Select Two (Multi-Select) Questions

It supports deep content inspection for all protocols

Why it fails: Flow-based inspection performs pattern matching on packet flows and deliberately omits deep content inspection of every protocol; that is proxy-based mode's role. Flow mode is chosen for high throughput with basic antivirus and IPS. Claiming full deep inspection misstates its architecture.

It requires manual buffer allocation

Why it fails: Flow-based inspection performs stream-based scanning with fixed, pre-allocated buffers, so no manual buffer allocation is required; that describes proxy-based inspection tuning instead. It is tempting because administrators do size proxy buffers manually, but flow mode's benefit is exactly the opposite: automatic resource handling with lower memory and latency overhead.

It offers more granular application control

Why it fails: Granular application control is a proxy-based inspection strength, since full application-layer decoding identifies applications precisely; flow-based inspection matches patterns per packet and offers coarser application visibility. It is tempting because flow mode does inspect applications, but its benefit is higher throughput, not granularity, so this fails the stated benefit.

Schedule the installation during a maintenance window

Why it fails: Scheduling during a maintenance window is a good practice to minimize impact, but it does not validate the policy or ensure correctness. The question asks for actions to take before installing to ensure proper validation and avoid downtime; scheduling is a timing consideration, not a validation step. The key actions are policy check and installation preview.

Install the policy package to all devices simultaneously

Why it fails: Installing to all devices simultaneously can cause widespread downtime if there is an error. It is better to install in phases or to a staging device first. This action does not ensure validation and can exacerbate issues if the policy is faulty. Therefore, it is not recommended before installation.

Enable workspace mode to lock the ADOM

Why it fails: Workspace mode locks the ADOM to prevent concurrent edits, but it does not validate the policy or preview changes. While it can be useful in collaborative environments, it does not directly contribute to preventing downtime during installation. The focus should be on validation and preview.

Enabling SSL inspection globally

Why it fails: SSL inspection is a security profile applied to traffic flows, not a partitioning mechanism; it decrypts and inspects regardless of which VDOM carries the packet. It tempts because inspection policies are configured per VDOM, yet enabling it globally neither creates nor isolates VDOM boundaries.

Using different HA clusters

Why it fails: HA clusters group devices for failover of the same configuration, not to partition traffic within a multi-VDOM device; separation comes from assigning interfaces and policies to distinct VDOMs. It tempts because cluster membership does isolate device roles, which suits resilience rather than tenant or zone separation.

Using different firmware versions

Why it fails: Firmware version is a device-wide software attribute, not a per-VDOM segmentation construct; VDOMs partition interfaces, routing tables and policies within one firmware image. It tempts because version differences can isolate management planes, but that is device lifecycle management, not traffic separation.

BGP

Why it fails: BGP is a routing protocol that exchanges network reachability between autonomous systems; it carries no user identity or credential exchange, so it cannot authenticate anyone. It is tempting because BGP appears in FortiGate configuration for dynamic routing and SD-WAN, and it would be the correct choice when peering with routers rather than authenticating users.

IGMP

Why it fails: IGMP is a multicast group management protocol, carrying no user credentials and performing no authentication. It is tempting because it is a valid FortiGate-supported protocol, but for multicast traffic handling, not identity verification. Authentication requires methods such as LDAP, RADIUS, TACACS+ or local passwords.

RIP

Why it fails: RIP is a distance-vector routing protocol for exchanging network reachability, not a user authentication mechanism. It is tempting because it is a legitimate FortiGate feature, but it belongs in routing configuration. Authentication uses LDAP, RADIUS, TACACS+, Kerberos or local user databases.

System interface settings

Why it fails: System interface settings belong to the FortiGate device configuration database, not to a policy package, so they are not installed by a policy package push. It is tempting because interface configuration is managed centrally in FortiManager, but that occurs through device-level settings or provisioning templates rather than policy package installation.

Routing tables

Why it fails: Routing tables reside in the device configuration and are not carried inside a policy package, so a policy package push does not install them. It is tempting because FortiManager centrally manages routing, yet that is delivered via device settings or provisioning templates, not the policy package itself.

SNMP community strings and syslog server settings

Why it fails: SNMP community strings and syslog server settings are not synchronized by default. They are management-plane configurations that often differ per unit for monitoring purposes. Administrators must manually configure or enable synchronization for these settings if they want them replicated across the cluster.

The FortiGate hostname and administrative passwords

Why it fails: The hostname and administrator passwords are not synchronized by default because they are considered per-device settings. Each unit can have a unique hostname for identification, and password synchronization must be explicitly enabled. This prevents an attacker who compromises one node from automatically gaining credentials for the other.

The cluster's virtual MAC address and HA priority

Why it fails: The virtual MAC address is a cluster-wide setting that is already identical on all nodes, and HA priority is a per-device setting that determines which unit becomes primary. Neither is part of the configuration synchronization process; they are HA operational parameters configured independently or set identically as part of HA setup.

Policy Packages

Why it fails: Policy Packages are used to manage firewall policies, security profiles, and related objects. They do not typically include system-level settings like DNS or NTP servers. While they are essential for security policy deployment, they are not designed for pushing base administrative configurations to new devices. Therefore, they do not fulfill the requirement.

ADOM Revisions

Why it fails: ADOM Revisions are used for version control and auditing of configuration changes within an ADOM. They do not automatically apply configurations to new devices. While they help track changes, they are not a mechanism for provisioning settings. Thus, they cannot be used to ensure new FortiGates receive specific administrative settings.

Device Groups

Why it fails: Device Groups are used to logically group FortiGates for policy installation and management. They do not contain configuration settings themselves; they are merely organizational containers. While you can install policies to a device group, they do not provide a way to push base administrative settings like DNS or NTP. Therefore, they are not suitable for this requirement.

Enable 'Strong Password' policy in the FortiManager global settings.

Why it fails: Enabling a strong password policy helps enforce password complexity, but it is not a separate required configuration beyond creating accounts with strong passwords. The scenario requires access control and logging; a password policy alone does not ensure logging. Thus, it is not a required configuration.

Set up a remote syslog server for storing logs.

Why it fails: A remote syslog server is useful for centralized log storage, but it is not required to log administrator actions on FortiManager itself. The requirement is to log actions, which can be done locally. Remote syslog is optional and not a required configuration for this scenario.

Enable two-factor authentication for administrator accounts.

Why it fails: While two-factor authentication enhances security, it is not strictly required to ensure that only authorized personnel can log in; strong passwords and profiles are sufficient for basic access control. The scenario does not specify a requirement for two-factor authentication, so it is not a required configuration.

Enable NAT on the external interface to allow internal hosts to access the internet.

Why it fails: In transparent mode, the FortiGate does not perform NAT by default; it acts as a bridge. NAT would typically be handled by the router. Enabling NAT on the FortiGate in transparent mode is not standard and would require additional configuration, but it is not a requirement for basic operation or security inspection. The scenario does not mention NAT as a requirement.

Configure a default gateway on the FortiGate to route management traffic.

Why it fails: In transparent mode, the FortiGate does not use a default gateway on data interfaces. Management traffic would use the management interface's own default gateway if needed, but that is configured separately. A default gateway on the data interfaces is not applicable in transparent mode and is not required for the described setup.

Set the FortiGate to NAT mode instead of transparent mode to enable security inspections.

Why it fails: Security inspections can be performed in transparent mode; switching to NAT mode would change the network design and require IP addressing changes. The scenario specifically requires transparent mode, so this is incorrect. Transparent mode supports most security profiles, including antivirus, IPS, and web filtering, when applied via firewall policies.

Enable NAT traversal (NAT-T) on the phase1 configuration.

Why it fails: NAT-T is used when there is a NAT device between the VPN peers. It helps the VPN traverse NAT but does not affect recovery speed or subnet restriction. It is not required unless NAT is present, and it does not address the requirements.

Configure a firewall policy that allows all traffic between the two sites without any restrictions.

Why it fails: A firewall policy that allows all traffic would not restrict traffic to specific subnets; it would permit everything. This contradicts the requirement to allow only specific subnets. Additionally, it does not help with recovery from disruptions.

Set the phase1 proposal to use only AES-256 encryption and SHA-256 hashing.

Why it fails: While strong encryption and hashing are important for security, they do not directly impact the speed of recovery from network disruptions or restrict traffic to specific subnets. This step is about security strength, not the stated requirements.

Configure the FortiGate to use a public CA certificate for re-signing.

Why it fails: Using a public CA is not required and is impractical because the FortiGate must re-sign certificates on the fly for any domain. The FortiGate uses its own internal CA for re-signing. Clients must trust this internal CA, not a public one. Public CA certificates cannot be used for dynamic re-signing without private key access.

Set the inspection mode to certificate inspection instead of deep inspection.

Why it fails: Certificate inspection only inspects the certificate metadata, not the encrypted payload. To perform deep inspection, the mode must be set to deep inspection. Certificate inspection would not decrypt the traffic, so it would not require installing a CA certificate on clients, but it also would not provide the deep inspection the administrator wants.

Import the server certificates from all HTTPS websites into the FortiGate.

Why it fails: Importing server certificates is not feasible because there are countless HTTPS sites. The FortiGate dynamically generates certificates signed by its own CA. It does not need the original server private keys. Importing server certificates would not enable deep inspection and is not a supported method for SSL inspection.

TCP port selection

Why it fails: IKEv2 Phase 1 negotiates encryption, integrity, authentication and Diffie-Hellman group parameters; TCP port selection is not among them. Ports are fixed (UDP 500 and 4500) or handled by NAT-Traversal. The option is tempting because ports matter for firewall rules, but they are not negotiated Phase 1 attributes.

Firewall policy ID

Why it fails: Firewall policy ID is a local enforcement construct, not an IKEv2 Phase 1 payload; Phase 1 negotiates encryption, authentication, integrity and DH group via SA proposals. It tempts because policy IDs do appear in tunnel configuration, but they govern traffic selection, not key exchange.

Hardware serial numbers

Why it fails: Serial numbers are device-specific identifiers and are never synchronised; each unit retains its own. It is tempting because HA does replicate configuration, but hardware identity is deliberately excluded so the secondary remains a distinct appliance.

Management IP address

Why it fails: The management IP is unique per unit and is not synchronised; each firewall keeps its own address for individual access. It is tempting because HA does replicate configuration objects, but interface addressing for management stays local to preserve separate administration.

Interface physical speed

Why it fails: SD-WAN rules select members by measured criteria such as latency, jitter, packet loss, bandwidth and link quality, plus priority and SLA targets; physical interface speed is a static port attribute, not a rule selector. It tempts because link capacity informs member choice, but that belongs to interface configuration.

MAC address spoofing

Why it fails: SD-WAN rules match traffic using performance SLA metrics, source and destination, and preferred member ordering; MAC address spoofing is a firewall interface or VIP setting, unrelated to rule matching. It tempts because MAC-based forwarding exists on FortiGate, but it is not a configurable SD-WAN rule option.

Hardware acceleration toggle

Why it fails: SD-WAN rule configuration matches traffic against SLA targets, priority, load-balancing method and member selection; hardware acceleration is a per-firewall-policy or interface setting, not a rule criterion. It tempts because acceleration affects throughput, but FortiManager exposes it outside the SD-WAN rule wizard.

Disable heartbeat interfaces and rely only on monitored data interfaces for failure detection.

Why it fails: Heartbeat interfaces carry HA synchronization and election traffic. Disabling them would break HA communication and likely cause both units to become primary or lose synchronization. Failure detection should use both heartbeat and monitored interfaces. This option is harmful and does not reduce link-flap-induced failovers.

Set the HA priority of the backup unit higher than the primary unit to speed up the election.

Why it fails: Raising the backup unit's priority above the primary would make the backup more likely to become the primary, potentially causing an unintended role change. HA priority affects master election, not link-flap sensitivity or session continuity. This option does not address the stated goals and could destabilize the cluster.

Enable override so that the unit with the highest priority always becomes the primary after a failover.

Why it fails: Override controls which unit becomes primary based on priority, but it does not provide session continuity or reduce sensitivity to link flaps. In fact, enabling override can cause additional role changes when a higher-priority unit recovers. This option does not meet the two stated requirements.

Use the 'Retrieve Configuration' option before upgrading to ensure current settings are backed up.

Why it fails: Retrieving configuration is good practice for backup, but it is not a required step specific to staged firmware testing. The question asks for features or steps required to test on a few devices before rolling out to all. Backup is generally recommended but not a functional requirement for the staged rollout process itself.

Enable 'Auto-Update' in the FortiManager system settings to automatically download firmware from FortiGuard.

Why it fails: Auto-Update automatically downloads firmware to FortiManager, but it does not control staged rollout to devices. It is useful for keeping images available, but the administrator still needs to manually select devices and initiate upgrades. It does not provide the testing capability required.

Configure a firmware upgrade schedule that applies to all devices but with a delay for non-test devices.

Why it fails: FortiManager does not support per-device delay in a single scheduled upgrade. Schedules apply uniformly to the target set. To achieve staged rollout, you must manually upgrade test devices first, then upgrade the rest. A single schedule with delays is not a feature.

Enable 'ADOM Locking' to prevent concurrent modifications by different tenants.

Why it fails: This is incorrect because ADOM locking is designed to prevent multiple administrators from editing the same ADOM simultaneously, not to isolate tenants. It does not restrict which ADOMs a tenant can access; it only locks an ADOM during editing. It is not a mechanism for multi-tenant isolation.

Use the 'Super_User' profile for all tenant administrators and rely on ADOM assignments to restrict access.

Why it fails: This is incorrect because the Super_User profile grants full access to all ADOMs and system settings, regardless of ADOM assignment. Even if a user is assigned to a specific ADOM, the Super_User profile overrides that and provides global access. This would violate tenant isolation and security.

Enable 'FortiManager Fabric' to automatically isolate tenant configurations.

Why it fails: This is incorrect because FortiManager Fabric is a feature for integrating with other Fortinet products, such as FortiAnalyzer and FortiAuthenticator, for centralized management and logging. It does not provide ADOM-level isolation or restrict administrative access between tenants. It is not relevant to multi-tenant configuration isolation.

Run a policy consistency check to validate the package.

Why it fails: While a policy consistency check can help identify issues, it is not a mandatory step before every installation. FortiManager performs basic validation during installation. The consistency check is a troubleshooting tool, not a prerequisite. The installation can proceed without it, though it is good practice to review for conflicts.

Configure a firewall address object for all external interfaces.

Why it fails: Creating address objects is part of policy design but not a specific prerequisite for installation. Policies may reference various objects, but there is no requirement to create an address object for all external interfaces. The installation process will validate referenced objects, but this is not a mandatory step before every installation.

Enable workspace mode for the ADOM to allow policy editing.

Why it fails: Workspace mode controls how changes are committed but is not required for installation. In normal mode, changes are saved automatically. Workspace mode is optional and often used in multi-admin scenarios. Enabling it does not affect the ability to install a policy package; it only changes the editing workflow.

Policy change impact reports

Why it fails: This is a feature of the policy tab, not Analyzer.

Hardware diagnostic reports

Why it fails: Hardware diagnostics are in the system tab.

Firmware compatibility reports

Why it fails: This is in the device manager.

Use 'Install All' to ensure all devices are up to date.

Why it fails: Install All pushes the policy package to all devices in the ADOM, regardless of whether they need the changes. This is inefficient and can cause unnecessary load and potential disruptions. It does not optimize the installation process; instead, it broadens the scope unnecessarily.

Schedule installations during off-peak hours to reduce impact.

Why it fails: Scheduling installations during off-peak hours can reduce the impact on network performance, but it does not optimize the installation process itself in terms of targeting only the required devices. It is a complementary practice but not a primary action to ensure efficient and targeted installation.

Enable 'Auto Install' on the policy package to push changes automatically to all devices.

Why it fails: Auto Install automatically installs policy changes to all devices assigned to the policy package whenever a change is made. This can lead to unnecessary installations and increased load, especially if only a subset of devices needs the change. It does not optimize the process for targeted deployment and may cause performance issues.