to eliminate wrong answers

Option B is wrong because a loopback interface is a virtual interface used for management or routing protocol stability, not for aggregating physical links. Option C is wrong because a VLAN interface is a logical interface for 802.1Q VLAN tagging on a single physical or aggregate interface, not a method to combine multiple physical ports. Option D is wrong because a software switch interface creates a Layer 2 bridge between ports, but it does not provide link aggregation for increased bandwidth or redundancy in the same way as an aggregate interface.

Full explanation →

MCQeasy

Which mode of SSL VPN provides full network-layer access to the remote network, allowing any application to function as if the client is directly connected?

A.Tunnel mode

B.Web mode

C.Split tunneling mode

D.Clientless mode

AnswerA

Tunnel mode is the SSL VPN operating mode that creates a virtual network adapter on the client and assigns it an IP address from the internal network. This allows the client to participate at Layer 3, with routing entries directing traffic through the TLS-encrypted tunnel, thereby providing full network-layer access to any IP-based service, not just web applications.

Why this answer

Tunnel mode is correct because it creates a virtual network interface on the client that obtains an IP address from the FortiGate's SSL VPN address pool, encapsulating all IP traffic within SSL/TLS packets. This provides full network-layer (Layer 3) access, allowing any application—including those using non-HTTP protocols like SSH, RDP, or custom TCP/UDP services—to function as if the client were directly connected to the remote network.

Exam trap

The trap here is that candidates often confuse 'split tunneling' as a separate VPN mode when it is actually a routing configuration option within tunnel mode, leading them to incorrectly select Option C instead of recognizing that tunnel mode is the only mode providing full network-layer access.

How to eliminate wrong answers

Option B (Web mode) is wrong because it only provides application-layer access via a web portal, proxying HTTP/HTTPS traffic and cannot handle non-web protocols or raw IP packets. Option C (Split tunneling mode) is wrong because it is not a distinct SSL VPN mode; it is a routing policy that can be applied within tunnel mode to direct only specific subnets over the VPN, but it does not define the fundamental access method. Option D (Clientless mode) is wrong because it relies on a web browser and supports only limited applications (e.g., web-based, VNC, RDP via Java/ActiveX) without installing a client, thus lacking full network-layer access.

Full explanation →

MCQhard

A FortiGate administrator runs the following command and sees: 'diagnose ips anomaly list' returns no entries, but the IPS sensor is configured with anomaly signatures. What is the MOST likely reason the signatures are not appearing?

A.The IPS sensor is configured in 'passive' mode, which suppresses anomaly detection.

B.The anomaly signatures have not triggered any events yet because traffic thresholds have not been exceeded.

C.Anomaly signatures are not displayed by 'diagnose ips anomaly list'; they require a different command.

D.The IPS sensor is not enabled on any firewall policy.

AnswerB

Anomaly signatures in FortiOS are rate-based detectors that only generate an event when traffic exceeds a configured threshold, such as packets per second or concurrent connections. The command output lists only triggered anomalies, not configured ones. If no traffic has exceeded the threshold, the list remains completely empty, which is a normal operational state.

Why this answer

The 'diagnose ips anomaly list' command displays only anomaly signatures that have been triggered and are currently in a state where thresholds have been exceeded. If no entries appear, it means the configured anomaly signatures have not yet detected traffic surpassing their defined thresholds (e.g., packets per second, connections per second). Anomaly signatures are threshold-based and only become active when the monitored traffic exceeds the configured limits, at which point they would appear in the list.

Exam trap

The trap here is that candidates assume 'diagnose ips anomaly list' shows all configured anomaly signatures, but it only shows those that have been triggered by exceeding thresholds, leading them to incorrectly suspect a configuration or policy issue.

How to eliminate wrong answers

Option A is wrong because IPS sensors do not have a 'passive' mode that suppresses anomaly detection; passive mode in FortiGate refers to the IPS engine's action (e.g., monitoring without blocking), but anomaly signatures still trigger and appear in the list if thresholds are exceeded. Option C is wrong because 'diagnose ips anomaly list' is the correct command to display triggered anomaly signatures; no alternative command is needed for this purpose. Option D is wrong because even if the IPS sensor is not enabled on any firewall policy, the anomaly signatures would still be configured in the sensor and would appear in the 'diagnose ips anomaly list' output if they had triggered, though they would not affect traffic; the absence of entries is due to thresholds not being exceeded, not policy attachment.

Full explanation →

MCQmedium

You are configuring a route-based IPsec VPN with BGP over the tunnel. After Phase 2 is up, the BGP session does not establish. You run 'diagnose debug ipsec' and see no errors. What should you check next?

A.Disable anti-replay on the tunnel

B.Enable NAT traversal

C.Ensure the tunnel interface is added to the BGP neighbor configuration

D.Check the Phase 1 proposal

AnswerC

In a route-based IPsec VPN, the tunnel interface is a logical interface that terminates the encrypted traffic and carries the BGP session. For BGP to establish, the neighbor command must reference the correct IP address of the remote peer on that tunnel interface, and the local tunnel interface must be set as the update source (or the source interface must be reachable). Without the tunnel interface being tied to the BGP neighbor configuration, BGP will attempt to use another interface as the source, so the TCP connection fails even though IPsec is up.

Why this answer

When Phase 2 is up and 'diagnose debug ipsec' shows no errors, the IPsec tunnel is functioning correctly at the encryption layer. The BGP session failing to establish typically indicates a routing or interface configuration issue. Option C is correct because the tunnel interface must be explicitly added to the BGP neighbor configuration (e.g., 'config router bgp -> config neighbor -> set interface <tunnel>') so that BGP knows to send its TCP packets (port 179) over that specific tunnel interface; without this, BGP may try to use the physical interface instead, causing the session to fail.

Exam trap

The trap here is that candidates assume a successful Phase 2 means the tunnel is fully operational for all traffic, overlooking that BGP requires explicit interface binding to the tunnel interface to establish the TCP session.

How to eliminate wrong answers

Option A is wrong because disabling anti-replay would not affect BGP session establishment; anti-replay is a security feature that prevents packet replay attacks and does not impact routing protocol connectivity. Option B is wrong because NAT traversal is only needed when a NAT device is present between the VPN peers, and the question does not indicate any NAT scenario; enabling it unnecessarily would not resolve a BGP peering issue. Option D is wrong because Phase 1 is already up (as Phase 2 is established), so checking Phase 1 proposals is irrelevant; the problem lies in the BGP configuration, not the IKE/ISAKMP settings.

Full explanation →

MCQmedium

An administrator is troubleshooting a connectivity issue. A ping from the FortiGate to 8.8.8.8 succeeds, but traffic from internal hosts to the internet is failing. The firewall policy allows the traffic. What is the most likely cause?

A.The default route on the FortiGate is missing

B.The internal hosts have the wrong default gateway configured

C.DNS resolution is failing

D.The FortiGate's interface to the internal network is down

AnswerB

Hosts forward traffic to destinations outside their subnet via their configured default gateway; in this network, that gateway should be the FortiGate's internal interface IP. If the hosts point to a different or nonexistent IP, their packets for internet destinations are sent to a device that cannot forward them, so the traffic never reaches the FortiGate. Even though the FortiGate can ping 8.8.8.8, the hosts remain isolated, which precisely matches the reported symptoms.

Why this answer

Since the FortiGate can ping 8.8.8.8, its default route and internet connectivity are working. The issue is that internal hosts cannot reach the internet, which points to a Layer 3 forwarding problem at the host level. The most likely cause is that the internal hosts have the wrong default gateway configured, so their traffic is not being sent to the FortiGate for routing.

Exam trap

The trap here is that candidates assume a successful ping from the FortiGate implies end-to-end connectivity, overlooking that the internal hosts' default gateway configuration is independent of the FortiGate's own routing table.

How to eliminate wrong answers

Option A is wrong because if the default route on the FortiGate were missing, the FortiGate itself would not be able to ping 8.8.8.8, but the ping succeeded. Option C is wrong because DNS resolution failure would prevent name resolution, but the question describes a connectivity issue where traffic to the internet is failing, and the ping to 8.8.8.8 uses an IP address, not a hostname, so DNS is not the bottleneck. Option D is wrong because if the FortiGate's interface to the internal network were down, the FortiGate would not be able to communicate with internal hosts at all, but the firewall policy allows the traffic and the FortiGate can still ping external IPs, indicating the internal interface is operational.

Full explanation →

MCQmedium

An administrator runs 'diagnose debug application fnbamd -1' on a FortiGate to troubleshoot authentication issues. The output shows that the FortiGate successfully contacts the LDAP server but the user authentication fails. What does this indicate?

A.The user's password is incorrect or the user account is locked

B.The LDAP server is unreachable

C.The LDAP bind user password is incorrect

D.The LDAP schema does not match what FortiGate expects

AnswerA

In the fnbamd debug output, "successful contact" confirms that the FortiGate established a TCP session and communicated with the LDAP server; the failure happens during the final bind step where the end user's distinguished name (DN) and password are verified. An LDAP 'invalidCredentials' or 'accountDisabled' result at this stage is the server's definitive rejection of that specific user's password or account state, not a communication problem. Therefore, the correct interpretation is that the user's password is wrong or the user account is locked out, disabled, or expired.

Why this answer

The 'diagnose debug application fnbamd -1' output shows successful contact with the LDAP server, meaning network connectivity and server reachability are fine. Since the server is reachable but authentication fails, the most likely cause is that the user's credentials (password) are incorrect or the account is locked/disabled on the LDAP server. This is a standard LDAP bind failure scenario where the server returns an 'invalid credentials' or 'account locked' error.

Exam trap

The trap here is that candidates often confuse a successful TCP connection or LDAP server response with successful authentication, not realizing that the FortiGate must perform a separate bind with the user's credentials, which can fail independently.

How to eliminate wrong answers

Option B is wrong because the output explicitly indicates the FortiGate successfully contacts the LDAP server, ruling out unreachability. Option C is wrong because the LDAP bind user password is used for the initial bind to search the directory, not for user authentication; a bind user password issue would prevent the search from succeeding, but the output shows contact is successful. Option D is wrong because an LDAP schema mismatch would typically cause attribute retrieval failures (e.g., group membership), not a direct authentication failure during the user bind attempt.

Full explanation →

Multi-Selecteasy

An admin is configuring ECMP (Equal Cost Multi-Path) on a FortiGate with two ISPs. Which TWO conditions must be met for ECMP to load balance traffic across both links? (Choose two.)

Select 2 answers

A.The routes must be configured with the same metric

B.The routes must have the same priority

C.The FortiGate must be in transparent mode

D.The routes must have the same administrative distance

E.The routes must point to different next-hop IP addresses

AnswersB, D

Equal priority ensures both routes are considered.

Why this answer

ECMP requires that multiple routes to the same destination have equal cost. On FortiGate, the cost is determined by administrative distance (AD) and priority (which is the route metric). Both routes must have the same AD and the same priority to be considered equal-cost and eligible for load balancing.

If either value differs, one route will be preferred over the other, and ECMP will not activate.

Exam trap

The trap here is that candidates confuse 'metric' (which is the priority value on FortiGate) with 'administrative distance', or assume ECMP requires different next-hop IPs, when in fact the key condition is equal cost (same AD and same priority).

Full explanation →

MCQmedium

A company is deploying FortiGate for outbound web filtering. They want to block users from accessing social media sites during business hours, but still allow access to cloud-based productivity tools like Office 365. Which approach should the administrator use to meet this requirement?

A.Create a firewall policy to block all traffic to ports commonly used by social media (e.g., TCP 443).

B.Use a web filter profile to block URLs containing 'facebook' or 'twitter'.

C.Configure an application control profile with rules to block social media applications and allow Office 365 applications.

D.Implement a DNS filter to block DNS queries for social media domains.

AnswerC

Application control is the correct approach because it classifies traffic based on application signatures and behaviors rather than static port numbers or URL strings. A properly configured application control profile can identify and block specific social media applications—even when they run over HTTPS or use non-standard ports—while explicitly allowing Office 365 applications, including Outlook, Teams, and SharePoint Online. This granularity meets the exact requirement without disrupting business-critical services, and with SSL inspection enabled, it remains effective against encrypted social media traffic.

Why this answer

Application control is the correct approach because it can identify and control applications like social media and Office 365 based on their unique signatures, regardless of the ports or protocols they use. Unlike URL filtering or port blocking, application control can differentiate between Office 365 traffic and social media traffic even when both use HTTPS on TCP 443, allowing the administrator to block social media while permitting cloud productivity tools.

Exam trap

The trap here is that candidates often assume URL filtering or port blocking is sufficient, but the NSE4 exam tests the understanding that application control is required when applications share the same port (e.g., TCP 443) and need to be differentiated based on their behavior, not just their domain or port.

How to eliminate wrong answers

Option A is wrong because blocking TCP 443 would block all HTTPS traffic, including Office 365 and other legitimate web services, not just social media. Option B is wrong because URL filtering based on keywords like 'facebook' or 'twitter' is unreliable—social media sites often use dynamic URLs, CDNs, or IP addresses that do not contain those keywords, and users can bypass it via direct IP access or HTTPS encryption. Option D is wrong because DNS filtering only blocks domain resolution; users could still access social media by using direct IP addresses, cached DNS entries, or alternative DNS servers, making it an incomplete solution.

Full explanation →

MCQeasy

An administrator wants to allow SSH access from the internet to a server inside the network at 192.168.1.10. Which NAT configuration is needed?

A.Use policy-based routing to forward SSH traffic

B.Create a VIP mapping public IP:22 to private IP:22 and an allow policy from WAN to DMZ

C.Configure source NAT on the outbound policy from DMZ to WAN

D.Enable NAT on the WAN interface

AnswerB

VIP translates the destination address; the policy allows the traffic after translation.

Why this answer

To allow inbound SSH access from the internet to an internal server, you need a Virtual IP (VIP) that maps a public IP and port (e.g., 203.0.113.5:22) to the private IP and port (192.168.1.10:22), combined with a firewall policy from the WAN zone to the DMZ zone that permits SSH traffic. This is Destination NAT (DNAT), which translates the destination address of incoming packets so they are routed to the internal server.

Exam trap

The trap here is that candidates often confuse source NAT (SNAT) with destination NAT (DNAT), thinking that enabling NAT on the WAN interface alone is sufficient for inbound access, when in fact a VIP (DNAT) and an allow policy are required to translate and permit the traffic.

How to eliminate wrong answers

Option A is wrong because policy-based routing (PBR) controls the path packets take based on criteria like source/destination, but it does not perform address translation; it cannot map a public IP to a private IP for inbound access. Option C is wrong because source NAT (SNAT) translates the source IP of outbound traffic, which is used for internal hosts to access the internet, not for allowing inbound SSH from the internet to an internal server. Option D is wrong because simply enabling NAT on the WAN interface without a specific VIP or DNAT rule does not create a mapping for inbound traffic; it typically applies to outbound traffic (masquerading) or requires additional configuration to handle inbound connections.

Full explanation →

MCQeasy

What is the primary difference between route-based and policy-based IPsec VPNs on a FortiGate?

A.Route-based requires a static route, policy-based uses dynamic routing.

B.Route-based encrypts all traffic, policy-based encrypts only specified services.

C.Route-based supports only IKEv2, policy-based supports both IKEv1 and IKEv2.

D.Route-based uses a tunnel interface, policy-based uses firewall policies to define traffic selectors.

AnswerD

Correct: route-based has a tunnel interface; policy-based defines selectors in Phase 2.

Why this answer

The primary difference is that route-based IPsec VPNs use a tunnel interface (e.g., 'phase1-interface' and 'phase2-interface') which participates in routing, while policy-based IPsec VPNs rely on firewall policies with explicit traffic selectors (source/destination addresses and services) to trigger encryption. In route-based VPNs, the tunnel interface is assigned an IP address and routes are used to direct traffic into the tunnel, decoupling encryption from policy matching. In policy-based VPNs, the firewall policy itself defines what traffic is encrypted, making the traffic selector part of the policy configuration.

Exam trap

The trap here is that candidates often confuse 'route-based' with 'dynamic routing' and 'policy-based' with 'static routing', but in reality, route-based VPNs can use either static or dynamic routing, while policy-based VPNs are inherently static and cannot participate in dynamic routing protocols.

How to eliminate wrong answers

Option A is wrong because route-based VPNs can use static or dynamic routing (e.g., OSPF, BGP) over the tunnel interface, and policy-based VPNs do not support dynamic routing at all—they rely solely on static traffic selectors defined in firewall policies. Option B is wrong because both route-based and policy-based VPNs encrypt only the traffic that matches their respective routing/policy rules; neither encrypts 'all traffic' by default. Option C is wrong because both VPN types support IKEv1 and IKEv2 on FortiGate; the choice of IKE version is independent of whether the VPN is route-based or policy-based.

Full explanation →

MCQeasy

Which web filtering feature allows an administrator to force web search engines to filter explicit content in search results, regardless of the user's browser settings?

A.DNS filter

B.URL filter

C.Application control

D.Safe search

AnswerD

Safe search enforces filtering at the search engine level.

Why this answer

Safe search is a web filtering feature that forces supported search engines (e.g., Google, Bing, Yahoo) to filter explicit content from search results by appending specific query parameters (such as `safe=active` for Google) to the search request. This enforcement occurs at the FortiGate proxy level, overriding the user's browser settings and ensuring compliance with acceptable use policies.

Exam trap

The trap here is that candidates often confuse DNS filter or URL filter with safe search, thinking that blocking explicit content at the domain or URL level is equivalent to filtering search results, but only safe search modifies the actual search engine query parameters to enforce content filtering at the source.

How to eliminate wrong answers

Option A is wrong because DNS filter controls access based on domain name resolution (e.g., blocking or redirecting DNS queries to known malicious or category-based domains), but it does not modify search engine query parameters to enforce content filtering. Option B is wrong because URL filter blocks or allows access based on the full URL path or pattern (e.g., blocking specific URLs or categories), but it cannot inject parameters into search engine requests to enforce safe search. Option C is wrong because application control identifies and controls application traffic (e.g., blocking or shaping social media or streaming apps), but it does not have the capability to modify HTTP request parameters within search engine queries.

Full explanation →

Multi-Selectmedium

An active-passive HA cluster is experiencing frequent failovers. Which TWO factors could cause unnecessary failovers? (Choose two.)

Select 2 answers

A.Using a data interface as the heartbeat interface

B.An unstable network link for the heartbeat

C.Different firmware versions on cluster members

D.Mismatched HA passwords between cluster members

E.Mismatched HA priority values

AnswersA, B

Data interfaces may have fluctuating link status, triggering failover.

Why this answer

Incorrect heartbeat interface configuration (e.g., using a busy data port) can cause false positives. A mismatched HA password prevents proper communication, but may not cause failover; mismatched priority affects role selection, not failover frequency. Unstable heartbeat links cause failover.

Full explanation →

MCQeasy

What is the purpose of the DNS filter security profile on a FortiGate?

A.To block DNS queries to known malicious domains

B.To inspect DNS traffic for virus signatures

C.To filter spam emails based on DNS blacklists

D.To prevent DNS tunneling attacks

AnswerA

DNS filter uses FortiGuard DNS categories and custom domain lists to block malicious DNS queries.

Why this answer

The DNS filter security profile on a FortiGate is designed to block DNS queries to known malicious domains by comparing the domain names in DNS requests against a regularly updated database of malicious or categorized domains. This prevents users from resolving domains associated with malware, phishing, or command-and-control servers, thereby stopping threats before an IP connection is even established.

Exam trap

The trap here is that candidates often confuse DNS filter with antivirus or antispam profiles, mistakenly thinking it inspects payloads or email content, when in fact it operates strictly at the DNS query layer to block domain resolution.

How to eliminate wrong answers

Option B is wrong because DNS filter does not inspect DNS traffic for virus signatures; that function is performed by antivirus profiles, which scan file attachments or payloads for malware patterns. Option C is wrong because filtering spam emails based on DNS blacklists is a feature of antispam profiles, not DNS filter — DNS filter operates at the DNS query level, not on email content. Option D is wrong while DNS tunneling is a real attack, the primary purpose of DNS filter is to block queries to malicious domains, not to detect or prevent DNS tunneling; tunneling detection requires deep packet inspection or anomaly-based analysis, typically handled by IPS or application control profiles.

Full explanation →

MCQmedium

A FortiGate admin has configured a firewall policy allowing traffic from the internal network (10.0.1.0/24) to the internet (any). Users report that they cannot access a specific website (203.0.113.5). The admin runs 'diagnose firewall fqdn list' and sees that the FQDN object used in a policy above the allow policy resolves to an IP that includes 203.0.113.5. What is the MOST likely cause?

A.The destination NAT on the allow policy is misconfigured

B.The FortiGate's DNS server is not resolving the FQDN correctly

C.The antivirus profile on the allow policy is blocking the website

D.The FQDN object resolved to the IP after the policy was created, but the policy lookup uses the cached IP and matches before the allow policy

AnswerD

Policy lookup matches the first policy where source/destination conditions are met. Since the FQDN object resolved to the destination IP, a higher-priority policy matches and the intended allow policy is never evaluated.

Why this answer

The FQDN object in a policy above the allow policy resolved to an IP that includes 203.0.113.5. FortiGate performs policy lookup based on cached IP addresses for FQDN objects. Since the FQDN object's cached IP now matches the destination IP of the website, traffic hits the higher-priority policy (which likely denies or otherwise blocks the traffic) before reaching the allow policy.

This is why users cannot access the website despite the allow policy existing.

Exam trap

The trap here is that candidates assume the allow policy will always match traffic to the website, but they overlook that FortiGate evaluates policies top-down and uses cached IP addresses for FQDN objects, so a higher-priority policy with a matching cached IP can intercept the traffic before the allow policy is reached.

How to eliminate wrong answers

Option A is wrong because destination NAT is not involved in this scenario; the issue is about policy matching order based on cached FQDN resolution, not NAT misconfiguration. Option B is wrong because the FQDN resolved correctly (the admin sees the IP in the list), so DNS resolution is not the problem. Option C is wrong because there is no indication that an antivirus profile is blocking the website; the problem is policy precedence, not security profile filtering.

Full explanation →

MCQmedium

A network administrator notices that some users can access blocked web categories despite a web filter profile applied to the policy. The admin runs 'diagnose debug rating' and sees 'rating not allow' for the category. What is the MOST likely cause?

A.The web filter profile has an 'override' configured for those users

B.The policy is not using the correct web filter profile

C.DNS filter is allowing the domain

D.The FortiGuard web filter database is outdated

AnswerA

A web filter override is an explicit exemption configured inside the FortiGate profile that lets certain users, groups, or source IPs bypass the FortiGuard rating decision. When an override is in place, the FortiGuard rating may still be evaluated as 'not allow' (blocked), but the override action overrides that result and permits the session. This exactly matches the symptom where only some users, presumably those included in the override rule, can access sites that are otherwise blocked for everyone else.

Why this answer

The 'rating not allow' message in the 'diagnose debug rating' output indicates that the FortiGate's rating engine correctly identified the category as blocked by the web filter profile. However, if an 'override' is configured for specific users or groups, it allows them to bypass the blocked category. This explains why some users can access the site despite the profile blocking it, as the override takes precedence over the profile's default action.

Exam trap

The trap here is that candidates often assume a 'rating not allow' message means the filter is working correctly for everyone, overlooking the possibility that an override configured within the same profile can selectively permit access for certain users.

How to eliminate wrong answers

Option B is wrong because if the policy were not using the correct web filter profile, the 'diagnose debug rating' output would not show 'rating not allow' for the category; it would either show no rating or a different profile reference. Option C is wrong because DNS filter operates independently of web filter rating; even if DNS filter allows the domain, the web filter profile's rating decision (block) would still apply unless overridden. Option D is wrong because an outdated FortiGuard database would cause 'rating not allow' for all users, not selectively for some, and the debug output would typically show 'rating error' or 'unrated' rather than a clear 'rating not allow'.

Full explanation →

MCQmedium

A FortiGate is configured with an aggregate interface (link aggregation group) consisting of two physical ports. The administrator notices that traffic is not being distributed evenly across the two links. Which configuration setting should be verified to improve load balancing?

A.Check the LACP mode (active vs passive)

B.Increase the MTU on the aggregate interface

C.Verify the load-balancing algorithm for the aggregate interface

D.Ensure the physical ports are in the same VDOM

AnswerC

The algorithm determines how traffic is hashed to links; changing it can improve distribution.

Why this answer

The aggregate interface uses a load-balancing algorithm to distribute traffic across member links. If traffic is uneven, the algorithm (e.g., source-destination IP, source-destination MAC, or layer 4 port) may not match the traffic pattern, causing hash polarization. Verifying and adjusting this algorithm is the correct step to improve distribution.

Exam trap

The trap here is confusing LACP negotiation settings (active/passive) with the actual traffic distribution mechanism, leading candidates to incorrectly select option A instead of recognizing that the load-balancing algorithm directly controls link utilization.

How to eliminate wrong answers

Option A is wrong because LACP mode (active vs passive) controls link negotiation and aggregation establishment, not traffic distribution across already-aggregated links. Option B is wrong because increasing MTU affects maximum packet size but has no impact on how traffic is hashed or distributed among aggregate members. Option D is wrong because VDOM membership ensures logical separation but does not influence the load-balancing algorithm or per-packet distribution across physical ports in an aggregate.

Full explanation →

MCQeasy

An administrator needs to allow outbound DNS traffic (UDP port 53) from multiple internal subnets to the internet. Which object type should be used to group the subnets into a single source in the firewall policy?

A.VIP group

B.Schedule group

C.Address group

D.Service group

AnswerC

An address group is the correct object because it bundles multiple address objects—such as subnets, IP ranges, and FQDNs—into a single named entity. This address group can then be used as the source field in an outbound policy, effectively allowing all internal subnets to initiate DNS queries. This is exactly what the administrator needs to match the source subnets for outbound UDP port 53 traffic.

Why this answer

An address group is the correct object type to group multiple internal subnets into a single source in a firewall policy. In FortiGate, address groups allow you to combine multiple IP addresses or subnets (IPv4 or IPv6) into a logical group, which can then be referenced as the source in a single firewall policy. This simplifies administration by reducing the number of policies needed to allow outbound DNS traffic from multiple subnets.

Exam trap

The trap here is that candidates often confuse address groups with service groups, mistakenly thinking that grouping subnets is done via service objects, but service groups only define protocols and ports, not IP addresses.

How to eliminate wrong answers

Option A is wrong because a VIP group is used to group multiple virtual IP (VIP) objects for destination NAT (port forwarding) or load balancing, not for grouping source subnets. Option B is wrong because a schedule group is used to group time-based schedules (e.g., daily, weekly) to control when a policy is active, not to define source addresses. Option D is wrong because a service group is used to group multiple service definitions (e.g., DNS, HTTP, HTTPS) by protocol/port, not to group source IP subnets.

Full explanation →

Multi-Selecthard

A FortiGate configured in transparent mode needs to allow HTTP traffic between two VLANs. The administrator has created a firewall policy. However, traffic is still blocked. Which TWO additional configurations are necessary for transparent mode operation?

Select 2 answers

A.Enable VLAN forwarding on the bridge

B.Configure a management IP address on the FortiGate

C.Create static routes for each VLAN subnet

D.Disable antivirus inspection on the policy

E.Assign IP addresses to the internal interfaces

AnswersA, B

The bridge must be configured to forward VLAN-tagged traffic.

Why this answer

In transparent mode, the FortiGate acts as a Layer 2 bridge, so VLAN tags must be preserved and forwarded across the bridge. Enabling VLAN forwarding on the bridge (option A) allows the FortiGate to pass 802.1Q-tagged frames between VLANs, which is essential for inter-VLAN HTTP traffic. Without this, the bridge will drop VLAN-tagged frames, blocking the traffic even if a firewall policy exists.

Exam trap

The trap here is that candidates often assume transparent mode requires IP addresses on interfaces (like NAT/route mode) or that static routes are needed for inter-VLAN traffic, but the key is understanding that transparent mode is Layer 2 and requires VLAN forwarding and a management IP for policy enforcement.

Full explanation →

MCQmedium

A FortiGate administrator needs to allow remote management from the internet only from a specific IP address. Which configuration achieves this?

A.Create a local-in policy to allow management access only from the trusted host

B.Change the admin port to a non-standard port

C.Enable HTTPS and restrict admin access via admin host

D.Use a firewall policy with source address restriction

AnswerA

A local-in policy is evaluated before any firewall policy and explicitly governs traffic destined to the FortiGate's own IP addresses. By defining a local-in rule that permits management traffic only from the specified trusted host IP, the administrator ensures all other sources are implicitly denied, providing precise source-based access control for the management interface.

Why this answer

A local-in policy is the correct method to restrict remote management access to a FortiGate from the internet because it operates at the control plane level, filtering traffic destined to the FortiGate itself before it reaches the management daemons. By specifying a source IP address in a local-in policy, you can explicitly allow HTTPS or SSH management only from that trusted host, while implicitly denying all other sources. This is more secure than relying on firewall policies, which apply to traffic passing through the FortiGate, not to traffic destined to the FortiGate's own IP addresses.

Exam trap

The trap here is that candidates often confuse firewall policies (which control traffic passing through the FortiGate) with local-in policies (which control traffic destined to the FortiGate), leading them to incorrectly select option D, thinking a standard firewall policy can restrict management access from the internet.

How to eliminate wrong answers

Option B is wrong because changing the admin port to a non-standard port is a form of security through obscurity and does not restrict access to a specific IP address; it only changes the port number, which can still be scanned and accessed from any source. Option C is wrong because enabling HTTPS and restricting admin access via admin host (the 'admin host' setting) is a legacy method that only works for GUI access and does not apply to SSH or other management protocols; it also does not provide the granularity of a local-in policy. Option D is wrong because a firewall policy with source address restriction applies to traffic transiting through the FortiGate (forwarding plane), not to traffic destined to the FortiGate itself (control plane); management traffic is handled by the control plane and must be filtered using local-in policies or the 'trusted host' feature.

Full explanation →

100

MCQhard

You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?

A.The session has been active for 1 hour and will expire in about 1 hour

B.The session is blocked by the firewall

C.The session is using UDP protocol

D.The session is in a half-open state

AnswerA

duration=3600 seconds = 1 hour, expire=3599 seconds ≈ 1 hour. This is a normal established session.

Why this answer

The output shows `duration=3600` (seconds), meaning the session has been active for 1 hour, and `expire=3599` (seconds), meaning the session will expire in about 1 hour (3600 seconds minus 1 second already elapsed). The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to an established TCP session. Therefore, option A is correct.

Exam trap

The trap here is that candidates often misinterpret `proto_state=01` as a half-open state or confuse `proto=6` with UDP, but Fortinet uses `proto_state=01` to indicate an established TCP session, not a half-open one.

How to eliminate wrong answers

Option B is wrong because the output shows a valid session with a state (`proto_state=01`) and an expiry timer; a blocked session would not have a duration or expire value, or would show a different state like `proto_state=00` (not established). Option C is wrong because `proto=6` explicitly indicates TCP (protocol 6), not UDP (protocol 17). Option D is wrong because `proto_state=01` in Fortinet's session table represents an established TCP session (SYN-SYN/ACK-ACK completed), not a half-open state (which would be `proto_state=00` or a different value indicating incomplete handshake).

Full explanation →

101

MCQmedium

A FortiGate admin is configuring a hub-and-spoke IPsec VPN. The hub has multiple phase 2 configurations for each spoke. The spokes can communicate with the hub but not with each other. The admin wants to allow spoke-to-spoke traffic through the hub. Which configuration change is required on the hub?

A.Change the IPsec mode from policy-based to route-based

B.Modify the Phase 2 selectors on the hub to include both spoke subnets and add firewall policies allowing traffic between the spoke networks

C.Enable 'add-route' on the hub's Phase 1 settings

D.Configure a static route on each spoke pointing to the other spoke's subnet via the tunnel

AnswerB

The correct fix is to ensure the hub's Phase 2 selectors for each spoke tunnel define traffic selectors that include both hub-side and remote-spoke subnets, so the hub can decapsulate traffic from one spoke, match it against the phase2 selectors of the other spoke's tunnel, and re-encapsulate it for forwarding. Additionally, the hub must have firewall policies that explicitly allow traffic between the spoke networks—typically by placing each spoke interface in a zone and permitting the traffic between them or using address objects. Without both the expanded selectors and the inter-spoke firewall policy, packets arriving from one spoke for the other will be dropped, as the hub either lacks the matching phase2 selector or the policy permission to forward the traffic.

Why this answer

In a hub-and-spoke VPN with policy-based IPsec, the hub's Phase 2 selectors define which subnets can communicate through each tunnel. By default, each spoke's Phase 2 selector only includes the hub and that specific spoke's subnets, blocking spoke-to-spoke traffic. Adding both spoke subnets to the hub's Phase 2 selectors and creating firewall policies that permit traffic between those spoke networks allows the hub to route traffic between spokes, effectively enabling spoke-to-spoke communication through the hub.

Exam trap

The trap here is that candidates often assume route-based VPNs are always required for spoke-to-spoke communication, but the real issue is that Phase 2 selectors and firewall policies must be explicitly configured to allow inter-spoke traffic through the hub.

How to eliminate wrong answers

Option A is wrong because changing from policy-based to route-based IPsec is not required; the issue is with Phase 2 selectors and firewall policies, not the IPsec mode. Route-based VPNs use virtual interfaces and routing, but the same selector and policy adjustments would still be needed to allow spoke-to-spoke traffic. Option C is wrong because 'add-route' on Phase 1 settings automatically installs routes for remote networks based on Phase 2 selectors, but it does not modify the selectors themselves or create firewall policies to permit spoke-to-spoke traffic.

Option D is wrong because configuring static routes on each spoke for the other spoke's subnet via the tunnel would only work if the hub already had the correct Phase 2 selectors and firewall policies; without those, the traffic would be dropped at the hub.

Full explanation →

102

MCQmedium

A FortiGate administrator needs to upgrade the firmware from 7.0.5 to 7.2.0. The current firmware is 7.0.5. What is the recommended upgrade path?

A.Upgrade to 7.0.6 first, then to 7.2.0

B.Upgrade to 7.2.0 directly after downgrading to 7.0.0

C.Upgrade to 7.4.0 first, then downgrade to 7.2.0

D.Upgrade directly from 7.0.5 to 7.2.0

AnswerA

First upgrade to the latest 7.0.x, then to 7.2.0.

Why this answer

Fortinet firmware upgrades must follow a supported upgrade path to avoid configuration incompatibility or system instability. The recommended path from 7.0.5 to 7.2.0 is to first upgrade to the latest 7.0.x release (7.0.6) and then to 7.2.0, as direct jumps across major versions (e.g., 7.0.x to 7.2.0) are not supported and may cause upgrade failures or data loss.

Exam trap

The trap here is that candidates assume any direct upgrade between consecutive major versions is allowed, but Fortinet enforces a strict path that requires upgrading to the latest patch of the current major branch first.

How to eliminate wrong answers

Option B is wrong because downgrading to 7.0.0 before upgrading to 7.2.0 is unnecessary and introduces risk; the correct path is to upgrade within the 7.0.x branch first. Option C is wrong because upgrading to 7.4.0 (a later major version) and then downgrading to 7.2.0 is not a supported upgrade path and may cause configuration corruption or boot issues. Option D is wrong because directly upgrading from 7.0.5 to 7.2.0 is not supported; Fortinet requires an intermediate upgrade to the latest 7.0.x release to ensure compatibility of the firmware image and configuration database.

Full explanation →

103

MCQmedium

A FortiGate admin configures a firewall policy to allow HTTP traffic from the internal network (10.0.0.0/8) to the internet. Users report that they cannot access web pages. The admin runs 'diagnose debug flow' and sees packets hitting the policy but being dropped. What is the MOST likely cause?

A.The interface is not configured as a WAN interface

B.The policy is disabled

C.The firewall policy action is set to DENY

D.The traffic is being processed by a higher priority deny policy

AnswerC

If the policy action is set to DENY, even though the traffic matches the source/destination/service, it will be dropped. This is a common misconfiguration.

Why this answer

The debug flow output shows packets hitting the policy but being dropped. If the policy action were set to DENY, the firewall would match the traffic and then drop it, which matches the symptom. The fact that the policy is being hit rules out a disabled policy or a higher-priority deny policy (unless the higher-priority policy is also being hit, but the debug indicates the specific policy is the one dropping the traffic).

Exam trap

The trap here is that candidates often assume a policy being 'hit' in debug flow means it is allowing traffic, but in FortiOS, a policy with action DENY will still show as 'hit' before the packet is dropped.

How to eliminate wrong answers

Option A is wrong because the interface type (WAN vs. internal) does not affect whether a firewall policy can allow traffic; FortiGate policies are based on source/destination interfaces and addresses, not interface roles. Option B is wrong because if the policy were disabled, the debug flow would not show packets hitting that policy; it would either match a different policy or be dropped by the implicit deny. Option D is wrong because if a higher-priority deny policy were processing the traffic, the debug flow would show that policy being hit, not the current policy; the debug output explicitly shows this policy being hit and then dropped.

Full explanation →

104

MCQeasy

Which inspection mode in the antivirus profile processes traffic by buffering the entire file before scanning, allowing more thorough detection but potentially increasing latency?

A.Proxy-based inspection

B.Deep inspection

C.DNS inspection

D.Flow-based inspection

AnswerA

Proxy-based inspection is the correct mode because it buffers the entire file in memory before scanning, allowing FortiOS to perform a thorough, full-file signature analysis. This enables detection of threats embedded deep within archives, compressed files, or multi-part executables that could evade streaming methods. As a result, it provides the highest fidelity for antivirus detection, albeit with added latency proportional to file size.

Why this answer

Proxy-based inspection in the antivirus profile buffers the entire file in memory before scanning, enabling thorough detection of threats like polymorphic malware or embedded exploits. This mode reassembles the full data stream, allowing the FortiGate to perform deep content analysis, but it introduces higher latency due to the buffering and reassembly process.

Exam trap

The trap here is that candidates often confuse 'deep inspection' with 'proxy-based inspection' because both involve thorough analysis, but deep inspection specifically refers to SSL/TLS decryption, not the file buffering mechanism in antivirus profiles.

How to eliminate wrong answers

Option B is wrong because deep inspection is a broader security profile feature (e.g., SSL/TLS inspection) that decrypts traffic for scanning, not a specific antivirus inspection mode that buffers files. Option C is wrong because DNS inspection is a separate security profile for filtering DNS queries and responses, not related to file buffering or antivirus scanning. Option D is wrong because flow-based inspection processes packets in real-time without buffering the entire file, reducing latency but sacrificing the thorough detection that proxy-based mode provides.

Full explanation →

105

MCQmedium

A company wants to block all peer-to-peer (P2P) traffic using Application Control on their FortiGate. They have enabled the application control profile, but users can still download files via BitTorrent. What is the most likely reason?

A.The application control profile does not have SSL inspection enabled.

B.The FortiGate is operating in Transparent mode.

C.The application control profile is applied to the outgoing policy, but BitTorrent traffic is incoming.

D.The default application signatures do not include BitTorrent.

AnswerA

Without SSL inspection, encrypted BitTorrent traffic cannot be inspected and matched.

Why this answer

BitTorrent traffic is often encrypted, so without SSL inspection, the FortiGate cannot inspect the payload of the encrypted sessions to identify the application. Application Control relies on deep packet inspection (DPI) to match traffic against application signatures; if SSL inspection is not enabled, the FortiGate only sees encrypted packets and cannot detect BitTorrent, allowing the traffic to pass unchecked.

Exam trap

The trap here is that candidates often assume application control works on all traffic regardless of encryption, but FortiGate requires SSL inspection to identify applications that use encryption, such as BitTorrent.

How to eliminate wrong answers

Option B is wrong because Transparent mode does not affect the ability to perform application control; the FortiGate can still inspect traffic and apply profiles in Transparent mode. Option C is wrong because BitTorrent traffic can be both incoming and outgoing; application control policies apply to the direction specified, and blocking outgoing P2P traffic is standard, so the direction is not the issue. Option D is wrong because FortiGate's default application signatures do include BitTorrent; the problem is that the signatures cannot match encrypted traffic without SSL inspection.

Full explanation →

106

MCQmedium

A FortiGate administrator is configuring SSL deep inspection for a firewall policy that handles traffic to multiple internal servers. Some servers have self-signed certificates. The administrator wants to avoid certificate errors for users. What configuration is recommended?

A.Configure the firewall policy to accept invalid certificates

B.Use certificate inspection instead of deep inspection

C.Add the server certificates to the FortiGate's trusted CA store

D.Disable deep inspection for those servers

AnswerC

Why this answer

Adding the self-signed server certificates to the FortiGate's trusted CA store allows the FortiGate to validate those certificates during SSL deep inspection. This prevents certificate errors for users, as the FortiGate will trust the self-signed certificates and generate a valid signed certificate for the client, avoiding browser warnings.

Exam trap

The trap here is that candidates may think disabling deep inspection or using certificate inspection is simpler, but the correct approach is to trust the self-signed certificates by importing them into the FortiGate's CA store to maintain full inspection without certificate errors.

How to eliminate wrong answers

Option A is wrong because configuring the firewall policy to accept invalid certificates would bypass security checks, allowing potentially malicious certificates and defeating the purpose of deep inspection. Option B is wrong because certificate inspection only examines the certificate metadata without decrypting traffic, so it cannot prevent certificate errors for self-signed certificates; it would still pass the error to the client. Option D is wrong because disabling deep inspection for those servers would leave their traffic unexamined, failing to enforce security policies like antivirus or IPS, and does not address the certificate error issue.

Full explanation →

107

Multi-Selecteasy

An administrator needs to authenticate users on a FortiGate using RADIUS. Which TWO of the following are required to configure RADIUS authentication?

Select 2 answers

A.A PKI certificate for the RADIUS server

B.A RADIUS server object with IP address and shared secret

C.An FSSO connector

D.A user group that references the RADIUS server

E.A local user account for each RADIUS user

AnswersB, D

This defines the connection to the RADIUS server.

Why this answer

A RADIUS server object defines the IP address and shared secret that the FortiGate uses to communicate with the RADIUS server for authentication requests. Option D is correct because a user group must reference the RADIUS server to map authenticated users to policies; without this group, the FortiGate cannot apply firewall rules based on RADIUS authentication.

Exam trap

The trap here is that candidates often think a local user account is required for each RADIUS user, but RADIUS offloads authentication to an external server, making local accounts unnecessary.

Full explanation →

108

MCQhard

An administrator has configured DLP sensors to detect credit card numbers in outgoing traffic. However, the administrator notices that traffic containing credit card numbers is still passing through undetected. The firewall policy uses flow-based inspection. What is the MOST likely reason DLP is not detecting the data?

A.DLP requires proxy-based inspection to perform data leakage detection.

B.The DLP sensor is not applied to the correct firewall policy.

C.The DLP sensor is configured with the wrong regular expression.

D.The credit card numbers are encrypted by SSL and deep inspection is not enabled.

AnswerA

DLP scanning requires proxy-based inspection because it needs to buffer the content for pattern matching.

Why this answer

DLP requires proxy-based inspection to buffer and analyze the content. Flow-based inspection does not support DLP.

Full explanation →

109

MCQeasy

A FortiGate administrator wants to ensure that traffic from the internal network to the internet is translated to a single public IP address. Which NAT method should be used?

A.Central SNAT

B.One-to-one NAT

C.Fixed port range NAT

D.Overload NAT

AnswerD

Overload NAT, also known as Port Address Translation (PAT), is the correct method for this scenario. It translates the source IP address of all internal hosts to one public IP while dynamically assigning a unique source port for each connection, preserving the host identity through the port mapping. This provides scalable, concurrent internet access for many internal users using a single public address.

Why this answer

Overload NAT (also known as Port Address Translation or PAT) is the correct method because it allows multiple internal hosts to share a single public IP address by mapping each session to a unique source port. This is exactly what the administrator needs: translating all internal-to-internet traffic to one public IP.

Exam trap

The trap here is that candidates often confuse 'Central SNAT' (a FortiGate configuration method) with a specific NAT type, or think 'one-to-one NAT' is suitable for sharing a single IP, when it actually requires a dedicated public IP per internal host.

How to eliminate wrong answers

Option A is wrong because Central SNAT is a policy-based NAT method in FortiGate that can use overload or other modes, but it is not a specific NAT method itself; it is a configuration approach. Option B is wrong because one-to-one NAT maps a single private IP to a single public IP, which would require multiple public IPs for multiple internal hosts, not a single public IP. Option C is wrong because fixed port range NAT allocates a fixed range of ports per internal host, which still requires multiple public IPs or port ranges and does not achieve the goal of using a single public IP for all traffic.

Full explanation →

110

MCQmedium

You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?

A.The TCP handshake is incomplete; the SYN-ACK has not been received

B.The session is a UDP session

C.The session has been idle for 3600 seconds

D.The session is fully established and will expire in 3599 seconds

AnswerA

State 01 is SYN_SENT, meaning the SYN has been sent but no SYN-ACK received yet.

Why this answer

The output shows a TCP session (proto=6) with proto_state=01, which in Fortinet's session table indicates the session is in the SYN-SENT state (TCP state 1). This means the initial SYN has been sent but the SYN-ACK has not yet been received, so the TCP three-way handshake is incomplete. The duration and expire values reflect the session's age and remaining lifetime, not its establishment status.

Exam trap

The trap here is that candidates see 'expire=3599' and assume the session is established and about to expire, but Fortinet's proto_state field directly reveals the TCP handshake phase, and state 01 specifically means the handshake is incomplete.

How to eliminate wrong answers

Option B is wrong because proto=6 explicitly indicates TCP (not UDP, which would be proto=17). Option C is wrong because duration=3600 shows the session has been active for 3600 seconds, not idle; idle time is tracked separately in the session table. Option D is wrong because proto_state=01 (SYN-SENT) means the session is not fully established; a fully established TCP session would show proto_state=02 (ESTABLISHED) or higher.

Full explanation →

111

MCQmedium

A FortiGate administrator configures an IPS sensor with a signature that has a 'pass' action. The sensor is applied to a firewall policy. When traffic matches this signature, what will happen?

A.The traffic is allowed without any logging.

B.The traffic is reset and a log is generated.

C.The traffic is allowed but a log message is generated.

D.The traffic is blocked and logged.

AnswerC

Pass action allows the traffic and logs the event.

Why this answer

When an IPS signature with a 'pass' action is matched, the firewall allows the traffic to proceed normally, but a log message is generated to record the event. This is because the 'pass' action explicitly permits the traffic while still enabling logging if the signature is configured with logging enabled. In FortiGate, the 'pass' action overrides the default block behavior of IPS, ensuring the session continues without interruption.

Exam trap

The trap here is that candidates often assume 'pass' means no logging occurs, confusing it with a 'monitor' action or forgetting that logging is a separate configuration from the signature action.

How to eliminate wrong answers

Option A is wrong because the 'pass' action does not suppress logging; logging is controlled separately in the signature configuration, and by default, a log is generated when a signature matches. Option B is wrong because a 'reset' action would terminate the session with a TCP RST or ICMP unreachable, which is not the behavior of 'pass'. Option D is wrong because 'block' action would deny the traffic and log it, but 'pass' explicitly allows the traffic, so blocking does not occur.

Full explanation →

112

MCQhard

An administrator runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows many sessions with 'proto_state=01' and 'expire=3599'. What does 'expire=3599' indicate?

A.The session has 3599 packets

B.The session has been alive for 3599 seconds

C.The session has 3599 bytes of data transferred

D.The session will timeout in 3599 seconds

AnswerD

Expire shows remaining time before the session is removed due to inactivity.

Why this answer

In FortiGate diagnostics, the 'expire' field in the session list output indicates the remaining time in seconds before the session times out. A value of 3599 seconds means the session will be removed from the session table after that many seconds of inactivity, assuming no further traffic matches the session. This is a key metric for understanding session lifecycle and timeout behavior.

Exam trap

The trap here is confusing 'expire' (remaining time until timeout) with 'duration' (time since session creation), leading candidates to incorrectly select option B.

How to eliminate wrong answers

Option A is wrong because 'expire' does not represent a packet count; packet counts are shown in separate fields like 'packets' or 'pkt_in/pkt_out'. Option B is wrong because 'expire' is the remaining time until timeout, not the elapsed time since the session was created; the 'duration' field tracks how long the session has been alive. Option C is wrong because 'expire' is unrelated to data transfer size; byte counts are displayed in fields such as 'bytes' or 'total_bytes'.

Full explanation →

113

MCQhard

An administrator sees the following CLI output when checking an IPS sensor: 'config ips sensor edit test config entries edit 1 set severity medium set action block set target default end'. However, attacks with severity medium are still passing. The IPS sensor is applied to a policy with flow-based inspection. What is the likely issue?

A.The IPS sensor is not enabled in the policy

B.The IPS sensor rule has 'target' set to 'default' which may not apply to the traffic direction

C.The FortiGate needs a FortiSandbox for IPS to work

D.The severity level is set too high

AnswerB

For flow-based inspection, target must be 'client' or 'server' to match direction. 'default' may not work as expected.

Why this answer

The 'set target default' command in the IPS sensor configuration means the rule is applied to traffic that matches the default target, which is typically the 'client-to-server' direction. If the attack traffic is flowing in the opposite direction (server-to-client), the rule will not trigger. This is a common misconfiguration when using flow-based inspection, where the target direction must match the actual traffic flow for the action to be enforced.

Exam trap

The trap here is that candidates often assume 'default' means the rule applies to all traffic, but in FortiGate IPS, 'default' typically refers to a specific direction (client-to-server), and failing to set the correct target for bidirectional attack patterns is a common oversight.

How to eliminate wrong answers

Option A is wrong because the IPS sensor is applied to a policy with flow-based inspection, and the CLI output shows the sensor is configured; if it were not enabled, the administrator would not see the sensor configuration or the policy would not reference it. Option C is wrong because FortiSandbox is not required for IPS to function; IPS uses local signatures and pattern matching, and FortiSandbox is an additional security service for advanced threat detection, not a prerequisite for basic IPS operation. Option D is wrong because 'set severity medium' is not too high; attacks with severity medium should be blocked if the rule is correctly applied, and the issue is that the rule is not matching due to the target direction, not the severity level.

Full explanation →

114

MCQhard

A FortiGate administrator is configuring a route-based IPsec VPN between two FortiGate devices. After setting up the tunnel and firewall policies, traffic does not flow. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. 'get router info routing-table all' shows routes on both sides. However, pings from the local network to the remote network fail. What is the MOST likely cause?

A.The pre-shared key is incorrect

B.The firewall policy allowing traffic to the remote subnet has the source and destination interfaces reversed

C.The remote FortiGate's static route points to the wrong local subnet

D.The Phase 2 proposal uses different encryption algorithms on each side

AnswerB

In a route-based VPN, the policy must be configured with the VPN interface as the destination interface (if traffic flows from internal to VPN) or source interface (if from VPN to internal). Misconfiguration here causes traffic to be dropped.

Why this answer

The tunnel is up and routes are present, indicating Phase 1 and Phase 2 negotiations succeeded. The most likely cause is that the firewall policy allowing traffic to the remote subnet has the source and destination interfaces reversed. In a route-based VPN, the policy must have the incoming interface as the source (e.g., internal) and the outgoing interface as the destination (e.g., the VPN tunnel interface).

Reversing these prevents traffic from being matched, even though the tunnel is established.

Exam trap

The trap here is that candidates assume a tunnel being up and routes present guarantees traffic flow, overlooking that the firewall policy's interface direction must match the traffic flow, not the tunnel's logical direction.

How to eliminate wrong answers

Option A is wrong because an incorrect pre-shared key would prevent Phase 1 from completing, causing the tunnel to show as down, not up. Option C is wrong because the remote FortiGate's static route pointing to the wrong local subnet would cause asymmetric routing or unreachability, but the local side's routes are correct per the scenario; the issue is on the local firewall policy, not the remote route. Option D is wrong because mismatched Phase 2 proposals would cause the tunnel to fail to establish or show as up with no traffic, but 'diagnose vpn tunnel list' would typically show a down or error state, not 'up'.

Full explanation →

115

MCQmedium

A client connects to a FortiGate SSL VPN in web mode. The user can access internal web applications but cannot ping or RDP to servers. The administrator wants to allow these services. What must be changed?

A.Enable split tunneling on the SSL VPN portal

B.Change the SSL VPN type from web mode to tunnel mode

C.Add the server IP addresses to the portal's bookmarks

D.Configure a firewall policy allowing the client's IP to the servers

AnswerB

Tunnel mode supports all IP traffic, not just web, by creating a virtual network interface.

Why this answer

Web mode SSL VPN only provides application-layer access through a web portal, typically using HTTP/HTTPS. It does not create a virtual network interface on the client, so lower-layer protocols like ICMP (ping) and RDP (TCP/3389) cannot be routed through the VPN. To support these services, the VPN must operate in tunnel mode, which assigns a virtual IP to the client and creates a full Layer 3 tunnel, allowing all IP-based traffic to traverse the FortiGate.

Exam trap

The trap here is that candidates assume adding a firewall policy or enabling split tunneling will magically allow non-web traffic in web mode, not realizing that web mode fundamentally lacks the Layer 3 virtual interface required to route protocols other than HTTP/HTTPS.

How to eliminate wrong answers

Option A is wrong because split tunneling controls which destinations are routed through the VPN tunnel versus the internet, but it does not change the fundamental limitation of web mode—web mode cannot pass non-HTTP traffic regardless of split tunneling settings. Option C is wrong because bookmarks in the SSL VPN portal are only shortcuts for web-based applications; they do not enable protocol-level forwarding for ICMP or RDP. Option D is wrong because firewall policies are necessary for traffic to be permitted, but without tunnel mode, the client's traffic never reaches the FortiGate as routable IP packets—web mode only proxies HTTP/HTTPS requests, so a firewall policy alone cannot allow ping or RDP.

Full explanation →

116

MCQmedium

A company has a web server in the DMZ that must be accessible from the internet on both HTTP and HTTPS. The admin configures a VIP to map the public IP to the server's private IP. However, external users can only reach HTTP. What is the MOST likely cause?

A.The VIP is configured for port forwarding only for HTTP (port 80)

B.The web server is not listening on HTTPS

C.The VIP is using overload mode instead of one-to-one

D.The firewall policy allowing traffic to the VIP only permits HTTP

AnswerA

The virtual IP (VIP) object on a FortiGate is responsible for destination NAT, mapping an external address and port to an internal server. When a VIP is defined with only the HTTP service (port 80), the FortiGate will only translate traffic destined to that external IP:port pair. Incoming HTTPS connections to port 443 are not matched by the VIP, so they are dropped or not forwarded, precisely matching the symptom that external users cannot reach the web server over HTTPS.

Why this answer

The VIP (Virtual IP) configuration on a FortiGate maps a public IP and port to a private IP and port. If the VIP is configured only for port forwarding on TCP 80 (HTTP), it will not translate traffic for TCP 443 (HTTPS). This is the most likely cause because external users can reach HTTP but not HTTPS, indicating the VIP itself is not handling HTTPS traffic.

Exam trap

The trap here is that candidates often assume the firewall policy is the issue, but the VIP itself must be configured to forward the specific ports; a policy allowing all traffic is useless if the VIP does not translate the destination port for HTTPS.

How to eliminate wrong answers

Option B is wrong because if the web server were not listening on HTTPS, the connection would still be attempted and fail at the server level, but the symptom is that external users cannot reach HTTPS at all, which points to a VIP or policy issue, not server configuration. Option C is wrong because overload mode (PAT) and one-to-one mode (DNAT) both can handle multiple ports; the mode does not restrict which ports are forwarded. Option D is wrong because the firewall policy allowing traffic to the VIP only permits HTTP would block HTTPS, but the question states the VIP is configured for port forwarding only for HTTP, making the VIP itself the root cause; a policy issue would be secondary and less likely given the VIP configuration.

Full explanation →

117

Multi-Selectmedium

A FortiGate administrator needs to allow inbound HTTPS traffic to a web server located at 192.168.1.10. The public IP is 203.0.113.5. The administrator wants to translate the destination to the internal server and also translate the source port to a fixed range for logging purposes. Which THREE configuration elements are required?

Select 3 answers

A.Create a Virtual IP (VIP) mapping 203.0.113.5 to 192.168.1.10

B.Create a firewall policy from WAN to DMZ allowing HTTPS and referencing the VIP as destination

C.Configure Central SNAT to translate the server's source IP for return traffic

D.Create an IP pool with fixed port range for source translation

E.Enable 'allow source port translation' on the VIP

AnswersA, B, D

A VIP is necessary for destination NAT (DNAT) to forward public IP to internal server.

Why this answer

To allow inbound HTTPS to an internal server with destination NAT, a Virtual IP (VIP) mapping 203.0.113.5 to 192.168.1.10 is required. A firewall policy from WAN to DMZ allowing HTTPS and referencing the VIP as destination permits the traffic and applies the NAT. Additionally, to translate the source port to a fixed range for logging, an IP pool with fixed port range is needed.

Thus, options A, B, and D are all required.

Exam trap

The trap here is that candidates often confuse VIPs (destination NAT) with IP pools (source NAT) or Central SNAT, mistakenly thinking source translation is needed for inbound traffic, when the question specifically requires destination translation and fixed port mapping for logging.

Full explanation →

118

MCQhard

An administrator has configured an SSL VPN with tunnel mode and split tunneling enabled. However, remote users report that all internet traffic is going through the VPN tunnel. What is the MOST likely cause?

A.The firewall policy allows traffic to the internet

B.The SSL VPN portal has 'split tunneling' disabled

C.The client's routing table is set to route all traffic through the VPN

D.The user has installed a root certificate

AnswerC

Even with split tunneling enabled on the portal, if the client pushes a route for 0.0.0.0/0, all traffic goes through the tunnel.

Why this answer

When split tunneling is enabled on the FortiGate SSL VPN portal, the FortiClient VPN software should only route traffic destined for the corporate network through the tunnel. If remote users report that all internet traffic is going through the VPN tunnel, the most likely cause is that the client's routing table has been configured to route all traffic (0.0.0.0/0) through the virtual adapter, overriding the split-tunneling rules. This can happen if the client is set to 'Route all traffic through VPN' in its settings, which forces a default route into the VPN interface regardless of the portal configuration.

Exam trap

The trap here is that candidates often assume the portal's split-tunneling setting is the sole control, but the client-side configuration can override it, making option B seem correct when the real issue is the client's routing table.

How to eliminate wrong answers

Option A is wrong because a firewall policy allowing traffic to the internet is necessary for internet access, but it does not cause traffic to be forced through the VPN tunnel; it only permits the traffic once it reaches the FortiGate. Option B is wrong because the question states that split tunneling is enabled on the SSL VPN portal; if it were disabled, the behavior would be expected, but the scenario explicitly says it is enabled. Option D is wrong because installing a root certificate is used for certificate-based authentication or to trust the FortiGate's certificate, not to alter routing decisions for VPN traffic.

Full explanation →

119

MCQeasy

What is the purpose of configuring a loopback interface on a FortiGate?

A.To create a logical interface that remains up regardless of physical link status

B.To provide a virtual IP address for NAT

C.To connect to a VLAN

D.To aggregate multiple physical interfaces for increased bandwidth

AnswerA

A loopback interface is a virtual interface that is always administratively up once created, independent of any physical link state. This guarantees a stable IP address for management access, routing protocol peering (e.g., OSPF, BGP), and device identification, even if all physical interfaces fail. Only a manual shutdown or system-wide outage can bring it down.

Why this answer

A loopback interface is a logical interface that is not tied to any physical port, so it remains operational (up/up) as long as the FortiGate itself is running. This makes it ideal for management access, BGP peering, and other services that require a stable IP address independent of physical link failures.

Exam trap

The trap here is that candidates confuse a loopback interface with a virtual IP (VIP) for NAT or with a VLAN sub-interface, because both are 'virtual' constructs, but they serve entirely different purposes in the FortiGate architecture.

How to eliminate wrong answers

Option B is wrong because a loopback interface is not used for NAT; virtual IPs (VIPs) or IP pools are used for NAT purposes. Option C is wrong because VLANs are created as sub-interfaces on physical or aggregate interfaces, not on a loopback interface. Option D is wrong because aggregating multiple physical interfaces for increased bandwidth is achieved via Link Aggregation (LAG) or 802.3ad, not a loopback interface.

Full explanation →

120

MCQhard

You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is an ICMP session with state 01 and expires in 1 second.

B.The session is a UDP session to port 443 and has been active for 3600 seconds.

C.The session is a TCP session to port 443 that has been active for 3600 seconds and will expire in 3599 seconds.

D.The session is a TCP session that has timed out and will be removed in 3599 seconds.

AnswerC

Why this answer

The output shows 'proto=6', which is the protocol number for TCP, and 'dport=443' indicates the destination port is HTTPS. The 'duration=3600' means the session has been active for 3600 seconds, and 'expire=3599' means it will expire in 3599 seconds. The 'proto_state=01' is a TCP state code, confirming this is a TCP session.

Exam trap

The trap here is that candidates often confuse protocol numbers (e.g., thinking '6' is UDP or ICMP) or misinterpret 'expire' as the time since expiration rather than the remaining time until expiration.

How to eliminate wrong answers

Option A is wrong because 'proto=6' is TCP, not ICMP (which uses protocol number 1), and 'dport=443' specifies a port, which is not applicable to ICMP. Option B is wrong because 'proto=6' is TCP, not UDP (which uses protocol number 17), and the session is to port 443, not from it. Option D is wrong because the session has not timed out; 'expire=3599' indicates it is still active and will expire in 3599 seconds, not that it has already timed out.

Full explanation →

121

MCQmedium

An admin wants to monitor CPU and memory usage on a FortiGate using SNMP. Which configuration is required?

A.Configure a performance SLA monitor

B.Enable SNMP agent and configure an SNMP community

C.Enable SNMP on the interface and set administrative access to SNMP

D.Configure an SNMP v3 user and enable SNMP traps

AnswerB

Enabling SNMP agent and a community allows SNMP managers to poll OIDs for CPU/memory.

Why this answer

To monitor CPU and memory usage via SNMP, the FortiGate must first have the SNMP agent enabled and an SNMP community configured. The community string acts as a password for SNMPv1/v2c queries, allowing an NMS to poll the device for OIDs like CPU usage (1.3.6.1.4.1.12356.101.4.1.1) and memory usage (1.3.6.1.4.1.12356.101.4.1.4). Without enabling the agent and defining a community, the FortiGate will not respond to SNMP GET requests.

Exam trap

The trap here is that candidates confuse enabling SNMP on an interface (administrative access) with enabling the SNMP agent itself, leading them to select option C, which only allows SNMP traffic to reach the FortiGate but does not activate the SNMP service or community required for polling.

How to eliminate wrong answers

Option A is wrong because a performance SLA monitor is used for link health checks and failover decisions (e.g., SD-WAN), not for exposing CPU/memory metrics via SNMP. Option C is wrong because enabling SNMP on an interface and setting administrative access to SNMP only allows SNMP traffic to reach the FortiGate through that interface; it does not enable the SNMP agent itself or define a community for authentication. Option D is wrong because configuring an SNMP v3 user and enabling traps is for sending unsolicited notifications (traps) to an NMS, not for responding to polled queries for CPU and memory usage; polling requires the SNMP agent and community (or user for v3) to be active.

Full explanation →

122

MCQeasy

A company uses Fortinet Single Sign-On (FSSO) to authenticate users for firewall policies. The FSSO collector agent is installed on a Windows server and configured with Active Directory polling. What does the collector agent do?

A.It acts as a RADIUS proxy between FortiGate and AD

B.It monitors AD logon events and sends user-IP mappings to the FortiGate

C.It polls the FortiGate for user information

D.It directly authenticates users to the FortiGate

AnswerB

This is the core function of the FSSO collector agent.

Why this answer

The FSSO collector agent polls Active Directory for security event logs to detect user logon events. It then maps the logged-on user to their IP address and sends this user-IP mapping to the FortiGate via the FSSO protocol (port 8000). This allows the FortiGate to enforce firewall policies based on user identity without requiring the user to authenticate directly to the FortiGate.

Exam trap

The trap here is that candidates often confuse the collector agent's role with that of a RADIUS server or a direct authentication proxy, but FSSO is purely a passive monitoring mechanism that does not perform authentication itself.

How to eliminate wrong answers

Option A is wrong because the FSSO collector agent does not act as a RADIUS proxy; RADIUS-based authentication is handled by a separate FortiAuthenticator or RADIUS server, not by the collector agent. Option C is wrong because the collector agent does not poll the FortiGate for user information; instead, it pushes user-IP mappings to the FortiGate. Option D is wrong because the collector agent does not directly authenticate users to the FortiGate; it only monitors existing AD logon events and relays the mapping information.

Full explanation →

123

Multi-Selectmedium

An administrator is configuring a FortiGate to use FortiManager for centralized management. Which three steps are required?

Select 3 answers

A.Enable VDOMs on the FortiGate.

B.Authorize the FortiGate in the FortiManager GUI.

C.Register the FortiGate to the FortiManager using the registration code.

D.Create a local admin account on the FortiGate for FortiManager to use.

E.Ensure network connectivity between FortiGate and FortiManager on TCP port 541.

AnswersB, C, E

Authorization is needed to accept management.

Why this answer

After the FortiGate is discovered by FortiManager (via FGFM protocol), the administrator must explicitly authorize the device in the FortiManager GUI under 'Device Manager > Unregistered Devices'. This step is mandatory to establish a trusted management relationship; without authorization, the FortiGate remains in an unmanaged state and cannot receive configuration or policy updates.

Exam trap

The trap here is that candidates often confuse 'registration' (step C) with 'authorization' (step B), thinking one step suffices, when in fact both are required sequentially, and they may also incorrectly assume a local admin account (step D) is needed for authentication.

Full explanation →

124

Multi-Selectmedium

An administrator wants to implement ZTNA (Zero Trust Network Access) on a FortiGate to secure access to an internal application. Which TWO components are essential for a ZTNA configuration?

Select 2 answers

A.A firewall policy using IPsec VPN

B.A FortiGate in transparent mode

C.A policy-based IPsec tunnel

D.A proxy-based firewall policy

E.A ZTNA rule that verifies endpoint identity and posture

AnswersD, E

ZTNA uses proxy-based inspection to apply access rules.

Why this answer

ZTNA on FortiGate requires a proxy-based firewall policy to intercept and inspect application-layer traffic. This policy type enables the FortiGate to act as a reverse proxy, terminating TLS connections and enforcing access control based on user identity and device posture before forwarding traffic to the internal application.

Exam trap

The trap here is confusing ZTNA's proxy-based architecture with VPN-based access, leading candidates to incorrectly select IPsec or policy-based tunnel options, when ZTNA actually requires a proxy firewall policy and a separate ZTNA rule for endpoint verification.

Full explanation →

125

MCQmedium

An administrator wants to block users from uploading sensitive documents through webmail. Which security profile should be configured on the FortiGate to achieve this goal?

A.Data Leak Prevention (DLP)

B.Antivirus

C.Application control

D.Web filter

AnswerA

DLP (Data Leak Prevention) profiles in FortiOS inspect traffic content, not just metadata. It can match file content against predefined or custom sensitive data patterns (e.g., credit card numbers or confidential labels like 'INTERNAL ONLY') using full-content scanning. When a match occurs, the firewall can block the upload, log it, and optionally send a notification. Unlike antivirus or web filter, DLP operates at the content-inspection layer of the proxy and can be applied to HTTP/HTTPS, FTP, and email protocols, making it the appropriate choice for preventing sensitive-data exfiltration via uploads.

Why this answer

Data Leak Prevention (DLP) is the correct security profile because it is specifically designed to inspect content (e.g., file names, patterns, or keywords) in traffic such as webmail uploads and block sensitive data from leaving the network. DLP sensors can be configured with rules to match patterns like credit card numbers, social security numbers, or custom keywords, and then take action such as blocking or logging the session.

Exam trap

The trap here is that candidates may confuse the function of DLP with web filtering or application control, thinking that blocking the webmail application entirely is equivalent to preventing data leaks, when in fact DLP is the only profile that inspects the actual content being transmitted.

How to eliminate wrong answers

Option B (Antivirus) is wrong because it focuses on detecting and blocking malware based on signatures, not on inspecting content for sensitive data patterns. Option C (Application control) is wrong because it identifies and controls applications (e.g., blocking webmail entirely) but does not inspect the actual data payload for sensitive content. Option D (Web filter) is wrong because it controls access to websites based on categories or URLs, not the content within uploaded files or messages.

Full explanation →

126

MCQeasy

What is the order of evaluation for firewall policies on a FortiGate?

A.Random order

B.From bottom to top

C.From top to bottom, first match

D.By policy ID in ascending order

AnswerC

Correct.

Why this answer

FortiGate firewall policies are evaluated sequentially from the top of the policy list downward. The first policy that matches the traffic's source, destination, service, and schedule is applied, and no further policies are checked. This top-down, first-match behavior ensures deterministic traffic handling and is fundamental to FortiGate's policy-based architecture.

Exam trap

The trap here is that candidates often confuse policy ID with evaluation order, assuming policies are processed by ascending ID, but FortiGate evaluates based on the visual list order, which can be manually rearranged independently of the ID numbers.

How to eliminate wrong answers

Option A is wrong because FortiGate does not evaluate policies in random order; it uses a deterministic sequential evaluation from top to bottom. Option B is wrong because policies are evaluated from top to bottom, not bottom to top; a bottom-to-top order would reverse the intended priority and is not how FortiGate processes policies. Option D is wrong because while policy IDs are assigned sequentially, evaluation order is determined by the policy's position in the list (which can be rearranged), not by the numeric ID; reordering policies changes evaluation order independently of their IDs.

Full explanation →

127

MCQeasy

Which of the following best describes the purpose of a captive portal on a FortiGate?

A.To provide secure remote access to internal resources

B.To authenticate users before granting network access

C.To encrypt traffic between sites

D.To block malware from entering the network

AnswerB

Captive portal intercepts HTTP traffic and redirects to a login page.

Why this answer

A captive portal on a FortiGate intercepts HTTP/HTTPS traffic from unauthenticated users and redirects them to a web-based login page. Once the user provides valid credentials (e.g., via local database, LDAP, or RADIUS), the FortiGate creates an authenticated session, allowing network access. This is a core mechanism for guest Wi-Fi or BYOD onboarding, not for remote access or encryption.

Exam trap

The trap here is that candidates confuse captive portal with SSL VPN or IPsec VPN, thinking it provides remote access or encryption, when in fact it only performs local network access authentication and does not create a secure tunnel.

How to eliminate wrong answers

Option A is wrong because secure remote access to internal resources is provided by IPsec VPN or SSL VPN (e.g., FortiClient), not by a captive portal which only authenticates users at the network edge. Option C is wrong because encrypting traffic between sites is the function of IPsec VPN tunnels or ADVPN, not a captive portal which does not perform any encryption. Option D is wrong because blocking malware is handled by FortiGate's antivirus, IPS, and web filtering engines, not by a captive portal which focuses solely on user authentication before granting network access.

Full explanation →

128

MCQhard

An administrator configures a FortiGate in transparent mode to be deployed between a router and a switch. After installation, traffic passes through but the administrator cannot access the FortiGate's management IP from the management network. What is the MOST likely reason?

A.The management IP is not in the same subnet as the management network.

B.Transparent mode does not support management access; only NAT/Route mode does.

C.The FortiGate's firewall policy blocks management traffic even in transparent mode.

D.The administrator must configure a management VLAN interface to access the FortiGate.

AnswerA

In transparent mode, the FortiGate operates as a layer 2 bridge and uses a dedicated management IP for administrative access. This management IP must belong to the same subnet as the directly connected management network, because the FortiGate resolves the management destination via ARP and does not route management traffic without a routed interface. If the management IP is in a different subnet, the FortiGate cannot respond to ARP requests or forward management packets, making it unreachable. Therefore, the administrator's incorrect subnet selection prevents any management connection.

Why this answer

In transparent mode, the FortiGate acts as a Layer 2 bridge, and its management IP must belong to the same subnet as the management network to be reachable. If the management IP is on a different subnet, the FortiGate will not respond to management traffic because it does not route between subnets in transparent mode; it only forwards traffic at Layer 2.

Exam trap

The trap here is that candidates often assume transparent mode disables all management access or requires special VLANs, when the real issue is simply a subnet mismatch between the management IP and the management network.

How to eliminate wrong answers

Option B is wrong because transparent mode fully supports management access via a dedicated management IP, just like NAT/Route mode, though the IP is used for management only and not for routing. Option C is wrong because by default in transparent mode, there is no firewall policy blocking management traffic; management access is controlled by administrative access settings (e.g., HTTPS, SSH) on the management interface, not by firewall policies. Option D is wrong because a management VLAN interface is not required; the administrator can assign a management IP directly to the FortiGate's management interface (e.g., the internal interface) as long as it is on the same subnet as the management network.

Full explanation →

129

MCQmedium

A company uses FSSO (Fortinet Single Sign-On) with a domain controller. Users authenticate to the domain, and the FortiGate retrieves the login events. The firewall policy uses the FSSO group. Some users report that after logging in, they cannot access resources that require authentication. The administrator checks the FSSO status and sees that the FortiGate is receiving login events. What is the most likely cause?

A.The user is not a member of the FSSO group

B.The FSSO collector agent is not running

C.The user's IP address is not in the source address range of the policy

D.The FortiGate is not polling the domain controller

AnswerC

FSSO authenticates the user, but the policy's source address must match the user's IP.

Why this answer

Even though the FortiGate is receiving FSSO login events, the firewall policy also includes a source address restriction. If the user's IP address falls outside the defined source address range, the policy will not match, and the user will be denied access despite being authenticated via FSSO. The FSSO group membership is only one condition; the source IP must also satisfy the policy's source address criteria.

Exam trap

The trap here is that candidates assume receiving FSSO login events guarantees policy match, ignoring that the source address condition in the firewall policy is a separate, independent requirement that must also be satisfied.

How to eliminate wrong answers

Option A is wrong because if the user were not a member of the FSSO group, the FortiGate would not show the user as authenticated, and the administrator would not see the user's login events in the FSSO status. Option B is wrong because the FSSO collector agent is confirmed to be running since the FortiGate is receiving login events; a stopped collector agent would prevent event reception. Option D is wrong because the FortiGate is already receiving login events, which proves it is successfully polling or receiving data from the domain controller; if polling were failing, no events would appear.

Full explanation →

130

Multi-Selecthard

A FortiGate administrator is configuring a policy-based routing (PBR) rule to send all traffic from the 'Engineering' VLAN (10.1.0.0/16) to a dedicated internet link through gateway 203.0.113.1. The administrator also wants to apply a traffic shaper to limit bandwidth. Which THREE configuration tasks must be performed?

Select 3 answers

A.Define a traffic shaper object with the desired bandwidth limits

B.Enable SD-WAN on the FortiGate

C.Configure Central NAT to translate the source IP

D.Create a policy-based route with source 10.1.0.0/16 and gateway 203.0.113.1

E.Create a firewall policy allowing traffic from Engineering VLAN to internet and apply the traffic shaper

AnswersA, D, E

The shaper must exist before it can be applied in a firewall policy.

Why this answer

A traffic shaper object must first be defined with the desired bandwidth limits (e.g., maximum rate, burst size) before it can be applied to a firewall policy. Without this object, the shaper cannot be referenced or enforced.

Exam trap

The trap here is that candidates often think SD-WAN is required for PBR or that Central NAT is mandatory, when in fact PBR and traffic shaping are independent features that can be configured without SD-WAN or Central NAT.

Full explanation →

131

MCQmedium

An administrator configures a policy route to direct traffic from subnet 10.1.1.0/24 to the internet via ISP1 with a gateway of 203.0.113.1. However, traffic from that subnet is still using the default route via ISP2. What is the MOST likely cause?

A.The source interface is not specified in the policy route

B.The default route has a lower administrative distance

C.The policy route's destination is set to 'all' which conflicts with the default route

D.The policy route is configured after the default route in the routing table

AnswerA

Policy routes require a source interface to match. If not set, the policy route may not apply.

Why this answer

Policy routes in FortiGate are evaluated based on the source interface and source address. If the source interface is not specified, the policy route may not match the incoming traffic because the firewall does not know which interface the traffic is arriving on. Without a matching source interface, the policy route is skipped, and the default route (via ISP2) is used instead.

Exam trap

The trap here is that candidates assume policy routes are evaluated after the routing table or that administrative distance affects policy route matching, when in fact policy routes are processed first and require explicit source interface matching.

How to eliminate wrong answers

Option B is wrong because administrative distance is a property of static routes, not policy routes; policy routes are evaluated before the routing table lookup, so a lower administrative distance on the default route does not override a matching policy route. Option C is wrong because setting the destination to 'all' in a policy route means it matches any destination, which does not conflict with the default route; the issue is the missing source interface, not the destination. Option D is wrong because policy routes are not ordered in the routing table; they are evaluated in the order they appear in the policy route list, and the default route is only consulted if no policy route matches.

Full explanation →

132

MCQhard

A company with 500 employees uses FortiGate as their internet gateway. They recently enabled SSL deep inspection using the built-in CA certificate. After deployment, many users report that they cannot access their online banking websites. The error message in the browser says 'The certificate is not trusted'. The administrator has already pushed the FortiGate CA certificate to all domain-joined computers via Group Policy. However, the problem persists for banking sites. The administrator also notices that banking sites load fine on mobile devices that do not have the CA certificate installed. What is the most likely cause and solution?

A.Disable SSL inspection entirely to avoid certificate issues.

B.The CA certificate is not properly installed on all computers. Re-deploy via Group Policy.

C.Use certificate inspection instead of deep inspection for all traffic.

D.Banking websites use certificate pinning. Exempt them from deep inspection using an SSL inspection exemption list.

AnswerD

Banking platforms frequently implement certificate pinning by hard-coding the expected public key or certificate fingerprint in the client or browser. When FortiGate performs deep inspection, it replaces the original server certificate with its own re-signed copy, causing the pin validation to fail and the connection to be blocked. The recommended fix is to add these banking domains to the SSL exemption list so the FortiGate passes the original certificate untouched, preserving deep inspection for all other domains.

Why this answer

Banking websites often use HTTP Public Key Pinning (HPKP) or certificate pinning, where the browser expects a specific certificate or public key from the server. When FortiGate performs SSL deep inspection, it re-signs the server's certificate with its own CA, breaking the pinning validation. This causes the 'certificate not trusted' error even when the FortiGate CA is trusted, because the browser detects that the presented certificate does not match the pinned certificate.

The correct solution is to exempt banking sites from deep inspection using an SSL inspection exemption list, allowing the original server certificate to pass through.

Exam trap

The trap here is that candidates assume the issue is always a missing CA certificate deployment, but the real problem is certificate pinning, which causes trust failures even when the CA is trusted, because the browser checks the pinned certificate hash against the presented certificate.

How to eliminate wrong answers

Option A is wrong because disabling SSL inspection entirely would remove security visibility for all HTTPS traffic, which is an overreaction and not necessary; the issue is specific to pinned certificates. Option B is wrong because the problem persists despite the CA certificate being properly deployed via Group Policy, and the error is not due to missing CA trust but due to certificate pinning validation failure. Option C is wrong because certificate inspection (which only inspects the certificate metadata, not the content) would still present the original server certificate to the browser, but it does not address the root cause of pinning; however, the question states deep inspection is enabled, and switching to certificate inspection would not resolve the pinning issue because the browser still sees the original certificate, which is actually correct for pinned sites—but the real fix is exemption, not a global change to certificate inspection.

Full explanation →

133

MCQmedium

A FortiGate is configured with two equal-cost static default routes via two ISPs. The administrator wants to use both links simultaneously for outbound traffic, distributing sessions per source-destination pair. Which ECMP load balancing method should be configured under config system settings?

A.weighted-round-robin

B.vip-inbound-grpc

C.spillover

D.source-destination-ip

AnswerD

Correct method to distribute sessions per source-destination IP pair.

Why this answer

The source-destination-ip method under ECMP load balancing distributes sessions based on both source and destination IP addresses, ensuring that all packets belonging to the same session (same source-destination pair) are forwarded via the same path. This meets the requirement of using both links simultaneously for outbound traffic while maintaining per-session consistency.

Exam trap

The trap here is that candidates often confuse ECMP load balancing methods with general load balancing techniques, mistakenly selecting weighted-round-robin because it sounds like a standard load balancing algorithm, but it does not guarantee per-source-destination pair distribution in FortiGate's ECMP context.

How to eliminate wrong answers

Option A (weighted-round-robin) is wrong because it distributes sessions in a round-robin fashion based on weights, not per source-destination pair, which can cause session asymmetry. Option B (vip-inbound-grpc) is wrong because it is not an ECMP load balancing method; it relates to gRPC-based VIP configuration for inbound traffic. Option C (spillover) is wrong because it forwards traffic to a secondary link only when the primary link's bandwidth threshold is exceeded, not for simultaneous use of both links.

Full explanation →

134

Multi-Selectmedium

An admin is troubleshooting why traffic from a specific host (10.0.1.10) to a web server (203.0.113.50:80) is being denied. The FortiGate has several policies. Which TWO CLI commands should the admin use to identify which policy is matching the traffic? (Choose two.)

Select 2 answers

A.execute ping 203.0.113.50

B.diagnose firewall iprope lookup 10.0.1.10 -> 203.0.113.50 80

C.diagnose debug flow

D.diagnose firewall policy list

E.get firewall policy

AnswersB, D

Simulates the policy lookup for a specific flow, showing which policy matches.

Why this answer

B is correct because 'diagnose firewall iprope lookup' is the exact CLI command that performs a simulated policy lookup for a given source IP, destination IP, and port, showing which firewall policy matches the traffic. This allows the admin to verify the policy match without generating real traffic.

Exam trap

The trap here is that candidates often confuse 'diagnose debug flow' (a real-time debugging tool) with 'diagnose firewall iprope lookup' (a static policy lookup tool), or they mistakenly think 'get firewall policy' can identify the matching policy without specifying traffic parameters.

Full explanation →

135

MCQmedium

An admin configures a firewall policy to allow SMTP traffic from a mail server to the internet with NAT enabled. External recipients report that the email source IP is the FortiGate's external interface IP. The admin wants the source to be a specific IP from a pool. What should the admin configure?

A.Create a central SNAT policy with the source as the mail server and the translated IP as the desired address

B.Use a VIP with port forwarding to translate the source

C.In the firewall policy, enable NAT and specify the IP pool as a fixed port range or overload

D.Enable NAT on the policy and set the IP pool configuration to use a dynamic IP pool

AnswerC

In the firewall policy, enabling NAT and referencing an IP pool is the proper method for policy-based source NAT. An IP pool configured as overload (PAT) allows multiple internal sessions to share a single translated IP, while a fixed port range pool also uses a single IP but constrains the source port range; both can satisfy the requirement for a single public address for the mail server. This is exactly what the admin needs for SMTP traffic, ensuring all outbound mail appears from the same IP. Thus it is the correct choice.

Why this answer

The admin wants the source IP of outbound SMTP traffic to be a specific IP from a pool rather than the FortiGate's external interface IP. In a firewall policy with NAT enabled, you can specify an IP pool to override the default source NAT behavior. The IP pool can be configured as Fixed Port Range or Overload (PAT) to translate the mail server's source IP to a desired address from the pool, ensuring external recipients see that specific IP.

Exam trap

The trap here is that candidates often confuse IP pools with VIPs or central SNAT, mistakenly thinking VIPs can modify source IPs or that central SNAT is required, when in fact the IP pool directly attached to the firewall policy is the correct and simplest solution for overriding the source NAT address.

How to eliminate wrong answers

Option A is wrong because a central SNAT policy is used for source NAT but does not allow specifying an IP pool directly within a firewall policy; it requires separate configuration and is not the standard method for overriding the translated IP in a policy-based NAT scenario. Option B is wrong because a Virtual IP (VIP) is used for destination NAT (port forwarding), not source NAT; it translates incoming traffic to an internal server, not outbound source IPs. Option D is wrong because a dynamic IP pool is used for load-balancing or rotating source IPs, not for pinning the source to a specific IP from a pool; the admin needs a fixed translation, which requires Fixed Port Range or Overload mode.

Full explanation →

136

MCQhard

An administrator has configured an IPS sensor to block critical-severity attacks. However, after a week, they notice that a known exploit (CVE-2021-44228) is still getting through. Which configuration change should be made to improve detection?

A.Set the IPS sensor severity filter to 'low' and above.

B.Change the IPS sensor action from 'default' to 'block' for all signatures.

C.Create a custom IPS signature for the exploit.

D.Enable the specific IPS signature for the exploit in the sensor.

AnswerD

The signature may be present but disabled; enabling it allows detection.

Why this answer

The IPS sensor must have the specific signature for CVE-2021-44228 (Log4Shell) enabled to detect and block it. Even if the sensor is set to block critical-severity attacks, the signature for this exploit may be disabled by default in the sensor's signature database. Enabling the specific signature ensures the sensor inspects traffic for the exploit's unique patterns and applies the configured action.

Exam trap

The trap here is that candidates assume setting the severity filter to 'critical' or changing the action to 'block' globally will catch all critical exploits, but they forget that individual signatures must be explicitly enabled in the sensor to be evaluated.

How to eliminate wrong answers

Option A is wrong because lowering the severity filter to 'low' and above would cause the sensor to process more signatures, but it does not enable a disabled signature; the exploit's signature may still be disabled regardless of severity. Option B is wrong because changing the action from 'default' to 'block' for all signatures would override per-signature actions and could cause false positives or performance issues, but it still does not enable a disabled signature. Option C is wrong because creating a custom IPS signature is unnecessary when the vendor (Fortinet) already provides a signature for CVE-2021-44228; the issue is that the signature is disabled, not missing.

Full explanation →

137

Multi-Selectmedium

A FortiGate administrator is troubleshooting why traffic from a specific internal host is not being allowed through a firewall policy. The policy appears correct and is enabled. Which TWO diagnostic commands could the administrator use to determine if the traffic is matching a different policy?

Select 2 answers

A.get system performance status

B.config system ha

C.execute ping options

D.diagnose firewall iprope list

E.diagnose debug flow

AnswersD, E

This shows hit counts for each policy, indicating which policies are being matched.

Why this answer

The 'diagnose firewall iprope list' command (D) displays the kernel's internal firewall rule list, allowing the administrator to verify the exact order and matching criteria of all policies. The 'diagnose debug flow' command (E) enables real-time packet flow tracing, showing which policy each packet matches and why it is accepted or denied. Together, these two commands directly reveal if traffic is matching a different policy than intended.

Exam trap

The trap here is that candidates often rely on 'get system performance status' or 'execute ping' to troubleshoot policy matching, but these commands do not reveal which policy ID the traffic is matching or the order of evaluation.

Full explanation →

138

MCQmedium

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

A.The web server's certificate is self-signed and FortiGate is rejecting the connection

B.The antivirus profile is configured for flow-based inspection instead of proxy-based

C.SSL/TLS deep inspection is not enabled on the firewall policy

D.The FortiGuard antivirus subscription has expired

AnswerC

HTTPS traffic is encrypted. FortiGate cannot inspect the payload without SSL deep inspection decrypting the TLS session. The antivirus profile requires inspection mode to be enabled.

Why this answer

HTTPS traffic is encrypted with SSL/TLS, so an antivirus profile cannot inspect the payload unless the firewall can decrypt the traffic. Even with antivirus enabled in the policy, without SSL/TLS deep inspection (also called SSL inspection or HTTPS decryption), FortiGate only sees encrypted packets and cannot scan for malware. Therefore, the most likely reason is that SSL/TLS deep inspection is not enabled on the firewall policy.

Exam trap

The trap here is that candidates often assume antivirus profiles automatically inspect all traffic, forgetting that encrypted HTTPS requires explicit SSL/TLS decryption before any content inspection can occur.

How to eliminate wrong answers

Option A is wrong because a self-signed certificate does not cause FortiGate to reject the connection by default; it may generate a warning or require an SSL inspection policy to handle untrusted certificates, but the traffic would still be forwarded (and remain unscanned) unless a specific action is configured. Option B is wrong because both flow-based and proxy-based inspection modes support antivirus scanning; the inspection mode affects performance and some features but does not prevent scanning of HTTPS traffic if decryption is configured. Option D is wrong because an expired FortiGuard antivirus subscription would prevent signature updates and might disable real-time scanning, but the traffic would still be inspected (with potentially outdated signatures) unless the license is completely expired and the feature is blocked; the question states antivirus is enabled, so the subscription expiry is not the most likely reason for no scanning at all.

Full explanation →

139

Multi-Selectmedium

A company requires two-factor authentication for SSL VPN access. They already have an LDAP server for user credentials. Which TWO components are necessary to implement this?

Select 2 answers

A.FortiAuthenticator

B.FortiToken hardware or mobile tokens

C.RADIUS server

D.Certificate Authority (CA)

E.LDAP server

AnswersB, E

FortiToken provides the one-time password (OTP) required for two-factor authentication.

Why this answer

FortiToken hardware or mobile tokens provide the second factor (something you have) required for two-factor authentication. The LDAP server supplies the first factor (something you know) via user credentials. Together, they satisfy the two-factor requirement for SSL VPN access on FortiGate.

Exam trap

The trap here is that candidates often assume a RADIUS server or FortiAuthenticator is mandatory for two-factor authentication, but FortiGate can directly integrate LDAP with FortiToken without intermediate servers.

Full explanation →

140

MCQmedium

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. Phase 1 is up, but Phase 2 fails to establish. The debug command 'diagnose vpn ike log' shows: 'no suitable proposal found'. What is the most likely cause?

A.Phase 2 encryption or authentication algorithms do not match on both sides.

B.The firewall policy allowing IPsec traffic is missing.

C.The remote gateway IP address is unreachable.

D.The pre-shared key is incorrect.

AnswerA

Phase 2 (Quick Mode) negotiates the IPsec SA parameters, including the encryption algorithm (e.g., AES-256, 3DES) and authentication algorithm (e.g., SHA-1, SHA-256) for the ESP/AH protocol. If the local and remote firewalls do not offer a common proposal for these algorithms and the Diffie-Hellman group, the Phase 2 negotiation will fail with an error such as 'no proposal chosen.' Since Phase 1 has already formed a secure IKE SA, the problem isolates specifically to a Phase 2 proposal mismatch, preventing the tunnel from establishing even though both gateways are reachable and authenticated.

Why this answer

The 'no suitable proposal found' error in Phase 2 of an IPsec VPN tunnel indicates that the Phase 2 parameters (encryption algorithm, authentication algorithm, or PFS settings) do not match between the two FortiGate peers. Since Phase 1 is up, the IKE SA is established, meaning pre-shared keys, remote gateway reachability, and basic firewall policies for IKE traffic are correct. The mismatch specifically occurs in the Phase 2 proposal negotiation, where each side sends its supported transforms and the responder cannot find a common set.

Exam trap

The trap here is that candidates often confuse Phase 1 and Phase 2 proposal errors, assuming any 'no suitable proposal found' message relates to Phase 1, but the context of Phase 1 being up explicitly isolates the issue to Phase 2 parameter mismatch.

How to eliminate wrong answers

Option B is wrong because a missing firewall policy for IPsec traffic would prevent Phase 1 from establishing, as IKE packets (UDP 500/4500) would be dropped; Phase 1 being up confirms the firewall policy is in place. Option C is wrong because if the remote gateway IP address were unreachable, Phase 1 would fail to initiate or complete, as IKE negotiation requires bidirectional reachability. Option D is wrong because an incorrect pre-shared key would cause Phase 1 authentication to fail, resulting in a 'no suitable proposal found' error at Phase 1, not Phase 2; Phase 1 being up confirms the pre-shared key is correct.

Full explanation →

141

MCQhard

An admin configures a policy-based NAT rule (central SNAT) to translate source IPs from 10.0.0.0/24 to a dynamic IP pool of 203.0.113.1-203.0.113.10 with overload enabled. Users report that some connections are dropped. What is the MOST likely cause?

A.The port range for each IP in the pool is exhausted

B.The firewall policy has 'set nat enable' disabled

C.The route to the internet is missing

D.The pool does not have enough IPs to cover all users

AnswerA

Each IP has a limited number of ports (around 64,000). Under heavy traffic, ports can be exhausted, causing connection drops.

Why this answer

With overload enabled (Port Address Translation), the firewall translates multiple internal IPs to a single public IP by using unique source ports. Each public IP can handle up to 65,535 ports, but the actual usable port range is often smaller due to reserved ports and system limits. When all ports on all IPs in the pool are consumed, new connections are dropped because no port can be allocated for the translation.

Exam trap

The trap here is that candidates assume the pool must have enough IPs for each user, but overload (PAT) allows many users to share a single IP, so the real bottleneck is port exhaustion, not IP count.

How to eliminate wrong answers

Option B is wrong because 'set nat enable' is a legacy setting for policy-based NAT; central SNAT rules do not require this option to be enabled on the firewall policy. Option C is wrong because a missing internet route would cause all outbound traffic to fail, not just some connections being dropped. Option D is wrong because dynamic IP pools with overload do not require one IP per user; the issue is port exhaustion, not a lack of IP addresses.

Full explanation →

142

MCQeasy

An administrator needs to configure a FortiGate to allow remote management via HTTPS from the internet. Which configuration step is required?

A.Create a firewall policy from WAN to LAN with HTTPS service and set action to ACCEPT.

B.Enable SSH access on the WAN interface instead of HTTPS.

C.Enable HTTPS access on the WAN interface and create a firewall policy allowing inbound HTTPS from any to the FortiGate's IP.

D.Configure a port forwarding rule to redirect HTTPS from WAN to the internal management IP.

AnswerC

This allows HTTPS management from the internet by enabling the service on the interface and permitting traffic.

Why this answer

Remote HTTPS management of a FortiGate from the internet requires two steps: enabling HTTPS access on the WAN interface (under config system interface) and creating a firewall policy that allows inbound HTTPS traffic (TCP/443) from any source to the FortiGate's own IP address. Without the explicit policy, the traffic is dropped by the implicit deny rule, even if the interface is configured to listen for HTTPS.

Exam trap

The trap here is that candidates assume enabling HTTPS on the interface alone is sufficient, forgetting that FortiGate still requires an explicit firewall policy to permit inbound traffic to its own IP, as the implicit deny rule blocks all traffic not matched by a policy.

How to eliminate wrong answers

Option A is wrong because a firewall policy from WAN to LAN with HTTPS service would forward management traffic to internal LAN hosts, not to the FortiGate itself, and does not enable the WAN interface to accept HTTPS connections. Option B is wrong because enabling SSH instead of HTTPS does not satisfy the requirement to allow remote management via HTTPS; SSH and HTTPS are separate protocols with different purposes. Option D is wrong because port forwarding is used to redirect traffic to internal servers behind the FortiGate, not to the FortiGate's own management interface; the FortiGate's management IP is directly reachable on the WAN interface when HTTPS access is enabled and a policy is in place.

Full explanation →

143

MCQmedium

A network admin configures an IPsec VPN between two FortiGates using IKEv2. Phase 1 completes successfully, but Phase 2 fails to establish. The admin runs 'diagnose vpn ike log' and sees the error 'proposal mismatch'. What is the most likely cause?

A.The IKE version is not compatible

B.The Phase 2 selectors (local and remote subnets) are misconfigured

C.The Phase 2 encryption and authentication algorithms do not match

D.The pre-shared keys do not match

AnswerC

The correct interpretation of the 'proposal mismatch' error is that the Phase 2 encryption and authentication algorithms, or other transform parameters like the PFS Diffie-Hellman group, differ between the two FortiGates. During IKE Phase 2, the initiator sends a list of SA proposals containing encryption algorithms (e.g., AES128/256), integrity algorithms (e.g., SHA1/256), and optionally DH groups for PFS. If none of the responder's configured Phase 2 proposals match any of the initiator's proposals, the responder sends the 'no proposal chosen' or 'proposal mismatch' notification. To resolve this, the Phase 2 transform sets (encryption, authentication, and PFS) must be aligned on both endpoints.

Why this answer

The error 'proposal mismatch' in the 'diagnose vpn ike log' output specifically indicates that the Phase 2 parameters (encryption, authentication, or DH group) do not match between the two FortiGate peers. Since Phase 1 completed successfully, the IKE version (IKEv2) and pre-shared keys are already validated, leaving only the Phase 2 proposal as the cause. Option C correctly identifies that the encryption and authentication algorithms are mismatched, which is the most common reason for this error.

Exam trap

The trap here is that candidates often confuse 'proposal mismatch' with Phase 1 issues or selector mismatches, but the error is specific to cryptographic algorithm negotiation in Phase 2, not to network-layer subnet definitions or authentication credentials.

How to eliminate wrong answers

Option A is wrong because Phase 1 completed successfully, which confirms that both peers are using a compatible IKE version (IKEv2 in this scenario). Option B is wrong because a 'proposal mismatch' error is related to cryptographic parameters, not to the local/remote subnet selectors; a misconfiguration of selectors would typically result in a 'no matching selector' or 'traffic selector mismatch' error, not 'proposal mismatch'. Option D is wrong because pre-shared keys are negotiated during Phase 1 authentication; since Phase 1 succeeded, the PSKs must match, so a PSK mismatch would have prevented Phase 1 from completing.

Full explanation →

144

MCQmedium

A network administrator has configured a firewall policy allowing traffic from the internal network (10.0.0.0/8) to the internet. Users report that some websites are not loading. The administrator runs 'diagnose firewall iprope list 100000' and sees the policy listed with a hit count of zero. What is the MOST likely cause?

A.The source interface or destination interface is incorrectly configured

B.The policy has a schedule that does not match the current time

C.The policy is placed below a more specific or broader policy that matches the same traffic

D.The FortiGate has a routing issue preventing traffic from reaching the internet

AnswerC

FortiGate firewall policies are evaluated top-down and the first policy that matches all configured criteria (source, destination, interface, and service) is executed; lower policies are never reached if a higher policy matches the same traffic. This means a broader policy placed above this specific rule—for example, an any-to-any policy—will shadow it, causing this rule's hit count to remain zero. Since FortiGate uses first-match rather than best-match, rule ordering is critical, and moving this rule above the broad policy would restore its visibility and hit count.

Why this answer

A hit count of zero indicates the firewall policy has never matched any traffic. When a more specific or broader policy exists above it in the sequence, the FortiGate processes policies top-down and stops at the first match, so the lower policy never gets evaluated. This is the most likely cause given that the policy is present but unused.

Exam trap

The trap here is that candidates often assume a zero hit count means the policy is not working due to misconfiguration or routing, but the real issue is policy ordering and the top-down match-first behavior of FortiGate firewalls.

How to eliminate wrong answers

Option A is wrong because if the source or destination interface were misconfigured, the traffic would not match any policy at all, but the administrator would likely see hits on other policies or no hits anywhere, not specifically zero on this policy while other policies may have hits. Option B is wrong because a schedule mismatch would prevent the policy from being active, but the policy would still appear in the rule list with a hit count of zero; however, the question states users can reach some websites, implying some traffic is passing, which would not be the case if a schedule were blocking all traffic through this policy. Option D is wrong because a routing issue would prevent traffic from reaching the internet entirely, but users report only some websites are not loading, indicating partial connectivity, and routing issues would affect all internet-bound traffic, not just specific sites.

Full explanation →

145

MCQmedium

What is the primary advantage of using IKEv2 over IKEv1 for IPsec VPN?

A.IKEv2 has built-in support for NAT traversal and MOBIKE

B.IKEv2 supports only main mode

C.IKEv2 requires aggressive mode

D.IKEv2 is only for route-based VPN

AnswerA

IKEv2 includes NAT-T and MOBIKE as standard.

Why this answer

IKEv2 offers built-in NAT traversal (NAT-T) and MOBIKE (RFC 4555) as core features, not optional extensions. This eliminates the need for separate RFC 3947 NAT-T configuration and allows seamless IP address changes during a VPN session, making it far more robust for mobile users and dynamic environments compared to IKEv1.

Exam trap

The trap here is that candidates often confuse IKEv2's single exchange with 'main mode only' or think it requires aggressive mode, when in fact IKEv2 eliminates both modes and uses a more efficient, secure handshake.

How to eliminate wrong answers

Option B is wrong because IKEv2 does not support only main mode; it uses a single, streamlined exchange (two pairs of messages) that replaces both main and aggressive modes from IKEv1. Option C is wrong because IKEv2 does not require aggressive mode; aggressive mode is an IKEv1 concept that IKEv2 eliminates entirely for security reasons. Option D is wrong because IKEv2 is not limited to route-based VPNs; it supports both policy-based and route-based IPsec VPN configurations in FortiOS.

Full explanation →

146

MCQmedium

An administrator needs to allow SSH access to the FortiGate's management interface from a specific management subnet (10.0.1.0/24). Which configuration achieves this?

A.Set the administrative access profile to allow SSH from any IP

B.Configure a firewall policy to allow SSH from 10.0.1.0/24 to the FortiGate

C.Under system admin settings, set the trusted host for the administrator to 10.0.1.0/24 and enable SSH access

D.Create a local-in policy to allow SSH from 10.0.1.0/24

AnswerC

This is the standard and correct method: in the System > Admin > Administrators settings, define a trusted host as 10.0.1.0/24 for that administrator, and ensure SSH is enabled in the administrative access for the interface the admin connects to. Trusted hosts explicitly allowlist the source IP ranges that can initiate management sessions, so only devices from 10.0.1.0/24 can SSH to the FortiGate. Additionally, SSH administrative access must be enabled on the relevant interface for the login to be accepted.

Why this answer

The trusted host setting under system admin settings restricts administrative access (including SSH) to only the specified source IP or subnet. By setting the trusted host to 10.0.1.0/24 and enabling SSH access, the FortiGate ensures that only SSH connections originating from that management subnet can reach the management interface. This is the standard method for controlling administrative access to the FortiGate's management plane.

Exam trap

The trap here is that candidates often confuse firewall policies (which control transit traffic) with administrative access controls (which control traffic destined to the FortiGate itself), leading them to incorrectly select Option B.

How to eliminate wrong answers

Option A is wrong because setting the administrative access profile to allow SSH from any IP would permit SSH connections from all sources, not just the specific management subnet, violating the requirement. Option B is wrong because firewall policies control traffic passing through the FortiGate between interfaces, not traffic destined to the FortiGate itself; administrative access is governed by administrative access settings and trusted hosts, not firewall policies. Option D is wrong because local-in policies are used to filter traffic destined to the FortiGate's own IP addresses, but they are not the primary or recommended method for restricting administrative access; the trusted host setting is the correct and simpler approach for this purpose.

Full explanation →

147

MCQmedium

A FortiGate is operating in transparent mode. The admin needs to allow HTTP traffic from users to a web server. Which type of firewall policy is required?

A.A layer 2 firewall policy

B.A policy-based NAT rule

C.A firewall policy using zone-based security

D.A VIP policy to map the web server's public IP

AnswerA

In transparent mode, the FortiGate acts as a transparent bridge (bump in the wire) and does not route IP traffic, so all traffic control must occur at Layer 2. A layer 2 firewall policy inspects and forwards frames based on MAC addresses, VLANs, and other Layer 2 attributes, making it the only policy type that can effectively filter traffic in this deployment. This policy type is required because there is no Layer 3 routing table or IP-based decision-making in transparent mode.

Why this answer

In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic without routing. To allow HTTP traffic from users to a web server, a Layer 2 firewall policy is required because it filters traffic based on MAC addresses and Layer 2 headers, not IP addresses or routing decisions. This policy type is the only one that works in transparent mode, as it does not involve NAT or routing.

Exam trap

The trap here is that candidates often assume firewall policies always involve IP addresses and routing, but in transparent mode, the FortiGate uses Layer 2 policies that operate at the data link layer, not the network layer.

How to eliminate wrong answers

Option B is wrong because policy-based NAT rules are used in NAT/route mode to translate IP addresses, not in transparent mode where the FortiGate does not perform IP routing or NAT. Option C is wrong because zone-based security policies are applicable in NAT/route mode for grouping interfaces into zones; transparent mode uses Layer 2 policies, not zones. Option D is wrong because VIP policies are used for destination NAT in NAT/route mode to map public IPs to private IPs, which is irrelevant in transparent mode where the FortiGate does not perform IP address translation.

Full explanation →

148

MCQmedium

A network admin receives an alert that the FortiGate disk logs are no longer being written. The admin checks the disk status and sees that the disk is full. However, the admin needs to preserve the logs for compliance purposes. Which action should the admin take to continue logging while preserving the existing logs?

A.Configure log upload to FortiAnalyzer and manually archive current logs, then clear the local disk

B.Increase the log disk quota to allow more logs

C.Delete all logs from the disk and restart logging

D.Compress the existing log files and set a higher compression level for future logs

AnswerA

Uploading existing logs to FortiAnalyzer preserves them off-device, then clearing the local disk frees space for continued logging. This is the proper workflow.

Why this answer

The correct action is to configure log upload to FortiAnalyzer and manually archive the current logs, then clear the local disk. This preserves the logs for compliance by offloading them to an external server, while freeing up disk space to allow new logging to continue. Other options are incorrect: increasing the disk quota does not solve the full issue, deleting logs loses compliance data, and compression alone may not free enough space immediately.

Full explanation →

149

MCQmedium

An administrator configures a policy route to send all traffic from subnet 172.16.1.0/24 to a specific next-hop 10.0.0.2. However, the traffic is still using the default route. What could be the reason?

A.The policy route has a lower priority than the default route.

B.The policy route does not have a destination interface set.

C.The policy route must be configured before the default route.

D.The source subnet is not correctly defined in the policy route.

AnswerA

Why this answer

Policy routes in FortiGate are evaluated based on their priority value, where a lower number indicates higher priority. If the policy route has a higher priority value (e.g., 10) than the default route (which is implicitly 0), the default route will be preferred. The administrator must ensure the policy route's priority is lower than the default route's priority to override it.

Exam trap

The trap here is that candidates often assume policy routes automatically override static routes, but FortiGate uses a priority-based selection where the default route's implicit priority of 0 can supersede a policy route with a higher priority value.

How to eliminate wrong answers

Option B is wrong because a destination interface is not mandatory for a policy route to function; the route can be matched based on source and next-hop alone. Option C is wrong because FortiGate does not require policy routes to be configured before static routes; they are evaluated independently based on priority, not order of configuration. Option D is wrong because if the source subnet were incorrectly defined, the traffic would not match the policy route at all, but the symptom described is that traffic is using the default route, indicating the policy route exists but is not being selected due to priority.

Full explanation →

150

MCQeasy

An admin needs to translate the source IP of traffic from multiple internal hosts to a single public IP when accessing the internet, while keeping track of each session. Which NAT method should be used?

A.Fixed port range NAT

B.One-to-one NAT

C.Central SNAT without overload

D.Overload NAT (Port Address Translation)

AnswerD

Overload NAT, also known as Port Address Translation (PAT), allows many internal hosts to share one public IP by rewriting not only the source IP but also the source port to a unique, dynamically assigned value. The NAT engine maintains a translation table keyed by the public IP and the new source port, so return traffic is correctly forwarded back to the original internal host. This session multiplexing is what makes a single public IP sufficient for the entire internal network, with a theoretical maximum of about 65,536 concurrent sessions per public IP.

Why this answer

Overload NAT, also known as Port Address Translation (PAT), allows multiple internal hosts to share a single public IP address by mapping each session to a unique source port. This is the correct method for translating source IPs from multiple internal hosts to one public IP while maintaining session tracking, as it uses the transport-layer port number to differentiate between concurrent connections.

Exam trap

The trap here is that candidates often confuse 'Central SNAT without overload' with PAT, not realizing that without overload (port translation), the NAT device cannot multiplex multiple internal hosts to a single public IP, leading to session failures.

How to eliminate wrong answers

Option A is wrong because Fixed port range NAT assigns a predefined range of ports to each internal host, which limits the number of concurrent sessions per host and does not efficiently share a single public IP across many hosts. Option B is wrong because One-to-one NAT maps a single internal IP to a single external IP, requiring a public IP for each internal host, which does not conserve public IP addresses. Option C is wrong because Central SNAT without overload translates the source IP without using port multiplexing, meaning it can only handle one session per public IP at a time, causing conflicts when multiple internal hosts try to access the internet simultaneously.

Full explanation →

Fortinet NSE 4 Network Security Professional NSE4 (NSE4) — Questions 76–150