troubleshooting

A FortiAnalyzer is failing to receive logs from a FortiGate. After verifying the IP connectivity and the FortiGate registration status, which setting should be checked next?

You are configuring FortiWeb in reverse proxy mode. A client is receiving 403 Forbidden errors for legitimate traffic due to a SQL injection false positive. Which feature should you modify to allow this traffic while maintaining security?

Which GUI menu is primarily used for monitoring real-time activity?

Which TWO of the following are common reasons for a policy installation failure in FortiManager?

An administrator needs to enforce DMARC 'reject' policy for incoming mail. Where is this enforced in FortiMail?

You have imported a new FortiGate into FortiManager. Which operation must you perform to synchronize the existing policy package with the new device?

You are deploying FortiWeb in a cloud environment. You need to ensure the WAF learns legitimate user behavior. Which mode should you start in to avoid blocking legitimate traffic?

You have multiple FortiADC nodes in a High Availability (HA) cluster. Which synchronization method ensures that the session table is shared between nodes to prevent user disconnects during a failover?

Which THREE types of dashboards can be viewed in FortiAnalyzer?

When using 'Log Forwarding', can you filter the logs before they are forwarded?

Which of the following is a mandatory step when creating a new ADOM in FortiManager?

When setting up a 'FortiSoC' playbook to send an email, what must be configured first?

You need to ensure that the FortiMail doesn't relay spam to external addresses. Which feature should be configured?

Which tab is used to monitor traffic logs from the managed FortiGates?

Which feature is essential for protecting against password-based malware in attachments?

Where do you go to view the real-time logs currently being received by the FortiAnalyzer?

Which TWO of the following steps are required to integrate FortiAuthenticator with a FortiGate for RADIUS authentication?

In the context of the Security Fabric, what is a 'root' FortiGate?

What happens when you change an ADOM's version?

When managing policy packages, what does the 'Policy Package' clone feature do?

An administrator is managing multiple FortiGate devices using FortiManager. They need to ensure that policy changes made in the ADOM are only pushed to specific firewalls. Which feature should they use to achieve granular control over policy deployment?

What is the primary function of the 'Sender Reputation' service?

What is the purpose of 'Auto-cache' for reports?

When using FortiSoC playbooks, what is the 'Connector' used for?

Which service does FortiAuthenticator provide to enable centralized management of user identities?

Which THREE objects are required to configure a basic load balancing setup in FortiADC?

Which feature allows FortiMail to perform automatic cleanup of old messages in the quarantine?

What is the purpose of the 'Relay Host' setting in FortiMail?

You are experiencing delays in mail delivery. Where is the best place to check for queued messages?

Which TWO products provide identity-based security within the Fortinet portfolio?

In a FortiWeb high-availability cluster, how are the synchronization settings for SSL certificates managed?

What is the function of the FortiGate's 'Security Fabric' connector?

What is the function of the 'Device Manager' in FortiAnalyzer?

Which THREE of the following are benefits of using ADOMs in FortiManager?

An administrator needs to revert a firewall configuration to a state from two weeks ago. Which feature in FortiManager allows for this recovery?

When configuring a Recipient Policy, what does the 'Action' field determine?

You are deploying FortiWeb in 'Reverse Proxy' mode. Where should the default gateway of the backend web servers point?

Which setting in the 'System Settings' is used to define the administrator's password policy?

When integrating FortiAuthenticator with a Windows Active Directory, why is it recommended to use a service account with limited privileges?

Which of the following is a symptom of a full quarantine storage?

Which TWO actions are commonly performed within the 'Device Manager' module?

You are troubleshooting a scenario where FortiADC is failing to perform health checks on a backend server. Which log should you prioritize to identify the specific reason for the health check failure?

Which object type should you use in FortiManager to ensure a consistent naming convention for address objects across multiple ADOMs?

You are the network security analyst for a company that has FortiGates at the headquarters and at 12 branch offices, all managed by a central FortiManager. The company recently added a FortiAnalyzer appliance and wants to ensure that all Security Fabric devices send their logs to it. You have added the FortiAnalyzer to the root FortiGate's Security Fabric and enabled log forwarding. However, the branch FortiGates are not showing any logs on the FortiAnalyzer. What is the most likely reason?

You are troubleshooting a failed policy installation. Where can you view the detailed diff between the FortiManager policy database and the actual FortiGate running configuration?

Which TWO of the following are true regarding FortiADC's ability to perform Layer 7 load balancing?

Which protocol is used for communication between the FortiMail and a remote LDAP server for user authentication?

What is the purpose of the 'Session Limit' setting in an Access Control Rule?

Which TWO methods can be used to authenticate users for access to the FortiMail quarantine portal?

Which tab in the FortiManager GUI is primarily used for managing firewall policies and objects?

You are troubleshooting a sync issue where a device shows 'Modified' status in the Device Manager. What is the most likely cause?

You are creating a new policy package. You need to ensure that shared objects from the Global ADOM are available. What is the correct workflow?

Which THREE types of logs can be generated by FortiWeb?

What happens when you change the 'Log Policy' to 'Archive only'?

Which TWO tasks are part of the 'Log Management' phase on FortiAnalyzer?

Which protocol is most secure for retrieving email from the FortiMail server?

Which of the following is true about 'Report Data Masking'?

What is the benefit of using 'FortiGuard' services with FortiMail?

How can you ensure that only encrypted traffic is allowed for webmail access?

When an email is encrypted using FortiMail's Identity-Based Encryption (IBE), what does the recipient receive?

What is the primary function of the FortiAnalyzer 'Log View' page?

Which THREE items are found in the 'System Settings' area?

In which configuration area are 'Content Profiles' created and modified?

An analyst notices that a FortiAnalyzer appliance is not archiving logs to a configured remote storage server, even though the local disk still has free space. The administrator confirms the archive schedule is enabled and the remote server is reachable. Which setting should the analyst verify first?

What is the primary function of the Security Fabric's 'Automation Stitch' feature?

Which TWO methods can be used to back up FortiAnalyzer configuration?

What is the purpose of 'Revision History' when it comes to policy packages?

A FortiADC is deployed to load balance SMTP traffic. Which health check type should be used?

A user reports that they cannot see any data in 'FortiView' for a specific device. What is the most likely cause?

You are troubleshooting a scenario where an Event Handler is not triggering as expected. What is the most effective way to verify if the logs are matching the filter criteria defined in the handler?

Which TWO of the following are valid log file types supported by FortiAnalyzer?

Which THREE settings are required for successful DKIM signing on outgoing mail?

Which TWO actions can be automated via a FortiGate Automation Stitch?

What is the purpose of the 'Security Fabric' dashboard on the FortiGate?

Where do you check the current status of the FortiMail services?

Which TWO of the following are valid ways to monitor the status of managed FortiGate devices in the Device Manager?

Which THREE components are visible in the 'Log View' interface?

When adding a FortiGate to a FortiAnalyzer, which information is required?

In Gateway mode, what is the default behavior when FortiMail receives an email for an unknown recipient?

What is the purpose of an 'Event Handler' in FortiAnalyzer?

What is the benefit of using FortiAnalyzer in the Security Fabric?

Which component of FortiAnalyzer is used to identify top talkers on the network?

Which configuration file format is used for importing user lists?

You are managing a FortiManager ADOM that contains multiple FortiGate devices. You notice that the 'Device Status' shows 'Modified'. What does this indicate?

Where do you configure the email server settings for FortiManager alert notifications?

Which THREE actions are available in the 'DLP' section of a policy?

A FortiADC is reporting 'Server Busy' for a pool member. What does this indicate?

Which FortiMail feature helps to prevent 'backscatter' when dealing with spam?

You are configuring DKIM signing on FortiMail. The administrator has generated the public/private key pair. Where must the public key be published to ensure the receiving MTA validates the email correctly?

When using 'Install Wizard', what does the 'Auto-update' check-box do?

If an administrator needs to ensure that a specific set of CLI commands is always applied during the deployment of a new device, which tool should be used?

How can you restrict management access to the FortiMail GUI to only specific IP addresses?

Which dashboard provides a 'Threat Map'?

Which TWO settings are configurable in a 'Recipient Policy'?

What is a 'Playbook' in the context of FortiSoC?

A playbook is failing to execute an action on a FortiGate. Which tool is used to view the execution history and logs of the playbook?

Which TWO of the following are components of the FortiMail AntiSpam framework?

You are deploying a new policy package to multiple FortiGate devices. Which FortiManager feature allows you to verify that the policies are syntactically correct before pushing them to the production environment?

In the context of FortiAuthenticator, what does 'SSO' stand for?

In a FortiADC deployment, you need to ensure that the load balancer terminates SSL connections from clients and initiates a new connection to the backend server. Which feature should you configure?

What must occur before a FortiGate can be managed by a specific ADOM in FortiManager?

Which THREE of the following are components of the Fortinet Security Fabric that can provide telemetry or data to the FortiGate?

Which TWO of the following are valid states for a device in FortiManager?

Which of the following is a valid method for importing a FortiGate configuration into FortiManager?

You are a network security analyst managing a FortiManager appliance that administers 40 FortiGate devices. A new security policy was created and installed on all managed FortiGates. A week later, an administrator accidentally modifies a firewall address object directly on one of the FortiGates via its local GUI. When FortiManager next retrieves the device configuration, what will it report?

Which protocol is utilized for log forwarding between FortiAnalyzer units?

Which dashboard shows the health status of all registered devices?

Which THREE actions can be performed on a policy package within the Policy & Objects tab?

In a FortiADC environment, you are implementing a Layer 7 load balancing rule. You need to rewrite the HTTP request header 'X-Forwarded-For' to include the client IP address. Which tool should you use?

You are troubleshooting a FortiADC health check. The health check is failing even though the server is up. What should you verify first?

Which THREE features are provided by the FortiADC when acting as an application delivery controller?

When using the FortiManager 'Install Wizard' to push configuration changes, what happens if the policy package being pushed contains objects that do not exist on the target FortiGate?

You are integrating FortiAuthenticator with a FortiGate to provide SSO for VPN users. The users are successfully authenticating against AD, but they are not being assigned the correct group-based firewall policies. What is the most likely cause?

What happens to the logs if a FortiAnalyzer reaches its 'Maximum Storage' limit?

Which FortiView tool allows you to see traffic patterns based on geographical origin?

Which TWO methods can be used to authenticate administrative users on FortiAnalyzer?

You need to implement a persistence method in FortiADC where the user is tied to the server based on the cookie provided by the backend application. Which method do you choose?

Which TWO of the following are valid ways for FortiAuthenticator to receive user authentication requests?

Which component of the FortiADC performs the translation between the virtual IP and the real server IP?

When using FortiMail in Server Mode, how does the appliance handle incoming mail?

Which THREE items are checked by the AntiSpam profile during email processing?

Which TWO of the following are mandatory steps when configuring an ADOM in FortiManager?

A developer wants to use a REST API to configure FortiADC objects. Where can you find the documentation and schema for the FortiADC API?

An administrator is using the 'Policy Lookup' tool in FortiManager. What does this tool provide?

Which TWO actions can be triggered by a FortiSoC Playbook?

An administrator wants to prevent email spoofing by verifying the sender's domain. Which policy should be configured to check the DNS TXT record of the sending domain?

Which TWO actions occur during the FortiMail inspection process before an email is delivered?

What is the primary function of the 'FortiToken'?

What does the 'Auto-Link' feature in the 'Policy & Objects' tab do?

What is the primary function of the 'Object' menu within the Policy & Objects tab?

Which THREE elements are part of the Event Handler configuration?

When integrating FortiWeb with FortiAnalyzer, which information is passed to FortiAnalyzer?

What is the primary benefit of using a 'Device Group' in FortiManager?

How can you disable the 'Greylisting' feature for a specific, trusted sender?

What is the result of 'Retrieve Config' when the FortiGate has local changes not yet in the FortiManager database?

Which FortiWeb feature is best used to detect 'Brute Force' attacks against a login page?

A network administrator needs to back up the FortiManager configuration, including all managed device configurations and policy packages. Which method should be used to ensure a complete backup that can be restored to a new FortiManager appliance if necessary?

Which interface mode is best suited for high-availability setups where you need to minimize configuration changes on existing infrastructure?

Which FortiAuthenticator feature allows you to map LDAP groups to local FortiAuthenticator groups for administrative access?

What is the purpose of 'Report Templates'?

What is the purpose of 'Policy Package' import?

An administrator needs to quickly distribute a CLI command to fifty managed FortiGate devices. Which feature should they use to automate this task efficiently?

If you want to ensure that only authorized administrators can access the FortiAnalyzer GUI, which feature should you implement?

Which 'Install Wizard' option ensures that configuration changes on the FortiManager are synchronized back to the device's configuration file?

An administrator wants to ensure that a specific policy is always included in all policy packages within an ADOM. What feature should be used?

How can you verify that a FortiGate is sending logs to the FortiAnalyzer?

How can you view the current number of emails in the quarantine?

FortiADC is configured with a Layer 7 policy. You notice that the persistence is failing for a specific application. Which persistence method is most appropriate for a cookie-based application?

What is the primary role of the 'Administrator' profile?

Which TWO types of report formats can be generated by FortiAnalyzer?

In FortiManager, what is the result of using the 'Re-install Policy' option instead of the 'Install Wizard'?

You notice that the FortiMail system time is incorrect, causing issues with SSL/TLS certificate validation. How do you correct this?

You are configuring a FortiWeb WAF policy to protect a web application. Which inspection mode is most effective for blocking SQL injection attacks while minimizing false positives in a production environment?

You are deploying FortiMail in Transparent Mode. Which network configuration requirement is mandatory for this deployment?

You are troubleshooting a Security Fabric deployment where a downstream FortiGate is not appearing in the Fabric topology on the root FortiGate. You have verified that the downstream FortiGate is configured with the correct root FortiGate IP and that network connectivity exists. Which action should you take next to resolve the issue?

When using 'VPN Manager', what is the main benefit compared to manual VPN configuration?

Where do you configure the expiration period for messages in the quarantine?

What is the purpose of the 'License' section in the FortiMail menu?

Which TWO of the following are allowed in an ADOM?

You need to export logs from FortiAuthenticator to a remote syslog server. Which configuration path allows you to define this destination?

Which of these is a legitimate reason to place a sender on the 'Block' list in the AntiSpam profile?

You are configuring DLP to block emails containing credit card numbers. Which component must be configured to define the pattern matching for the card numbers?

An administrator is attempting to move a device from one ADOM to another. Which condition must be met for this to succeed?

Which dashboard widget provides a high-level summary of system resource usage?

What is the purpose of 'Log Forwarding' in FortiAnalyzer?

An administrator notices that the 'Device Manager' status is 'Unsynchronized'. What is the recommended first step to resolve this?

When using the Workflow mode for policy management, what happens immediately after a policy change request is submitted?

You are deploying FortiMail in Transparent mode. Which configuration step is mandatory to ensure traffic is inspected without modifying the IP headers of the email packets?

Which method is the most efficient way to apply a specific set of CLI commands to 50 FortiGate devices simultaneously in FortiManager?

When adding a FortiWeb appliance to the Security Fabric, what is the primary prerequisite that must be met on the FortiGate?

Which TWO actions can be performed on items currently residing in the FortiMail global quarantine?

Which DNS record must be published in the public DNS to enable DKIM signing for outgoing mail?

When utilizing the 'Install Preview' feature before pushing a policy package, what is the primary benefit to the administrator?

You are integrating FortiWeb with FortiAnalyzer. What is the benefit of this integration in a Security Fabric context?

Which TWO of the following are valid methods to back up a FortiManager configuration?

A user is attempting to authenticate via a FortiAuthenticator-backed portal but receives an 'Access Denied' message. The user exists in the AD group mapped to the policy. What should you check first?

When configuring an 'Event Handler' with a 'Threshold', what does the 'Count' field represent?

Which command allows you to verify if the FortiMail can reach a remote mail server on port 25?

When scheduling a report, what is the purpose of the 'Output Profile'?

You are trying to delete an ADOM, but the option is greyed out. What is the most likely cause?

What is the purpose of the 'Add Device' wizard?

When using FortiAuthenticator to provide RADIUS authentication for a third-party VPN gateway, which setting must match between the two devices?

A security team stores logs from several FortiGate devices in a single ADOM on their FortiAnalyzer appliance. They need to run a report that includes data from only two of those devices while excluding all others. What is the most appropriate way to accomplish this on FortiAnalyzer?

You are configuring a Security Fabric with a root FortiGate and a downstream FortiGate. You want to ensure that if the root FortiGate fails, the downstream FortiGate can still provide security services and maintain Fabric connectivity. Which configuration should you implement?

Which menu path is used to create a new Administrator account?

Which configuration is required to allow external users to access the Webmail portal?

A compliance officer needs FortiAnalyzer to alert the security team by email whenever an administrator logs in to the FortiGate at a branch office outside business hours. Which FortiAnalyzer capability should be configured to satisfy this requirement?

How are Revision Histories primarily used in FortiManager when a device configuration has been modified locally on the FortiGate?

Which THREE of the following are true regarding 'Revision History'?

Which component manages the 'Daily Report' schedule?

What is the primary function of the FortiMail 'Quarantine' feature?

Which THREE actions can be performed by a FortiWeb appliance when it detects a violation in a web request?

When configuring log forwarding from FortiAnalyzer to a remote Syslog server, which TWO of the following parameters must be correctly configured to ensure the remote server accepts the logs?

Which TWO of the following are true about 'Scripts' in FortiManager?

When should you use 'Log Archive' instead of 'Log Database'?

Which TWO of the following are primary functions of a Web Application Firewall (WAF) like FortiWeb?

A FortiMail appliance is deployed in gateway mode as an outbound relay for an internal application server. The application sends notification emails to external customers using the envelope sender notifications@corp.example.com, but the messages are being rejected by several recipient mail servers with SPF failures. The network team confirms the FortiMail's public IP is 203.0.113.45, and the SPF record for corp.example.com is 'v=spf1 mx -all'. The MX record for corp.example.com points to 198.51.100.20, which is the inbound FortiMail cluster. Which FortiMail configuration change will resolve the SPF failures for outbound mail sent through this relay?

You are implementing a WAF policy for a web application. Which profile should you use to prevent the disclosure of sensitive server-side information in error messages?

A FortiManager administrator attempted to install a policy package, but the installation failed due to an object conflict. Where can the administrator view the detailed reason for the installation failure?

What is the primary benefit of the Security Fabric's 'Automation Stitch' feature?

Which type of scan should be enabled to detect known malware in email attachments?

What does the 'Heuristic' score measure in the AntiSpam engine?

If an administrator uses the 'Import Policy' function, what is the effect on the FortiManager ADOM?

When deploying a policy package, what is the function of the 'Policy Package Status' column in the Install Wizard?

Which TWO of the following protocols does FortiMail support for mail retrieval?

A FortiADC deployment is experiencing high latency for HTTPS traffic. You suspect the SSL handshake is the bottleneck. Which tool in FortiADC is best suited to verify the SSL negotiation time?

Which TWO components can be included in a 'Provisioning Template' to manage device settings?

What is the default port for SMTP communication?

If a FortiAnalyzer is in 'Collector' mode, what is its primary limitation?

You are configuring a FortiWeb policy to protect a web application. You need to ensure that the WAF blocks SQL injection attempts while allowing legitimate traffic. Which operational mode should you configure in the server policy?

What is the maximum number of ADOMs supported on a FortiAnalyzer?

Which TWO factors impact the performance of report generation?

What is the primary purpose of using 'Provisioning Templates' in FortiManager?

Which THREE of the following are core components of the Fortinet Security Fabric?

What is the function of the 'Check for Updates' feature in FortiManager's FortiGuard settings?

You need to restrict an administrator to only viewing reports for a specific ADOM. How do you achieve this?

You are configuring an Event Handler to monitor for failed login attempts. To ensure you do not receive too many alerts for the same source IP in a short duration, what should you configure?

Which administrative account type has full access to all ADOMs and system settings?

What does the 'FortiView' module provide?

If an administrator wants to perform a 'Config Check' to see what changes will be deployed during an installation, which option should they select in the 'Install Wizard'?

You are configuring a FortiWeb WAF policy for a web application. You need to ensure that the WAF blocks requests that contain SQL injection patterns. Which feature should you enable in the WAF profile?

Which component of the FortiAuthenticator is responsible for the self-service portal where users can manage their own two-factor authentication tokens?

A FortiADC is load balancing an HTTPS application. You need to offload SSL processing to the ADC to reduce server load. What is the correct object to configure for this?

What is the consequence of deleting a device from an ADOM in FortiManager?

Which THREE are key benefits of using FortiWeb to protect web applications?

A user authenticated via FortiAuthenticator is unable to access a resource protected by a FortiGate policy. The policy uses the user's LDAP group. What is the most likely cause?

Which TWO features in FortiMail help prevent email spoofing?

An administrator needs to identify which application is consuming the most bandwidth on the network. Which feature in FortiView provides the most efficient visual representation for this task?

Which FortiWeb feature allows you to block traffic based on the geographic origin of the IP address?

When configuring 'Global Objects' in FortiManager, what happens to the specific objects in the ADOM-level database?

Which THREE components are required to create a functional FortiSoC Playbook?

A network security analyst is troubleshooting why certain inbound emails are being marked as spam by FortiMail even though they originate from a trusted partner's domain. The partner's domain has a valid SPF record, but the emails are failing the 'Domain-based Message Authentication, Reporting, and Conformance' (DMARC) check. The analyst confirms that the partner's emails are being forwarded by a third-party mailing list. What is the most likely reason for the DMARC failure?

When modifying a policy package, what does 'Lock' indicate?

Which of the following is a component of the Fortinet Security Fabric?

When defining an Install Workflow, which THREE settings or options can be configured to manage the deployment process?

In the Security Fabric, which feature allows the FortiGate to automatically quarantine a host that is identified as compromised by another Fabric device?

What happens if a message matches multiple policies?

Which THREE features are provided by FortiAuthenticator when integrated into a Security Fabric to enforce identity-based access?

Which TWO conditions must be met for a report to run successfully?

You are debugging a SAML authentication issue where FortiAuthenticator is the IDP. The logs show 'Assertion expired'. What is the most likely cause?

How does FortiMail identify the policy to apply to an incoming email?

If you need to change the log storage retention period for a specific ADOM, where is this setting located?

A customer wants to offload logs from FortiAnalyzer to a remote Syslog server. Where is this configured?

Which protocol does FortiAnalyzer primarily use for Web UI access?

An administrator wants to perform a 'Re-install Policy' on a subset of devices without changing their current configuration settings. Which install option should be selected?

What is the primary function of the 'AntiSpam' profile?

What is the primary difference between a Gateway and a Server mode deployment?

Which of these is a benefit of 'Transparent' mode?

How can you view the 'Total' number of policies in a specific policy package?

What is the primary benefit of deploying FortiMail in a cluster?

What is the main advantage of using the FortiMail 'Quarantine' portal for end-users?

An administrator wants to ensure that all outgoing emails are archived to a secondary server. Where is this configured?

Which feature in the Device Manager allows you to push configuration changes to multiple FortiGate devices at once?