Hard Difficulty Questions

The AD domain controller's disk space

Why it fails: Disk space on a domain controller does not determine whether FortiAuthenticator maps an AD group to a portal policy; authentication would fail differently, not with a policy denial. Checking DC health is tempting because AD outages break authentication, and would be correct if the user's credentials or LDAP lookups were failing.

The FortiGate session table

Why it fails: The FortiGate session table tracks firewall connections, not FortiAuthenticator's group-to-policy evaluation, so it cannot explain this portal denial. The session table is tempting because stale sessions cause access problems, and would be the right check if traffic were dropped by the FortiGate rather than rejected during authentication.

The WAF policy on FortiWeb

Why it fails: FortiWeb's WAF inspects HTTP traffic for attacks; it does not evaluate FortiAuthenticator group-to-policy mappings, so it cannot cause this portal denial. Checking WAF policy is tempting because web-facing portals traverse FortiWeb, and would be right if the failure were a blocked or filtered HTTP request rather than authentication.

The total number of logs

Why it fails: Count specifies how many matching log entries must occur within the threshold period before the event handler fires, not a running total of all logs. It is tempting because the field is numeric and relates to log volume, but the handler evaluates occurrences inside the time window, not cumulative log totals.

The priority of the alert

Why it fails: Count is a numeric occurrence threshold, not an alert severity. It is tempting because event handlers do generate alerts, and severity is configured elsewhere in the handler, but Count defines how many matching events must accumulate within the time window to trigger the alert.

The time window in seconds

Why it fails: Count is the number of matching events required, whereas the separate Time field defines the window in seconds. It is tempting because both are numeric threshold parameters configured together, but conflating them means the handler would never evaluate event frequency correctly.

ping <IP>

Why it fails: ICMP echo confirms IP reachability only; it cannot test TCP port 25, so a host answering ping may still block SMTP. It is tempting because ping is the quickest reachability check, but the axis is ICMP versus TCP, and the correct tool is a TCP port test such as telnet or execute tcp-port.

arp -a

Why it fails: arp -a displays the local ARP cache mapping IP addresses to MAC addresses on the same subnet; it sends no traffic to the remote mail server and cannot test port 25. It is tempting as a connectivity diagnostic, but the axis is layer-2 cache inspection versus layer-4 TCP reachability.

traceroute <IP>

Why it fails: Traceroute maps the router path to a destination using UDP or ICMP probes; it never opens a TCP session on port 25, so SMTP reachability stays unverified. It is tempting because it diagnoses routing failures, but the axis is path discovery versus port-level connectivity testing.

The RADIUS accounting port

Why it fails: Authentication and accounting are separate RADIUS functions; the VPN gateway must match FortiAuthenticator's authentication port (default 1812), while accounting (1813) is only needed if the gateway sends accounting records. Accounting port matching matters when session start/stop accounting is required.

The NAS-IP-Address

Why it fails: NAS-IP-Address identifies the requesting gateway inside Access-Request packets; FortiAuthenticator must accept whatever the gateway sends, but the value need not be configured identically on both sides. Matching it is relevant when FortiAuthenticator filters clients by NAS identifier or IP.

The VSA Vendor ID

Why it fails: Vendor-Specific Attributes carry vendor-defined data such as group membership; FortiAuthenticator and the VPN gateway need not share a VSA Vendor ID unless the gateway parses Fortinet VSAs. VSA alignment is required when returning Fortinet group attributes to a Fortinet device.

Device Manager > Revision History

Why it fails: Revision History records configuration revisions and install history per device, not the detailed conflict diagnostics from a failed install. The installation failure reason appears in the installation preview or install log. Revision History is tempting because it tracks installs, but it does not surface object-conflict detail.

System Settings > Event Log

Why it fails: System Settings > Event Log records administrative and system events, not the object-level conflict detail produced by a failed policy package installation. That detail appears in the installation preview or install log for the package. The Event Log is tempting as a general troubleshooting location, but it lacks policy-install diagnostics.

Policy & Objects > Installation Targets

Why it fails: Installation Targets lists which devices a policy package installs to; it does not display failure diagnostics. The conflict reason is shown in the installation preview or install log when the install is attempted. Installation Targets is tempting because it governs install scope, but it holds no error detail.

Device manager logs

Why it fails: This shows device connectivity.

System logs

Why it fails: System logs show general OS events.

FortiView

Why it fails: This is for traffic analytics.

The number of registered devices

Why it fails: Registered device count does not drive report generation load; the factors are the number of logs and the report time range. It is tempting because device inventory feels resource-related, but report performance depends on log volume queried, not endpoints registered to the manager.

The firmware version of the devices

Why it fails: Device firmware version does not affect report generation performance; log volume and report time range do. It is tempting because firmware governs feature availability, but report rendering queries stored logs, so version differences do not change the processing workload.

The CPU temperature

Why it fails: CPU temperature is a hardware health metric, not a report generation factor; log volume and time range determine performance. It is tempting because thermal throttling can slow any system, but FortiManager report performance is governed by the dataset queried, not sensor readings.

Packet Capture (sniffer)

Why it fails: Packet capture records raw frames, so it shows handshake packets but not FortiADC's own SSL negotiation timing. It is tempting because it is the standard tool for diagnosing connection resets or malformed packets, but that scenario requires per-transaction timing metrics, which the SSL-specific diagnostic tool reports.

Log Access

Why it fails: Log Access displays historical event and traffic records, not per-handshake timing breakdowns. It is tempting because logs can reveal failed TLS negotiations or certificate errors, but that scenario needs measured negotiation duration, which the SSL diagnostic tool provides rather than retrospective log entries.

System Health Monitor

Why it fails: System Health Monitor reports CPU, memory, and interface statistics, not SSL handshake duration. It is tempting because high CPU from TLS processing can correlate with latency, but that scenario requires direct measurement of negotiation time, which the SSL-specific diagnostic tool supplies.

Change the management port.

Why it fails: Changing the management port obscures which port the GUI listens on but applies no source-address filtering, so any IP reaching that port is still accepted. It is tempting as a hardening step, and would be correct to reduce automated scanning, not to restrict access to specific addresses.

Disable GUI access.

Why it fails: Disabling GUI access blocks all administrators entirely rather than permitting a defined set of source addresses. It is tempting as a blunt hardening measure, and would be correct only when management must occur exclusively through the CLI or console, not when specific IPs should retain GUI access.

Configure a firewall policy.

Why it fails: Firewall policies govern traffic traversing FortiMail, not administrative logins to its GUI; management access is controlled by administrator trust hosts or local-in policies. It is tempting because firewall rules commonly restrict access, and would be correct for filtering mail or network traffic rather than GUI administration.

Script.

Why it fails: A script executes CLI commands or automation logic; it does not itself guarantee a policy appears in every package within an ADOM. It is tempting because scripts can push configuration programmatically, but the global-policy feature is the built-in mechanism that automatically inserts the same policy into all packages.

Provisioning Template.

Why it fails: A provisioning template pushes configuration to managed devices; it does not insert a policy into every policy package inside an ADOM. It is tempting because templates enforce consistent settings across firewalls, but the global-policy feature is what automatically includes a policy in all packages.

Standard Policy.

Why it fails: A standard policy is a normal firewall policy stored within a single policy package; it is not automatically replicated across every package in the ADOM. It is tempting because standard policies are the default building block, but the global-policy feature exists specifically to enforce inclusion everywhere.

Source IP Persistence

Why it fails: Source IP persistence hashes the client's address to select a real server, so clients behind NAT or proxies collapse onto one backend and failover moves them mid-session. It suits protocols lacking cookies or session identifiers, whereas this application already carries a cookie FortiADC can inspect.

SSL Session ID

Why it fails: SSL Session ID persistence keys on the TLS session identifier, which only exists while the encrypted session is reused; it cannot track HTTP-layer cookie values and breaks when clients renegotiate or open new TLS sessions. It suits pure TLS pass-through balancing, not cookie-based application persistence.

Round Robin

Why it fails: Round Robin distributes each new connection to the next available real server, so successive requests from one client land on different backends and session state is lost. It suits stateless workloads where any server can answer. Cookie-based applications need the ADC to read or insert a cookie and pin that client to its originating server.

Change Firmware automatically

Why it fails: Change Firmware automatically is a FortiManager upgrade schedule, not an Install Workflow setting. Install Workflows define per-device deployment steps such as install targets, interface mappings and policy package assignment, so firmware scheduling falls outside their scope. It would be the correct choice when automating firmware upgrades across managed devices.

Delete Policy after Install

Why it fails: Install Workflows offer no option to delete policies after installation; policies persist on the device until replaced or removed manually. It tempts because temporary policy staging sounds useful, but the workflow only controls when and where existing packages install.

Shutdown the device

Why it fails: Reaching Maximum Storage triggers log rolling or overwriting of the oldest logs, not a device shutdown. It is tempting because a full disk does halt new log reception, and would be correct if the question asked what happens when the override setting is disabled.

Alert via SNMP only

Why it fails: SNMP traps are only generated if an SNMP community and trap host are configured; the default Maximum Storage action is to overwrite the oldest logs, so no alert fires. SNMP alerting suits monitoring setups where an administrator has deliberately enabled threshold notifications.

Pause all services

Why it fails: Pausing all services is not the default Maximum Storage behaviour; FortiAnalyzer rolls over by deleting the oldest logs to free space. Administrators might expect a protective halt, but pausing services is a manual troubleshooting step, not an automatic disk-full response.

show log traffic

Why it fails: 'show log traffic' displays stored traffic log entries, not live packet contents, so it cannot reveal SMTP dialogue in real time. It tempts because it is a legitimate CLI diagnostic for historical traffic. Live SMTP inspection requires the packet-capture tool with a filter, which streams frames as they traverse the interface.

execute telnet

Why it fails: 'execute telnet' opens an outbound Telnet session from FortiMail to a remote host; it does not capture or display passing SMTP packets. It tempts because Telnet can manually test SMTP connectivity to a server. Real-time SMTP traffic viewing needs the packet-capture command with an SMTP filter applied to the interface.

get system status

Why it fails: Displays FortiMail's system status, such as uptime and resource usage, not SMTP packet contents. It is tempting because it is a genuine CLI diagnostic command, but the correct tool for real-time SMTP inspection is a packet sniffer such as diagnose sniffer packet.

FortiView data archiving

Why it fails: This does not impact report generation performance.

Log archive compression

Why it fails: Log archive compression reduces disk usage of stored logs but does not extend the report engine's query window. Preventing timeouts on six months of data requires configuring the report's data/time range and log retention so the required historical logs remain available to the report engine.

ADOM mode change

Why it fails: ADOM mode governs administrative domain partitioning and policy scope, not report query execution. Report timeouts stem from the query period exceeding retained or indexed log data, so the fix is extending log retention and report time range, not changing ADOM mode.

Manually re-import the config

Why it fails: Manual imports cause configuration drift.

Disable policy management

Why it fails: Disabling management breaks synchronization.

Delete local policy and recreate

Why it fails: This is inefficient and loses data.

The browser is blocked

Why it fails: A blocked browser would prevent the SAML flow from starting, producing no assertion at all rather than an expired one. Browser blocking is relevant when troubleshooting redirect or cookie failures, but the logged expiry points to clock skew between the IDP and service provider.

The SAML certificate is self-signed

Why it fails: A self-signed certificate causes trust or signature validation errors, not an expiry message; the assertion's NotOnOrAfter timestamp is independent of certificate signing. Self-signed certificates are the answer when the SP rejects the IDP's signature as untrusted.

The user password is too old

Why it fails: Password age affects directory authentication and expiry warnings, not the SAML assertion's validity window. An aged password is the right diagnosis when FortiAuthenticator rejects the initial bind, whereas 'Assertion expired' indicates the IDP and SP clocks differ beyond the assertion lifetime.

It requires all backend servers to be on the same subnet

Why it fails: Layer 7 load balancing operates on HTTP headers, URLs and cookies, so FortiADC forwards requests to real servers across routed subnets; same-subnet placement is not a requirement. The claim is tempting because Layer 2/3 designs and some direct server return modes do constrain server placement, but content-based virtual servers do not.

It only supports TCP-based traffic

Why it fails: FortiADC's Layer 7 load balancing inspects and routes application-layer protocols including HTTP and HTTPS, so restricting it to TCP-only contradicts the scenario's requirement. TCP load balancing operates at Layer 4, where FortiADC distributes connections without parsing requests; that is the correct choice when only transport-level distribution is needed.

It cannot perform health checks on web servers

Why it fails: FortiADC performs Layer 7 health checks on web servers, probing HTTP responses to verify application availability. The claim is tempting because Layer 4 monitors exist, but Layer 7 load balancing specifically includes HTTP/HTTPS health monitoring, making this statement false.

Persistence Sharing

Why it fails: Persistence sharing synchronises client-to-server session affinity records, not the session table itself. It is tempting because both concern sessions across cluster members, so it would be correct when you need a client's persistence entry honoured after failover to another FortiWeb.

State Replication

Why it fails: State replication synchronises TCP session state so established connections survive failover; it does not share the FortiWeb session table. It is tempting because the names overlap, so it would be the right answer when the requirement is preserving active connections rather than sharing session records.

Configuration Sync

Why it fails: Configuration sync replicates FortiWeb settings and policies between cluster members, not runtime session entries. It is tempting because cluster members must share configuration, so it would be correct when you need consistent WAF policies, server pools and profiles deployed across all nodes.

The LDAP user account is locked

Why it fails: A locked LDAP account fails authentication outright, so FortiAuthenticator would reject the login and no user identity would reach the FortiGate policy at all. It is tempting because lockouts do cause access failures, and would be correct if the user could authenticate but the group membership lookup returned nothing.

FortiAuthenticator is in maintenance mode

Why it fails: Maintenance mode stops FortiAuthenticator serving authentication requests entirely, which would affect every user rather than one LDAP-group member. It is tempting because service outages do break access, and would be correct if all users authenticating through that appliance lost access simultaneously, not just this individual.

The user is using the wrong password

Why it fails: A wrong password would block authentication at FortiAuthenticator itself, so the user would never reach the FortiGate policy or its LDAP group lookup. It is tempting because credential errors are a common login failure, and re-entering the password would be the fix when FortiAuthenticator rejects the user outright.