CCNA Nse6 Security Fabric Specialist Topics Questions

MCQmedium

You are configuring FortiWeb in reverse proxy mode. A client is receiving 403 Forbidden errors for legitimate traffic due to a SQL injection false positive. Which feature should you modify to allow this traffic while maintaining security?

A.Enable Auto Learning

B.Disable the SQL Injection scanner entirely

C.Switch to Transparent mode

D.Create a WAF Exception for the specific signature ID

AnswerD

WAF exceptions allow administrators to bypass specific signature triggers for known legitimate traffic patterns.

Why this answer

Custom signatures or exception rules allow for granular bypassing of specific signatures that trigger false positives.

Practice this question →

MCQmedium

You are deploying FortiWeb in a cloud environment. You need to ensure the WAF learns legitimate user behavior. Which mode should you start in to avoid blocking legitimate traffic?

A.Bypass Mode

B.Offline Mode

C.Prevention Mode

D.Detection Mode

AnswerD

Detection mode allows traffic while logging violations for analysis.

Why this answer

Detection mode allows the FortiWeb to analyze traffic and build a baseline without actively blocking requests.

Practice this question →

MCQhard

You have multiple FortiADC nodes in a High Availability (HA) cluster. Which synchronization method ensures that the session table is shared between nodes to prevent user disconnects during a failover?

A.Session Synchronization

B.Database Replication

C.VRRP Heartbeat

D.Configuration Sync

AnswerA

This ensures the session state is mirrored to the secondary node.

Why this answer

Session sync (or HA synchronization) is essential for maintaining stateful connections during failover.

Practice this question →

MCQhard

FortiAuthenticator is acting as a SAML Service Provider for a FortiGate. Users are failing to authenticate. Where should you check the logs to determine if the SAML assertion was received and parsed correctly?

A.FortiAnalyzer Traffic Log

B.FortiGate Event Log

C.RADIUS Authentication Log

D.FortiAuthenticator SAML log

AnswerD

The SAML specific logs verify if the IDP (FortiAuthenticator) correctly communicated with the SP.

Why this answer

The SAML debug logs on the FortiAuthenticator provide detail on the assertion exchange and attribute mapping.

Practice this question →

Multi-Selectmedium

Which TWO of the following steps are required to integrate FortiAuthenticator with a FortiGate for RADIUS authentication?

Select 2 answers

A.Install a web certificate on the FortiGate

B.Enable LDAP on the FortiAuthenticator

C.Configure FortiAuthenticator as a RADIUS Server on FortiGate

D.Configure SAML on the FortiGate

E.Add the FortiGate IP as a RADIUS Client on FortiAuthenticator

AnswersC, E

FortiGate needs to know where to send the auth request.

Why this answer

Integration requires defining the FortiAuthenticator as a RADIUS server on the FortiGate and ensuring the FortiGate is a registered client on the FortiAuthenticator.

Practice this question →

MCQmedium

In the context of the Security Fabric, what is a 'root' FortiGate?

A.The firewall with the most ports

B.The oldest firewall in the office

C.The device that controls the Fabric and collects telemetry

D.A virtual appliance

AnswerC

The root device acts as the central point for Fabric management and data collection.

Why this answer

The root FortiGate is the top-level management device that orchestrates other members in the Fabric.

Practice this question →

MCQeasy

Which service does FortiAuthenticator provide to enable centralized management of user identities?

A.Identity and Access Management (IAM)

B.Packet filtering

C.Load balancing

D.Web application firewalling

AnswerA

FortiAuthenticator is the centralized IAM solution in the Fortinet portfolio.

Why this answer

FortiAuthenticator serves as an LDAP/RADIUS server for centralized credential management.

Practice this question →

Multi-Selectmedium

Which THREE objects are required to configure a basic load balancing setup in FortiADC?

Select 3 answers

A.Virtual Server

B.Server Pool

C.WAF Policy

D.Content Routing Policy

E.Real Server

AnswersA, B, E

The listener that clients connect to.

Why this answer

Load balancing requires a real server, a server pool, and a virtual server to bind them.

Practice this question →

Multi-Selecteasy

Which TWO products provide identity-based security within the Fortinet portfolio?

Select 2 answers

A.FortiSwitch

B.FortiAP

C.FortiADC

D.FortiGate

E.FortiAuthenticator

AnswersD, E

FortiGate enforces identity-based policies.

Why this answer

FortiGate and FortiAuthenticator work together to provide identity-based access control.

Practice this question →

MCQhard

In a FortiWeb high-availability cluster, how are the synchronization settings for SSL certificates managed?

A.Automatic sync via the HA configuration

B.Manual file upload to each node

C.Using a shared external NFS mount

D.Via FortiManager only

AnswerA

In an HA cluster, FortiWeb synchronizes configuration objects and certificates automatically.

Why this answer

SSL certificates must be synchronized across the cluster to ensure consistent decryption of incoming traffic.

Practice this question →

MCQhard

You have a cluster of FortiWebs. You need to ensure that the session table is shared among members. What is this feature called?

A.Persistence Sharing

B.State Replication

C.Session Synchronization

D.Configuration Sync

AnswerC

Session synchronization allows members to share the current session table.

Why this answer

Session synchronization is required in clusters to maintain state if a failover occurs.

Practice this question →

MCQeasy

What is the function of the FortiGate's 'Security Fabric' connector?

A.To connect to physical power outlets

B.To reset the firewall

C.To integrate with external platforms like AWS or Azure

D.To bypass the firewall

AnswerC

Connectors enable the Fabric to extend into hybrid cloud environments.

Why this answer

Connectors link the Security Fabric to external cloud and virtualization platforms.

Practice this question →

MCQmedium

You are deploying FortiWeb in 'Reverse Proxy' mode. Where should the default gateway of the backend web servers point?

A.To a secondary FortiGate

B.To the FortiWeb internal interface

C.To the Loopback interface

D.Directly to the Internet

AnswerB

Ensures traffic flows symmetrically back through the appliance.

Why this answer

In reverse proxy mode, the FortiWeb handles the traffic; the servers should communicate back through the load balancer or the network gateway.

Practice this question →

MCQhard

When integrating FortiAuthenticator with a Windows Active Directory, why is it recommended to use a service account with limited privileges?

A.To adhere to the principle of least privilege

B.To allow easier backup

C.To increase speed

D.To bypass password expiration

AnswerA

Using a low-privilege service account limits the scope of potential attacks.

Why this answer

Following the principle of least privilege ensures that the compromise of the service account does not compromise the entire domain.

Practice this question →

MCQmedium

You are troubleshooting a scenario where FortiADC is failing to perform health checks on a backend server. Which log should you prioritize to identify the specific reason for the health check failure?

A.System Event Logs

B.Session Table Logs

C.Application Traffic Logs

D.Security Policy Logs

E.SNMP Traps

AnswerA

Health check status changes are logged under System Event logs.

Why this answer

The FortiADC system logs, specifically those related to health check events, provide details on why a node is marked as down.

Practice this question →

Multi-Selecthard

Which TWO of the following are true regarding FortiADC's ability to perform Layer 7 load balancing?

Select 2 answers

A.It can route traffic based on HTTP headers or URL patterns

B.It requires all backend servers to be on the same subnet

C.It can manipulate HTTP request and response headers

D.It only supports TCP-based traffic

E.It cannot perform health checks on web servers

AnswersA, C

Layer 7 inspection is required for content-aware routing.

Why this answer

Layer 7 load balancing allows for content-based routing and cookie-based persistence.

Practice this question →

Multi-Selectmedium

Which THREE types of logs can be generated by FortiWeb?

Select 3 answers

A.Packet Capture Log

B.Event Log

C.Traffic Log

D.User Billing Log

E.Attack Log

AnswersB, C, E

Logs system and maintenance events.

Why this answer

FortiWeb logs include traffic, attack, and system events for comprehensive auditing.

Practice this question →

MCQeasy

What is the primary function of the Security Fabric's 'Automation Stitch' feature?

A.To synchronize user databases

B.To trigger actions based on system events

C.To scan for vulnerabilities

D.To load balance traffic

AnswerB

Automation stitches use triggers and actions for automated response.

Why this answer

Automation Stitches trigger actions based on specific events detected by the Security Fabric.

Practice this question →

MCQhard

A FortiADC is deployed to load balance SMTP traffic. Which health check type should be used?

A.RADIUS

B.HTTP

C.DNS

D.TCP

AnswerD

A TCP connect check verifies the port is accepting connections.

Why this answer

The TCP health check is the standard for verifying the availability of a port for services like SMTP.

Practice this question →

Multi-Selecteasy

Which TWO actions can be automated via a FortiGate Automation Stitch?

Select 2 answers

A.Modify the BIOS settings

B.Quarantine a host

C.Purchase hardware

D.Send an email alert

E.Perform a software update on a server

AnswersB, D

Host isolation is a common security action.

Why this answer

Automation stitches commonly trigger alerts (email/logs) or network actions (quarantine).

Practice this question →

MCQeasy

What is the purpose of the 'Security Fabric' dashboard on the FortiGate?

A.To manage FortiCloud billing

B.To update antivirus signatures

C.To configure VPN tunnels

D.To view the topology and status of connected devices

AnswerD

The Fabric dashboard shows the health and connectivity of the entire security ecosystem.

Why this answer

The dashboard provides a visual topology and overview of all connected Fabric devices.

Practice this question →

MCQeasy

What is the benefit of using FortiAnalyzer in the Security Fabric?

A.It provides hardware acceleration for the FortiGate

B.It manages ISP failover

C.Centralized logging and reporting

D.It replaces the FortiGate firewall

AnswerC

The primary role of FortiAnalyzer is log management and forensic reporting.

Why this answer

FortiAnalyzer provides centralized log aggregation and analytics for the entire Fabric.

Practice this question →

Multi-Selecthard

Which THREE options are available for the 'Action' setting in a FortiWeb WAF policy?

Select 3 answers

A.Block

B.Monitor

C.Alert

D.Encrypt

E.Bypass

AnswersA, B, C

Discards the request.

Why this answer

Standard actions include blocking, alerting, and monitoring traffic.

Practice this question →

MCQhard

A FortiADC is reporting 'Server Busy' for a pool member. What does this indicate?

A.The server is rejected by the health check

B.The server is down

C.The server has reached its max connection limit

D.The ADC is experiencing high CPU

AnswerC

The ADC tracks server capacity and marks it busy when limits are hit.

Why this answer

The 'Server Busy' status usually means the server has reached its connection limit as defined in the server object.

Practice this question →

MCQeasy

In the context of FortiAuthenticator, what does 'SSO' stand for?

A.Single Sign-On

B.Standard Security Option

C.Service Security Object

D.Secure System Operation

AnswerA

SSO enables centralized authentication across multiple platforms.

Why this answer

Single Sign-On is the feature that allows users to authenticate once to access multiple resources.

Practice this question →

MCQmedium

In a FortiADC deployment, you need to ensure that the load balancer terminates SSL connections from clients and initiates a new connection to the backend server. Which feature should you configure?

A.Server Persistence

B.HTTP Header Insertion

C.SSL Offloading

D.Layer 4 Load Balancing

AnswerC

SSL Offloading terminates the client SSL and provides inspection capabilities.

Why this answer

SSL Offloading (or SSL Termination) allows the FortiADC to decrypt the traffic, inspect it, and then re-encrypt it before sending it to the backend.

Practice this question →

Multi-Selecteasy

Which THREE of the following are components of the Fortinet Security Fabric that can provide telemetry or data to the FortiGate?

Select 3 answers

A.FortiAP

B.FortiSwitch

C.FortiAnalyzer

D.A local DNS server without a Forti agent

E.A standard third-party unmanaged switch

AnswersA, B, C

FortiAP provides wireless access telemetry.

Why this answer

The Security Fabric is designed to integrate FortiSwitch, FortiAP, FortiAnalyzer, and other devices for shared intelligence.

Practice this question →

MCQmedium

Which identity provider type is most recommended for multi-factor authentication (MFA) within FortiAuthenticator?

A.SAML External IDP

B.FortiToken

C.OpenLDAP

D.Local Database

AnswerB

FortiToken provides seamless MFA integration within the FortiAuthenticator environment.

Why this answer

FortiToken is the native MFA solution integrated deeply with the FortiAuthenticator platform.

Practice this question →

Multi-Selecthard

Which TWO are common causes for a 'Security Fabric' connection failure between FortiGate and FortiAnalyzer?

Select 2 answers

A.Keyboard layout mismatch

B.Outdated browser

C.Incorrect IP/Port connectivity

D.High CPU on FortiGate

E.Invalid Fabric credentials

AnswersC, E

Network issues prevent the Fabric handshake.

Why this answer

Network reachability and mismatched credentials/certificates are the most common causes for connection drops.

Practice this question →

MCQhard

In a FortiADC environment, you are implementing a Layer 7 load balancing rule. You need to rewrite the HTTP request header 'X-Forwarded-For' to include the client IP address. Which tool should you use?

A.Configure a SNAT pool

B.Apply a WAF profile

C.Modify the Virtual Server interface

D.Use a Header Rewrite script

AnswerD

Header rewrite scripts are designed for this modification.

Why this answer

FortiADC content routing and header modification rules are used to manipulate HTTP headers.

Practice this question →

MCQhard

You are troubleshooting a FortiADC health check. The health check is failing even though the server is up. What should you verify first?

A.The ADC management IP

B.Expected Response code in the Health Check object

C.Server RAM utilization

D.The switch MTU

AnswerB

If the server returns 200 OK but the health check expects 302, it will fail.

Why this answer

The health check method and the expected status code in the response are critical for verification.

Practice this question →

Multi-Selecthard

Which THREE features are provided by the FortiADC when acting as an application delivery controller?

Select 3 answers

A.Email routing

B.Layer 7 Load Balancing

C.Web Application Firewall (WAF)

D.Global Server Load Balancing (GSLB)

E.DHCP server

AnswersB, C, D

L7 load balancing allows traffic routing based on content.

Why this answer

FortiADC provides load balancing, WAF capabilities, and global traffic management.

Practice this question →

MCQhard

You are integrating FortiAuthenticator with a FortiGate to provide SSO for VPN users. The users are successfully authenticating against AD, but they are not being assigned the correct group-based firewall policies. What is the most likely cause?

A.The FortiGate is not joined to the AD domain

B.The VPN tunnel is using IKEv1 instead of IKEv2

C.The FortiAuthenticator is in local authentication mode

D.RADIUS VSAs are not correctly configured to include group information

AnswerD

Without the correct VSA attributes, the FortiGate cannot map the user to the correct policy group.

Why this answer

FortiAuthenticator must pass the group membership information to the FortiGate via the RADIUS VSA (Vendor Specific Attribute) or FSSO, and the FortiGate must be configured to map these groups.

Practice this question →

MCQmedium

You need to implement a persistence method in FortiADC where the user is tied to the server based on the cookie provided by the backend application. Which method do you choose?

A.Source IP Persistence

B.Cookie Persistence

C.Round Robin

D.Least Connections

AnswerB

Cookie persistence allows the load balancer to track the user session via application cookies.

Why this answer

Cookie-based persistence, specifically 'Insert Cookie' or 'Passive Cookie', is the standard for application-level persistence.

Practice this question →

Multi-Selectmedium

Which TWO of the following are valid ways for FortiAuthenticator to receive user authentication requests?

Select 2 answers

A.NTP

B.TACACS+

C.RADIUS

D.ARP

E.ICMP

AnswersB, C

TACACS+ is used for administrative access control and is supported.

Why this answer

FortiAuthenticator supports standard protocols like RADIUS and TACACS+.

Practice this question →

MCQmedium

Which component of the FortiADC performs the translation between the virtual IP and the real server IP?

A.The Real Server group

B.The Health Check probe

C.The Virtual Server

D.The Content Routing policy

AnswerC

The virtual server is the front-end entity that processes incoming traffic.

Why this answer

The Virtual Server binds the VIP to the server pool, performing the actual load balancing and NAT.

Practice this question →

MCQhard

You are configuring a FortiADC virtual server with SSL offloading. The backend servers require the original client IP to be preserved. What feature do you enable?

A.X-Forwarded-For header insertion

B.HTTP compression

C.SSL session resumption

D.Source IP NAT

AnswerA

Enabling X-Forwarded-For ensures the backend server sees the real client IP.

Why this answer

The X-Forwarded-For header is the standard way to inject the client IP into the HTTP request headers for the backend server.

Practice this question →

MCQmedium

A developer wants to use a REST API to configure FortiADC objects. Where can you find the documentation and schema for the FortiADC API?

A.On the FortiGuard portal

B.In the API Explorer within the FortiADC GUI

C.In the CLI reference guide

D.By calling technical support

AnswerB

The GUI includes an integrated API explorer for testing and documentation.

Why this answer

The API documentation is accessible directly through the FortiADC web interface.

Practice this question →

Multi-Selecthard

Which TWO parameters must match between the FortiAuthenticator and the FortiGate when configuring RADIUS authentication?

Select 2 answers

A.RADIUS port

B.Server IP Address

C.Device MAC address

D.Shared Secret

E.System hostname

AnswersB, D

The client must know the IP address of the RADIUS server.

Why this answer

Shared secret and server IP address are essential for RADIUS communication.

Practice this question →

MCQeasy

What is the primary function of the 'FortiToken'?

A.User database management

B.Secure storage for passwords

C.Two-factor authentication (2FA)

D.VPN encryption

AnswerC

FortiToken is used to generate the OTP for 2FA.

Why this answer

FortiToken provides a secondary factor for authentication, enhancing account security.

Practice this question →

Multi-Selectmedium

Which THREE elements are essential to define a user in FortiAuthenticator?

Select 3 answers

A.Home address

B.Group Membership

C.Password / Auth method

D.Username

E.Operating System Version

AnswersB, C, D

Defines the user's role and access rights.

Why this answer

Username, password (or authentication method), and group membership are fundamental.

Practice this question →

MCQmedium

On FortiWeb, which component is used to inspect traffic for protocol-specific attacks like HTTP Request Smuggling?

A.WAF Policy

B.Service Object

C.Virtual Server

D.Server Pool

AnswerA

The WAF policy defines the specific security modules and profiles applied to traffic.

Why this answer

The WAF policy contains the inspection profiles and rules required to detect protocol-level anomalies.

Practice this question →

MCQmedium

When integrating FortiWeb with FortiAnalyzer, which information is passed to FortiAnalyzer?

A.Full packet captures of all traffic

B.SSL Private keys

C.Only administrative login logs

D.Full security event logs

AnswerD

Security logs provide the necessary data for threat detection and reporting.

Why this answer

FortiWeb sends its security logs, allowing FortiAnalyzer to provide unified visibility.

Practice this question →

MCQmedium

Which FortiWeb feature is best used to detect 'Brute Force' attacks against a login page?

A.IP Reputation

B.Rate Limiting / Thresholds

C.Cookie signing

D.SQL Injection protection

AnswerB

Threshold rules allow you to track failed attempts and block IPs that exceed the limit.

Why this answer

Threshold rules are used to limit the number of attempts within a specific window of time.

Practice this question →

MCQeasy

Which FortiAuthenticator feature allows you to map LDAP groups to local FortiAuthenticator groups for administrative access?

A.SSO Domain

B.LDAP Filter

C.RADIUS Client

D.Group Mapping

AnswerD

Group mapping links external identity sources to local policy roles.

Why this answer

Group mapping enables the synchronization of external directory groups with internal policies.

Practice this question →

MCQeasy

In the Security Fabric, which protocol is primarily used for communication between the FortiGate and the FortiAnalyzer?

A.HTTPS

B.SNMP

C.Syslog

D.OFTP

AnswerD

OFTP is the dedicated protocol for Fabric communication and log delivery.

Why this answer

OFTP (Over-Fabric Transfer Protocol) is the secure protocol used for telemetry and log transport in the Security Fabric.

Practice this question →

MCQhard

FortiADC is configured with a Layer 7 policy. You notice that the persistence is failing for a specific application. Which persistence method is most appropriate for a cookie-based application?

A.Cookie Insert

B.Source IP Persistence

C.SSL Session ID

D.Round Robin

AnswerA

Cookie insert adds a unique session identifier to the application traffic, ensuring consistent routing.

Why this answer

Cookie insert persistence is the industry standard for tracking sessions in HTTP applications at Layer 7.

Practice this question →

MCQeasy

You are configuring a FortiWeb WAF policy to protect a web application. Which inspection mode is most effective for blocking SQL injection attacks while minimizing false positives in a production environment?

A.Offline mode with learning enabled

B.Prevention mode with signature-based scanning enabled

C.Transparent mode with only DoS prevention

D.Detection mode with no signatures

AnswerB

Prevention mode blocks traffic, and signature-based scanning correctly identifies SQL injection patterns.

Why this answer

Detection mode is for logging, while Prevention mode blocks attacks. Signature-based scanning is the standard for identifying known SQL injection patterns.

Practice this question →

MCQhard

You need to export logs from FortiAuthenticator to a remote syslog server. Which configuration path allows you to define this destination?

A.System > Log Settings > Remote Logging

B.Authentication > RADIUS > Logging

C.General > Reporting

D.Network > Interfaces

AnswerA

Remote logging configuration is centrally managed under System settings.

Why this answer

System settings allow for log forwarding to external syslog servers.

Practice this question →

MCQeasy

When adding a FortiWeb appliance to the Security Fabric, what is the primary prerequisite that must be met on the FortiGate?

A.Configure static routing between the devices

B.Enable the Security Fabric connector on the FortiGate

C.Disable all firewall policies

D.Manually create an IPsec tunnel between devices

AnswerB

The FortiGate must have the Fabric connector enabled to accept the connection.

Why this answer

The FortiGate acts as the root of the Security Fabric and must allow the FortiWeb to join via the Fabric connector settings.

Practice this question →

MCQmedium

You are integrating FortiWeb with FortiAnalyzer. What is the benefit of this integration in a Security Fabric context?

A.It enables hardware acceleration on FortiWeb

B.It bypasses the need for WAF policies

C.It provides centralized logging and advanced analytics

D.It allows FortiWeb to perform SSL offloading

AnswerC

This is the primary function of FortiAnalyzer in the Fabric.

Why this answer

FortiAnalyzer provides centralized logging and advanced reporting capabilities for the entire Fabric, including FortiWeb.

Practice this question →

MCQhard

A user is attempting to authenticate via a FortiAuthenticator-backed portal but receives an 'Access Denied' message. The user exists in the AD group mapped to the policy. What should you check first?

A.The AD domain controller's disk space

B.The FortiGate session table

C.FortiAuthenticator Authentication Logs

D.The WAF policy on FortiWeb

AnswerC

Authentication logs provide the reason for failure, such as wrong password or policy mismatch.

Why this answer

Checking the FortiAuthenticator authentication logs reveals if the credential was rejected or if the policy match failed.

Practice this question →

MCQhard

When using FortiAuthenticator to provide RADIUS authentication for a third-party VPN gateway, which setting must match between the two devices?

A.The Shared Secret

B.The RADIUS accounting port

C.The NAS-IP-Address

D.The VSA Vendor ID

AnswerA

The shared secret is the cryptographic key used to secure RADIUS packets.

Why this answer

The Shared Secret is the mandatory security parameter for RADIUS communication between a client and a server.

Practice this question →

Multi-Selecthard

Which THREE actions can be performed by a FortiWeb appliance when it detects a violation in a web request?

Select 3 answers

A.Automatically patch the server vulnerability

B.Log the request details

C.Redirect the client to a block page

D.Increase the backend server CPU

E.Drop the connection (Reset)

AnswersB, C, E

Logging is essential for audit and forensics.

Why this answer

FortiWeb can block the request, log it for analysis, or reset the connection.

Practice this question →

Multi-Selectmedium

Which TWO of the following are valid methods for FortiAuthenticator to receive user information from an external source?

Select 2 answers

A.SAML

B.SNMP Traps

C.ICMP

D.LDAP

E.HTTP Proxy

AnswersA, D

SAML is a primary protocol for IDP/SP communication.

Why this answer

LDAP and SAML are standard protocols used by FortiAuthenticator to sync or authenticate users.

Practice this question →

Multi-Selecteasy

Which TWO of the following are primary functions of a Web Application Firewall (WAF) like FortiWeb?

Select 2 answers

A.Managing local user account provisioning

B.Performing deep packet inspection for malware on email attachments

C.Offloading SSL/TLS processing from backend servers

D.Routing static IP traffic between subnets

E.Protecting against SQL injection and XSS

AnswersC, E

WAFs are commonly used for SSL offloading.

Why this answer

WAFs protect against OWASP Top 10 vulnerabilities and provide SSL termination/offloading for web applications.

Practice this question →

MCQmedium

You are implementing a WAF policy for a web application. Which profile should you use to prevent the disclosure of sensitive server-side information in error messages?

A.XSS profile

B.SQL Injection profile

C.Data Leak Prevention profile

D.Cookie security profile

AnswerC

DLP/Leak prevention masks sensitive info like error strings or credit card data.

Why this answer

The Leak Detection or Information Disclosure profile masks sensitive data like stack traces in error messages.

Practice this question →

MCQeasy

What is the primary benefit of the Security Fabric's 'Automation Stitch' feature?

A.Improving log compression

B.Increasing bandwidth

C.Automating incident response actions

D.Updating firmware

AnswerC

Automation stitches provide predefined triggers and actions for incident response.

Why this answer

Automation stitches allow for triggering actions (like isolating a host) based on detected events.

Practice this question →

MCQhard

A FortiADC deployment is experiencing high latency for HTTPS traffic. You suspect the SSL handshake is the bottleneck. Which tool in FortiADC is best suited to verify the SSL negotiation time?

A.Packet Capture (sniffer)

B.Traffic Monitor / SSL Dashboard

C.Log Access

D.System Health Monitor

AnswerB

These tools track handshake timing and SSL performance metrics.

Why this answer

The built-in traffic analyzer and SSL handshake metrics provide insight into the time taken to complete the TLS exchange.

Practice this question →

Multi-Selectmedium

Which TWO methods are used to share user group information in the Security Fabric?

Select 2 answers

A.SSO

B.VLAN tagging

C.LDAP group synchronization

D.DHCP option 43

E.DNS records

AnswersA, C

Single Sign-On propagates identities.

Why this answer

SSO and LDAP group synchronization are primary ways user metadata is propagated in the Fabric.

Practice this question →

MCQmedium

You are configuring a FortiWeb policy to protect a web application. You need to ensure that the WAF blocks SQL injection attempts while allowing legitimate traffic. Which operational mode should you configure in the server policy?

A.Prevention mode

B.Transparent mode

C.Learning mode

D.Detection mode

AnswerA

Prevention mode actively drops traffic that matches configured security signatures.

Why this answer

Prevention mode is the standard setting for WAF policies to actively block detected threats based on configured signatures.

Practice this question →

MCQeasy

Which object in FortiWeb is used to define the specific web server or virtual host that the WAF should inspect?

A.Inspection Profile

B.Server Object

C.Server Policy

D.Virtual Host Profile

AnswerC

The Server Policy links the virtual server and the security settings.

Why this answer

A Server Policy in FortiWeb defines the virtual server and the rules applied to it.

Practice this question →

Multi-Selecteasy

Which THREE of the following are core components of the Fortinet Security Fabric?

Select 3 answers

A.FortiGate

B.Standard Web Browser

C.Third-party printer

D.FortiAnalyzer

E.FortiManager

AnswersA, D, E

The firewall is the center of the Fabric.

Why this answer

FortiGate, FortiAnalyzer, and FortiManager are the primary pillars of the Security Fabric.

Practice this question →

Multi-Selectmedium

Which THREE items are required to successfully integrate a FortiAuthenticator with an Active Directory (AD) environment for identity-based policies?

Select 3 answers

A.Service account with read permissions

B.LDAP server IP address or FQDN

C.A list of all client machine MAC addresses

D.Domain administrator credentials for the bind user

E.The AD database file export

AnswersA, B, D

A service account is necessary to perform queries against the AD.

Why this answer

You need the AD server details, a service account with read access, and the domain credentials to bind to the directory.

Practice this question →

MCQmedium

You are configuring a FortiWeb WAF policy for a web application. You need to ensure that the WAF blocks requests that contain SQL injection patterns. Which feature should you enable in the WAF profile?

A.Enable SQL Injection in the WAF profile

B.Enable Buffer Overflow protection

C.Enable HTTP Protocol Validation

D.Enable Cross-site Scripting protection

AnswerA

This feature specifically targets SQL injection patterns.

Why this answer

SQL injection protection is a core feature of the signature-based protection in FortiWeb WAF profiles.

Practice this question →

MCQeasy

Which component of the FortiAuthenticator is responsible for the self-service portal where users can manage their own two-factor authentication tokens?

A.AD Connector

B.Admin GUI

C.RADIUS Server

D.User Portal

AnswerD

The User Portal allows users to manage their own settings.

Why this answer

The User Portal is the dedicated interface for end-users to manage their accounts and 2FA tokens.

Practice this question →

MCQmedium

A FortiADC is load balancing an HTTPS application. You need to offload SSL processing to the ADC to reduce server load. What is the correct object to configure for this?

A.Content Routing Policy

B.Client SSL Profile

C.Server SSL Profile

D.Layer 7 Persistence Rule

AnswerB

The Client SSL profile allows the ADC to act as the SSL endpoint for incoming client connections.

Why this answer

SSL offloading requires a Client SSL profile applied to the Virtual Server to handle the handshake and decryption.

Practice this question →

Multi-Selecteasy

Which THREE are key benefits of using FortiWeb to protect web applications?

Select 3 answers

A.Replacing the ISP

B.Physical security of the server room

C.Protection against SQL Injection

D.SSL Offloading

E.Regulatory compliance reporting

AnswersC, D, E

WAF blocks common web attacks.

Why this answer

FortiWeb protects against injection, provides SSL offloading, and offers compliance reporting.

Practice this question →

MCQhard

A user authenticated via FortiAuthenticator is unable to access a resource protected by a FortiGate policy. The policy uses the user's LDAP group. What is the most likely cause?

A.The FortiGate remote group is not defined for the LDAP server

B.The LDAP user account is locked

C.FortiAuthenticator is in maintenance mode

D.The user is using the wrong password

AnswerA

The FortiGate must explicitly know about the group to enforce policy-based access.

Why this answer

If the group is not correctly mapped in the FortiGate's remote group list, the user will not match the policy.

Practice this question →

MCQmedium

Which FortiWeb feature allows you to block traffic based on the geographic origin of the IP address?

A.Threshold rules

B.Country Blocking

C.IP Reputation

D.Signature set

AnswerB

Country blocking is a standard WAF feature to filter traffic by origin.

Why this answer

Geo-IP blocking allows administrators to restrict access based on country codes.

Practice this question →

MCQeasy

Which of the following is a component of the Fortinet Security Fabric?

A.A personal printer

B.A standard consumer router

C.A generic web server

D.FortiAnalyzer

AnswerD

FortiAnalyzer provides the central logging and analysis function of the Fabric.

Why this answer

FortiAnalyzer is a core element of the Security Fabric ecosystem.

Practice this question →

MCQeasy

In the Security Fabric, which feature allows the FortiGate to automatically quarantine a host that is identified as compromised by another Fabric device?

A.Security Rating

B.Automation Stitch

C.Fabric Connector

D.Log Correlation

AnswerB

Automation Stitches allow for cross-product automated responses.

Why this answer

The Automation Stitch is the component that triggers actions across the Fabric based on identified events.

Practice this question →

Multi-Selecthard

Which THREE features are provided by FortiAuthenticator when integrated into a Security Fabric to enforce identity-based access?

Select 3 answers

A.Single Sign-On (SSO) agentless polling

B.Certificate Authority (CA) services

C.LDAP/RADIUS user directory synchronization

D.Web Application Firewall (WAF) traffic inspection

E.FortiGate firewall policy enforcement

AnswersA, B, C

FAC supports SSO methods to authenticate users across the network.

Why this answer

FortiAuthenticator handles LDAP synchronization, certificate management, and SSO token issuance for the Fabric.

Practice this question →

MCQhard

You are debugging a SAML authentication issue where FortiAuthenticator is the IDP. The logs show 'Assertion expired'. What is the most likely cause?

A.The browser is blocked

B.The SAML certificate is self-signed

C.The user password is too old

D.Time skew between IDP and SP

AnswerD

SAML assertions have a strict validity window; if clocks are out of sync, the assertion is rejected.

Why this answer

Time skew between the IDP and SP (Service Provider) is the most common cause of expired assertion errors.

Practice this question →

MCQmedium

You are setting up a FortiGate Security Fabric. How do you authorize a downstream FortiSwitch to be managed by the FortiGate?

A.Via CLI using the 'exec switch authorize' command

B.By adding it to the FortiAnalyzer

C.By enabling LLDP on the port

D.By rebooting the switch

AnswerA

Authorizing the switch via the CLI or GUI is the mandatory step for Fabric control.

Why this answer

Authorization is required in the Managed FortiSwitch list to establish the management connection.

Practice this question →