Courseiva

CCNA System and Network Administration Questions

60 questions · System and Network Administration · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

A company is deploying a FortiGate HA cluster in active-passive mode across two data centers. The network team reports that after a failover, some existing TCP sessions are dropped. Which configuration change should be applied to maintain session persistence during failover?

A.Enable session synchronization between cluster members
B.Disable NAT inspection on the firewall policy
C.Configure gratuitous ARP on the virtual IP
D.Increase the heartbeat interval to 2 seconds
AnswerA

Session sync shares session state between primary and secondary, maintaining sessions during failover.

Why this answer

In an active-passive HA cluster, session synchronization (config.sys ha session-sync) ensures that TCP session state information is replicated from the active unit to the passive unit. Without this, the passive unit has no knowledge of existing sessions after a failover, causing them to be dropped. Enabling session synchronization allows the new active unit to continue forwarding traffic for established sessions seamlessly.

Exam trap

The trap here is that candidates often confuse gratuitous ARP (which handles Layer 2 updates) with session persistence, assuming that updating MAC tables is sufficient to maintain TCP sessions, but session state must be replicated at Layer 4.

How to eliminate wrong answers

Option B is wrong because disabling NAT inspection does not affect session persistence during failover; NAT is a separate function and does not control session state replication. Option C is wrong because gratuitous ARP is used to update the network with the new MAC address of the virtual IP after failover, but it does not preserve existing TCP sessions; it only ensures Layer 2 reachability. Option D is wrong because increasing the heartbeat interval to 2 seconds would actually slow down failure detection, potentially increasing session loss, and has no impact on session synchronization.

Practice this question →
2
MCQhard

A medium-sized enterprise has a FortiGate 100F in NAT/Route mode with three interfaces: port1 (WAN, 203.0.113.1/24, gateway 203.0.113.254), port2 (internal, 192.168.1.1/24), and port3 (DMZ, 10.0.0.1/24). The internal network hosts a web server at 192.168.1.10 and a mail server at 192.168.1.20. The DMZ hosts a public web server at 10.0.0.10 and a public DNS server at 10.0.0.20. The company has a single public IP 203.0.113.1. The administrator has configured the following: - Port forwarding: external HTTP to DMZ web server (10.0.0.10:80) and external DNS to DMZ DNS server (10.0.0.20:53). - Outbound NAT (IP Pool) for internal users to 203.0.113.1. - Firewall policies allowing internal to external, DMZ to external, and external to DMZ (for forwarded services). Users report that they can access the Internet but cannot reach the internal web server (192.168.1.10) via its public IP (203.0.113.1:80). The DMZ web server is accessible from the Internet. What is the most likely cause?

A.The firewall policy from internal to DMZ is blocking traffic
B.Hairpin NAT is not enabled on the FortiGate
C.The port forwarding rule maps the public IP to the DMZ server, not the internal server
D.The IP Pool for outbound NAT is misconfigured
AnswerC

The port forwarding rule, implemented as a Virtual IP (VIP), maps the public IP and port to 10.0.0.10, which is the DMZ server. When internal users attempt to access the internal server via the public IP, the FortiGate uses this VIP and translates the destination to the DMZ server's IP address. Consequently, the traffic never reaches the intended internal server, and the internal users cannot establish a connection to it. To resolve this, the VIP's mapped IP must be changed to the internal server's address, or a separate VIP must be created for the internal server.

Why this answer

The port forwarding rule is configured to forward external HTTP requests (port 80) to the DMZ web server at 10.0.0.10. The internal web server at 192.168.1.10 is not covered by any port forwarding rule. Therefore, when internal users try to access the public IP 203.0.113.1:80, the traffic is not redirected to the internal server, and the request fails.

This is the primary cause, not a missing hairpin NAT or misconfigured outbound NAT.

Exam trap

The trap here is that candidates often assume hairpin NAT is the universal fix for internal access to public IPs, but they overlook that the port forwarding rule must first exist for the target internal server; without that rule, hairpin NAT has no effect.

How to eliminate wrong answers

Option A is wrong because the problem is about accessing the internal web server via its public IP, not about traffic between internal and DMZ zones; the firewall policy from internal to DMZ is irrelevant here. Option B is wrong because hairpin NAT (also called NAT reflection) is only needed when a device on the internal network tries to reach another internal device via the public IP, but in this scenario, the port forwarding rule does not even point to the internal server, so enabling hairpin NAT would not fix the issue. Option D is wrong because the IP Pool for outbound NAT is correctly configured to translate internal users' source IPs to 203.0.113.1 for Internet access, and users can already access the Internet, indicating outbound NAT is functioning properly.

Practice this question →
3
MCQhard

A FortiGate in NAT/Route mode has a policy with NAT enabled. The admin needs the source IP of traffic from internal users (192.168.1.0/24) to be translated to the interface IP of port1 (203.0.113.1) when accessing the internet. Which configuration is necessary?

A.Add a static route for 192.168.1.0/24 with next-hop 203.0.113.1
B.Set the administrative access to HTTPS on port1
C.Create a central NAT rule with source 192.168.1.0/24 and IP pool 203.0.113.2-203.0.113.10
D.Configure a firewall policy with NAT enabled and the outbound interface set to port1
AnswerD

By default, NAT on a policy uses the egress interface IP as the translated source.

Why this answer

In NAT/Route mode, enabling NAT on a firewall policy with the outbound interface set to port1 causes the FortiGate to translate the source IP of traffic from the internal network (192.168.1.0/24) to the IP address of that interface (203.0.113.1) by default. This is the standard method for source NAT (SNAT) in a policy-based configuration, requiring no additional IP pool or static route for the translation itself.

Exam trap

The trap here is that candidates may confuse the need for an IP pool or static route with the simple policy-based NAT, assuming that translating to the interface IP requires additional configuration beyond enabling NAT on the policy.

How to eliminate wrong answers

Option A is wrong because a static route for 192.168.1.0/24 with next-hop 203.0.113.1 is unnecessary and incorrect; the internal subnet is directly connected, and the next-hop for internet-bound traffic should be the default gateway, not the interface IP. Option B is wrong because setting administrative access to HTTPS on port1 only enables management access to the interface, not source NAT translation. Option C is wrong because creating a central NAT rule with an IP pool of 203.0.113.2-203.0.113.10 would translate the source IP to a range of addresses, not the single interface IP (203.0.113.1), which does not match the requirement.

Practice this question →
4
Multi-Selectmedium

An administrator is configuring a FortiGate HA cluster in active-passive mode. Which two statements are correct about this configuration?

Select 2 answers
A.The cluster IP address is assigned to both units simultaneously.
B.One unit is active and forwards traffic, while the other is passive and does not forward traffic unless a failover occurs.
C.Both units can forward traffic simultaneously.
D.Heartbeat interfaces are optional.
E.Session synchronization is configured to maintain stateful failover.
AnswersB, E

This defines active-passive HA.

Why this answer

In an active-passive HA cluster, only the active unit processes and forwards traffic, while the passive unit remains in standby mode and does not forward traffic unless a failover occurs. This ensures high availability without load sharing. Additionally, session synchronization is configured to replicate stateful session information from the active to the passive unit, enabling seamless failover without disrupting established sessions.

Exam trap

The trap here is that candidates often confuse active-passive with active-active mode, mistakenly thinking both units can forward traffic simultaneously, or they assume the cluster IP is shared by both units at all times.

Practice this question →
5
MCQhard

An administrator configures an aggregate interface (port1 and port2) on a FortiGate. After connecting the switch ports, the aggregate interface shows 'down'. The individual member ports are up. What is the MOST likely cause?

A.The member ports are set to different speeds
B.The switch ports are not configured for LACP or static aggregation
C.The aggregate interface IP address is in the same subnet as the management interface
D.The FortiGate needs a reboot after creating an aggregate interface
AnswerB

An aggregate interface on a FortiGate requires the connected switch ports to be placed in a matching port-channel or LACP group. If the switch ports are left as ordinary access or trunk ports without LACP or static aggregation, the FortiGate does not receive the expected LACP protocol data units, and the aggregate interface remains down because the link-aggregation handshake never completes. This is the most common cause of an aggregate that is administratively up but physically down.

Why this answer

The aggregate interface remains down because the switch ports are not configured for LACP or static aggregation. For a FortiGate aggregate interface to come up, both the FortiGate member ports and the corresponding switch ports must be configured with the same aggregation protocol (LACP active/passive or static). Without this, the switch treats the ports as individual links, causing a mismatch that keeps the aggregate interface down.

Exam trap

The trap here is that candidates assume the aggregate interface will come up automatically if the member ports are physically up, overlooking the requirement for matching aggregation configuration on the switch side.

How to eliminate wrong answers

Option A is wrong because different speeds on member ports would cause the aggregate interface to fail to form or degrade performance, but the individual ports would still show up; the aggregate interface would not necessarily show 'down' due to speed mismatch alone, as FortiGate can still form an aggregate with speed differences in some configurations. Option C is wrong because an IP address conflict between the aggregate interface and the management interface would cause routing or connectivity issues, not prevent the aggregate interface from coming up at Layer 1/2. Option D is wrong because a reboot is not required after creating an aggregate interface; the interface state updates dynamically once the configuration and physical connections are correct.

Practice this question →
6
MCQmedium

A network administrator configures a new FortiGate as the default gateway for a subnet. The FortiGate has two WAN interfaces (port1 and port2) connected to different ISPs. The admin wants to load-balance outbound traffic across both links. Which configuration method will achieve this goal?

A.Configure a single default gateway and rely on ARP for failover
B.Configure a policy route for each subnet directing traffic to a different ISP
C.Configure two static default routes with different distances
D.Configure two static default routes with the same distance and metric
AnswerD

ECMP uses routes with equal administrative distance and metric to distribute traffic across multiple paths.

Why this answer

Configuring two static default routes with the same distance and metric enables ECMP (Equal-Cost Multi-Path) routing on FortiGate. This allows the FortiGate to load-balance outbound traffic across both WAN interfaces (port1 and port2) using a per-flow or per-packet algorithm, distributing sessions between the two ISPs.

Exam trap

The trap here is that candidates often confuse ECMP (same distance/metric) with floating static routes (different distances), mistakenly thinking that multiple default routes with different distances will load-balance, when in fact they only provide failover.

How to eliminate wrong answers

Option A is wrong because relying on a single default gateway with ARP failover does not provide load balancing; it only offers failover if the gateway becomes unreachable, and ARP is not a load-balancing mechanism. Option B is wrong because policy routes direct traffic based on source/destination criteria, not for general load balancing of all outbound traffic; they are used for selective routing, not equal distribution across two default paths. Option C is wrong because configuring two static default routes with different distances creates a primary/backup scenario (floating static route), where only the route with the lower distance is active, and the other is used only if the primary fails—no load balancing occurs.

Practice this question →
7
Multi-Selectmedium

Which ONE of the following is a valid method to upgrade the FortiGate firmware? (Choose one.)

Select 1 answer
A.Use the GUI under System > Firmware.
B.Use the command 'execute upgrade image tftp <ip> <filename>'.
C.Use the command 'execute backup config tftp'.
D.Use the command 'execute reboot'.
E.Use the command 'execute restore config tftp'.
AnswersA

Correct. The FortiGate GUI under System > Firmware is a valid method to upgrade firmware.

Why this answer

The FortiGate GUI under System > Firmware allows uploading and installing firmware images, a standard upgrade method. Option B is incorrect because the command syntax is reversed; the correct syntax is 'execute upgrade image tftp <filename> <ip>'. Options C, D, and E are not firmware upgrade commands (they are backup/restore and reboot, respectively).

Therefore, only option A is a valid upgrade method among the choices.

Exam trap

The trap here is that candidates may confuse backup/restore or reboot commands with firmware upgrade commands, or incorrectly assume that only GUI-based methods are valid, while the TFTP upgrade command is also a legitimate and commonly tested method.

Practice this question →
8
MCQmedium

An administrator needs to integrate a FortiGate with FortiAnalyzer for centralized logging. After configuring the FortiAnalyzer IP and enabling logging, the FortiGate shows 'connection refused' for FortiAnalyzer. What is the most likely cause?

A.The FortiAnalyzer is not registered with the FortiGate.
B.The FortiGate is not generating any logs.
C.The FortiAnalyzer SNMP community string is incorrect.
D.A firewall is blocking the required ports between FortiGate and FortiAnalyzer.
AnswerD

Ports 514/443 must be open.

Why this answer

The 'connection refused' error indicates that the FortiGate is attempting to establish a TCP connection to the FortiAnalyzer, but the FortiAnalyzer is actively rejecting the connection attempt. This is most commonly caused by a firewall (either on the network path or on the FortiAnalyzer itself) blocking the required ports, such as TCP 514 (syslog) or TCP 443/8443 (FortiGate-FortiAnalyzer protocol). Without proper port access, the TCP handshake fails, resulting in a connection refused message.

Exam trap

The trap here is that candidates often confuse 'connection refused' with 'no route to host' or 'timeout', and may incorrectly attribute the issue to registration or log generation rather than recognizing that a TCP-level rejection points to a firewall or port blocking issue.

How to eliminate wrong answers

Option A is wrong because the FortiAnalyzer does not need to be registered with the FortiGate; registration is the opposite direction (FortiGate registers with FortiAnalyzer) and a missing registration would cause an authentication or authorization failure, not a TCP-level 'connection refused'. Option B is wrong because the FortiGate not generating logs would not cause a connection refused error; the error occurs during the initial connection setup, before any log data is transmitted. Option C is wrong because SNMP community strings are used for SNMP-based monitoring, not for FortiGate-FortiAnalyzer logging communication, which uses TCP-based protocols like syslog or FortiGate-FortiAnalyzer proprietary protocol.

Practice this question →
9
MCQeasy

A FortiGate is configured in transparent mode. Which of the following statements is true?

A.The FortiGate can have multiple routing tables
B.The FortiGate supports VLAN sub-interfaces
C.The FortiGate acts as a router and performs NAT
D.The FortiGate interfaces have IP addresses for management only
AnswerD

Interfaces are in bridge mode; a management IP is assigned to the bridge.

Why this answer

In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. Interfaces do not require IP addresses for data forwarding; they only need IP addresses for management access (e.g., HTTPS, SSH, or SNMP). This makes option D correct.

Exam trap

The trap here is that candidates often assume transparent mode still supports routing or NAT because they confuse it with NAT/route mode, but transparent mode explicitly disables routing and NAT, focusing solely on Layer 2 bridging and firewall inspection.

How to eliminate wrong answers

Option A is wrong because transparent mode uses a single routing table (the management VDOM's routing table) and does not support multiple routing tables, which are a feature of NAT/route mode. Option B is wrong because VLAN sub-interfaces are not supported in transparent mode; the FortiGate treats VLANs as separate interfaces but cannot create sub-interfaces on physical ports. Option C is wrong because transparent mode does not perform routing or NAT; it acts as a transparent bridge, forwarding frames without modifying IP headers.

Practice this question →
10
MCQmedium

A FortiGate is configured with two WAN interfaces in an active-passive HA cluster. The administrator notices that the passive unit is not synchronizing configuration changes from the active unit. What is the MOST likely cause?

A.The HA heartbeat interface is not configured or is down.
B.The passive unit has a different firmware version.
C.The HA mode is set to active-active instead of active-passive.
D.The administrator must manually trigger a sync from the active unit.
AnswerA

Configuration synchronization in a FortiGate HA cluster depends on the heartbeat link, which carries both liveness detection and configuration/session sync traffic. If the heartbeat interface is not physically assigned or is down, the primary cannot push configuration updates to the secondary, even though the cluster may still be considered up. This results in configuration drift while failover behavior appears normal, exactly matching the symptom described in the question.

Why this answer

In an HA cluster, the heartbeat interface is responsible for synchronizing configuration changes and monitoring peer status between the active and passive units. If the heartbeat interface is not configured or is down, the passive unit cannot receive configuration updates from the active unit, leading to a synchronization failure. This is the most likely cause because without a functional heartbeat link, the cluster cannot maintain state or configuration consistency.

Exam trap

The trap here is that candidates often assume synchronization is triggered manually or that HA mode affects sync behavior, but FortiGate HA relies entirely on a functional heartbeat link for automatic configuration replication, regardless of the active-passive or active-active mode.

How to eliminate wrong answers

Option B is wrong because while different firmware versions can cause compatibility issues, the HA cluster typically prevents formation or logs a version mismatch error, but the passive unit would not even join the cluster; the question states the passive unit is present but not synchronizing, so a missing or down heartbeat is more likely. Option C is wrong because the HA mode (active-active vs. active-passive) affects failover behavior and load sharing, not the synchronization mechanism itself; both modes use the heartbeat interface for sync, so changing the mode would not prevent sync if the heartbeat is functional. Option D is wrong because configuration synchronization in FortiGate HA is automatic and continuous via the heartbeat link; there is no manual trigger required from the active unit—if the heartbeat is up, sync happens automatically.

Practice this question →
11
MCQhard

A FortiGate is configured with two equal-cost default routes to different ISPs. The administrator notices that traffic for a specific destination is load-balanced across both links as expected. However, they want all traffic from a specific source IP to use only ISP1, while other traffic remains load-balanced. Which configuration should be applied?

A.Increase the administrative distance of the ISP2 default route to 20
B.Create a policy route with source address set to the specific IP and set the gateway to ISP1
C.Configure SD-WAN rules to steer the traffic
D.Add a static host route for the specific source IP via ISP1
AnswerB

Policy routes match before the routing table and can steer traffic to a specific gateway.

Why this answer

Policy routing allows you to override the routing table for specific traffic based on criteria such as source IP. By creating a policy route that matches the specific source IP and sets the next-hop gateway to ISP1, you ensure that traffic from that source always uses ISP1, while all other traffic continues to be load-balanced across both equal-cost default routes. This is the most direct and flexible method for source-based path selection without altering the global routing behavior.

Exam trap

The trap here is that candidates often confuse policy routing with static routing or administrative distance changes, mistakenly thinking that modifying route preference or adding a host route for the source IP will achieve source-based forwarding, when in fact policy routing is the only method that allows traffic selection based on source IP without affecting other traffic.

How to eliminate wrong answers

Option A is wrong because increasing the administrative distance of the ISP2 default route to 20 would make it less preferred than the ISP1 route (default AD 10), causing all traffic to use ISP1 only, not just traffic from the specific source IP. Option C is wrong because SD-WAN rules are designed for advanced traffic steering and load balancing across multiple WAN links, but they require SD-WAN to be enabled and configured, which is an unnecessary complexity for this simple source-based policy requirement; a policy route is the standard and simpler solution. Option D is wrong because a static host route is used for a specific destination IP, not a source IP; adding a static host route for the source IP would be syntactically incorrect and would not achieve the desired behavior.

Practice this question →
12
Multi-Selecthard

An administrator is configuring a FortiGate in transparent mode and needs to forward traffic between two VLANs. Which three configurations are required? (Choose three.)

Select 3 answers
A.Enable NAT on the policies to translate addresses between VLANs
B.Assign an IP address to each VLAN subinterface for management
C.Create VLAN subinterfaces on the physical interface for each VLAN
D.Create firewall policies to allow traffic between the VLANs
E.Configure static routes to route between VLANs
AnswersB, C, D

In transparent mode, each VLAN subinterface typically gets an IP for management, but for traffic forwarding, the FortiGate needs to be in the VLANs. Actually, a management IP is required for the VDOM, but not necessarily on each VLAN? In transparent mode, you set a management IP for the VDOM, but traffic forwarding between VLANs requires the FortiGate to have interfaces in both VLANs. So subinterfaces are needed, and they usually have IPs assigned for management, but forwarding itself uses layer 2. However, to perform any layer 3 inspection, the FortiGate needs IPs on the subnets. So likely needed.

Why this answer

In transparent mode, FortiGate acts as a Layer 2 bridge, so VLAN subinterfaces must be created on the physical interface to tag and separate traffic for each VLAN (Option C). An IP address must be assigned to each VLAN subinterface for management access (Option B), as the FortiGate does not route between VLANs at Layer 3 but still needs an IP to be reachable for administration. Firewall policies are required to control and allow traffic between VLANs (Option D), even in transparent mode, because the FortiGate applies security rules to Layer 2 forwarded frames.

Exam trap

The trap here is that candidates assume transparent mode requires routing or NAT for inter-VLAN communication, but FortiGate in transparent mode bridges VLANs at Layer 2, relying on an external router for Layer 3 forwarding.

Practice this question →
13
Multi-Selecthard

A FortiGate is configured in an HA cluster with two units. The cluster is working, but the administrator wants to ensure that configuration changes made on the primary unit are automatically synchronized to the secondary unit. Which two conditions must be met? (Choose TWO.)

Select 2 answers
A.The HA configuration must be properly set with a valid group ID and password
B.Both units must have the same firmware version and license
C.The heartbeat interface must be operational and configured correctly
D.The HA cluster must be configured with a virtual MAC address
E.VDOM mode must be enabled on both units
AnswersA, C

A valid HA configuration is necessary for cluster formation and synchronization.

Why this answer

The HA group ID and password are essential for the cluster to identify and authenticate members. Without a matching group ID and password, the secondary unit will not accept configuration synchronization from the primary, as these parameters ensure that only authorized units participate in the cluster and receive configuration updates.

Exam trap

The trap here is that candidates often assume firmware and license matching (Option B) is required for config sync, but FortiGate HA only requires same firmware version for cluster formation, not for the sync process itself, and licenses do not affect synchronization.

Practice this question →
14
MCQeasy

A network administrator needs to allow SSH access to the FortiGate from a management subnet 10.0.1.0/24. Which configuration step is required on the interface connected to that subnet?

A.Enable HTTPS administrative access only
B.Set the administrative access to 'any'
C.Enable SSH administrative access on the interface
D.Configure a firewall policy allowing SSH from the subnet
AnswerC

SSH must be enabled on the interface for SSH connections to be accepted.

Why this answer

To allow SSH access to the FortiGate from a specific subnet, you must enable SSH administrative access on the interface connected to that subnet. This setting controls which management protocols are permitted to reach the FortiGate itself at the interface level, independent of firewall policies. Without enabling SSH on the interface, the FortiGate will drop SSH packets at Layer 3 before any policy lookup occurs.

Exam trap

The trap here is that candidates often assume a firewall policy is sufficient to allow management traffic, forgetting that administrative access must be explicitly enabled on the interface for protocols like SSH, HTTPS, or Telnet.

How to eliminate wrong answers

Option A is wrong because enabling only HTTPS administrative access would allow HTTPS but not SSH; SSH requires its own administrative access toggle on the interface. Option B is wrong because there is no 'any' administrative access setting; administrative access is configured per protocol (e.g., HTTPS, SSH, PING) and cannot be set to a wildcard value. Option D is wrong because a firewall policy allowing SSH from the subnet is not sufficient; the interface-level administrative access must first permit SSH management traffic, otherwise the FortiGate discards the packets before they reach the firewall engine.

Practice this question →
15
MCQmedium

A FortiGate administrator wants to integrate the FortiGate with a FortiAnalyzer for centralized logging. Which configuration step is required on the FortiGate?

A.Create a firewall policy allowing traffic from FortiAnalyzer to the FortiGate
B.Configure a syslog server pointing to the FortiAnalyzer IP
C.Enable 'Send Logs to FortiAnalyzer' under Log Settings and specify the FortiAnalyzer IP
D.Configure an SNMP community on the FortiAnalyzer
AnswerC

This is the correct method to integrate with FortiAnalyzer.

Why this answer

FortiGate integrates natively with FortiAnalyzer via the 'Send Logs to FortiAnalyzer' setting under Log Settings. This uses FortiGate's proprietary logging protocol (not syslog) to securely forward logs to the FortiAnalyzer IP, enabling centralized log management and analysis without additional firewall policies for inbound traffic.

Exam trap

The trap here is that candidates confuse native FortiAnalyzer logging with syslog, selecting Option B because they assume all log forwarding uses syslog, but FortiGate uses a proprietary protocol for FortiAnalyzer integration.

How to eliminate wrong answers

Option A is wrong because FortiGate initiates outbound log connections to FortiAnalyzer, so no inbound firewall policy is required; the traffic flows from FortiGate to FortiAnalyzer, not the reverse. Option B is wrong because FortiAnalyzer integration uses FortiGate's native FortiAnalyzer logging protocol, not syslog; configuring a syslog server would send logs in syslog format, which FortiAnalyzer can receive but is not the required step for native integration. Option D is wrong because SNMP is used for monitoring and traps, not for centralized logging; FortiAnalyzer does not require an SNMP community for log reception.

Practice this question →
16
MCQeasy

What is the primary purpose of configuring a loopback interface on a FortiGate?

A.To provide a stable IP address for management and routing protocols
B.To aggregate bandwidth from multiple physical interfaces
C.To enable NAT for internal networks
D.To increase the number of available physical ports
AnswerA

Loopback interfaces are always up and provide a consistent IP for management and routing.

Why this answer

A loopback interface on a FortiGate is a virtual interface that is always up, independent of physical link states. It provides a stable and reachable IP address for management access (e.g., HTTPS, SSH) and for routing protocols like OSPF or BGP to use as the router ID or source interface, ensuring consistent connectivity even if physical interfaces fail.

Exam trap

The trap here is that candidates often confuse a loopback interface with a physical interface used for link aggregation or NAT, not realizing its primary role is to provide a stable, always-up logical endpoint for management and routing protocol stability.

How to eliminate wrong answers

Option B is wrong because aggregating bandwidth from multiple physical interfaces is achieved through link aggregation (LACP or static aggregation), not a loopback interface. Option C is wrong because NAT for internal networks is configured using policies and IP pools, not by creating a loopback interface. Option D is wrong because a loopback interface is virtual and does not increase the number of physical ports; it only provides a logical addressing endpoint.

Practice this question →
17
MCQmedium

An administrator wants to synchronize the FortiGate's time with a reliable NTP server. After configuring the NTP server, they notice the time is still incorrect. What could be the issue?

A.The FortiGate does not have a firewall policy allowing NTP traffic from the FortiGate itself
B.The NTP server is not reachable due to a missing route
C.The FortiGate does not support NTP
D.The NTP server is not configured correctly
AnswerA

Traffic from the FortiGate to the NTP server must be allowed by a policy.

Why this answer

By default, FortiGate does not allow traffic sourced from its own IP addresses, including NTP queries, to pass through its interfaces unless an explicit firewall policy permits it. Even if the NTP server is reachable via routing, the FortiGate's own NTP client traffic is subject to the same policy enforcement as any other traffic. Therefore, a firewall policy must be created with the source set to the FortiGate's interface IP and the destination set to the NTP server to allow NTP (UDP port 123) traffic outbound.

Exam trap

The trap here is that candidates assume NTP traffic is automatically allowed for management purposes, but FortiGate treats all traffic, including its own, as subject to firewall policies, so a missing explicit policy is a common oversight.

How to eliminate wrong answers

Option B is wrong because a missing route would cause the NTP server to be unreachable, but the question states the administrator configured the NTP server and noticed the time is still incorrect, implying the server is reachable at the network layer; the issue is policy-based, not routing. Option C is wrong because FortiGate fully supports NTP (RFC 1305) for time synchronization, and this is a standard feature in FortiOS. Option D is wrong because the NTP server configuration (IP address or hostname) may be correct, but without a firewall policy to permit the outbound NTP traffic from the FortiGate itself, the synchronization will fail regardless of server correctness.

Practice this question →
18
MCQmedium

An administrator wants to aggregate two physical interfaces (port1 and port2) on a FortiGate to increase bandwidth and provide redundancy. Which interface type should be created?

A.Aggregate interface
B.Loopback interface
C.VLAN interface
D.Software switch interface
AnswerA

Aggregate interfaces (LAG) provide increased bandwidth and redundancy.

Why this answer

An aggregate interface (also known as a Link Aggregation Group or LAG) combines multiple physical interfaces into a single logical link, increasing bandwidth and providing redundancy. This is the correct choice because it directly supports the administrator's goal of aggregating port1 and port2 on a FortiGate, using the IEEE 802.3ad standard (LACP) or static aggregation.

Exam trap

The trap here is that candidates often confuse a software switch interface with link aggregation, but a software switch simply bridges ports at Layer 2 without the load-balancing and failover mechanisms of an aggregate interface.

How to eliminate wrong answers

Option B is wrong because a loopback interface is a virtual interface used for management or routing protocol stability, not for aggregating physical links. Option C is wrong because a VLAN interface is a logical interface for 802.1Q VLAN tagging on a single physical or aggregate interface, not a method to combine multiple physical ports. Option D is wrong because a software switch interface creates a Layer 2 bridge between ports, but it does not provide link aggregation for increased bandwidth or redundancy in the same way as an aggregate interface.

Practice this question →
19
MCQmedium

An administrator is troubleshooting a connectivity issue. A ping from the FortiGate to 8.8.8.8 succeeds, but traffic from internal hosts to the internet is failing. The firewall policy allows the traffic. What is the most likely cause?

A.The default route on the FortiGate is missing
B.The internal hosts have the wrong default gateway configured
C.DNS resolution is failing
D.The FortiGate's interface to the internal network is down
AnswerB

Hosts forward traffic to destinations outside their subnet via their configured default gateway; in this network, that gateway should be the FortiGate's internal interface IP. If the hosts point to a different or nonexistent IP, their packets for internet destinations are sent to a device that cannot forward them, so the traffic never reaches the FortiGate. Even though the FortiGate can ping 8.8.8.8, the hosts remain isolated, which precisely matches the reported symptoms.

Why this answer

Since the FortiGate can ping 8.8.8.8, its default route and internet connectivity are working. The issue is that internal hosts cannot reach the internet, which points to a Layer 3 forwarding problem at the host level. The most likely cause is that the internal hosts have the wrong default gateway configured, so their traffic is not being sent to the FortiGate for routing.

Exam trap

The trap here is that candidates assume a successful ping from the FortiGate implies end-to-end connectivity, overlooking that the internal hosts' default gateway configuration is independent of the FortiGate's own routing table.

How to eliminate wrong answers

Option A is wrong because if the default route on the FortiGate were missing, the FortiGate itself would not be able to ping 8.8.8.8, but the ping succeeded. Option C is wrong because DNS resolution failure would prevent name resolution, but the question describes a connectivity issue where traffic to the internet is failing, and the ping to 8.8.8.8 uses an IP address, not a hostname, so DNS is not the bottleneck. Option D is wrong because if the FortiGate's interface to the internal network were down, the FortiGate would not be able to communicate with internal hosts at all, but the firewall policy allows the traffic and the FortiGate can still ping external IPs, indicating the internal interface is operational.

Practice this question →
20
Multi-Selecteasy

An admin is configuring ECMP (Equal Cost Multi-Path) on a FortiGate with two ISPs. Which TWO conditions must be met for ECMP to load balance traffic across both links? (Choose two.)

Select 2 answers
A.The routes must be configured with the same metric
B.The routes must have the same priority
C.The FortiGate must be in transparent mode
D.The routes must have the same administrative distance
E.The routes must point to different next-hop IP addresses
AnswersB, D

Equal priority ensures both routes are considered.

Why this answer

ECMP requires that multiple routes to the same destination have equal cost. On FortiGate, the cost is determined by administrative distance (AD) and priority (which is the route metric). Both routes must have the same AD and the same priority to be considered equal-cost and eligible for load balancing.

If either value differs, one route will be preferred over the other, and ECMP will not activate.

Exam trap

The trap here is that candidates confuse 'metric' (which is the priority value on FortiGate) with 'administrative distance', or assume ECMP requires different next-hop IPs, when in fact the key condition is equal cost (same AD and same priority).

Practice this question →
21
MCQmedium

A FortiGate is configured with an aggregate interface (link aggregation group) consisting of two physical ports. The administrator notices that traffic is not being distributed evenly across the two links. Which configuration setting should be verified to improve load balancing?

A.Check the LACP mode (active vs passive)
B.Increase the MTU on the aggregate interface
C.Verify the load-balancing algorithm for the aggregate interface
D.Ensure the physical ports are in the same VDOM
AnswerC

The algorithm determines how traffic is hashed to links; changing it can improve distribution.

Why this answer

The aggregate interface uses a load-balancing algorithm to distribute traffic across member links. If traffic is uneven, the algorithm (e.g., source-destination IP, source-destination MAC, or layer 4 port) may not match the traffic pattern, causing hash polarization. Verifying and adjusting this algorithm is the correct step to improve distribution.

Exam trap

The trap here is confusing LACP negotiation settings (active/passive) with the actual traffic distribution mechanism, leading candidates to incorrectly select option A instead of recognizing that the load-balancing algorithm directly controls link utilization.

How to eliminate wrong answers

Option A is wrong because LACP mode (active vs passive) controls link negotiation and aggregation establishment, not traffic distribution across already-aggregated links. Option B is wrong because increasing MTU affects maximum packet size but has no impact on how traffic is hashed or distributed among aggregate members. Option D is wrong because VDOM membership ensures logical separation but does not influence the load-balancing algorithm or per-packet distribution across physical ports in an aggregate.

Practice this question →
22
Multi-Selecthard

A FortiGate configured in transparent mode needs to allow HTTP traffic between two VLANs. The administrator has created a firewall policy. However, traffic is still blocked. Which TWO additional configurations are necessary for transparent mode operation?

Select 2 answers
A.Enable VLAN forwarding on the bridge
B.Configure a management IP address on the FortiGate
C.Create static routes for each VLAN subnet
D.Disable antivirus inspection on the policy
E.Assign IP addresses to the internal interfaces
AnswersA, B

The bridge must be configured to forward VLAN-tagged traffic.

Why this answer

In transparent mode, the FortiGate acts as a Layer 2 bridge, so VLAN tags must be preserved and forwarded across the bridge. Enabling VLAN forwarding on the bridge (option A) allows the FortiGate to pass 802.1Q-tagged frames between VLANs, which is essential for inter-VLAN HTTP traffic. Without this, the bridge will drop VLAN-tagged frames, blocking the traffic even if a firewall policy exists.

Exam trap

The trap here is that candidates often assume transparent mode requires IP addresses on interfaces (like NAT/route mode) or that static routes are needed for inter-VLAN traffic, but the key is understanding that transparent mode is Layer 2 and requires VLAN forwarding and a management IP for policy enforcement.

Practice this question →
23
MCQmedium

A FortiGate administrator needs to allow remote management from the internet only from a specific IP address. Which configuration achieves this?

A.Create a local-in policy to allow management access only from the trusted host
B.Change the admin port to a non-standard port
C.Enable HTTPS and restrict admin access via admin host
D.Use a firewall policy with source address restriction
AnswerA

A local-in policy is evaluated before any firewall policy and explicitly governs traffic destined to the FortiGate's own IP addresses. By defining a local-in rule that permits management traffic only from the specified trusted host IP, the administrator ensures all other sources are implicitly denied, providing precise source-based access control for the management interface.

Why this answer

A local-in policy is the correct method to restrict remote management access to a FortiGate from the internet because it operates at the control plane level, filtering traffic destined to the FortiGate itself before it reaches the management daemons. By specifying a source IP address in a local-in policy, you can explicitly allow HTTPS or SSH management only from that trusted host, while implicitly denying all other sources. This is more secure than relying on firewall policies, which apply to traffic passing through the FortiGate, not to traffic destined to the FortiGate's own IP addresses.

Exam trap

The trap here is that candidates often confuse firewall policies (which control traffic passing through the FortiGate) with local-in policies (which control traffic destined to the FortiGate), leading them to incorrectly select option D, thinking a standard firewall policy can restrict management access from the internet.

How to eliminate wrong answers

Option B is wrong because changing the admin port to a non-standard port is a form of security through obscurity and does not restrict access to a specific IP address; it only changes the port number, which can still be scanned and accessed from any source. Option C is wrong because enabling HTTPS and restricting admin access via admin host (the 'admin host' setting) is a legacy method that only works for GUI access and does not apply to SSH or other management protocols; it also does not provide the granularity of a local-in policy. Option D is wrong because a firewall policy with source address restriction applies to traffic transiting through the FortiGate (forwarding plane), not to traffic destined to the FortiGate itself (control plane); management traffic is handled by the control plane and must be filtered using local-in policies or the 'trusted host' feature.

Practice this question →
24
MCQmedium

A FortiGate administrator needs to upgrade the firmware from 7.0.5 to 7.2.0. The current firmware is 7.0.5. What is the recommended upgrade path?

A.Upgrade to 7.0.6 first, then to 7.2.0
B.Upgrade to 7.2.0 directly after downgrading to 7.0.0
C.Upgrade to 7.4.0 first, then downgrade to 7.2.0
D.Upgrade directly from 7.0.5 to 7.2.0
AnswerA

First upgrade to the latest 7.0.x, then to 7.2.0.

Why this answer

Fortinet firmware upgrades must follow a supported upgrade path to avoid configuration incompatibility or system instability. The recommended path from 7.0.5 to 7.2.0 is to first upgrade to the latest 7.0.x release (7.0.6) and then to 7.2.0, as direct jumps across major versions (e.g., 7.0.x to 7.2.0) are not supported and may cause upgrade failures or data loss.

Exam trap

The trap here is that candidates assume any direct upgrade between consecutive major versions is allowed, but Fortinet enforces a strict path that requires upgrading to the latest patch of the current major branch first.

How to eliminate wrong answers

Option B is wrong because downgrading to 7.0.0 before upgrading to 7.2.0 is unnecessary and introduces risk; the correct path is to upgrade within the 7.0.x branch first. Option C is wrong because upgrading to 7.4.0 (a later major version) and then downgrading to 7.2.0 is not a supported upgrade path and may cause configuration corruption or boot issues. Option D is wrong because directly upgrading from 7.0.5 to 7.2.0 is not supported; Fortinet requires an intermediate upgrade to the latest 7.0.x release to ensure compatibility of the firmware image and configuration database.

Practice this question →
25
MCQeasy

What is the purpose of configuring a loopback interface on a FortiGate?

A.To create a logical interface that remains up regardless of physical link status
B.To provide a virtual IP address for NAT
C.To connect to a VLAN
D.To aggregate multiple physical interfaces for increased bandwidth
AnswerA

A loopback interface is a virtual interface that is always administratively up once created, independent of any physical link state. This guarantees a stable IP address for management access, routing protocol peering (e.g., OSPF, BGP), and device identification, even if all physical interfaces fail. Only a manual shutdown or system-wide outage can bring it down.

Why this answer

A loopback interface is a logical interface that is not tied to any physical port, so it remains operational (up/up) as long as the FortiGate itself is running. This makes it ideal for management access, BGP peering, and other services that require a stable IP address independent of physical link failures.

Exam trap

The trap here is that candidates confuse a loopback interface with a virtual IP (VIP) for NAT or with a VLAN sub-interface, because both are 'virtual' constructs, but they serve entirely different purposes in the FortiGate architecture.

How to eliminate wrong answers

Option B is wrong because a loopback interface is not used for NAT; virtual IPs (VIPs) or IP pools are used for NAT purposes. Option C is wrong because VLANs are created as sub-interfaces on physical or aggregate interfaces, not on a loopback interface. Option D is wrong because aggregating multiple physical interfaces for increased bandwidth is achieved via Link Aggregation (LAG) or 802.3ad, not a loopback interface.

Practice this question →
26
MCQhard

You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is an ICMP session with state 01 and expires in 1 second.
B.The session is a UDP session to port 443 and has been active for 3600 seconds.
C.The session is a TCP session to port 443 that has been active for 3600 seconds and will expire in 3599 seconds.
D.The session is a TCP session that has timed out and will be removed in 3599 seconds.
AnswerC

Why this answer

The output shows 'proto=6', which is the protocol number for TCP, and 'dport=443' indicates the destination port is HTTPS. The 'duration=3600' means the session has been active for 3600 seconds, and 'expire=3599' means it will expire in 3599 seconds. The 'proto_state=01' is a TCP state code, confirming this is a TCP session.

Exam trap

The trap here is that candidates often confuse protocol numbers (e.g., thinking '6' is UDP or ICMP) or misinterpret 'expire' as the time since expiration rather than the remaining time until expiration.

How to eliminate wrong answers

Option A is wrong because 'proto=6' is TCP, not ICMP (which uses protocol number 1), and 'dport=443' specifies a port, which is not applicable to ICMP. Option B is wrong because 'proto=6' is TCP, not UDP (which uses protocol number 17), and the session is to port 443, not from it. Option D is wrong because the session has not timed out; 'expire=3599' indicates it is still active and will expire in 3599 seconds, not that it has already timed out.

Practice this question →
27
MCQmedium

An admin wants to monitor CPU and memory usage on a FortiGate using SNMP. Which configuration is required?

A.Configure a performance SLA monitor
B.Enable SNMP agent and configure an SNMP community
C.Enable SNMP on the interface and set administrative access to SNMP
D.Configure an SNMP v3 user and enable SNMP traps
AnswerB

Enabling SNMP agent and a community allows SNMP managers to poll OIDs for CPU/memory.

Why this answer

To monitor CPU and memory usage via SNMP, the FortiGate must first have the SNMP agent enabled and an SNMP community configured. The community string acts as a password for SNMPv1/v2c queries, allowing an NMS to poll the device for OIDs like CPU usage (1.3.6.1.4.1.12356.101.4.1.1) and memory usage (1.3.6.1.4.1.12356.101.4.1.4). Without enabling the agent and defining a community, the FortiGate will not respond to SNMP GET requests.

Exam trap

The trap here is that candidates confuse enabling SNMP on an interface (administrative access) with enabling the SNMP agent itself, leading them to select option C, which only allows SNMP traffic to reach the FortiGate but does not activate the SNMP service or community required for polling.

How to eliminate wrong answers

Option A is wrong because a performance SLA monitor is used for link health checks and failover decisions (e.g., SD-WAN), not for exposing CPU/memory metrics via SNMP. Option C is wrong because enabling SNMP on an interface and setting administrative access to SNMP only allows SNMP traffic to reach the FortiGate through that interface; it does not enable the SNMP agent itself or define a community for authentication. Option D is wrong because configuring an SNMP v3 user and enabling traps is for sending unsolicited notifications (traps) to an NMS, not for responding to polled queries for CPU and memory usage; polling requires the SNMP agent and community (or user for v3) to be active.

Practice this question →
28
Multi-Selectmedium

An administrator is configuring a FortiGate to use FortiManager for centralized management. Which three steps are required?

Select 3 answers
A.Enable VDOMs on the FortiGate.
B.Authorize the FortiGate in the FortiManager GUI.
C.Register the FortiGate to the FortiManager using the registration code.
D.Create a local admin account on the FortiGate for FortiManager to use.
E.Ensure network connectivity between FortiGate and FortiManager on TCP port 541.
AnswersB, C, E

Authorization is needed to accept management.

Why this answer

After the FortiGate is discovered by FortiManager (via FGFM protocol), the administrator must explicitly authorize the device in the FortiManager GUI under 'Device Manager > Unregistered Devices'. This step is mandatory to establish a trusted management relationship; without authorization, the FortiGate remains in an unmanaged state and cannot receive configuration or policy updates.

Exam trap

The trap here is that candidates often confuse 'registration' (step C) with 'authorization' (step B), thinking one step suffices, when in fact both are required sequentially, and they may also incorrectly assume a local admin account (step D) is needed for authentication.

Practice this question →
29
MCQhard

An administrator configures a FortiGate in transparent mode to be deployed between a router and a switch. After installation, traffic passes through but the administrator cannot access the FortiGate's management IP from the management network. What is the MOST likely reason?

A.The management IP is not in the same subnet as the management network.
B.Transparent mode does not support management access; only NAT/Route mode does.
C.The FortiGate's firewall policy blocks management traffic even in transparent mode.
D.The administrator must configure a management VLAN interface to access the FortiGate.
AnswerA

In transparent mode, the FortiGate operates as a layer 2 bridge and uses a dedicated management IP for administrative access. This management IP must belong to the same subnet as the directly connected management network, because the FortiGate resolves the management destination via ARP and does not route management traffic without a routed interface. If the management IP is in a different subnet, the FortiGate cannot respond to ARP requests or forward management packets, making it unreachable. Therefore, the administrator's incorrect subnet selection prevents any management connection.

Why this answer

In transparent mode, the FortiGate acts as a Layer 2 bridge, and its management IP must belong to the same subnet as the management network to be reachable. If the management IP is on a different subnet, the FortiGate will not respond to management traffic because it does not route between subnets in transparent mode; it only forwards traffic at Layer 2.

Exam trap

The trap here is that candidates often assume transparent mode disables all management access or requires special VLANs, when the real issue is simply a subnet mismatch between the management IP and the management network.

How to eliminate wrong answers

Option B is wrong because transparent mode fully supports management access via a dedicated management IP, just like NAT/Route mode, though the IP is used for management only and not for routing. Option C is wrong because by default in transparent mode, there is no firewall policy blocking management traffic; management access is controlled by administrative access settings (e.g., HTTPS, SSH) on the management interface, not by firewall policies. Option D is wrong because a management VLAN interface is not required; the administrator can assign a management IP directly to the FortiGate's management interface (e.g., the internal interface) as long as it is on the same subnet as the management network.

Practice this question →
30
MCQmedium

An administrator configures a policy route to direct traffic from subnet 10.1.1.0/24 to the internet via ISP1 with a gateway of 203.0.113.1. However, traffic from that subnet is still using the default route via ISP2. What is the MOST likely cause?

A.The source interface is not specified in the policy route
B.The default route has a lower administrative distance
C.The policy route's destination is set to 'all' which conflicts with the default route
D.The policy route is configured after the default route in the routing table
AnswerA

Policy routes require a source interface to match. If not set, the policy route may not apply.

Why this answer

Policy routes in FortiGate are evaluated based on the source interface and source address. If the source interface is not specified, the policy route may not match the incoming traffic because the firewall does not know which interface the traffic is arriving on. Without a matching source interface, the policy route is skipped, and the default route (via ISP2) is used instead.

Exam trap

The trap here is that candidates assume policy routes are evaluated after the routing table or that administrative distance affects policy route matching, when in fact policy routes are processed first and require explicit source interface matching.

How to eliminate wrong answers

Option B is wrong because administrative distance is a property of static routes, not policy routes; policy routes are evaluated before the routing table lookup, so a lower administrative distance on the default route does not override a matching policy route. Option C is wrong because setting the destination to 'all' in a policy route means it matches any destination, which does not conflict with the default route; the issue is the missing source interface, not the destination. Option D is wrong because policy routes are not ordered in the routing table; they are evaluated in the order they appear in the policy route list, and the default route is only consulted if no policy route matches.

Practice this question →
31
MCQmedium

A FortiGate is configured with two equal-cost static default routes via two ISPs. The administrator wants to use both links simultaneously for outbound traffic, distributing sessions per source-destination pair. Which ECMP load balancing method should be configured under config system settings?

A.weighted-round-robin
B.vip-inbound-grpc
C.spillover
D.source-destination-ip
AnswerD

Correct method to distribute sessions per source-destination IP pair.

Why this answer

The source-destination-ip method under ECMP load balancing distributes sessions based on both source and destination IP addresses, ensuring that all packets belonging to the same session (same source-destination pair) are forwarded via the same path. This meets the requirement of using both links simultaneously for outbound traffic while maintaining per-session consistency.

Exam trap

The trap here is that candidates often confuse ECMP load balancing methods with general load balancing techniques, mistakenly selecting weighted-round-robin because it sounds like a standard load balancing algorithm, but it does not guarantee per-source-destination pair distribution in FortiGate's ECMP context.

How to eliminate wrong answers

Option A (weighted-round-robin) is wrong because it distributes sessions in a round-robin fashion based on weights, not per source-destination pair, which can cause session asymmetry. Option B (vip-inbound-grpc) is wrong because it is not an ECMP load balancing method; it relates to gRPC-based VIP configuration for inbound traffic. Option C (spillover) is wrong because it forwards traffic to a secondary link only when the primary link's bandwidth threshold is exceeded, not for simultaneous use of both links.

Practice this question →
32
MCQmedium

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

A.The web server's certificate is self-signed and FortiGate is rejecting the connection
B.The antivirus profile is configured for flow-based inspection instead of proxy-based
C.SSL/TLS deep inspection is not enabled on the firewall policy
D.The FortiGuard antivirus subscription has expired
AnswerC

HTTPS traffic is encrypted. FortiGate cannot inspect the payload without SSL deep inspection decrypting the TLS session. The antivirus profile requires inspection mode to be enabled.

Why this answer

HTTPS traffic is encrypted with SSL/TLS, so an antivirus profile cannot inspect the payload unless the firewall can decrypt the traffic. Even with antivirus enabled in the policy, without SSL/TLS deep inspection (also called SSL inspection or HTTPS decryption), FortiGate only sees encrypted packets and cannot scan for malware. Therefore, the most likely reason is that SSL/TLS deep inspection is not enabled on the firewall policy.

Exam trap

The trap here is that candidates often assume antivirus profiles automatically inspect all traffic, forgetting that encrypted HTTPS requires explicit SSL/TLS decryption before any content inspection can occur.

How to eliminate wrong answers

Option A is wrong because a self-signed certificate does not cause FortiGate to reject the connection by default; it may generate a warning or require an SSL inspection policy to handle untrusted certificates, but the traffic would still be forwarded (and remain unscanned) unless a specific action is configured. Option B is wrong because both flow-based and proxy-based inspection modes support antivirus scanning; the inspection mode affects performance and some features but does not prevent scanning of HTTPS traffic if decryption is configured. Option D is wrong because an expired FortiGuard antivirus subscription would prevent signature updates and might disable real-time scanning, but the traffic would still be inspected (with potentially outdated signatures) unless the license is completely expired and the feature is blocked; the question states antivirus is enabled, so the subscription expiry is not the most likely reason for no scanning at all.

Practice this question →
33
MCQeasy

An administrator needs to configure a FortiGate to allow remote management via HTTPS from the internet. Which configuration step is required?

A.Create a firewall policy from WAN to LAN with HTTPS service and set action to ACCEPT.
B.Enable SSH access on the WAN interface instead of HTTPS.
C.Enable HTTPS access on the WAN interface and create a firewall policy allowing inbound HTTPS from any to the FortiGate's IP.
D.Configure a port forwarding rule to redirect HTTPS from WAN to the internal management IP.
AnswerC

This allows HTTPS management from the internet by enabling the service on the interface and permitting traffic.

Why this answer

Remote HTTPS management of a FortiGate from the internet requires two steps: enabling HTTPS access on the WAN interface (under config system interface) and creating a firewall policy that allows inbound HTTPS traffic (TCP/443) from any source to the FortiGate's own IP address. Without the explicit policy, the traffic is dropped by the implicit deny rule, even if the interface is configured to listen for HTTPS.

Exam trap

The trap here is that candidates assume enabling HTTPS on the interface alone is sufficient, forgetting that FortiGate still requires an explicit firewall policy to permit inbound traffic to its own IP, as the implicit deny rule blocks all traffic not matched by a policy.

How to eliminate wrong answers

Option A is wrong because a firewall policy from WAN to LAN with HTTPS service would forward management traffic to internal LAN hosts, not to the FortiGate itself, and does not enable the WAN interface to accept HTTPS connections. Option B is wrong because enabling SSH instead of HTTPS does not satisfy the requirement to allow remote management via HTTPS; SSH and HTTPS are separate protocols with different purposes. Option D is wrong because port forwarding is used to redirect traffic to internal servers behind the FortiGate, not to the FortiGate's own management interface; the FortiGate's management IP is directly reachable on the WAN interface when HTTPS access is enabled and a policy is in place.

Practice this question →
34
MCQmedium

An administrator needs to allow SSH access to the FortiGate's management interface from a specific management subnet (10.0.1.0/24). Which configuration achieves this?

A.Set the administrative access profile to allow SSH from any IP
B.Configure a firewall policy to allow SSH from 10.0.1.0/24 to the FortiGate
C.Under system admin settings, set the trusted host for the administrator to 10.0.1.0/24 and enable SSH access
D.Create a local-in policy to allow SSH from 10.0.1.0/24
AnswerC

This is the standard and correct method: in the System > Admin > Administrators settings, define a trusted host as 10.0.1.0/24 for that administrator, and ensure SSH is enabled in the administrative access for the interface the admin connects to. Trusted hosts explicitly allowlist the source IP ranges that can initiate management sessions, so only devices from 10.0.1.0/24 can SSH to the FortiGate. Additionally, SSH administrative access must be enabled on the relevant interface for the login to be accepted.

Why this answer

The trusted host setting under system admin settings restricts administrative access (including SSH) to only the specified source IP or subnet. By setting the trusted host to 10.0.1.0/24 and enabling SSH access, the FortiGate ensures that only SSH connections originating from that management subnet can reach the management interface. This is the standard method for controlling administrative access to the FortiGate's management plane.

Exam trap

The trap here is that candidates often confuse firewall policies (which control transit traffic) with administrative access controls (which control traffic destined to the FortiGate itself), leading them to incorrectly select Option B.

How to eliminate wrong answers

Option A is wrong because setting the administrative access profile to allow SSH from any IP would permit SSH connections from all sources, not just the specific management subnet, violating the requirement. Option B is wrong because firewall policies control traffic passing through the FortiGate between interfaces, not traffic destined to the FortiGate itself; administrative access is governed by administrative access settings and trusted hosts, not firewall policies. Option D is wrong because local-in policies are used to filter traffic destined to the FortiGate's own IP addresses, but they are not the primary or recommended method for restricting administrative access; the trusted host setting is the correct and simpler approach for this purpose.

Practice this question →
35
MCQmedium

A FortiGate is operating in transparent mode. The admin needs to allow HTTP traffic from users to a web server. Which type of firewall policy is required?

A.A layer 2 firewall policy
B.A policy-based NAT rule
C.A firewall policy using zone-based security
D.A VIP policy to map the web server's public IP
AnswerA

In transparent mode, the FortiGate acts as a transparent bridge (bump in the wire) and does not route IP traffic, so all traffic control must occur at Layer 2. A layer 2 firewall policy inspects and forwards frames based on MAC addresses, VLANs, and other Layer 2 attributes, making it the only policy type that can effectively filter traffic in this deployment. This policy type is required because there is no Layer 3 routing table or IP-based decision-making in transparent mode.

Why this answer

In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic without routing. To allow HTTP traffic from users to a web server, a Layer 2 firewall policy is required because it filters traffic based on MAC addresses and Layer 2 headers, not IP addresses or routing decisions. This policy type is the only one that works in transparent mode, as it does not involve NAT or routing.

Exam trap

The trap here is that candidates often assume firewall policies always involve IP addresses and routing, but in transparent mode, the FortiGate uses Layer 2 policies that operate at the data link layer, not the network layer.

How to eliminate wrong answers

Option B is wrong because policy-based NAT rules are used in NAT/route mode to translate IP addresses, not in transparent mode where the FortiGate does not perform IP routing or NAT. Option C is wrong because zone-based security policies are applicable in NAT/route mode for grouping interfaces into zones; transparent mode uses Layer 2 policies, not zones. Option D is wrong because VIP policies are used for destination NAT in NAT/route mode to map public IPs to private IPs, which is irrelevant in transparent mode where the FortiGate does not perform IP address translation.

Practice this question →
36
MCQmedium

An administrator configures a policy route to send all traffic from subnet 172.16.1.0/24 to a specific next-hop 10.0.0.2. However, the traffic is still using the default route. What could be the reason?

A.The policy route has a lower priority than the default route.
B.The policy route does not have a destination interface set.
C.The policy route must be configured before the default route.
D.The source subnet is not correctly defined in the policy route.
AnswerA

Why this answer

Policy routes in FortiGate are evaluated based on their priority value, where a lower number indicates higher priority. If the policy route has a higher priority value (e.g., 10) than the default route (which is implicitly 0), the default route will be preferred. The administrator must ensure the policy route's priority is lower than the default route's priority to override it.

Exam trap

The trap here is that candidates often assume policy routes automatically override static routes, but FortiGate uses a priority-based selection where the default route's implicit priority of 0 can supersede a policy route with a higher priority value.

How to eliminate wrong answers

Option B is wrong because a destination interface is not mandatory for a policy route to function; the route can be matched based on source and next-hop alone. Option C is wrong because FortiGate does not require policy routes to be configured before static routes; they are evaluated independently based on priority, not order of configuration. Option D is wrong because if the source subnet were incorrectly defined, the traffic would not match the policy route at all, but the symptom described is that traffic is using the default route, indicating the policy route exists but is not being selected due to priority.

Practice this question →
37
MCQeasy

Which FortiGate operating mode allows the device to act as a transparent layer 2 bridge, forwarding traffic without performing NAT or routing?

A.Transparent mode
B.HA mode
C.VDOM mode
D.NAT/Route mode
AnswerA

Transparent mode acts as a layer 2 bridge.

Why this answer

Transparent mode is the correct answer because in this mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing Network Address Translation (NAT) or routing. The device does not have an IP address on its interfaces for forwarding decisions, making it invisible to the network at Layer 3.

Exam trap

The trap here is that candidates often confuse 'transparent mode' with 'VDOM mode' because VDOMs can be configured in transparent mode, but VDOM mode itself is a virtualization feature, not the operating mode that defines Layer 2 bridging behavior.

How to eliminate wrong answers

Option B (HA mode) is wrong because High Availability mode is a clustering configuration for redundancy and failover, not an operating mode that changes the device's Layer 2 or Layer 3 forwarding behavior. Option C (VDOM mode) is wrong because Virtual Domain mode is a virtualization feature that allows partitioning a single FortiGate into multiple logical firewalls, each operating in its own mode (transparent or NAT/route), but it does not inherently make the device a transparent bridge. Option D (NAT/Route mode) is wrong because this is the default Layer 3 operating mode where the FortiGate performs routing and NAT, acting as a router with IP addresses on interfaces, which is the opposite of transparent bridging.

Practice this question →
38
MCQmedium

You notice that the FortiGate HA cluster is not failing over when the primary unit loses power. The HA configuration shows 'set ha-priority 250' on the primary and 'set ha-priority 200' on the secondary. What is the most likely cause?

A.The secondary unit has a lower priority, so it never takes over
B.The password for HA synchronization is incorrect
C.The session pickup feature is disabled
D.The HA heartbeat interface is not configured correctly or is down
AnswerD

The HA heartbeat interface is the dedicated link used by both units to exchange state and health information. If this interface is not configured correctly or is down, the secondary cannot reliably monitor the primary's heartbeat; in this scenario, the cluster may not even form, or if it did form, the secondary will not detect the primary's failure and will not initiate a failover. In some cases, a failed heartbeat with a still-functioning management plane can lead to split-brain, but a correctly working heartbeat is fundamental to failover detection and to avoid the cluster being stuck with an inactive primary.

Why this answer

The most likely cause is that the HA heartbeat interface is not configured correctly or is down (Option D). FortiGate HA relies on heartbeat packets exchanged over dedicated or VLAN interfaces to monitor peer status. If the heartbeat interface fails, the secondary unit cannot detect the primary's loss of power, so no failover occurs regardless of priority settings.

The HA priority values (250 vs. 200) are valid and would normally cause the primary to be elected as the active unit, but a broken heartbeat link prevents failover detection.

Exam trap

The trap here is that candidates often assume priority values alone determine failover behavior, but FortiGate HA failover requires a working heartbeat link to detect peer failure; without it, even a complete power loss goes unnoticed.

How to eliminate wrong answers

Option A is wrong because the secondary unit's lower priority (200) does not prevent it from taking over; in fact, when the primary fails, the secondary with the next highest priority becomes active. Option B is wrong because an incorrect HA synchronization password would cause configuration sync failures, not a failure to detect a power loss and trigger failover. Option C is wrong because session pickup (or session failover) is a feature for preserving active sessions during failover, not a requirement for the failover itself to occur.

Practice this question →
39
MCQeasy

A network administrator is configuring a FortiGate for the first time and needs to enable administrative access via HTTPS from the internal network. Which configuration step is required?

A.Set the administrative access to HTTPS on the internal interface
B.Enable HTTPS on the system global settings
C.Create a firewall policy allowing inbound HTTPS from internal to the FortiGate
D.Configure a static route for the management subnet
AnswerA

To manage a FortiGate via HTTPS on a specific interface, you must explicitly enable HTTPS in the interface's administrative access settings. This is done with `config system interface` and `set allowaccess https` (or `set allowaccess ping https ...`), which tells the control plane to accept HTTPS sessions destined to that interface's IP address. Without this setting, even if the interface has a valid IP and the firewall permits HTTP(S) traffic, the FortiGate will drop management connection attempts.

Why this answer

Administrative access to a FortiGate interface is controlled per-interface under the interface configuration. By default, HTTPS access is disabled on all interfaces. To enable administrative HTTPS access from the internal network, you must set the administrative access to HTTPS on the specific internal interface.

This allows the FortiGate to listen for HTTPS management traffic on that interface's IP address.

Exam trap

The trap here is that candidates confuse firewall policies (which control traffic passing through the FortiGate) with local-in policies (which control traffic destined to the FortiGate), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option B is wrong because HTTPS is not enabled globally; it is enabled per-interface under config system interface. The global settings only control the HTTPS port (default 443) and certificate, not the interface-level access. Option C is wrong because firewall policies control traffic passing through the FortiGate, not traffic destined to the FortiGate itself.

Administrative access is governed by the local-in policy, which is implicitly controlled by the interface's administrative access settings. Option D is wrong because a static route is only needed if the management subnet is not directly connected; for the internal network, the FortiGate already has a directly connected route, so no static route is required.

Practice this question →
40
MCQhard

A FortiGate administrator is upgrading firmware from version 6.0 to 7.0. The upgrade path requires multiple steps. Which of the following is the recommended method to ensure a successful upgrade?

A.Upgrade to 6.2, then to 6.4, then to 7.0, following the official upgrade path
B.Perform a factory reset after upgrading to 7.0
C.Use the 'execute upgrade-version' command to automatically determine the path
D.Upload and install the 7.0 firmware directly, then restore configuration from backup
AnswerA

Stepwise upgrades ensure compatibility and prevent issues.

Why this answer

FortiGate firmware upgrades must follow a specific path to ensure compatibility of the firmware image, configuration database, and bootloader. Skipping intermediate versions (e.g., 6.2 and 6.4) can cause configuration corruption or boot failure because each major version may change the internal data structures or require a specific bootloader version. The official upgrade path from 6.0 to 7.0 is 6.0 → 6.2 → 6.4 → 7.0, as documented in Fortinet's release notes.

Exam trap

The trap here is that candidates may think a direct upgrade is acceptable because they assume firmware is backward-compatible, or they confuse the 'execute update-now' command with an automatic path resolver, when in fact Fortinet requires strict adherence to the documented upgrade path to prevent bootloader and configuration schema mismatches.

How to eliminate wrong answers

Option B is wrong because performing a factory reset after upgrading to 7.0 does not address the need for a correct upgrade path; it only resets the configuration, but the firmware itself must still be upgraded in the correct sequence to avoid bootloader or database incompatibilities. Option C is wrong because the 'execute upgrade-version' command does not exist; FortiGate uses 'execute update-now' for firmware updates, but there is no automatic path determination command—the administrator must manually follow the documented upgrade path. Option D is wrong because directly uploading and installing 7.0 firmware from 6.0 is not supported; it can result in a failed upgrade or a non-booting unit due to incompatible firmware structures, and restoring a configuration from backup after a direct upgrade may also fail if the configuration format has changed.

Practice this question →
41
MCQeasy

An administrator has configured two FortiGate units in an active-passive HA cluster. The primary unit fails. How does the secondary unit become active?

A.The secondary unit detects loss of heartbeat from the primary and takes over
B.The administrator must manually reboot the secondary unit
C.The secondary unit becomes active only if the heartbeat link is also down
D.The secondary unit waits for a configuration change before becoming active
AnswerA

Heartbeat monitoring triggers failover when primary is unreachable.

Why this answer

In an active-passive HA cluster, the secondary unit monitors the primary unit's health via heartbeat messages. When the primary fails and stops sending heartbeats, the secondary unit detects the loss of heartbeat and initiates a failover, transitioning to the active role. This is the default behavior in FortiGate HA, where the secondary unit does not require manual intervention or additional conditions to become active.

Exam trap

The trap here is that candidates may think the secondary unit requires the heartbeat link to be down or manual intervention to become active, but FortiGate HA automatically promotes the secondary unit upon detecting the primary's failure via heartbeat loss.

How to eliminate wrong answers

Option B is wrong because FortiGate HA is designed for automatic failover; the administrator does not need to manually reboot the secondary unit, as that would defeat the purpose of high availability. Option C is wrong because the secondary unit becomes active when the primary fails, regardless of whether the heartbeat link is also down; the heartbeat link being down alone would not trigger a failover if the primary is still active. Option D is wrong because the secondary unit does not wait for a configuration change; it becomes active based on the failure detection, and configuration synchronization occurs after the failover.

Practice this question →
42
MCQhard

An administrator configures a policy route to send all traffic from a specific subnet to a different next-hop. However, traffic from that subnet is still using the default route. Which configuration could be causing this?

A.The firewall policy denies the traffic before policy routing
B.The policy route is applied to the wrong incoming interface
C.The default route has a higher administrative distance
D.The policy route destination is set to all
AnswerB

Policy routes are tied to a specific incoming interface, so if the traffic arrives on a different interface than the one specified in the policy route, the route will never be evaluated. The administrator must confirm that the policy route's incoming interface matches the physical port where the traffic actually enters the FortiGate. Since the policy route is not applied on the wrong interface, the traffic follows the normal routing table, and the intended policy behavior is not observed.

Why this answer

Policy routes are evaluated based on the incoming interface of the traffic. If the policy route is applied to the wrong incoming interface, traffic from the specified subnet arriving on a different interface will not match the policy and will instead follow the default route. This is a common misconfiguration where the administrator assumes the policy applies globally rather than per-interface.

Exam trap

The trap here is that candidates often assume policy routes apply globally to all traffic matching the source/destination, forgetting that FortiGate requires the incoming interface to be explicitly specified for policy routes to be evaluated.

How to eliminate wrong answers

Option A is wrong because firewall policies are evaluated after policy routing in FortiGate's processing order; if policy routing matches, the traffic is forwarded to the policy route's next-hop before any firewall policy is checked, so a deny firewall policy would not cause the traffic to use the default route. Option C is wrong because a higher administrative distance makes a route less preferred, so if the default route had a higher administrative distance, it would be less likely to be used, not more; the issue is that the policy route is not being matched at all. Option D is wrong because setting the policy route destination to 'all' would match all destinations, which would actually increase the likelihood of the policy route being applied, not cause it to be ignored; the problem is the interface mismatch, not the destination setting.

Practice this question →
43
Multi-Selectmedium

An administrator wants to allow only HTTPS and SSH administrative access to the FortiGate from a specific management subnet 192.168.100.0/24. Which TWO steps must be taken on the FortiGate?

Select 2 answers
A.Set the trusted host(s) on the administrator account to 192.168.100.0/24
B.Create a local-in policy to allow traffic from 192.168.100.0/24
C.Enable HTTPS and SSH globally under system global
D.Configure a firewall policy to permit HTTPS and SSH from the management subnet to the FortiGate
E.On the interface, set allowaccess to https and ssh
AnswersA, E

This restricts which IPs can access the FortiGate via those protocols.

Why this answer

Setting the trusted host(s) on an administrator account restricts administrative logins to only those originating from the specified subnet (192.168.100.0/24). This is a per-account access control that works in conjunction with interface-level allowaccess settings to enforce administrative source IP restrictions.

Exam trap

The trap here is that candidates often confuse firewall policies (which control forwarded traffic) with local-in policies or interface allowaccess settings (which control traffic destined to the FortiGate itself), leading them to incorrectly select option D.

Practice this question →
44
Multi-Selecteasy

An administrator needs to configure DNS on a FortiGate so that internal hosts can resolve external domain names. Which two settings are required? (Choose two.)

Select 2 answers
A.Configure DNS servers under System > DNS.
B.Create a firewall policy allowing DNS traffic from internal to external.
C.Enable DNS proxy on the FortiGate.
D.Set the FortiGate's hostname to the domain name.
E.Configure a static route for DNS servers.
AnswersA, C

DNS server addresses must be specified for the FortiGate to perform resolution.

Why this answer

Configuring DNS servers under System > DNS is the fundamental step that tells the FortiGate which external DNS resolvers (e.g., 8.8.8.8) to use for resolving domain names. Without this, the FortiGate cannot forward DNS queries from internal hosts to the internet. Option C is correct because enabling the DNS proxy on the FortiGate allows it to intercept DNS requests from internal clients, cache responses for performance, and forward them to the configured DNS servers, which is essential for internal hosts to resolve external domains through the FortiGate.

Exam trap

The trap here is that candidates often think a firewall policy is required for DNS traffic, but the FortiGate's DNS proxy handles the forwarding internally, making the explicit policy unnecessary unless the proxy is disabled and hosts send queries directly.

Practice this question →
45
MCQhard

A FortiGate administrator is troubleshooting a problem where users cannot access the Internet. The FortiGate has a default route pointing to the ISP gateway. The administrator runs 'execute ping 8.8.8.8' from the FortiGate CLI and it succeeds. However, internal users behind NAT are unable to reach external servers. Which is the most likely cause?

A.The default route is incorrectly configured
B.An implicit deny policy is blocking traffic from internal to external
C.No NAT policy is configured for internal users
D.External access profile is set to read-only
AnswerC

If no NAT policy is configured for internal users' traffic, the FortiGate forwards packets with the original private source IP addresses (e.g., 10.0.0.0/8). The external server sends reply packets to that private address, which is not routable across the public internet, causing return traffic to be dropped or blackholed. The FortiGate's own ping works because it uses its interface's public IP as the source, so replies are routable. This mismatch—successful ping from the FortiGate but failures for internal users—is a classic symptom of missing source NAT.

Why this answer

The administrator confirmed that the FortiGate itself can reach the Internet (ping 8.8.8.8 succeeds), so the default route and basic connectivity are working. However, internal users behind NAT cannot reach external servers, which indicates that traffic from internal users is either not being translated or is being blocked. The most likely cause is that no NAT policy (or firewall policy with NAT enabled) exists to perform source NAT for internal users, so their private IP addresses are not translated to the FortiGate's public IP, and the ISP gateway drops the packets because private addresses are not routable on the Internet.

Exam trap

The trap here is that candidates assume a successful ping from the FortiGate CLI proves end-to-end connectivity for all users, but they overlook that NAT translation is required for internal private IPs to reach the Internet.

How to eliminate wrong answers

Option A is wrong because the default route is correctly configured — the 'execute ping 8.8.8.8' succeeded, proving the route works. Option B is wrong because an implicit deny policy would block all traffic, including the ping from the FortiGate itself; since the ping succeeded, there is no implicit deny blocking outbound traffic. Option D is wrong because the external access profile is a GUI/administrative access setting that controls read/write permissions for the web interface, not a factor in NAT or traffic forwarding.

Practice this question →
46
MCQmedium

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

A.The web server's certificate is self-signed and FortiGate is rejecting the connection
B.The FortiGuard antivirus subscription has expired
C.The antivirus profile is configured for flow-based inspection instead of proxy-based
D.SSL/TLS deep inspection is not enabled on the firewall policy
AnswerD

To inspect HTTPS for malware, FortiGate must terminate the TLS session using an SSL/TLS deep inspection profile, which decrypts the payload, applies the antivirus profile, and then re-encrypts the traffic. Without this, the FortiGate only sees ciphertext and cannot apply antivirus signatures because the content is opaque. The firewall policy must explicitly reference an SSL inspection profile set to 'deep-inspection' (not just 'certificate-inspection') and clients must trust the FortiGate's CA to avoid handshake warnings. If this is not enabled, all HTTPS traffic bypasses antivirus scanning regardless of the configured antivirus profile.

Why this answer

D is correct because antivirus scanning of HTTPS traffic requires the firewall to decrypt the SSL/TLS-encrypted payload. Without SSL/TLS deep inspection enabled on the policy, FortiGate sees only encrypted packets and cannot inspect the content for viruses, even if an antivirus profile is applied. The admin must configure a deep inspection profile that includes SSL/TLS decryption to allow the antivirus engine to scan the decrypted traffic.

Exam trap

The trap here is that candidates often assume antivirus profiles can scan encrypted traffic automatically, but FortiGate cannot inspect encrypted payloads without SSL/TLS deep inspection enabled on the policy.

How to eliminate wrong answers

Option A is wrong because a self-signed certificate does not cause FortiGate to reject the connection by default; FortiGate will still forward the traffic, but without deep inspection, it cannot scan the encrypted content. Option B is wrong because an expired FortiGuard antivirus subscription would prevent signature updates but would not stop scanning of traffic that is already encrypted—the traffic would still be scanned if decrypted, but with outdated signatures. Option C is wrong because flow-based inspection can still scan HTTPS traffic if SSL/TLS deep inspection is enabled; the inspection mode (flow vs. proxy) affects how the scanning engine processes traffic, but both require decryption to inspect encrypted payloads.

Practice this question →
47
MCQmedium

An administrator wants to configure SNMP on a FortiGate to allow a monitoring server 192.168.1.100 to poll read-only information. Which set of commands is correct?

A.config system snmp sysinfo set status enable set community public set trap-receiver 192.168.1.100 end
B.config system snmp community edit 1 set name public set query enable set query-port 161 set hosts 192.168.1.100 end
C.config system snmp set enable set community public set host 192.168.1.100 end
D.config system interface edit port1 set snmp-index 1 set allowaccess snmp end
AnswerB

Why this answer

SNMP read-only polling on FortiGate is configured under the `config system snmp community` hierarchy. The `set query enable` command allows SNMP GET requests, `set query-port 161` specifies the standard SNMP port, and `set hosts 192.168.1.100` restricts polling to that specific monitoring server. This matches the requirement for read-only access without configuring traps or enabling SNMP globally via the sysinfo context.

Exam trap

The trap here is that candidates often confuse the `config system snmp sysinfo` context (for system contact/location) with the community configuration context, or mistakenly think SNMP is enabled globally via a simple `set enable` command, when in fact the community must be explicitly created and enabled with `set query enable`.

How to eliminate wrong answers

Option A is wrong because `config system snmp sysinfo` is used to set system contact and location information, not to enable SNMP polling or define communities; `set community public` is invalid in that context, and `set trap-receiver` configures trap destinations, not polling hosts. Option C is wrong because `config system snmp` is not a valid configuration path on FortiGate; SNMP is configured under `config system snmp community` and `config system snmp sysinfo`, and `set enable` and `set community` are not valid commands at that level. Option D is wrong because `config system interface` with `set allowaccess snmp` only enables SNMP access on a specific interface, but it does not configure the SNMP community, query settings, or allowed hosts, which are required for the monitoring server to poll.

Practice this question →
48
MCQeasy

An administrator wants to ensure that traffic to a specific web server always exits through a particular ISP link, regardless of route changes. Which feature should be configured?

A.Equal-cost multi-path (ECMP) routing
B.Policy-based routing (PBR)
C.Static route with higher distance
D.SD-WAN with load balancing
AnswerB

Policy routes allow forwarding decisions based on source/destination, overriding the routing table.

Why this answer

Policy-based routing (PBR) allows you to override the routing table by applying a route map to match traffic (e.g., source/destination IP, port) and explicitly set the next-hop interface or ISP link. This ensures traffic to the specific web server always exits through the designated ISP, regardless of dynamic route changes or the routing table's default behavior.

Exam trap

The trap here is that candidates confuse PBR with static routing or SD-WAN load balancing, thinking that a static route with a higher distance or SD-WAN can force traffic to a specific link, but only PBR provides the granular match-and-set logic to override the routing table for specific traffic flows regardless of route changes.

How to eliminate wrong answers

Option A is wrong because ECMP distributes traffic across multiple equal-cost paths for load balancing, not for pinning traffic to a specific link. Option C is wrong because a static route with a higher distance (administrative distance) acts as a backup route and only takes effect when the primary route is unavailable, not for forcing traffic to a particular link when the primary route is active. Option D is wrong because SD-WAN with load balancing distributes traffic across multiple WAN links based on policies or performance metrics, which does not guarantee that all traffic to a specific web server always uses the same ISP link.

Practice this question →
49
MCQeasy

A FortiGate has been configured with two WAN interfaces (wan1, wan2) in an SD-WAN zone. The administrator wants to ensure that traffic for a specific internal server uses only wan1. What is the most appropriate method?

A.Disable wan2 in the SD-WAN zone
B.Use policy routing with a higher priority for wan1
C.Configure a static route with a higher distance for wan2
D.Create an SD-WAN rule to match the server's traffic and set the preferred member to wan1
AnswerD

Creating an SD-WAN rule that matches the server's traffic (e.g., by destination IP address) and setting the preferred member to wan1 is the correct solution because SD-WAN rules are evaluated after policy routes and allow granular, application-aware egress selection. The preferred member setting ensures that wan1 is used for matching sessions, while other traffic can still be load-balanced or failed over across the WAN interfaces based on SD-WAN health-check and performance SLA. This approach is the recommended, flexible, and maintainable way to steer specific traffic in a Fortinet SD-WAN design.

Why this answer

SD-WAN rules allow granular traffic steering based on application, source, or destination. By creating an SD-WAN rule that matches the traffic destined for the internal server and setting the preferred member to wan1, the FortiGate will use SD-WAN's policy-based routing to ensure that traffic egresses exclusively via wan1, while other traffic can still use both WAN interfaces as per other rules.

Exam trap

The trap here is that candidates often confuse policy routing (Option B) with SD-WAN rules, not realizing that SD-WAN rules are the proper mechanism for per-traffic member selection within an SD-WAN zone, and that policy routing operates at a different layer and can override SD-WAN behavior if not carefully managed.

How to eliminate wrong answers

Option A is wrong because disabling wan2 in the SD-WAN zone removes it from all load-balancing and failover, which is overly broad and not a targeted solution for a single server's traffic. Option B is wrong because policy routing (PBR) operates independently of SD-WAN and can create conflicts; SD-WAN rules are the intended method for per-traffic member selection within an SD-WAN zone. Option C is wrong because configuring a static route with a higher distance for wan2 affects all traffic using that route, not just the specific server's traffic, and static routes do not integrate with SD-WAN's application-aware steering.

Practice this question →
50
MCQhard

During a firmware upgrade, the admin uploads the image via the GUI and clicks 'Upgrade'. The FortiGate reboots but comes up with the old firmware. What is the MOST likely cause?

A.The firmware image file is corrupted or not compatible with the platform
B.The FortiGate was in HA mode and the peer did not upgrade
C.The admin did not reboot after the upgrade
D.The admin forgot to save the configuration before upgrading
AnswerA

Corrupted or incompatible images cause upgrade failure; the FortiGate reverts to previous firmware.

Why this answer

When a FortiGate reboots after an upgrade but loads the old firmware, the most likely cause is that the uploaded firmware image was corrupted or incompatible with the platform. The FortiGate verifies the image integrity (e.g., checksum) during the upgrade process; if the image fails validation, the system will not commit the new firmware and will fall back to the previous version stored in the secondary boot partition. This ensures the device remains operational even if the upgrade image is invalid.

Exam trap

The trap here is that candidates often assume a failed upgrade is due to a missing reboot or HA misconfiguration, but Fortinet specifically designs the upgrade process to automatically reboot and validate the image, making image corruption or incompatibility the primary cause when the old firmware reappears.

How to eliminate wrong answers

Option B is wrong because in an HA cluster, the upgrade process is coordinated; if the peer does not upgrade, the primary would either fail to upgrade or the cluster would split, but the FortiGate would not reboot to the old firmware on its own—it would typically remain on the new firmware or fail to complete the upgrade. Option C is wrong because the admin explicitly clicked 'Upgrade', which triggers an automatic reboot; no separate manual reboot is required, and the issue is that the device came up with old firmware, not that it didn't reboot. Option D is wrong because configuration is stored separately from firmware; forgetting to save the config does not affect which firmware version loads after reboot—the config is saved automatically before upgrade or can be restored, but it does not cause the old firmware to load.

Practice this question →
51
Multi-Selecthard

A FortiGate administrator is setting up a new FortiGate and needs to integrate it with FortiAnalyzer and FortiManager. Which THREE statements are correct regarding this integration?

Select 3 answers
A.FortiAnalyzer can generate reports based on the logs received from FortiGate.
B.FortiManager can be used to manage multiple FortiGate devices from a central console.
C.FortiAnalyzer can push configuration changes to the FortiGate.
D.FortiGate uses the FGFM protocol to communicate with FortiAnalyzer.
E.FortiAnalyzer can receive logs from the FortiGate for centralized logging and analysis.
AnswersA, B, E

FortiAnalyzer provides reporting capabilities.

Why this answer

FortiAnalyzer is designed to receive logs from FortiGate devices and use them to generate comprehensive reports. The FortiGate sends logs via syslog or the FGFM protocol, and FortiAnalyzer stores them in its SQL database, allowing administrators to create scheduled or on-demand reports for compliance, traffic analysis, and security events.

Exam trap

The trap here is that candidates often confuse the roles of FortiAnalyzer and FortiManager, assuming FortiAnalyzer can manage configurations or that FGFM is used for both, when in fact FGFM is the FortiGate-FortiManager protocol, while FortiAnalyzer uses syslog or FGFM only for log forwarding.

Practice this question →
52
MCQmedium

A FortiGate is configured with two ISPs (WAN1 and WAN2) and uses SD-WAN for load balancing. The administrator notices that traffic to a critical SaaS application is being sent over the slower link. What should the administrator do to ensure this traffic uses the faster link?

A.Create an SD-WAN rule to match the SaaS application's destination and set preferred member to the faster link.
B.Remove the slower link from the SD-WAN interface.
C.Increase the bandwidth on the slower link.
D.Configure policy-based routing for the SaaS application.
AnswerA

An SD-WAN rule configured with an application match for the SaaS traffic and a preferred member set to the faster link is the correct approach because SD-WAN rules can steer traffic based on Layer 7 application signatures and dynamic link performance metrics. The preferred member acts as a tie-breaker, forcing the traffic to use the specified interface as long as it meets the SD-WAN health-check SLA (latency, jitter, packet loss), while still allowing automatic failover to the backup link if the preferred link degrades. This preserves redundancy and ensures the SaaS application consistently uses the best-performing path.

Why this answer

SD-WAN rules allow you to define traffic steering policies based on application or destination, and setting a preferred member explicitly directs matching traffic to the faster link. This overrides the default load-balancing algorithm, ensuring critical SaaS traffic uses the optimal path without affecting other traffic.

Exam trap

The trap here is that candidates often confuse SD-WAN rules with policy-based routing, thinking PBR can achieve the same result, but PBR lacks SD-WAN's application awareness, SLA monitoring, and seamless failover integration.

How to eliminate wrong answers

Option B is wrong because removing the slower link from the SD-WAN interface would eliminate redundancy and failover capability, not solve the traffic steering issue. Option C is wrong because increasing bandwidth on the slower link does not change the SD-WAN load-balancing decision; the traffic would still be sent to that link based on the current algorithm. Option D is wrong because policy-based routing (PBR) is a static routing mechanism that does not integrate with SD-WAN's dynamic path selection, performance SLA monitoring, or application-based steering, and it can conflict with SD-WAN rules.

Practice this question →
53
MCQmedium

A network administrator needs to configure a FortiGate to allow administrative access from a specific management subnet only. Which configuration step should be taken?

A.Create a local-in policy to permit traffic from the management subnet.
B.Disable administrative access on all interfaces except the management interface.
C.Configure an inbound firewall policy allowing HTTPS from the management subnet to the FortiGate's interface IP.
D.Under system > admin > settings, restrict administrative access to trusted hosts.
AnswerD

Why this answer

The 'Trusted Hosts' feature under System > Admin > Settings allows you to restrict administrative access (HTTPS, SSH, Telnet, etc.) to specific source IP addresses or subnets. This is the intended method for limiting management access to a management subnet without affecting other traffic or interface configurations.

Exam trap

The trap here is that candidates often confuse local-in policies with trusted hosts, thinking that a local-in policy is the primary method for restricting management access, when in fact trusted hosts is the simpler and correct approach for source-based restriction.

How to eliminate wrong answers

Option A is wrong because a local-in policy filters traffic destined to the FortiGate itself, but it is typically used for advanced traffic shaping or rate limiting, not for restricting administrative access based on source subnet; using it for this purpose would be overly complex and not the standard practice. Option B is wrong because disabling administrative access on all interfaces except the management interface does not restrict access by source IP; it only limits which interfaces can be used for management, but any host on the management subnet could still access the FortiGate from that interface. Option C is wrong because an inbound firewall policy controls traffic passing through the FortiGate (forward traffic), not traffic destined to the FortiGate itself (local-in traffic); administrative access is governed by local-in policies or trusted hosts, not by standard firewall policies.

Practice this question →
54
Multi-Selectmedium

A FortiGate administrator needs to configure NTP to ensure accurate time on the device. Which two steps are required? (Choose two.)

Select 2 answers
A.Enable the 'Sync on Save' option
B.Specify at least one NTP server address
C.Enable NTP under System > Settings
D.Configure a firewall policy to allow NTP traffic (UDP 123)
E.Set the time zone to the local time zone
AnswersB, C

At least one server is required for synchronization.

Why this answer

To configure NTP on a FortiGate, you must enable the NTP service under System > Settings (option C) and specify at least one NTP server address (option B) so the device can synchronize its clock. Without enabling the service, the NTP client process does not run, and without a server address, there is no source to query. Option A (Sync on Save) is unrelated to NTP; it refers to configuration changes.

Option D (firewall policy) is not required because the FortiGate's NTP client uses the management interface and bypasses regular firewall policies. Option E (set time zone) is not a required step for NTP synchronization, though it may be configured separately.

Exam trap

The trap is that candidates may think a firewall policy is necessary for NTP traffic, but FortiGate's own NTP client uses the management interface and does not require a policy. Additionally, some may confuse 'Sync on Save' with NTP, but that option is related to configuration changes, not time synchronization.

Practice this question →
55
MCQmedium

A network administrator notices that after configuring a new static route on a FortiGate, traffic to a remote subnet is still being forwarded via the default route. The administrator confirms the static route is present in the routing table with a lower distance than the default route. What is the MOST likely cause?

A.The static route is disabled by a firewall policy.
B.The static route is configured with a higher priority than the default route.
C.The static route's destination subnet overlaps with a directly connected subnet.
D.The static route's gateway is not reachable via any interface.
AnswerD

If the next-hop gateway is unreachable (no ARP entry or interface down), the route will not be installed in the routing table, and traffic will use the default route.

Why this answer

If the gateway specified in the static route is not reachable via any interface (e.g., the next-hop IP is not on a directly connected subnet or there is no ARP resolution), FortiGate will not install the route in the forwarding information base (FIB). The route may appear in the routing table but will be marked as inactive, causing traffic to still use the default route with a higher distance. FortiGate requires the next-hop to be reachable on a directly connected interface for the static route to be active.

Exam trap

The trap here is that candidates assume a static route with a lower administrative distance will always override the default route, but they overlook the critical requirement that the next-hop must be directly reachable for the route to be active in FortiGate's routing table.

How to eliminate wrong answers

Option A is wrong because firewall policies do not disable static routes; they control traffic flow based on source/destination, not route activation. Option B is wrong because 'priority' in FortiGate is synonymous with administrative distance, and the question states the static route has a lower distance (higher priority) than the default route, so this would not cause the issue. Option C is wrong because overlapping with a directly connected subnet would cause the static route to be ignored only if the destination is more specific; however, the question states the traffic is still using the default route, not the directly connected route, so this is not the cause.

Practice this question →
56
Multi-Selectmedium

An administrator is configuring SNMP on a FortiGate for monitoring. Which THREE items are required for SNMPv3 configuration?

Select 3 answers
A.Security level (authPriv or authNoPriv)
B.Authentication protocol (e.g., SHA) and privacy protocol (e.g., AES)
C.SNMP view definition for the user
D.SNMP community string (read-only or read-write)
E.SNMP user with username and authentication password
AnswersA, B, E

Security level defines whether authentication and privacy are used.

Why this answer

SNMPv3 requires a security level to define whether authentication and encryption are used. The security level (authPriv or authNoPriv) determines the operational mode for the user, making it a mandatory configuration element. Without specifying the security level, the FortiGate cannot enforce the appropriate authentication and privacy policies for SNMPv3 communications.

Exam trap

The trap here is that candidates often confuse SNMPv3 with SNMPv2c and incorrectly select the community string option, forgetting that SNMPv3 eliminates community strings in favor of user-based authentication and encryption.

Practice this question →
57
MCQhard

A FortiGate administrator configures policy-based routing (PBR) to direct traffic from subnet 192.168.1.0/24 to the internet via ISP1. However, traffic from that subnet is still using the default route via ISP2. What is the most likely cause?

A.The PBR rule's source address does not match the traffic correctly.
B.The default route has a lower administrative distance than the PBR rule.
C.PBR is not supported on FortiGate.
D.The PBR rule has a higher priority than the default route.
AnswerA

Why this answer

Policy-based routing (PBR) on FortiGate overrides the routing table only when the traffic matches all configured criteria, including the source address. If the source address in the PBR rule does not match 192.168.1.0/24 exactly (e.g., a typo, wrong subnet mask, or missing entry), the traffic falls through to the default route via ISP2. This is the most likely cause because PBR rules are evaluated before the routing table, but only for matching traffic.

Exam trap

The trap here is that candidates often confuse PBR with static routing and assume the default route's administrative distance or priority can override PBR, but PBR is evaluated before the routing table and is not subject to route metrics.

How to eliminate wrong answers

Option B is wrong because administrative distance is a property of routes in the routing table, not of PBR rules; PBR operates before the routing table lookup and is not compared to administrative distance. Option C is wrong because PBR is fully supported on FortiGate, including in NSE4 scope, and is commonly used for multi-WAN setups. Option D is wrong because a higher priority in PBR would make the rule more likely to match, not less; the issue is that the rule is not matching at all, not that it is being overridden by the default route.

Practice this question →
58
MCQmedium

A network administrator is configuring a new FortiGate and needs to ensure that all traffic from the internal network to the internet is source NATed to the public IP address on port1. The default route points to port1. Which configuration step is required to achieve this?

A.Configure a static route to the internet with NAT enabled
B.Enable NAT on the firewall policy from internal to internet
C.Set the interface port1 to NAT mode in its settings
D.Create an IP pool with the public IP and reference it in the policy
AnswerB

In FortiGate, source NAT is performed by enabling the NAT option on the firewall policy that matches the internal-to-internet traffic. This setting causes the FortiGate to masquerade the source IP of each packet with the IP address assigned to the egress interface, which is typically the public IP of the WAN port. This is the standard and correct method for allowing internal users to share a single public IP address when accessing the internet.

Why this answer

Source NAT (SNAT) on a FortiGate is configured at the firewall policy level, not on the interface or via a static route. By enabling NAT on the firewall policy from the internal network to the internet, the FortiGate automatically translates the source IP of traffic egressing port1 to the interface's primary IP address (the public IP). This is the standard method for implementing source NAT in FortiOS, as defined in the FortiGate Administration Guide.

Exam trap

The trap here is that candidates often confuse NAT configuration with interface settings or static routes, mistakenly thinking NAT must be enabled on the egress interface or as part of the route, whereas FortiOS applies NAT exclusively at the firewall policy level.

How to eliminate wrong answers

Option A is wrong because static routes in FortiOS do not have a NAT toggle; NAT is not a property of a route but of a firewall policy. Option C is wrong because interfaces in FortiOS do not have a 'NAT mode' setting; NAT is applied per policy, not per interface. Option D is wrong because an IP pool is only required when you need to translate to a specific IP address that is not the interface IP (e.g., for load balancing or PAT with a pool), but the question states the public IP is on port1, so the default interface NAT (enabled in the policy) suffices without an IP pool.

Practice this question →
59
MCQhard

An administrator configures a VLAN interface on a FortiGate's physical port with the IP 192.168.10.1/24. The VLAN ID is 10. The administrator connects a switch port configured as an access port (untagged) in VLAN 10. The devices on the switch cannot ping the FortiGate's VLAN interface. What is the most likely cause?

A.The switch port should be configured as a trunk port allowing VLAN 10
B.The FortiGate's physical port is not set to the same VLAN ID
C.The FortiGate's administrative access is not enabled on the VLAN interface
D.The FortiGate's VLAN interface is not assigned to any VDOM
AnswerA

The switch port must send tagged frames (trunk) for the FortiGate VLAN interface to recognize them.

Why this answer

The switch port is configured as an access port, which sends frames untagged. However, the FortiGate's VLAN interface expects to receive 802.1Q-tagged frames because the VLAN is defined as a subinterface on the physical port. For the FortiGate to process traffic for VLAN 10, the switch port must be configured as a trunk (or tagged) port that sends frames with the VLAN 10 tag.

An access port strips the tag, so the FortiGate never sees the VLAN 10 traffic.

Exam trap

The trap here is that candidates often confuse access/trunk port behavior with VLAN interface configuration on firewalls, mistakenly thinking an access port is sufficient because the VLAN ID matches, when in fact the FortiGate requires tagged frames for subinterfaces.

How to eliminate wrong answers

Option B is wrong because the FortiGate's physical port does not have a VLAN ID setting; VLANs are defined as subinterfaces, and the VLAN ID is set on the VLAN interface itself, not on the physical port. Option C is wrong because administrative access (e.g., HTTPS, SSH, ping) is a separate setting that controls management protocols, not basic IP connectivity; the devices cannot ping due to a Layer 2 tagging mismatch, not because ping is disabled. Option D is wrong because VDOM assignment is only relevant in multi-tenant or virtualized FortiGate configurations; by default, all interfaces belong to the root VDOM, and the VLAN interface would still be reachable if the tagging were correct.

Practice this question →
60
MCQmedium

After upgrading FortiGate firmware from 6.0 to 7.2, an administrator notices that a static route pointing to a next-hop IP 10.0.0.1 is no longer working. The route is present in the configuration but the FortiGate shows it as 'not active'. What is the MOST likely cause?

A.FortiGate now requires a default administrative distance of 10 for static routes
B.The route was deleted during the upgrade and needs to be re-added
C.The next-hop IP is not directly connected to any FortiGate interface
D.The remote gateway is down
AnswerC

FortiGate static routes require the next-hop IP (gateway) to be on a directly connected subnet of the outgoing interface. If the gateway is not directly connected to any FortiGate interface, the route cannot be resolved via ARP or neighbor discovery, so FortiGate marks the route as inactive and does not install it in the forwarding table. This is the most common and specific cause of an inactive static route after a configuration change or upgrade that alters interface IPs or subnet masks.

Why this answer

In FortiOS 7.2, a static route is considered 'active' only if the next-hop IP is reachable via a directly connected interface. If the next-hop IP 10.0.0.1 is not on a directly connected subnet, the route will be present in the configuration but marked as 'not active'. This is a fundamental routing principle: the next hop must be directly reachable (i.e., the router must have an ARP entry for it) for the route to be installed in the routing table.

Exam trap

The trap here is that candidates often assume a static route will be active as long as the configuration is present and the remote gateway is reachable, but FortiGate (and most routers) require the next-hop IP to be directly connected for the route to be installed in the routing table.

How to eliminate wrong answers

Option A is wrong because the default administrative distance for static routes in FortiOS remains 10 (unchanged from 6.0 to 7.2), and administrative distance does not affect whether a route is 'active'—it only influences route selection among multiple routes to the same destination. Option B is wrong because the route is still present in the configuration, so it was not deleted during the upgrade; the issue is that it is not active, not that it is missing. Option D is wrong because the remote gateway being down would cause the route to be present but possibly inactive only if the next hop is directly connected; if the next hop is not directly connected, the route would be inactive regardless of the remote gateway's state.

Practice this question →

Ready to test yourself?

Try a timed practice session using only System and Network Administration questions.

Start 20-question session