Fortinet NSE 4 Network Security Professional NSE4 (NSE4) — Questions 451–525

This is the correct statement. In FortiOS, the implicit deny is always located at the very end of the policy list, after every user-created policy, and serves as the final catch-all rule. During sequential policy lookup, if no explicit policy matches the traffic parameters, the implicit deny matches all remaining sessions and blocks them by discarding the packets, thereby enforcing a strict default-deny posture.

This is the correct FortiGate CLI command for backing up the configuration to a TFTP server. The command 'execute backup config' specifies the backup operation, 'tftp' selects the protocol, 'mybackup.conf' is the destination filename on the server, and '10.0.0.10' is the server IP. On FortiGate, this initiates a TFTP put from the unit, and it is the exact syntax required to meet the administrator's need.

A stuck process like the IPS engine can enter an infinite loop or deadlock in user space, consuming an entire CPU core even when no traffic is passing through the device. This is a well-known software defect scenario; the process runs continuously, executing instructions without yielding, causing high CPU while traffic counters remain low. Administrators can confirm this with `diag sys top` to identify the process ID, then restart the engine or the FortiGate, and also check for crash logs to identify the underlying bug.

Web Filtering on FortiGate leverages the FortiGuard web filtering database to classify URLs into categories (e.g., social media, malware, phishing) and enforce per-policy allow, block, or warn actions based on those categories or a custom URL list. This directly controls which websites users can access, making it the correct feature for blocking specific sites. It can also be combined with local overrides and wildcard FQDN entries to fine-tune granular access control.

Setting the remote gateway to 'Dialup User' allows the FortiGate to accept connections from any IP address, which is necessary for users with dynamic public IPs. This mode is designed for dial-up VPNs where the remote peer's IP is not known in advance. Without this, the FortiGate would only accept connections from a specific IP.

ZTNA rules are the central policy object in FortiOS that define which users and devices—identified by ZTNA tags—may access a specific protected application, and what action to take. When a client makes an HTTPS request through the ZTNA access proxy, the proxy evaluates matching ZTNA rules to allow or deny the session, making this the correct answer. These rules replace traditional firewall policies for application-level access control, not SSL VPN or IPsec.

Split tunneling is correct because it enables the administrator to define specific destination subnets that are routed through the SSL VPN tunnel, while all other traffic goes directly to the client's local network or Internet. This allows remote users to reach only the intended internal applications without exposing the entire corporate network. Split tunneling is configured via destination-based routing on the FortiGate, making it the precise access-control method for this scenario.

Adding a policy before the central SNAT policy with 'set nat disable' creates a deterministic exception: traffic matching that earlier policy is evaluated and its NAT disabled, so it is never processed by the subsequent central SNAT rule. Due to FortiOS policy ordering, the first match wins, meaning this exempt policy must be placed ahead of the NAT policy. This selectively preserves the original source address/port for those applications while other traffic continues through central SNAT.

To manage a FortiGate via HTTPS on a specific interface, you must explicitly enable HTTPS in the interface's administrative access settings. This is done with `config system interface` and `set allowaccess https` (or `set allowaccess ping https ...`), which tells the control plane to accept HTTPS sessions destined to that interface's IP address. Without this setting, even if the interface has a valid IP and the firewall permits HTTP(S) traffic, the FortiGate will drop management connection attempts.

FortiGuard classifies websites by continuously crawling and categorizing the public internet, but a brand-new domain or newly launched website may not yet have an entry in the FortiGuard rating database. When FortiGate receives a request for such a site, it returns a rating of 'Unrated', and the security policy's handling of the Unrated category determines whether the URL is allowed or blocked. Since no category has been assigned, the site is blocked not because it is malicious or inappropriate, but simply because it has not yet been reviewed — this is the well-known false-positive scenario for newly registered domains.

Fortinet firmware upgrades must follow the documented sequential path because configuration syntax and daemon behaviour change between major releases; jumping directly from 6.0 to 7.0 risks an unsupported conversion. Stepping through 6.2 and 6.4 lets each release migrate the configuration incrementally, satisfying the multi-step upgrade constraint in the stem.

The destination NAT (VIP) is the critical missing element in this scenario. When a client sends a TCP SYN to the web server's public IP, the FortiGate must use a matching VIP to translate that destination to the server's private IP address; without it, the firewall has no next hop or internal server to forward the packet to. As a result, the SYN is dropped or consumed by the firewall itself, the server never receives the request, and the client's session stays in SYN_SENT.

Because a loopback interface has no physical hardware behind it, its link status is always administratively and operationally up as long as the FortiGate unit itself is powered on and running. This is a key advantage over physical interfaces, which may go down due to cable disconnection, switch failure, or negotiated link loss. The persistent up state makes loopback interfaces ideal for dynamic routing protocols and management sources that need a stable endpoint.

Event logs are the correct log type for user authentication events. They record auditable system events, including successful and failed login attempts for administrators, VPN users, and other service accounts, as well as authentication failures and lockouts. Event logs are specifically designed to capture user authentication and accounting information for security auditing.

An SD-WAN rule is the correct, centralized mechanism in FortiOS to steer traffic based on application or service. By creating a rule that matches HTTP and setting WAN1 as the preferred member, you explicitly route that protocol out of WAN1 while optionally maintaining failover to WAN2 if WAN1 goes down. This approach leverages SD-WAN health-check and load-balancing logic, making it the most robust and policy-driven solution.

In policy-based NAT, the translation is an integral part of the firewall policy itself. The administrator enables NAT by setting the `nat` option to `enable` within that specific policy, optionally choosing an IP pool for source translation. This binds the translation rule directly to the policy's matching criteria, providing per-policy granularity, which is the defining characteristic of this approach.

This is correct because selecting 'All Sessions' under 'Log Allowed Traffic' causes the FortiGate to log every session that matches the policy, including the start and end of the session. This provides a complete record of allowed traffic. It is the appropriate setting when the administrator wants to log all traffic for auditing or troubleshooting purposes.

By creating a source-IP exemption list for specific signatures, known-good hosts such as domain controllers or admin workstations are skipped during detection. This reduces false positives without weakening protection for untrusted endpoints, since traffic from other sources still hits the full signature set. This is a targeted, address-based tuning measure that preserves detection efficacy where it matters.

A mismatched Phase 1 encryption or hash algorithm directly causes the exact error seen in the ike debug. When the initiator sends a proposal list and the responder cannot find an identical SA transform (same encryption, hash, DH group, lifetime), the responder returns a NO_PROPOSAL_CHOSEN notify and the debug prints something like "no acceptable proposal" or "proposal mismatched". Correcting the FortiGate's Phase 1 algorithm set to match the peer resolves this.

FortiGate evaluates traffic against explicit firewall policies in sequence; anything matching none of them is dropped by the implicit deny, which sits at the end of the policy list. It is not configured manually and applies automatically to all unmatched traffic.

In certificate inspection mode, the FortiGate does not decrypt the SSL stream but still inspects the server certificate during the handshake. A self-signed certificate is inherently untrusted because it is not issued by a recognized CA, so the inspection profile blocks the connection. This block prevents the browser from completing the handshake, resulting in certificate error messages being displayed to the user.

The FSSO collector agent is the critical component that gathers logon events from Active Directory (either through NetAPI polling or by reading Windows security event logs) and forwards them to the FortiGate. If the collector agent service is stopped or not running, the FortiGate has no source of domain user logon information, so it treats all traffic as unauthenticated and triggers local firewall authentication prompts. This is the most direct cause of the symptom described, because the entire FSSO identity pipeline is broken.

LDAP is the directory protocol Microsoft Entra ID and Active Directory expose for credential queries. Configuring an LDAP server on the FortiGate lets administrator logins be validated against Active Directory, satisfying the requirement to reuse those credentials.

The antivirus profile in FortiOS includes a file filter (or file pattern) capability that can match filenames, file extensions, or MIME types during protocol decoding. By configuring a file pattern for '.exe' and setting the action to 'block', FortiGate inspects the file's extension as it passes through HTTP (or HTTPS when deep inspection is enabled) and discards the file before it reaches the user. This is the correct method because the antivirus engine works at the content layer, not at the URL or application layer, and can enforce file-type blocking regardless of the website hosting the file.

In FortiGate, bandwidth control is enforced through traffic shaping policies that are directly referenced by a firewall policy. You can assign a shared or per-IP traffic shaper with guaranteed and maximum bandwidth values, plus a priority level, so matching HTTPS sessions get explicit bandwidth limits and fair distribution. This is the only option that applies per-policy rate limiting, allowing the administrator to cap and prioritize traffic without affecting other policies.

In IKEv1, an aggressive-mode initiator sends its SA proposal, key-exchange material, nonce, and identity in a single packet, while a main-mode-only responder expects the two-round-trip Main Mode sequence (SA exchange first, then KE/nonce). When the responder's phase 1 configuration is set to 'main mode only,' it immediately discards the incoming aggressive-mode packet and logs a mode mismatch such as 'aggressive mode is not supported.' This rejection occurs before any proposal comparison or PSK authentication, so the log indicates a configuration mismatch rather than a cryptographic or proposal failure.

The service object restricts the policy to TCP port 80 only, so browser sessions to port 443 match no permit rule and are dropped. Widening the service to HTTPS or ALL resolves the failure, since modern sites default to TLS.

Safe search: Safe search enforcement is a specific FortiGate feature that inserts the appropriate safe search cookies or query parameters (e.g., 'safe=active' for Google) into outbound requests to supported search engines. It also integrates with DNS-based and HTTPS inspection to prevent users from disabling this setting. Unlike category or URL filters, it actively modifies the request so the search engine itself returns filtered results, which is the only way to guarantee content-level safe search on the SERP.

The FortiGate must be able to reach the FSSO collector agent on TCP port 8000 (or the port specified under FSSO settings). This is the connection over which the collector agent sends login and logout events; if the port is firewalled, the FortiGate will not receive authentication updates and FSSO policies will fail to match. The default port is 8000, but it must match exactly on both the agent and the FortiGate.

In a policy-based IPsec VPN, the firewall policy itself defines the local and remote subnets through its source and destination address objects, effectively acting as the Phase 2 proxy-IDs. If those address objects do not exactly match the subnets to be protected, the tunnel remains up but traffic is not matched by the policy, so the FortiGate drops or fails to forward it. Additionally, using only 'all' as the destination may send a proxy-ID of 0.0.0.0/0, which many remote peers reject, causing a negotiation mismatch even though the policy itself is permissive.

A firewall policy with source 10.0.0.0/8, destination 172.16.0.10, service SMTP, and action ACCEPT is the fundamental permit rule needed to allow the SMTP traffic. FortiGate evaluates policies from top to bottom, and this tuple uniquely identifies the SMTP session directed to the mail server. Without such an explicit ACCEPT policy, the implicit deny rule would silently drop the traffic, so this is the correct baseline configuration.

Equal-distance static routes create an ECMP group that load-balances traffic across port1 and port2, but this balances based on destination and may not honor source-based preferences. Adding a policy route for 192.168.10.0/24 with outgoing interface port1 forces all traffic originating from that source subnet to egress via port1, overriding the ECMP decision for that specific source. This combination gives you both the high-availability/load-balancing benefit of ECMP and the required source-specific egress control.

In Fortinet's policy-based VPN model, firewall policies are the gatekeepers that decide which traffic is allowed to traverse the tunnel interface. Even with Phase 1 and Phase 2 both up, packets are dropped unless there is an explicit policy permitting traffic between the local and remote zones (e.g., from 'internal' to 'tunnel'). This is a frequent point of failure because the tunnel status itself is independent of the policy configuration.

`execute backup config ftp <filename> <server>` is the correct FortiGate CLI command to export the current configuration to a remote FTP server. The command specifies the object type `config` (the device configuration), the protocol `ftp`, the destination filename, and the server's hostname or IP address. FortiOS will prompt for FTP credentials if they are not provided, and the resulting backup file can later be restored with the corresponding `execute restore config ftp` command. This is the standard, supported method for a configuration backup via FTP.

The FortiGate's SNMP agent is disabled by default; without enabling it globally under System > SNMP, the device will not respond to any SNMP get/set requests regardless of other configuration. Enabling the agent is the mandatory first step to allow a management station to poll MIB objects such as interface utilization, CPU, and memory. This is a global toggle, not per-interface, and once enabled the agent listens on port 161 for all configured SNMP communities.

During Phase 2 negotiation, both peers exchange proxy IDs (traffic selectors) that define which source and destination subnets are encrypted. If the local proxy ID does not exactly match the remote peer's expected subnets, the IPsec SA is established with mismatched selectors. The remote gateway may then drop incoming packets that fall outside its configured selectors, or it may not respond at all, causing the tunnel to appear up but traffic to fail in one or both directions.

Inter-VDOM links are required to route traffic between VDOMs. The VIP in the root VDOM will translate the destination IP to the server's IP in vdom1. Firewall policies on both VDOMs must allow the traffic. This setup enables the server in vdom1 to be reachable from the internet through the root VDOM's VIP.

Creating a traffic shaper defines the guaranteed and maximum bandwidth thresholds, then referencing it directly in the firewall policy applies those limits to matched video streaming traffic. This satisfies the requirement to shape bandwidth per policy, since FortiGate shapers only take effect once bound to the policy handling that traffic.

The HA group ID is a mandatory matching parameter for cluster membership; each heartbeat packet carries the group ID, and a FortiGate only processes heartbeats from units with the same group ID. If the two units are configured with different group IDs, they will silently discard each other's heartbeat messages, so neither ever sees a peer and both remain in standalone mode. This is a classic misconfiguration when units are pre-staged separately or when a configuration template is not synchronized. Setting both units to the same group ID (0 through 255) is required before they can form an HA cluster.

The route priority setting, also known as the metric, must be identical for all routes to be eligible for ECMP in FortiGate. FortiGate evaluates routes by administrative distance first, then priority, and only when both values match are the routes considered equal cost and installed simultaneously. If one route has a lower priority, it will always be preferred, and the higher-priority route will be ignored, preventing load balancing. Therefore, ensuring the same priority is a correct and essential condition for ECMP.

This is correct because DLP sensors operate on cleartext payloads. When email traffic is protected by TLS/SSL and SSL deep inspection is not enabled, the sensor sees only ciphertext, so any regex pattern or data-identifier match is impossible. You must enable deep inspection on the applicable firewall policy so the FortiGate can decrypt the email and feed the plaintext to the DLP sensor.

A geography address object in FortiOS is explicitly designed for geo-IP filtering. It references a country or region (e.g., China or Europe) by leveraging FortiGuard's geolocation database to map an IP address to a country. When used in a firewall policy's source or destination, it allows or denies traffic based on the client's geographic location, making it the correct and direct approach for restricting web server access by country.

In flow-based inspection mode, the FortiGate processes files in a streaming fashion, reading data as it flows through and not buffering the whole file, which means it cannot decompress archive files like .zip before scanning their contents. Because the virus is hidden inside the .zip, the scanner never actually sees it, so the file passes through undetected even if signatures are current. Proxy-based inspection, in contrast, buffers the entire file and can decompress archives to scan each contained file, which is why flow mode fails in this situation. The default behavior in flow mode is not to decompress archives, making this the correct explanation.

The correct prerequisite is that the firewall policy permitting the HTTPS traffic must have SSL inspection enabled, meaning an SSL/SSH inspection profile is applied to that policy. This profile instructs the FortiGate to decrypt the traffic, apply security controls, and re-encrypt it, which is the essence of deep inspection. Without this profile attached, the policy merely forwards the encrypted traffic without any visibility.

Traffic shapers are used to control bandwidth usage and prioritize traffic. In this scenario, to allow HTTP traffic while ensuring it doesn't saturate the link, a traffic shaper can be applied to the firewall policy to guarantee or limit bandwidth for HTTP. It doesn't affect the destination or source IP translation; it's a QoS mechanism.

This command runs a trace of a specific user-selected packet or flow through the FortiGate's processing pipeline, displaying each stage including policy lookup, routing decisions, and the final action (accept or drop). It captures the exact policy ID matched and the reason for any drop, such as implicit deny or traffic-shaping constraints. As a debug utility, it is the proper tool for verifying the policy decision for a given flow, making it the correct answer.

This is the correct FortiOS CLI branch for enabling FortiAnalyzer log forwarding. 'set status enable' activates the FortiAnalyzer connection, and 'set server 10.10.10.10' defines the destination FortiAnalyzer appliance's IP address; optional settings like 'set upload enable' control exactly how logs are pushed. Once committed, the FortiGate establishes a dedicated logging channel to FortiAnalyzer, which is the intended method for collecting logs on that platform.

Dialup peer type makes the FortiGate accept multiple dynamic peers rather than one fixed remote gateway, and the authentication setting binds the LDAP user group to Phase 1. Without both, the group cannot authenticate VPN users, so this satisfies the requirement to use the LDAP group for IPsec authentication.

Application control profiles act on traffic only when the relevant application signature is present and its action is set to block. Adding the BitTorrent signature with a block action is therefore the necessary step to drop that application's traffic.

The command `config system log-fortianalyzer` enters the FortiAnalyzer configuration mode, where the `set server <ip>` command specifies the IPv4 address of the FortiAnalyzer device that will receive logs. This is the mandatory first step in the CLI to point the FortiGate at its log collector. Without this address, the FortiGate has no destination for its syslog-like log streams to FortiAnalyzer. Optionally, parameters like `set upload-option` and `set source-ip` can also be set here, but the server IP is essential.

FortiGate HA uses heartbeat packets over the HA link; when the secondary stops receiving them within the configured thresholds, it assumes the primary has failed and transitions to active, taking over the cluster's IP addresses and sessions.

The 'diagnose debug flow' command is the definitive real-time tracing tool for FortiGate traffic. It allows you to apply filters (e.g., by source IP, destination IP, port, or VLAN) and then traces each packet through the entire data path, showing the exact policy ID matched, the action taken (accept or drop), and any profile-based processing or session errors. This output directly answers the question of 'which policy did this traffic match?' making it the correct troubleshooting method.

Because route-based VPNs present the IPsec tunnel as a virtual interface, that interface can participate in dynamic routing protocols such as OSPF, BGP, or RIP. This allows the VPN to exchange routing information automatically, so remote subnets are learned dynamically rather than requiring static routes for each destination. This is a major operational advantage over policy-based VPNs, which cannot run routing protocols across the tunnel in a straightforward manner.

FortiMail must be configured as the mail gateway in inline mode, receiving incoming SMTP messages before any other mail server. It performs comprehensive email security functions—spam filtering, antivirus, phishing protection, and content inspection—using its own message-specific heuristics and reputation databases. Once a message is deemed clean, FortiMail relays it to the internal mail server, ensuring that only sanitized mail reaches the user's inbox.

The correct procedure is to upgrade the standby unit first, verify it has booted and joined the cluster with a healthy synchronization, then manually fail over so that the upgraded unit becomes primary and handles traffic. After that, upgrade the former primary (now standby) to the same version, ensuring both units finally run identical firmware. This rolling upgrade preserves a live unit for every step, avoiding an outage and keeping the HA pair in a supported configuration throughout.

Safe search enforcement is a built-in Web Filter profile setting that forces supported search engines (Google, Bing, YouTube) to apply strict content filtering by automatically modifying search request URLs (e.g., appending 'safe=active' for Google and 'adlt=strict' for Bing) or by redirecting to a forced-search endpoint. Unlike blocking features, it does not deny access to the search engine; it preserves search capability while scrubbing explicit results, which directly satisfies the administrator's goal. It typically requires HTTPS inspection to rewrite embedded search URLs inside encrypted traffic.

The 'Two-factor authentication with FortiToken' setting on a FortiGate enables the native token-based OTP mechanism, where users must provide both their primary password and a one-time passcode generated by a FortiToken device or mobile token. This is the correct option because it directly activates the FortiToken two-factor authentication feature within FortiOS, ensuring that the token OTP is validated as part of the authentication process. It is distinct from external protocols or directory services, as it is built-in and specifically designed for FortiToken integration.

Central SNAT with a dynamic IP pool using overload is the correct approach because it implements many-to-one Source NAT: the FortiGate dynamically selects a public IP from the pool and rewrites each internal source IP to that public IP while also changing the source port to a unique value, enabling thousands of internal connections to share a single public address. Central NAT is the recommended method for outbound internet traffic because it cleanly separates NAT configuration from firewall policies and directly supports overload/PAT, matching the requirement for general internet egress.

In FortiGate, firewall policies are evaluated sequentially from the top of the policy list downward. Because policy 1 matches all traffic from the internal interface to wan1 with service set to ALL, it includes SSH (TCP port 22). Since this allow policy is encountered first, it takes effect and the SSH session is permitted. Policy 2, even though it explicitly denies SSH, is never reached because the first match already decided the traffic's fate.

Adding entries to the static domain blocklist within a DNS filter profile is correct because it allows you to manually specify exact domain names to always block, independent of FortiGuard categorization. This is useful for domains that are known threats or unwanted but may not yet be classified by FortiGuard, or for enforcing custom corporate policy. The blocklist takes precedence over category-based filtering, ensuring these domains are always denied.

Policy routes are tied to a specific incoming interface, so if the traffic arrives on a different interface than the one specified in the policy route, the route will never be evaluated. The administrator must confirm that the policy route's incoming interface matches the physical port where the traffic actually enters the FortiGate. Since the policy route is not applied on the wrong interface, the traffic follows the normal routing table, and the intended policy behavior is not observed.

The 'duration' field in Fortinet's session output records the age of the session in seconds, counting upward from the moment the connection was first seen. In this output, duration=3600 directly indicates the session has been active for exactly 3600 seconds (one hour). This is the only option that matches the literal value in the CLI output.

The output displays an anomaly event of type 'tcp_syn_flood' in the triggered state, which means the FortiGate has detected that the number of incompleted TCP SYN packets has exceeded the configured threshold for the anomaly sensor. This is rate-based detection because the sensor continuously monitors the rate of SYN packets and compares it against a threshold; when the rate shoots up, the anomaly is considered triggered and the configured action (such as dropping subsequent packets or sending an alert) is executed. Therefore, the FortiGate is correctly interpreting a TCP SYN flood attack targeting itself or a protected host.

Policy-based NAT with an IP pool of type Overload performs source NAT by translating the source address of all matching sessions to the single IP defined in the pool. Since the pool contains only 203.0.113.10, every outbound session from the internal server will appear to originate from that exact IP using PAT (port address translation). This directly meets the requirement of ensuring all traffic from the server uses 203.0.113.10 as the source IP.

Setting 'Require Client Certificate' in the SSL VPN settings makes the FortiGate demand a client certificate during the SSL/TLS handshake, and only a certificate signed by a configured trusted CA will be accepted. This ensures that every SSL VPN session is cryptographically tied to a credential that is bound to a specific US user, so users without a valid certificate cannot even initiate the handshake. This is the direct control that physically enforces certificate-based access.

FortiGate traffic shapers are objects that must be explicitly referenced in a firewall policy; simply creating a shaper under Traffic Shaping does not cause any policy to use it. The firewall policy's 'Traffic Shaper' field and 'Per-IP Shaper' field both default to 'None', which means traffic matching the policy is forwarded with no bandwidth limitation. To enforce a shaping rule, the administrator must select the desired shaper in that drop-down field. When the shaper is left unassigned, the policy passes traffic at full interface speed, perfectly explaining the 'high bandwidth consumption' symptom.

This correctly captures the core trade-off. Flow-based inspection processes packets in a streaming fashion using pattern matching, protocol anomaly detection, and flow-level heuristics, keeping latency low and throughput high. Proxy-based inspection buffers and reassembles the entire payload, which allows for detecting complex evasions and embedded malware, but at the cost of higher latency and resource usage.

A web filtering profile is purpose-built to control web access by evaluating each requested URL against FortiGuard's real-time web category database, which includes categories like gambling, adult, and malicious sites. It can block or allow entire categories, apply URL or DNS filtering, and log or warn users based on policy. This is the exact tool to prevent users from accessing inappropriate content, as it can be assigned to a firewall policy to filter both HTTP and HTTPS traffic.

A schedule object with recurring time is the standard FortiGate construct for defining repeating time periods. The 'recurring' type allows you to specify days of the week and a start/end time, and it remains active indefinitely. This precisely matches the requirement to restrict internet access for employees on a continuous, repeating basis. In a firewall policy, this object controls when the rule is enforced, enabling automated time-based access control.

Correct: In transparent mode, you can create VLAN subinterfaces on physical ports to segment the Layer-2 network. These interfaces operate purely at Layer 2, bridging frames between 802.1Q-tagged segments without any IP configuration for forwarding. A management IP is optional and only for administrative access, not for the VLAN interface's traffic path. This design lets the firewall apply security policies to VLAN traffic while remaining invisible to Layer 3 routing.

Form-based authentication is the standard method for a FortiGate captive portal. When a user without an existing authenticated session attempts to access a web resource, the FortiGate redirects the browser to a login page containing an HTML form. The user submits a username and password, which the FortiGate then validates against a configured authentication server (e.g., LDAP, RADIUS, or local user database). Upon successful validation, the FortiGate creates an authentication session and permits the traffic, making this the correct interactive method for captive portal.

A Data Leak Prevention (DLP) profile is expressly designed to detect and prevent the transmission of sensitive information, including credit card numbers, by applying content inspection, regex pattern matching, and file fingerprinting to data in motion. On FortiGate, a DLP profile can be attached to a security policy to inspect HTTP, FTP, SMTP, and other protocols, and it can block, log, or allow based on predefined or custom data classifiers. This precisely matches the administrator's requirement to block uploads of files containing credit card data, making it the correct choice.

The action parameter is the core permit or deny decision in a FortiOS firewall policy. Only when set to ACCEPT will the FortiGate allow the session to be established and forward traffic; DENY immediately drops packets and prevents any further processing. Security profiles can only operate on traffic that has passed this initial action check, so ACCEPT is the non-negotiable foundation for allowing outbound web traffic.

FortiToken generates time-based one-time passwords (TOTP) in a mobile app, satisfying the stem's requirement for app-generated OTP authentication on FortiGate. Unlike SMS or email tokens, FortiToken Mobile runs locally on the device, producing rolling codes that FortiGate validates against its shared secret during firewall or SSL VPN login.