Select Two (Multi-Select) Questions

Simple ICMP packets

Why it fails: Simple ICMP packets are exactly the kind of stateless, easily parsed traffic the NP6 offloads in hardware, so they are not excluded. It is tempting to assume anything simple bypasses acceleration, but the NP6 handles basic session types; exceptions are traffic needing CPU-level inspection, such as certain encrypted or proxy-bound flows.

Standard UDP traffic

Why it fails: Standard UDP traffic is stateless and connectionless, so the NP6 can offload it directly without maintaining session state — it is precisely the kind of flow the processor accelerates. Traffic that cannot be offloaded includes protocols requiring deep inspection or stateful proxy handling, such as SMB or certain VoIP signalling, where the CPU must intervene.

The firmware version of the FortiGate

Why it fails: Performance SLA logic evaluates probe results against configured thresholds; FortiOS version affects available options but not the SLA calculation itself. It is tempting because firmware determines feature support, and it would matter when checking whether a given SLA setting can be configured on that device.

The number of active VPN tunnels

Why it fails: SLA logic compares probe latency, jitter and packet loss against thresholds; the count of active VPN tunnels is irrelevant to that evaluation. It is tempting because tunnels carry the probes, but their quantity does not alter how results are measured or whether a member passes.

Increase the Phase 1 lifetime to 24 hours

Why it fails: A 24-hour Phase 1 lifetime reduces rekey frequency, but rekeys are not the dominant cost; the optimisation is choosing stronger, hardware-accelerated ciphers and enabling offload. It is tempting because longer lifetimes do cut rekey overhead, which matters on high-latency links.

Use DES encryption for speed

Why it fails: DES is a weak 56-bit cipher and FortiGate hardware accelerates AES-NI and SHA, so DES yields no speed gain and fails compliance. It is tempting because legacy guidance equated smaller keys with lower CPU cost, which held before AES offload existed.

Disable NAT-Traversal

Why it fails: Disabling NAT-Traversal breaks IPsec when either peer sits behind NAT, preventing tunnel establishment; it does not improve throughput. It is tempting because NAT-T adds UDP encapsulation overhead, so removing it appears to reduce per-packet cost on NAT-free paths.

Performing a hard factory reset on the FortiGate

Why it fails: A hard factory reset erases configuration and returns the FortiGate to default settings, which does not provision SD-WAN templates or push policy from FortiManager. It is tempting because resets are used when onboarding devices with conflicting or unknown configurations, but SD-WAN deployment instead requires authorising the device, installing the SD-WAN template, and assigning it to the managed FortiGate.

Deleting all existing firewall policies

Why it fails: Deleting existing firewall policies is unnecessary; SD-WAN deployment requires creating a new policy referencing the SD-WAN zone, not removing current rules. It is tempting because policy cleanup is sometimes advised before major changes, and it would be correct when consolidating redundant or conflicting rules during a broader firewall migration.

Delete the entire ADOM

Why it fails: Deleting an entire ADOM removes every managed device, policy package and object within it, not a single revision entry. Revision History operates per object or policy package, offering restore, delete and lock actions on individual revisions. ADOM deletion belongs in System Settings when decommissioning a whole administrative domain.

Export the revision to an external cloud

Why it fails: FortiManager revision history supports export to local files, not to external cloud services; no cloud-export action exists in that interface. It tempts because FortiManager does integrate with cloud services elsewhere, such as FortiGuard and fabric connectors, so cloud export would be the right answer if the question asked about those features instead.

Modify the version permanently

Why it fails: Revision History entries are immutable snapshots; FortiManager offers no operation that rewrites a stored revision's version number, so permanent modification is impossible. It tempts because revisions can be restored or deleted, and installing a revision pushes its configuration to managed devices — yet the version identifier itself stays fixed.

Changes to the log settings on the FortiGate local GUI

Why it fails: Log settings changed on the FortiGate local GUI are device-local and are not tracked by FortiManager, so no push is required. Local GUI changes are tempting because FortiManager does push many settings, and a push would be correct when the change is made in a policy package or device-level configuration within FortiManager.

Adding a new user to the FortiGate local database

Why it fails: Adding a user to the FortiGate local database is a device-local change, not part of a FortiManager policy package, so it does not require a push. Local database edits are tempting because FortiManager can push user objects, and a push would be correct when the user is defined in a FortiManager-managed firewall address or user group.

Changing the FortiManager admin password

Why it fails: Changing the FortiManager admin password affects only FortiManager's own administrative access and is never pushed to managed FortiGates. It is tempting because FortiManager pushes many settings to devices, and a push would be correct when the change is a device-level configuration object, such as an admin account on the FortiGate itself.

TCP port selection

Why it fails: IKE uses UDP 500/4500.

Firewall policy ID

Why it fails: The firewall policy ID is a local FortiGate configuration value that selects which policy permits the tunnel; it is never carried in IKEv2 payloads or negotiated with the peer. It is tempting because policies reference the tunnel, but Phase 1 negotiates encryption, authentication, and DH group parameters instead.

SLA target name.

Why it fails: An SLA target names a measured performance threshold used to steer or select members, not a traffic origin. SLA targets appear as the health-check condition within an SD-WAN rule, defining which links qualify rather than which sources match.

Interface MAC address.

Why it fails: SD-WAN rules match sources by IP address, user, or geography, not by interface MAC address, which is a Layer 2 attribute invisible to policy matching. MAC-based criteria belong to Layer 2 switching or device-identity features.

Firewall policy ID.

Why it fails: A firewall policy ID identifies the rule performing the match, not the traffic origin, so it cannot serve as a source criterion. Policy IDs are referenced for logging, ordering, and diagnostics rather than SD-WAN rule source selection.

SNMP monitoring traffic

Why it fails: SNMP carries management and monitoring data between network devices; IPS policies inspect attack signatures and malicious payloads, not routine telemetry. It is tempting because SNMP traverses the firewall, but it is handled by management-plane access rules, not intrusion prevention inspection.

ICMP echo requests

Why it fails: ICMP echo requests are handled by the DoS policy's ICMP flood sensor, not signature inspection; an IPS policy inspects TCP/UDP application payloads. It tempts because ICMP anomaly detection is a FortiGate security profile, but that sits under DoS policies, so it would be correct for flood protection rather than IPS signature matching.

It supports deep content inspection for all protocols

Why it fails: Flow-based inspection performs single-pass scanning with limited protocol decoding, so it cannot deliver deep content inspection across all protocols; proxy mode does that. It is tempting because flow mode does inspect content at high throughput, but the stem asks for benefits, and full deep inspection is a proxy-based advantage.

It requires manual buffer allocation

Why it fails: Flow-based inspection uses stream-based scanning without manual buffer allocation; buffers are managed automatically, so this describes a limitation rather than a benefit. It is tempting because proxy-based mode does involve buffer sizing, and manual allocation would be relevant if the question asked about proxy inspection tuning.

It offers more granular application control

Why it fails: Flow-based inspection performs single-pass processing with less granular application control than proxy-based mode, which decodes each protocol fully. Granular application control is proxy mode's strength, so this is not a flow-mode benefit; it is tempting because flow mode does inspect applications, but at reduced depth.

Identical prefix lists

Why it fails: Prefix lists filter route advertisements and are not exchanged during session establishment; they matter only for route selection afterwards. They are tempting because both peers commonly share filtering policy, but adjacency requires matching AS numbers, authentication and reachable addresses instead.

Identical router IDs

Why it fails: Router IDs identify each speaker and must be unique, not identical; duplicate router IDs actually cause instability. It is tempting because both peers need a router ID configured, but adjacency depends on matching AS numbers, authentication and reachable addresses, not on the ID values matching.

The name of the administrator

Why it fails: SD-WAN rule selection criteria are technical metrics such as link quality, latency, jitter, packet loss, priority and source or destination; administrator name is not a traffic attribute. It is tempting because administrators configure the rules, but identity of the operator never appears as a matching condition.

System temperature

Why it fails: SD-WAN rule selection criteria are traffic attributes such as source/destination, application, or link quality — not chassis telemetry. Temperature is monitored for hardware health alerts, so it would be the right metric only when triggering thermal shutdown or fan-speed responses, never for steering sessions across WAN links.

Device serial number

Why it fails: SD-WAN rules match on traffic and link characteristics like application signatures, source address, or measured latency and jitter; a serial number identifies one appliance and cannot vary per session. Serial numbers are used for licensing and FortiManager device registration, which is where they would legitimately appear.

Set the IPsec Phase 1 encryption algorithm to DES to speed up decryptions

Why it fails: DES is a weak, deprecated cipher that FortiGate does not use for IPsec Phase 1 proposals; it would not improve throughput and would break confidentiality. Offloading inspection or excluding trusted traffic from specific profiles reduces load. DES would be considered only for legacy interoperability, never for performance tuning.

Disable all SSL inspection globally across the entire FortiGate device

Why it fails: Disabling SSL inspection globally strips deep inspection of encrypted sessions, so the Antivirus, Web Filtering and IPS profiles cannot examine TLS traffic at all — security is effectively removed, not optimised. It tempts administrators because SSL inspection is CPU-intensive, and disabling it is the correct fix only when encrypted traffic is deliberately excluded from inspection.

Remove the SD-WAN virtual interface from all firewall zones

Why it fails: Removing the SD-WAN virtual interface from all zones breaks the zone-based policy and profile binding, so the SD-WAN rule no longer matches traffic and inspection ceases. It tempts because zone membership controls where policies apply, and removing an interface is the right action when decommissioning a link or isolating it from all policy enforcement.

Automatic log rotation

Why it fails: Log rotation is a scheduled system-level housekeeping task configured under system settings; it does not modify ADOM configuration and therefore does not require Workspace Mode. Workspace Mode is used when you need to stage and commit configuration changes across multiple ADOMs as a single transaction.

Creating new ADOMs

Why it fails: ADOM creation is performed from the system-level ADOM management interface, outside the per-ADOM configuration lock that Workspace Mode governs. Workspace Mode applies to staging policy and object edits within an existing ADOM before committing them. Creating ADOMs is the correct action when you need to segment administrative domains.

Forcing a reboot

Why it fails: Forcing a reboot is a device-level operational command issued from the FortiManager device manager; it does not touch ADOM configuration and so bypasses Workspace Mode entirely. Workspace Mode exists to stage configuration changes before committing them. Rebooting is the right action when a managed FortiGate is unresponsive.

execute ipsec tunnel list

Why it fails: This lists active IPsec tunnels and their selectors, revealing nothing about BGP neighbour state or advertised prefixes. It is useful for confirming a tunnel is established before deeper troubleshooting, but diagnosing missing route propagation requires BGP-specific commands such as get router info bgp neighbours and summary.

diagnose sys sdwan member

Why it fails: This command shows SD-WAN member status, link health and SLA measurements, not BGP peering state or advertised prefixes. It is tempting when tunnel performance is suspected, but route propagation faults require BGP neighbour and routing-table commands to inspect received and advertised routes.

get system interface physical

Why it fails: Interface physical output shows link state, speed and MAC details, not BGP neighbour state or the Adj-RIB-Out, so it cannot reveal why specific prefixes are missing. It is tempting because physical-layer faults do break IPsec tunnels, and this command would be the right starting point when a tunnel is down rather than when routes are absent.

The HA cluster size

Why it fails: Enabling multi-vdom partitions the configuration into virtual domains; it does not alter HA cluster membership or size, which depends on HA peers and priorities. It is tempting because VDOMs and HA are both global-level settings, and multi-vdom would be relevant when planning per-VDOM HA topologies.

The physical port order

Why it fails: Multi-vdom changes configuration partitioning, not interface naming or physical port ordering, which remain fixed by hardware layout. It is tempting because VDOM mode does affect how interfaces are assigned and displayed, and it would matter when mapping ports to VDOMs after conversion.

Interface physical speed

Why it fails: SD-WAN rules select members by measured link quality — latency, jitter, packet loss and priority — not by interface physical speed, which is a static property of the port. Physical speed is relevant when sizing interfaces or configuring aggregate links, where raw bandwidth rather than dynamic path health governs the design.

MAC address spoofing

Why it fails: MAC address spoofing belongs to firewall VIP or IP-MAC binding configuration, not SD-WAN rule matching; SD-WAN rules match traffic by source, destination, application and user. Spoofing would be configured when a VIP must answer ARP for an external address on a FortiGate interface.

Hardware acceleration toggle

Why it fails: Hardware acceleration is a per-policy or per-profile setting controlling offload to NP processors, not a criterion within SD-WAN rule configuration. It would be toggled when troubleshooting throughput or session behaviour on policies where offload interferes with inspection features.

DHCP server settings

Why it fails: DHCP server settings are not required for SD-WAN traffic steering; the template needs the SD-WAN interface members and a performance SLA health check. It tempts because branch templates often include DHCP for LAN clients, which is correct when provisioning a full branch configuration rather than SD-WAN steering alone.

VLAN tagging

Why it fails: VLAN tagging is not a prerequisite for SD-WAN traffic steering; steering relies on SD-WAN members and performance SLA health checks, not VLAN configuration. It tempts because VLANs are commonly configured on the underlay interfaces carrying WAN traffic, which is valid when segmenting multiple services over one physical link.

Local users

Why it fails: Local users are irrelevant to SD-WAN traffic steering; the template must define SD-WAN members and a performance SLA to measure link quality. It tempts because templates frequently bundle authentication objects for branch devices, which is correct when provisioning user access rather than steering rules.

The firewall firmware version

Why it fails: Firmware version determines features and log field formats, not how efficiently logs are stored; compression, log level and retention settings drive storage consumption. It is tempting because firmware upgrades can change logging behaviour, but the stem asks about storage efficiency, which firmware does not govern.

The number of active users

Why it fails: Active user count reflects workload, not storage efficiency; the same users can generate vastly different log volumes depending on log level and enabled event categories. It is tempting because more users usually mean more logs, but volume is not efficiency — compression and retention settings are.

FortiGuard cached updates

Why it fails: FortiGuard cached updates are stored separately in memory and are not written into the configuration file. It is tempting because FortiGuard settings do appear in the config, but cached update content itself is not included; the config holds configuration, not cached data.

Real-time session tables

Why it fails: Real-time session tables are held in volatile kernel memory, not written to the FortiGate configuration file, which stores persistent settings such as firewall policies, interfaces and routing. It is tempting because session data is visible in the GUI and CLI, but that reflects live state, not saved configuration.