Courseiva

Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 1–75

940 questions total · 13pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 13

Page 2
1
MCQmedium

An administrator has configured OSPF on a FortiGate with multiple areas. They want to ensure that routes from area 0 are redistributed into area 1, but they notice that routes from area 1 are not appearing in area 0. What is the most likely configuration issue?

A.There is a firewall policy blocking OSPF packets
B.The ABR has 'area 1 stub' configured, preventing LSA type 5 redistribution
C.The redistribution is done with a route map that is not permitting the routes
D.The ABR is not configured with 'area 0' and 'area 1' on the same router
AnswerD

Correct. For a router to act as an ABR and exchange routes between areas, it must have interfaces in both area 0 and the other area (area 1). If the router lacks an interface in area 0, it cannot generate Type 3 LSAs, and routes from area 1 will not appear in area 0.

Why this answer

The most likely configuration issue is that the ABR is not properly configured as an ABR – it must have interfaces in both area 0 and area 1. Without an interface in area 0, the router cannot generate Type 3 LSAs (inter-area advertisements) between the areas, so routes from area 1 never appear in area 0. Option B is incorrect because a stub area blocks Type 5 LSAs from entering the stub area, but it does not block Type 3 LSAs from being advertised out of the stub area into the backbone; therefore, stub configuration would not prevent inter-area routes from reaching area 0.

Exam trap

The trap is that candidates often assume that any router connecting area 1 to area 0 is automatically an ABR, but it must have an interface in area 0 to function as an ABR. Without it, the router cannot perform inter-area route advertisement.

How to eliminate wrong answers

Option A is wrong because a firewall policy blocking OSPF packets would prevent OSPF neighbor formation entirely, not selectively block route redistribution from area 1 to area 0 while allowing redistribution from area 0 to area 1. Option C is wrong because redistribution with a route map is used for importing external routes into OSPF (e.g., from other protocols), not for controlling inter-area route advertisement between OSPF areas; inter-area routes are handled by ABR Type 3 LSA generation, not redistribution. Option D is wrong because an ABR must have interfaces in both area 0 and area 1 to function as an ABR; if the ABR were not configured with both areas, it would not be an ABR and inter-area routing would fail entirely, not just in one direction.

Full explanation →
2
MCQhard

You receive an alert from FortiSandbox that a file has been rated 'highly malicious'. The FortiGate has the FortiSandbox inline scanning enabled with the action 'block malicious'. However, the file is still being downloaded by users. What is the most likely reason?

A.The FortiSandbox device is not reachable from FortiGate
B.The IPS sensor is blocking the connection before the antivirus inspection
C.The antivirus database is outdated
D.The file type is not listed in the scanning profile for FortiSandbox
AnswerD

If the file type is excluded, FortiGate will not submit it to FortiSandbox for analysis, allowing it to pass.

Why this answer

FortiSandbox inline scanning only inspects file types that are explicitly listed in the scanning profile. If the file type (e.g., .zip, .pdf, or a specific executable extension) is not included in the profile, FortiGate will allow the file to pass through without sending it to FortiSandbox for analysis, even if the action is set to 'block malicious'. This explains why a file rated 'highly malicious' can still be downloaded by users.

Exam trap

The trap here is that candidates assume 'block malicious' applies universally to all files, but FortiSandbox inline scanning only inspects files whose types are explicitly configured in the scanning profile, so a missing file type bypasses the sandbox entirely.

How to eliminate wrong answers

Option A is wrong because if the FortiSandbox device were not reachable, FortiGate would typically fall back to a configured action (e.g., block or allow) or generate an alert, but the file would not be downloaded without some indication of the failure; the question states the file is still being downloaded, implying no connectivity issue was triggered. Option B is wrong because an IPS sensor blocking the connection before antivirus inspection would prevent the download entirely, not allow it to complete; the scenario describes the file being downloaded, so IPS is not the cause. Option C is wrong because an outdated antivirus database affects signature-based detection, but FortiSandbox inline scanning relies on cloud-based or sandbox analysis, not the local AV database; an outdated AV database would not prevent the file from being sent to FortiSandbox.

Full explanation →
3
Multi-Selecthard

A FortiGate administrator is troubleshooting why files are not being submitted to FortiSandbox for analysis. Which THREE conditions must be met for file submission to work? (Choose three.)

Select 3 answers
A.SSL inspection must be disabled for the policy
B.The file type must be in FortiSandbox's supported list
C.The antivirus profile must be in proxy-based inspection mode
D.The FortiSandbox must be in inline scanning mode
E.The FortiGate must have a valid FortiSandbox license
AnswersB, C, E

Unsupported files are not submitted.

Why this answer

FortiSandbox only supports analysis for specific file types (e.g., PE, PDF, Office documents). If the file type is not in the supported list, the FortiGate will not submit it, even if all other conditions are met. This is a fundamental filtering step in the FortiGate-FortiSandbox integration.

Exam trap

The trap here is that candidates often confuse the requirement for SSL inspection (must be enabled, not disabled) and assume FortiSandbox must be in inline mode, when in fact the FortiGate's inspection mode (proxy-based) is the critical factor.

Full explanation →
4
Multi-Selecthard

A FortiManager administrator wants to use automation stitches to respond to a specific security event on managed FortiGates. Which THREE components are required to build an automation stitch? (Select THREE.)

Select 3 answers
A.Trigger
B.Route
C.Action
D.FortiView dashboard
E.ADOM
AnswersA, B, C

The trigger defines the event that starts the automation stitch.

Why this answer

An automation stitch in FortiManager requires three core components: a Trigger (the event that starts the stitch), a Route (a conditional path that determines which actions to execute based on the trigger's output), and an Action (the actual response, such as a CLI script or object change). Without these three, the stitch cannot function as a complete automation workflow.

Exam trap

The trap here is that candidates often confuse FortiView or ADOM as required components because they are frequently used in FortiManager workflows, but they are not part of the automation stitch's three mandatory building blocks.

Full explanation →
5
MCQhard

When configuring FortiGate with FortiSandbox integration, an administrator wants to block files that are rated 'High Risk' by the sandbox. Which setting must be enabled in the antivirus profile to automatically quarantine these files?

A.Configure an automation stitch to quarantine files based on sandbox verdict
B.Enable 'File Filter' in the antivirus profile and add a rule for high-risk files
C.Enable 'Submit Files to FortiSandbox' and set action to 'Block'
D.Enable 'FortiSandbox Quarantine' in the IPS profile
AnswerC

This setting submits files and blocks high-risk verdicts.

Why this answer

The 'Submit Files to FortiSandbox' setting in the antivirus profile, when set to 'Block', directly instructs FortiGate to quarantine files that receive a 'High Risk' verdict from FortiSandbox. This action is part of the antivirus profile's sandbox integration, not a separate automation or IPS feature, and it automatically handles the quarantine without requiring additional configuration.

Exam trap

The trap here is that candidates often confuse the 'Block' action in the antivirus profile with automation stitches or file filters, assuming they need a separate workflow to quarantine files, when in fact the antivirus profile's sandbox integration directly handles the quarantine based on the verdict.

How to eliminate wrong answers

Option A is wrong because automation stitches are used for custom workflows (e.g., sending alerts or triggering scripts) but are not the primary setting to automatically quarantine files based on sandbox verdict; the antivirus profile's built-in 'Block' action handles this directly. Option B is wrong because 'File Filter' in the antivirus profile is used to block files by type or pattern (e.g., .exe), not to act on sandbox risk ratings; it does not interpret sandbox verdicts. Option D is wrong because 'FortiSandbox Quarantine' is not a setting in the IPS profile; IPS profiles focus on intrusion prevention signatures, not file quarantine based on sandbox analysis.

Full explanation →
6
MCQeasy

What is the purpose of BFD (Bidirectional Forwarding Detection) in a FortiGate routing configuration?

A.To encrypt routing protocol traffic
B.To detect forwarding path failures quickly
C.To authenticate routing peers
D.To provide load balancing across multiple paths
AnswerB

BFD rapidly detects failures for faster convergence.

Why this answer

BFD (Bidirectional Forwarding Detection) provides fast failure detection for forwarding paths between two adjacent routers, independent of any routing protocol. In FortiGate configurations, BFD is used to detect link or neighbor failures in sub-second intervals (e.g., 50-100 ms), enabling rapid convergence for dynamic routing protocols like OSPF or BGP. This is critical for SD-WAN and high-availability scenarios where traditional keepalive timers (e.g., OSPF Hello/Dead intervals of 10-40 seconds) are too slow.

Exam trap

The trap here is that candidates confuse BFD's role in fast failure detection with routing protocol features like authentication or encryption, or mistakenly think BFD itself provides load balancing, when in fact it only monitors path liveliness and triggers convergence.

How to eliminate wrong answers

Option A is wrong because BFD does not encrypt routing protocol traffic; encryption is handled by protocols like IPsec or authentication mechanisms within routing protocols (e.g., OSPF MD5 authentication). Option C is wrong because BFD does not authenticate routing peers; authentication is a separate feature of routing protocols (e.g., BGP MD5 password or OSPF authentication) and BFD itself has no authentication mechanism. Option D is wrong because BFD is a detection mechanism, not a load-balancing tool; load balancing across multiple paths is achieved by ECMP (Equal-Cost Multi-Path) routing or SD-WAN rules, while BFD simply detects failures on those paths.

Full explanation →
7
MCQmedium

An administrator configures a performance SLA to monitor a remote server. The SLA status shows 'dead' for one WAN member. The administrator checks the interface and sees that it is up and passing other traffic. What is the most likely cause?

A.The FortiGate's routing table does not have a route to the probe target
B.The interface is not added as an SD-WAN member
C.The SLA probe is using TCP port 80 but the server is only responding to ICMP
D.The SLA probe interval is set too high
AnswerC

If the probe type does not match the server's response, the SLA fails even if the link is up.

Why this answer

The performance SLA status shows 'dead' because the probe is failing to reach the remote server. The administrator configured the SLA to use TCP port 80, but the server only responds to ICMP. Since the probe packets (TCP SYN) are not being acknowledged, the SLA marks the member as dead, even though the interface is up and other traffic (e.g., ICMP) passes successfully.

Exam trap

The trap here is that candidates assume an 'up' interface and passing traffic guarantee SLA success, overlooking that the SLA probe uses a specific protocol and port that may not match the server's actual response behavior.

How to eliminate wrong answers

Option A is wrong because if the routing table lacked a route to the probe target, the probe would fail for all WAN members, not just one, and the interface would likely not pass other traffic to that destination. Option B is wrong because the interface is already an SD-WAN member (the SLA is monitoring one of its members), and the question states the interface is up and passing traffic. Option D is wrong because a high probe interval would delay detection of failure but would not cause a persistent 'dead' status; the probe would still succeed if the server responded correctly.

Full explanation →
8
MCQeasy

Which Fortinet product is specifically designed to deploy decoys and lures to detect lateral movement and early-stage attacks inside the network?

A.FortiSandbox
B.FortiEDR
C.FortiDeceptor
D.FortiClient
AnswerC

FortiDeceptor deploys decoys and lures to detect lateral movement.

Why this answer

FortiDeceptor is specifically designed to deploy decoys and lures that mimic real assets (e.g., servers, endpoints, IoT devices) to attract and detect lateral movement and early-stage attacks inside the network. It uses deception technology to create a realistic attack surface, triggering alerts when an attacker interacts with a decoy, without relying on signatures or behavioral analysis.

Exam trap

The trap here is that candidates often confuse FortiDeceptor with FortiSandbox or FortiEDR because all three are part of the Advanced Threat Protection portfolio, but only FortiDeceptor focuses on deception-based detection of lateral movement rather than file analysis or endpoint response.

How to eliminate wrong answers

Option A is wrong because FortiSandbox is a threat analysis and sandboxing solution that detonates files and URLs in a controlled environment to detect unknown malware, not a deception-based tool for deploying decoys and lures. Option B is wrong because FortiEDR is an endpoint detection and response solution that monitors and responds to threats on endpoints using behavioral analysis and machine learning, not a decoy deployment system. Option D is wrong because FortiClient is a lightweight endpoint agent for VPN, web filtering, and basic antivirus, lacking the dedicated deception capabilities to deploy decoys and lures for lateral movement detection.

Full explanation →
9
MCQmedium

During an SD-WAN health check, an administrator observes that a performance SLA for wan1 shows 'Status: dead' even though the interface is up and can ping the SLA server. The SLA configuration uses a TCP echo probe to 8.8.8.8 port 443. What is the most likely cause?

A.The SLA server is blocking ICMP echo requests.
B.The performance SLA is configured with the wrong threshold.
C.The firewall policy allowing the probe traffic is missing.
D.The probe protocol is TCP echo, but the server at 8.8.8.8 does not support TCP echo on port 443.
AnswerD

TCP echo uses port 7 by default; using a different port will not elicit a proper echo response unless the server is configured for it.

Why this answer

The TCP echo probe sends a TCP SYN to the specified port and expects a SYN-ACK to confirm connectivity. 8.8.8.8 (Google DNS) does not run a TCP echo service on port 443; it serves HTTPS. The server will respond with a TCP RST or simply ignore the probe, causing the SLA to fail and show 'dead' even though the interface is up and ICMP ping works.

Exam trap

The trap here is that candidates assume a successful ICMP ping to the SLA server means all probes should work, overlooking that TCP echo probes require a specific service (TCP echo on port 7 or a custom port that echoes data) and that port 443 on 8.8.8.8 does not provide that service.

How to eliminate wrong answers

Option A is wrong because the SLA uses a TCP echo probe, not ICMP, so ICMP blocking is irrelevant to the probe's failure. Option B is wrong because threshold misconfiguration would cause latency/jitter SLA failures, not a complete inability to establish a TCP connection (the probe never gets a SYN-ACK). Option C is wrong because if the firewall policy were missing, the probe traffic would be dropped and the interface would likely show 'dead' for all probes, but the administrator confirms the interface can ping the SLA server, indicating policy allows outbound traffic.

Full explanation →
10
MCQeasy

An administrator needs to monitor traffic flows across multiple FortiGate devices in a Security Fabric. The administrator wants to see a unified view of all traffic, including inter-device traffic, from a single pane. Which Fortinet tool provides this capability?

A.FortiAP
B.FortiManager
C.FortiGate local logs
D.FortiAnalyzer
AnswerD

FortiAnalyzer aggregates logs and provides cross-device traffic visibility.

Why this answer

FortiAnalyzer is the correct tool because it aggregates logs and traffic data from multiple FortiGate devices within a Security Fabric, providing a unified view of all traffic, including inter-device flows. It uses the FortiTelemetry protocol to collect logs and supports the Security Fabric's topology mapping, allowing administrators to monitor cross-device traffic from a single pane of glass.

Exam trap

The trap here is that candidates often confuse FortiManager's centralized management capabilities with FortiAnalyzer's log aggregation and monitoring functions, leading them to select FortiManager for traffic visibility when it is actually designed for policy and configuration management, not real-time traffic analysis.

How to eliminate wrong answers

Option A is wrong because FortiAP is a wireless access point device that provides Wi-Fi connectivity, not a centralized log aggregation or traffic monitoring tool for multiple FortiGates. Option B is wrong because FortiManager is primarily a centralized management platform for configuration and policy deployment, not a log analysis or traffic monitoring tool; it does not provide the unified traffic view that FortiAnalyzer offers. Option C is wrong because FortiGate local logs are stored locally on each device and cannot provide a unified view across multiple FortiGates or show inter-device traffic flows.

Full explanation →
11
Multi-Selectmedium

A FortiGate administrator is configuring a multi-peer IPsec VPN where two remote sites (Site A and Site B) connect to a central hub. The administrator wants to ensure that if the primary peer for a site goes down, traffic automatically fails over to the backup peer. Which TWO settings must be configured on the hub's phase1?

Select 2 answers
A.Set 'auto-negotiate' to 'enable'
B.Set 'dpd' to 'on-demand'
C.Set 'aggregate-ipsec' to 'round-robin'
D.Set 'peer-options' to include both peers with 'priority'
E.Set 'failover' to 'enable'
AnswersD, E

Why this answer

Multi-peer VPN requires configuring 'peer-options' with multiple peer IPs and priorities, and enabling 'failover' on the phase1 interface to allow automatic switching to the backup peer if the primary goes down.

Full explanation →
12
MCQmedium

A FortiGate in HA active-passive mode has two VDOMs. VDOM-1 is configured for management (management VDOM). The administrator connects to the management VDOM IP to manage the device. What is a characteristic of the management VDOM?

A.It provides administrative access and is separate from data VDOMs
B.It automatically synchronizes configuration to other VDOMs
C.It must be the root VDOM
D.It can only be accessed via the console port
AnswerA

Management VDOM is dedicated to management traffic, isolating administrative access from data traffic.

Why this answer

In an HA active-passive setup with multiple VDOMs, a management VDOM is dedicated to administrative access (e.g., SSH, HTTPS, SNMP) and is logically separated from data VDOMs that handle production traffic. This separation ensures that management traffic does not interfere with data plane operations and that administrative access remains available even if data VDOMs experience issues. The management VDOM can be any VDOM, not necessarily the root, and its configuration is not automatically synchronized to other VDOMs.

Exam trap

The trap here is that candidates often assume the management VDOM must be the root VDOM or that it automatically syncs configurations to other VDOMs, but Fortinet explicitly separates these concepts to allow flexible administrative isolation without affecting global settings or HA synchronization.

How to eliminate wrong answers

Option B is wrong because the management VDOM does not automatically synchronize its configuration to other VDOMs; configuration synchronization in HA is handled at the system level (e.g., via FGCP), not by the management VDOM itself. Option C is wrong because the management VDOM does not have to be the root VDOM; any VDOM can be designated as the management VDOM, and the root VDOM is a separate concept used for global settings. Option D is wrong because the management VDOM can be accessed via any allowed administrative interface (e.g., network interfaces with HTTPS/SSH enabled), not only the console port; console access is just one of many possible methods.

Full explanation →
13
Multi-Selectmedium

An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails phase 2. Which TWO commands are MOST useful to diagnose the phase 2 failure? (Choose two.)

Select 2 answers
A.diagnose sys session list
B.show vpn ipsec phase2-interface
C.get system performance status
D.diagnose vpn ike config
E.diagnose debug application ike 255
AnswersD, E

Shows phase 2 proposals and selectors.

Why this answer

The 'diagnose vpn ike config' command (D) displays the IKE configuration that the FortiGate is actually using for phase 2 negotiations, including proxy IDs, encryption algorithms, and lifetimes. This helps identify mismatches between the local and peer configurations that cause phase 2 to fail. The 'diagnose debug application ike 255' command (E) enables verbose IKE debugging, which logs every phase 2 exchange, including error messages like 'no proposal chosen' or 'mismatched proxy ID', directly pinpointing the failure reason.

Exam trap

The trap here is that candidates often choose 'show vpn ipsec phase2-interface' (B) thinking it shows real-time negotiation status, but it only displays static configuration, not the dynamic debug output needed to see why the peer rejects the proposal.

Full explanation →
14
MCQmedium

A FortiGate administrator notices that a VPN tunnel goes down and re-establishes every 30 minutes. The administrator checks the tunnel's phase1 and phase2 lifetimes. The phase1 lifetime is set to 86400 seconds and phase2 to 3600 seconds. What is the most likely cause of the tunnel dropping?

A.The phase2 lifetime is set to 3600 seconds, causing rekey failures
B.The phase1 lifetime is too short, causing frequent renegotiation
C.The VPN tunnel is not configured to use NAT traversal
D.The DPD (Dead Peer Detection) timeout is triggered every 30 minutes
AnswerD

If DPD retry timeout is set to a value that results in the peer being declared dead after 30 minutes, the tunnel will be torn down and re-established.

Why this answer

The VPN tunnel drops every 30 minutes, which matches a typical DPD (Dead Peer Detection) timeout interval. DPD is used to verify that the remote peer is still reachable; if no response is received within the DPD timeout (default often 30 minutes), the tunnel is torn down. The phase2 lifetime of 3600 seconds (1 hour) would cause rekey every hour, not 30 minutes.

The phase1 lifetime of 86400 seconds (24 hours) is long. Therefore, the most likely cause is a DPD timeout triggering every 30 minutes, making option D correct.

Full explanation →
15
MCQmedium

A FortiGate is configured to send logs to FortiAnalyzer. The administrator notices that logs are not appearing on FortiAnalyzer. Running 'diagnose log device show' shows 'connected=no'. What is the most likely cause?

A.The log rate is too high and logs are being dropped
B.The FortiGate's log buffer is full
C.The FortiGate cannot reach the FortiAnalyzer due to a network issue
D.The FortiAnalyzer license has expired
AnswerC

Connectivity failure is the primary reason for 'connected=no'.

Why this answer

The 'diagnose log device show' output showing 'connected=no' indicates that the TCP connection between the FortiGate and FortiAnalyzer (typically on port 514 for syslog or port 514/3000 for FortiAnalyzer protocol) is not established. The most likely cause is a network issue preventing the FortiGate from reaching the FortiAnalyzer, as the connection status is directly tied to Layer 3 reachability and TCP handshake completion.

Exam trap

The trap here is that candidates often confuse 'connected=no' with log delivery failures caused by high log rates or buffer issues, but the connection status is a Layer 4 TCP state indicator, not a measure of log throughput or storage capacity.

How to eliminate wrong answers

Option A is wrong because a high log rate would cause logs to be dropped or buffered locally, but the connection status ('connected=no') would still show as 'connected=yes' if the TCP session to FortiAnalyzer is up; log dropping does not affect the device connectivity state. Option B is wrong because a full log buffer would cause log loss or overwriting, but the 'connected=no' status indicates the FortiGate has not established a TCP connection to the FortiAnalyzer, which is independent of buffer utilization. Option D is wrong because an expired FortiAnalyzer license would still allow log reception and the TCP connection to remain established; the FortiAnalyzer would simply stop processing or storing logs, but the FortiGate would still show 'connected=yes'.

Full explanation →
16
Multi-Selectmedium

Which TWO of the following are required components for a Fortinet ZTNA solution? (Select two.)

Select 2 answers
A.FortiAuthenticator
B.FortiWeb
C.FortiAnalyzer
D.FortiGate
E.FortiClient EMS
AnswersD, E

FortiGate is the ZTNA gateway.

Why this answer

FortiGate is the enforcement point in a ZTNA solution, acting as the ZTNA gateway that verifies device posture and user identity before granting access to protected applications. It terminates ZTNA tunnels from FortiClient and applies identity-based policies, making it a required component for traffic inspection and access control.

Exam trap

The trap here is that candidates often assume FortiAuthenticator is required because ZTNA involves identity, but FortiGate can handle authentication locally or via any SAML IdP, making FortiAuthenticator optional, not mandatory.

Full explanation →
17
Multi-Selectmedium

A FortiGate is experiencing high latency on traffic passing through it. The administrator suspects that asymmetric routing is occurring. Which TWO symptoms are indicative of asymmetric routing?

Select 2 answers
A.The routing table shows multiple equal-cost paths to the same destination.
B.Traffic from the same source IP arrives on different interfaces for different sessions.
C.Traffic matching a policy is logged as allowed but the application does not work.
D.CPU usage is consistently above 90% during peak hours.
E.The firewall logs show TCP SYN packets but no corresponding SYN-ACK packets for the same session.
AnswersB, E

This indicates that the return traffic may be arriving on a different interface than expected.

Why this answer

Asymmetric routing occurs when traffic from the same source IP takes different paths through the network, causing packets to arrive on different FortiGate interfaces for different sessions. This breaks stateful inspection because the firewall expects all packets of a session to traverse the same interface; when they don't, it can lead to session timeouts or dropped packets, manifesting as high latency.

Exam trap

The trap here is that candidates often confuse asymmetric routing with general routing issues like ECMP (option A) or performance problems (option D), but the exam specifically tests the stateful firewall behavior where traffic arriving on different interfaces for the same session is the definitive symptom.

Full explanation →
18
MCQmedium

A FortiGate administrator receives alerts about a device communicating with a known botnet C2 server. The traffic is encrypted with TLS. Which ATP feature is most effective to block this communication?

A.Application control to block the C2 application
B.Antivirus profile with SSL inspection
C.IPS signature for botnet activity
D.DNS Filter with botnet C2 domain blocking
AnswerD

DNS filter blocks resolution of known malicious domains, preventing communication.

Why this answer

DNS Filter with botnet C2 domain blocking is the most effective because it proactively prevents the initial DNS resolution of the botnet's command-and-control domain, stopping the TLS handshake before it even begins. Since the traffic is encrypted with TLS, other security mechanisms like application control or IPS would require decryption to inspect the payload, which may not be feasible or configured. DNS Filter operates at Layer 7 without needing to decrypt the traffic, directly blocking the domain lookup based on FortiGuard's real-time threat intelligence.

Exam trap

The trap here is that candidates assume encrypted traffic requires SSL inspection to block it, but DNS Filter blocks the domain resolution before encryption occurs, making it the most efficient and non-intrusive solution for C2 communication.

How to eliminate wrong answers

Option A is wrong because Application Control identifies applications by signature or IP/port patterns, but encrypted TLS traffic hides the application payload, and the C2 server may use common ports (e.g., 443) that cannot be blocked without decryption. Option B is wrong because Antivirus profiles with SSL inspection require the FortiGate to perform man-in-the-middle decryption of the TLS traffic, which may break certificate pinning, cause privacy issues, or be impossible if the device uses certificate pinning or non-proxyable TLS. Option C is wrong because IPS signatures for botnet activity rely on pattern matching in the decrypted payload or unencrypted headers; without SSL inspection, the IPS engine cannot see the encrypted C2 commands, and the botnet may use dynamic IPs or domain fronting to evade signature-based detection.

Full explanation →
19
MCQhard

A FortiGate in an HA cluster shows the message 'split-brain detected' in the event log. The administrator checks the HA status and sees both units are in 'standalone' mode. What is the MOST likely cause of this split-brain scenario?

A.The heartbeat interface is down on both units, causing them to assume they are the primary
B.The HA priority is set to the same value on both units
C.The HA mode is set to 'active-active' instead of 'active-passive'
D.The HA cluster is using a unicast heartbeat and the configuration is incorrect
AnswerA

When heartbeat communication is lost, both units may assume primary role, leading to split-brain.

Why this answer

When the heartbeat interface fails on both units, each FortiGate loses communication with its peer and assumes it is the sole surviving unit. This causes both to transition to 'standalone' mode and operate independently, which is the classic split-brain scenario. The event log message 'split-brain detected' confirms that the cluster has lost heartbeat connectivity, leading to each unit believing it must take over as primary.

Exam trap

The trap here is that candidates often assume split-brain is caused by configuration mismatches (like priority or mode), but the core issue is always a loss of heartbeat communication between the cluster members, leading both to operate independently in standalone mode.

How to eliminate wrong answers

Option B is wrong because identical HA priority values do not cause a split-brain; they simply affect the election process, and FortiGate HA can handle tie-breaking via other criteria like serial number. Option C is wrong because active-active mode is a valid HA configuration and does not inherently cause a split-brain; split-brain is a connectivity issue, not a mode selection issue. Option D is wrong because an incorrect unicast heartbeat configuration could prevent cluster formation, but it would not cause both units to enter 'standalone' mode simultaneously; typically one would fail to join the cluster, not both becoming standalone.

Full explanation →
20
MCQhard

An admin creates a VDOM named 'CustomerA' with inter-VDOM link to the management VDOM. The admin wants CustomerA administrators to manage only their own VDOM. Which configuration step is required?

A.Use the 'config system admin' command and set trusthost to the admin's IP
B.Place the management VDOM and CustomerA in different administrative domains (ADOMs) in FortiManager
C.Create a new administrator and set the 'VDOM' field to 'CustomerA' and assign a profile with appropriate permissions
D.Enable admin-role override in the VDOM settings
AnswerC

This restricts the admin to only CustomerA VDOM.

Why this answer

To restrict a VDOM administrator to manage only their own VDOM, you must create a new administrator account and explicitly set the 'VDOM' field to that VDOM (e.g., 'CustomerA') and assign a profile with the necessary permissions. This ensures the admin's scope is limited to that VDOM, preventing access to the management VDOM or other VDOMs.

Exam trap

The trap here is confusing IP-based access control (trusthost) with VDOM-based administrative scoping, leading candidates to select Option A instead of understanding that VDOM assignment is the correct method to isolate admin privileges to a single VDOM.

How to eliminate wrong answers

Option A is wrong because the 'trusthost' setting restricts the source IP address from which an admin can log in, not the VDOM scope; it does not limit the admin to managing only CustomerA. Option B is wrong because administrative domains (ADOMs) are a FortiManager concept for multi-device management, not a FortiGate VDOM isolation feature; the question is about local VDOM administration on a single FortiGate. Option D is wrong because 'admin-role override' is not a standard FortiGate VDOM setting; the correct mechanism is to assign the admin to a specific VDOM via the 'config system admin' command with the 'vdom' parameter.

Full explanation →
21
Multi-Selecteasy

A FortiGate is experiencing high CPU usage due to a large number of sessions. Which TWO actions can the admin take to mitigate the issue? (Choose two.)

Select 2 answers
A.Set a shorter session TTL for idle sessions to free up resources
B.Increase the session table size
C.Upgrade the firmware to the latest version
D.Implement session rate limiting using 'config system session-ttl'
E.Disable all security profiles
AnswersA, D

Shorter TTL removes idle sessions quicker, reducing table size and CPU overhead.

Why this answer

Setting a shorter session TTL for idle sessions (Option A) reduces the time inactive sessions remain in the session table, freeing up memory and CPU resources used for session maintenance. This directly addresses high CPU caused by a large number of sessions by accelerating the cleanup of stale entries.

Exam trap

The trap here is that candidates may confuse session table size (a capacity metric) with session management efficiency, or assume that disabling security profiles is a valid troubleshooting step when it is actually a last-resort workaround that compromises security.

Full explanation →
22
MCQeasy

What is the primary function of FortiAnalyzer's FortiView feature?

A.Centralized device configuration management
B.Scheduling and generating compliance reports
C.Real-time traffic monitoring and visualization
D.Automated remediation of security incidents
AnswerC

FortiView is the real-time monitoring tool.

Why this answer

FortiView on FortiAnalyzer provides real-time traffic monitoring and visualization by aggregating logs from FortiGate devices and displaying them in graphical dashboards. It allows administrators to instantly view top talkers, applications, threats, and other network activity without needing to run manual queries, making it the primary function for live traffic analysis.

Exam trap

The trap here is that candidates confuse FortiView's real-time monitoring with FortiManager's centralized management or FortiAnalyzer's reporting capabilities, leading them to pick Option A or B instead of recognizing that FortiView is explicitly designed for live traffic visualization.

How to eliminate wrong answers

Option A is wrong because centralized device configuration management is handled by FortiManager, not FortiAnalyzer; FortiAnalyzer focuses on log management and reporting, not pushing configuration changes. Option B is wrong because while FortiAnalyzer can generate compliance reports, that is a secondary feature of the Reports module, not the primary function of FortiView, which is specifically for real-time monitoring and visualization. Option D is wrong because automated remediation of security incidents is a function of FortiSOAR or FortiGate's automation stitches, not FortiAnalyzer's FortiView, which is read-only and does not execute actions.

Full explanation →
23
Multi-Selecthard

An organization uses FortiAnalyzer for centralized logging. The security team wants to use playbooks to automate responses to detected incidents. Which THREE components are essential for a playbook to function?

Select 3 answers
A.Trigger
B.A report schedule
C.Conditions
D.A dashboard visualization
E.Actions
AnswersA, C, E

Defines what event initiates the playbook.

Why this answer

A trigger is essential because it defines the event or condition that initiates the playbook execution. Without a trigger, the playbook has no starting point and cannot automate responses to detected incidents. In FortiAnalyzer, triggers can be based on log events, alerts, or scheduled intervals.

Exam trap

The trap here is that candidates often confuse 'report schedule' or 'dashboard visualization' as necessary components because they are common FortiAnalyzer features, but they are not part of the core playbook execution triad of trigger, conditions, and actions.

Full explanation →
24
MCQmedium

A FortiGate administrator needs to integrate with FortiNAC to enforce network access control for wired and wireless devices. The administrator wants FortiNAC to dynamically assign VLANs based on the device's security posture. Which FortiNAC feature enables this?

A.DHCP fingerprinting
B.NAC policies
C.RADIUS accounting
D.SNMP traps
AnswerB

NAC policies use device posture information to assign VLANs dynamically.

Why this answer

NAC policies define rules for device classification and VLAN assignment based on posture assessment results.

Full explanation →
25
Multi-Selecthard

A FortiGate is configured with OSPF multi-area. The administrator needs to ensure that routes from area 2 are advertised into area 0. Which TWO configurations are necessary?

Select 2 answers
A.Configure a virtual-link between area 2 and area 0
B.Set the OSPF network type to point-to-point
C.Configure an Area Border Router (ABR) between area 2 and area 0
D.Disable OSPF on area 0
E.Enable route redistribution from OSPF into OSPF
AnswersA, C

A virtual-link is required to logically connect area 2 to area 0 when there is no direct physical connection, ensuring OSPF backbone continuity.

Why this answer

To advertise routes from area 2 into area 0, an Area Border Router (ABR) must connect the two areas. The ABR automatically generates Type 3 summary LSAs to propagate routes without explicit redistribution. However, in a multi-area OSPF design, if area 2 is not directly physically connected to backbone area 0, a virtual-link is required to provide logical connectivity.

Since the question asks for two necessary configurations and the topology implies a non-direct connection (common in multi-area setups), both an ABR and a virtual-link are needed.

Exam trap

Candidates often assume that OSPF requires explicit route redistribution for inter-area routing, but in a standard OSPF deployment, an ABR automatically advertises Type 3 LSAs. Also, virtual-links are only used when there is no direct physical connection to the backbone area, not as a substitute for an ABR.

Full explanation →
26
Multi-Selecthard

An administrator is troubleshooting an SD-WAN deployment where traffic from the branch to the datacenter is being sent over the backup LTE link even though the primary MPLS link has low latency and jitter. The SD-WAN rule uses 'Best Quality' strategy with latency and jitter metrics. The performance SLA for MPLS shows 'alive'. Which TWO configurations could cause this behavior?

Select 2 answers
A.BFD is enabled on MPLS but not on LTE.
B.The SD-WAN rule has 'set member' configured to only include LTE.
C.The performance SLA is not associated with the SD-WAN rule.
D.The route to the datacenter is learned via OSPF with a lower cost over LTE.
E.The latency threshold is set too low for MPLS.
AnswersB, C

If MPLS is not listed as a member in the rule, it won't be used.

Why this answer

If the SD-WAN rule uses 'set member' to include only the LTE interface, traffic will be forced over LTE regardless of the performance SLA status or the 'Best Quality' strategy. This overrides the dynamic path selection logic, causing the backup link to be used even when the primary MPLS link is healthy.

Exam trap

The trap here is that candidates assume 'Best Quality' strategy always evaluates all interfaces, but they overlook that the 'set member' configuration explicitly limits which interfaces the rule can use, overriding the strategy's dynamic selection.

Full explanation →
27
MCQhard

An administrator is troubleshooting an SD-WAN scenario where traffic from a branch office to a critical SaaS application is experiencing high latency. The SD-WAN rule uses the best quality SLA strategy. The administrator runs 'diagnose sys sdwan neighbor' and sees that both WAN links have SLA compliance above 90%. However, traffic still uses the slower link. The administrator then runs 'diagnose sys sdwan health-check list' and notices that the health-check server IP is different from the SaaS application's server IP. What is the MOST likely reason the traffic is not using the best-performing link?

A.The health-check server's IP does not match the application's destination IP, so SLA measurements are not representative
B.The SD-WAN rule is configured with 'set load-balance-mode' instead of 'best-quality'
C.The health-check server is not reachable from the faster link
D.The SD-WAN rule has a manual routing override configured
AnswerA

SLA probes measure performance to the configured server, which may not correlate with actual performance to a different destination. The administrator should configure a health-check server that represents the real application traffic.

Why this answer

The SD-WAN rule uses the best quality SLA strategy, which selects the link with the best SLA metrics (latency, jitter, packet loss) for the traffic. However, if the health-check server IP does not match the SaaS application's destination IP, the SLA measurements are not representative of the actual path to the application. The SD-WAN device measures performance to the health-check server, not the application server, so the link that appears best for the health-check may be worse for the actual application traffic, causing the slower link to be selected.

Exam trap

The trap here is that candidates assume high SLA compliance on both links means the best link will always be selected, but they overlook that the health-check target must match the application destination for SLA measurements to be relevant.

How to eliminate wrong answers

Option B is wrong because the question states the SD-WAN rule uses the best quality SLA strategy, so 'set load-balance-mode' is not configured; if it were, traffic would be distributed based on load balancing, not SLA quality. Option C is wrong because if the health-check server were not reachable from the faster link, the SLA would show non-compliance for that link, but the output shows both links have SLA compliance above 90%. Option D is wrong because a manual routing override would bypass SD-WAN policy entirely, but the administrator is observing SD-WAN behavior (traffic using a slower link despite SLA compliance), and the diagnostic commands confirm SD-WAN is active.

Full explanation →
28
MCQeasy

Which FortiClient ATP feature provides protection against zero-day malware by monitoring process behavior and blocking suspicious activities at the endpoint?

A.FortiClient Web Filtering
B.FortiClient Cloud Sandbox
C.FortiClient Exploit Prevention
D.FortiClient Vulnerability Scan
AnswerC

Exploit Prevention monitors process behavior and blocks exploit techniques.

Why this answer

FortiClient Exploit Prevention is correct because it uses real-time behavioral monitoring of process activities—such as API calls, memory access patterns, and code injection attempts—to detect and block zero-day malware that has no known signature. Unlike signature-based detection, this feature identifies malicious behavior at runtime, making it effective against previously unseen threats.

Exam trap

The trap here is that candidates often confuse cloud sandboxing (Option B) with endpoint behavioral protection, but FortiClient Cloud Sandbox is a separate, file-based analysis feature that does not provide real-time process monitoring on the endpoint.

How to eliminate wrong answers

Option A is wrong because FortiClient Web Filtering controls access to URLs and categorizes web traffic based on reputation and category, but it does not monitor process behavior or block suspicious activities at the endpoint. Option B is wrong because FortiClient Cloud Sandbox submits suspicious files to a cloud-based sandbox for dynamic analysis, which is a reactive, offline detection method rather than real-time behavioral monitoring on the endpoint. Option D is wrong because FortiClient Vulnerability Scan checks for missing patches and configuration weaknesses, but it does not monitor or block process-level behavior in real time.

Full explanation →
29
MCQmedium

An administrator configures a new ADOM in FortiManager for a set of FortiGates. The administrator wants to assign meta fields to devices in this ADOM. Where should the meta fields be defined?

A.Policy & Objects -> Object configurations
B.Device Manager -> ADOM settings
C.System settings -> Admin
D.Global database objects
AnswerB

Meta fields are configured in ADOM settings under Device Manager.

Why this answer

Meta fields in FortiManager are defined at the ADOM level under Device Manager -> ADOM settings. This ensures that the custom fields are available for all devices within that specific ADOM, allowing consistent metadata assignment across managed FortiGates. Defining them elsewhere, such as in global database objects, would apply them globally rather than per-ADOM, which is not the administrator's intent.

Exam trap

The trap here is that candidates may confuse ADOM-specific settings with global database objects, assuming meta fields must be defined globally for consistency, but FortiManager requires them to be defined at the ADOM level to maintain isolation between administrative domains.

How to eliminate wrong answers

Option A is wrong because 'Policy & Objects -> Object configurations' is used for managing firewall policies and shared objects, not for defining device-level meta fields. Option C is wrong because 'System settings -> Admin' deals with administrative access and user permissions, not device metadata configuration. Option D is wrong because 'Global database objects' are shared across all ADOMs and would apply meta fields globally, whereas the requirement is to assign meta fields specifically to devices in a single ADOM.

Full explanation →
30
MCQhard

An administrator is testing failover in an HA cluster. They unplug the primary FortiGate's port1 (the heartbeat interface) but the secondary does not take over. The heartbeat is configured on port1. What is the MOST likely cause?

A.The primary unit still has a heartbeat path through other interfaces
B.The HA uptime is less than the failover hold time
C.The secondary unit's priority is higher than the primary's
D.The secondary unit has a faulty power supply
AnswerA

If heartbeat is configured on multiple interfaces, the secondary may still receive heartbeat from the primary via another interface, preventing failover.

Why this answer

In a FortiGate HA cluster, the heartbeat interface is used to monitor the health of the primary unit. When the primary's port1 (heartbeat interface) is unplugged, the cluster can still maintain communication if the primary has an alternative heartbeat path through other interfaces (e.g., a dedicated HA management interface or a secondary heartbeat link). This prevents the secondary from detecting a complete failure, so it does not initiate a failover.

Exam trap

The trap here is that candidates often assume unplugging the heartbeat interface will always trigger a failover, but FortiGate HA can maintain heartbeat redundancy through other interfaces, so the secondary does not take over unless all heartbeat paths are lost.

How to eliminate wrong answers

Option B is wrong because the HA uptime and failover hold time affect the initial synchronization and failover delay, but they do not prevent failover when a heartbeat interface is physically disconnected. Option C is wrong because a higher priority on the secondary would make it the primary, but the question states the secondary does not take over, so priority is not the issue. Option D is wrong because a faulty power supply would cause the secondary to be completely offline or unable to respond, but the scenario describes the secondary as operational but not taking over, so power supply is not the cause.

Full explanation →
31
MCQeasy

Which FortiGate feature can automatically block traffic from an IP address that is detected as malicious by FortiSandbox?

A.Traffic Shaping
B.Intrusion Prevention System (IPS)
C.Application Control
D.Automation Stitch
AnswerD

Automation stitches can react to security events and update threat feeds dynamically.

Why this answer

Automation Stitch in FortiOS allows you to create a trigger-action pair that automatically blocks an IP address when FortiSandbox detects malicious activity. The trigger can be a FortiSandbox IOC (Indicator of Compromise) event, and the action can be an IP block via a local or external block list, enabling real-time, automated threat response without manual intervention.

Exam trap

The trap here is that candidates often confuse IPS (which blocks malicious traffic patterns) with automated IP blocking based on external threat intelligence, not realizing that Automation Stitch is the dedicated mechanism for orchestrating responses to FortiSandbox verdicts.

How to eliminate wrong answers

Option A is wrong because Traffic Shaping is a QoS mechanism that prioritizes or limits bandwidth for specific traffic types, not a security feature that blocks IPs based on threat intelligence. Option B is wrong because Intrusion Prevention System (IPS) detects and blocks exploit attempts and vulnerability-based attacks using signatures and protocol decoders, but it does not automatically block IPs based on FortiSandbox verdicts; IPS actions are triggered by traffic patterns, not external sandbox IOCs. Option C is wrong because Application Control identifies and controls application usage (e.g., blocking social media or video streaming) based on application signatures, not by blocking malicious IPs detected by FortiSandbox.

Full explanation →
32
Multi-Selecthard

A FortiGate admin configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. The admin wants traffic from VDOM-A to reach a server in VDOM-B. Which three configuration steps are required? (Choose three.)

Select 3 answers
A.Enable NAT on the VDOM link interface
B.Configure static routes pointing to the VDOM link interface on both VDOMs
C.Configure a firewall policy on VDOM-A allowing traffic to the VDOM link interface
D.Disable ARP on the VDOM link interfaces
E.Create a VDOM link and assign an interface to each VDOM
AnswersB, C, E

Routes are needed to direct traffic towards the other VDOM via the link.

Why this answer

Inter-VDOM routing via a VDOM link requires each VDOM to have a static route pointing to the VDOM link interface as the next hop. Without these routes, traffic from VDOM-A destined for a server in VDOM-B would have no path to the VDOM link, and the FortiGate would drop the packets. The static route ensures the firewall can forward traffic between the two VDOMs across the VDOM link.

Exam trap

The trap here is that candidates often assume VDOM links automatically route traffic between VDOMs, but they forget that each VDOM maintains its own independent routing table, so explicit static routes are mandatory for inter-VDOM communication.

Full explanation →
33
MCQmedium

An administrator wants to use FortiExtender to provide LTE WAN connectivity. After connecting the FortiExtender to the FortiGate, the LTE interface is not showing up. What is the first troubleshooting step?

A.Run 'execute lte test' command
B.Configure an SD-WAN rule for LTE traffic
C.Verify the FortiExtender is connected to the correct port and powered on
D.Check the signal strength of the LTE connection
AnswerC

Physical connectivity is the first check.

Why this answer

The first troubleshooting step is to verify the physical connection and power status of the FortiExtender. If the FortiExtender is not connected to the correct port (typically a USB or PoE port) or is not powered on, the FortiGate will not detect the LTE interface at all, making any software-level checks premature.

Exam trap

The trap here is that candidates jump to software-level troubleshooting (like running diagnostic commands or checking signal strength) without first confirming the basic physical connectivity and power status of the FortiExtender.

How to eliminate wrong answers

Option A is wrong because 'execute lte test' is a diagnostic command that requires the LTE interface to already be present and operational; running it before verifying physical connectivity will fail or return irrelevant errors. Option B is wrong because configuring an SD-WAN rule for LTE traffic assumes the LTE interface is already recognized and available, which is not the case here. Option D is wrong because checking signal strength presupposes that the LTE interface is up and has established a connection to the cellular network, which cannot happen if the FortiExtender is not physically connected or powered.

Full explanation →
34
MCQeasy

A network administrator runs 'get system ha status' on a FortiGate HA cluster and sees that only one unit shows as primary. The secondary unit shows as 'standalone' with no HA peer detected. What is the MOST likely cause of this issue?

A.The cluster serial numbers do not match
B.The heartbeat interface is down or misconfigured
C.The HA group ID is different on each unit
D.The HA priority on the secondary unit is set to 0
AnswerB

If the heartbeat link fails, the secondary cannot communicate with the primary and will assume it is standalone, resulting in the observed status.

Why this answer

When a secondary unit shows as 'standalone' with no HA peer detected, it indicates that the heartbeat communication between the two FortiGate units has failed. The most common cause is that the heartbeat interface is down, misconfigured, or not physically connected, preventing the units from discovering each other as HA peers. Without a functioning heartbeat link, the secondary unit cannot join the cluster and remains in standalone mode.

Exam trap

The trap here is that candidates often confuse 'no HA peer detected' with configuration mismatches like serial numbers or group IDs, but those mismatches still allow peer detection and generate specific error messages, whereas a failed heartbeat link results in a complete lack of peer visibility.

How to eliminate wrong answers

Option A is wrong because mismatched serial numbers would cause the units to reject each other as valid HA members, but the secondary unit would still detect the peer and show an error or 'mismatch' status, not 'standalone'. Option C is wrong because a different HA group ID would prevent the units from forming a cluster, but the secondary unit would still see the peer and report a group ID mismatch, not a 'no HA peer detected' state. Option D is wrong because setting the HA priority to 0 on the secondary unit would not prevent it from detecting the primary; it would simply make the secondary unit ineligible to become primary, but it would still join the cluster and show as a secondary member.

Full explanation →
35
MCQeasy

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal application. The application is accessed via HTTPS. Which component must be configured on the FortiGate to act as a reverse proxy for the application?

A.FortiClient EMS
B.SSL-VPN portal
C.ZTNA proxy
D.ZTNA inline CASB
AnswerC

Why this answer

ZTNA proxy is the FortiGate feature that acts as a reverse proxy, terminating the client connection and initiating a new connection to the internal application. It enforces access policies based on identity and device posture.

Full explanation →
36
MCQmedium

A FortiGate admin runs 'diagnose debug application authd -1' but sees no output for LDAP authentication attempts. What is the MOST likely reason?

A.The LDAP server is unreachable
B.The FortiGate is in FIPS mode
C.The LDAP server timed out
D.Debug flow is not enabled
AnswerB

In FIPS mode, FortiGate disables many debug capabilities to maintain compliance, so authd debug output will not be displayed even if authentication attempts are occurring. This is the most likely reason.

Why this answer

The 'diagnose debug application authd -1' command enables verbose debug logging for the authentication daemon. However, on a FortiGate running in FIPS mode, many debug commands are restricted or produce no output to comply with security requirements. This is the most likely reason for observing no LDAP authentication debug output.

Other possible reasons include running the command after authentication attempts have completed, but FIPS mode is a definitive system-level constraint.

Exam trap

Candidates often assume that additional debug flow is needed when 'diagnose debug application authd' shows no output, but the real common reason is that the FortiGate is in FIPS mode, which restricts debug commands. Alternatively, if the debug command is run after the fact, no historical output is shown.

How to eliminate wrong answers

Option A is wrong because an unreachable LDAP server would still generate authd debug output (e.g., connection failure messages) if debug flow were enabled; the issue is that no output appears at all, not that authentication fails. Option B is wrong because FIPS mode affects cryptographic compliance, not the visibility of debug output; authd debug still works in FIPS mode. Option C is wrong because an LDAP server timeout would produce a timeout error in the authd debug log (e.g., 'LDAP server timeout'), but the problem states no output is seen, indicating the debug mechanism itself is not capturing the traffic.

Full explanation →
37
MCQmedium

An administrator configures BGP route advertisement but the routes are not being sent to the neighbor. The BGP session is established. What is the MOST likely cause?

A.The BGP administrative distance is set too high
B.The BGP neighbor has the wrong update-source interface
C.The route is filtered by a route-map
D.The 'network' statement is missing for the desired prefix
AnswerD

Without a network statement, FortiGate does not advertise the route even if it is in the routing table.

Why this answer

The BGP session is established, so Layer 3 connectivity and TCP port 179 are working. The most common reason for routes not being advertised to a neighbor is that the 'network' statement is missing for the desired prefix. In BGP, the 'network' command does not advertise the prefix unless it matches an exact route in the IP routing table; without it, BGP has no prefix to send, even if the session is up.

Exam trap

The trap here is that candidates often assume a BGP session being established guarantees route advertisement, but BGP requires explicit 'network' statements or redistribution to inject prefixes, and the session state only indicates TCP connectivity and BGP open message exchange.

How to eliminate wrong answers

Option A is wrong because BGP administrative distance (e.g., 20 for eBGP, 200 for iBGP) affects route preference in the routing table, not the advertisement of routes to a neighbor. Option B is wrong because the update-source interface only affects the source IP of BGP packets; if the session is already established, the update-source is correctly configured, so it cannot be the cause of missing route advertisements. Option C is wrong because while a route-map can filter routes, the question states the session is established and routes are not being sent; a missing 'network' statement is a more fundamental and likely cause than a route-map, which would require explicit configuration to block routes.

Full explanation →
38
MCQhard

An administrator is troubleshooting BGP and runs 'get router info bgp neighbors 10.0.0.1' and sees 'BGP state = Active'. The neighbor IP is reachable via ping. What is the most likely cause?

A.The BGP update-source interface is missing
B.The BGP network statement is missing
C.The BGP router-id is not configured
D.The BGP neighbor's remote-as is misconfigured
AnswerD

A mismatch in remote AS will cause the neighbor to reject the connection, leading to Active state.

Why this answer

The BGP state 'Active' indicates that the router is actively trying to establish a TCP connection to the neighbor but is failing. Since the neighbor IP is reachable via ping (Layer 3 connectivity is fine), the most likely cause is a misconfiguration of the remote-as on one side, causing a BGP OPEN message mismatch (the received AS number does not match the expected remote-as). This prevents the TCP session from completing the BGP peering process.

Exam trap

The trap here is that candidates often assume 'Active' means a Layer 3 connectivity issue (like a missing route or firewall block), but since ping succeeds, the problem is specifically a BGP parameter mismatch, most commonly the remote-as.

How to eliminate wrong answers

Option A is wrong because a missing update-source interface would typically cause the BGP session to remain in 'Idle' or 'Connect' state, not 'Active', and the neighbor IP is reachable via ping, indicating the source interface is not the primary issue. Option B is wrong because a missing network statement only affects route advertisement, not the BGP neighbor state; the session can still reach 'Established' without any network statements. Option C is wrong because a missing router-id would prevent the BGP process from starting, causing the session to stay in 'Idle' state, not 'Active'; FortiOS automatically assigns a router-id if not configured.

Full explanation →
39
MCQmedium

An administrator creates a new VDOM and assigns interfaces. The VDOM is intended to operate in transparent mode. Which additional step is required?

A.Set the VDOM's mode to transparent under config system settings
B.Disable NAT on all policies
C.Configure a management IP for the VDOM
D.No additional steps; VDOMs default to transparent mode
AnswerA

The VDOM must be explicitly set to transparent mode.

Why this answer

A VDOM does not default to transparent mode; it must be explicitly configured. The command 'config system settings' with 'set vdom-type transparent' changes the VDOM's operational mode from the default NAT/route mode to transparent mode, which is required for the VDOM to function as a Layer 2 bridge.

Exam trap

The trap here is that candidates assume VDOMs default to transparent mode or that disabling NAT alone is sufficient, but FortiGate requires an explicit mode change via 'config system settings' to enable transparent operation.

How to eliminate wrong answers

Option B is wrong because disabling NAT on policies is a common practice in transparent mode but is not an additional step required to enable transparent mode; NAT is automatically unavailable in transparent mode. Option C is wrong because configuring a management IP is optional and only needed for administrative access, not to set the VDOM to transparent mode. Option D is wrong because VDOMs default to NAT/route mode, not transparent mode; an explicit configuration change is required.

Full explanation →
40
MCQeasy

A network administrator wants to delegate management of a specific VDOM to a junior administrator. The junior should be able to modify firewall policies and objects within that VDOM but not change system settings or other VDOMs. Which administrative access configuration meets this requirement?

A.Place the VDOM in transparent mode to allow full access
B.Create a RADIUS user that is assigned to the VDOM group
C.Use the management VDOM feature to assign the junior admin to the VDOM
D.Create a local user with an admin profile that has permissions for that VDOM only
AnswerD

Local users can be assigned profiles and restricted to specific VDOMs.

Why this answer

FortiGate allows you to create a local user with an admin profile that has permissions scoped to a specific VDOM. By assigning the junior administrator to that VDOM-only profile, they can modify firewall policies and objects within that VDOM but cannot change system settings or access other VDOMs. This is the standard method for delegating VDOM-specific administrative access without granting global or multi-VDOM privileges.

Exam trap

The trap here is that candidates often confuse the management VDOM feature (which only handles management traffic routing) with VDOM-specific admin profiles, or assume that transparent mode or RADIUS group assignment inherently restricts permissions, when in fact only a properly scoped admin profile can enforce VDOM-level access control.

How to eliminate wrong answers

Option A is wrong because placing a VDOM in transparent mode changes its operational mode (layer 2 forwarding) and does not restrict administrative access; it still allows full access to the VDOM's configuration if the admin has appropriate permissions. Option B is wrong because a RADIUS user assigned to a VDOM group only controls authentication and group membership, not the specific permissions within a VDOM; the admin profile assigned to the user determines the actual access scope, and RADIUS alone does not restrict to a single VDOM. Option C is wrong because the management VDOM feature is used to centralize management traffic (e.g., SNMP, syslog) and does not delegate administrative permissions; it does not restrict a junior admin to a specific VDOM.

Full explanation →
41
MCQhard

A FortiGate is deployed as the edge firewall for a medium-sized enterprise. The network has three internal zones: Trust (10.10.0.0/16), DMZ (172.16.0.0/24), and Guest (192.168.0.0/24). The FortiGate has an IPSec VPN to a branch office (10.20.0.0/16). Users in the Trust zone report intermittent connectivity to a web server in the DMZ (172.16.0.10, TCP port 443). The FortiGate logs show occasional 'session denied' messages for traffic from Trust to DMZ with reason 'denied by forward policy check'. The security policy has an explicit allow rule for Trust to DMZ HTTPS. The administrator has verified routing is correct and there are no address overlaps. When the issue occurs, the administrator runs 'diag debug flow' and sees that the packet matches the correct policy but still gets denied. The debug output also shows 'forward policy check: denied'. What is the most likely cause and recommended action?

A.A traffic shaping policy or application control profile is blocking the traffic; review and adjust the traffic shaping policy or application control profile applied to the policy.
B.The route to the DMZ is intermittently flapping; add a static route with a higher distance.
C.The security profiles (AV, IPS) are blocking the traffic; temporarily disable all security profiles on the policy.
D.The session helper for HTTPS is interfering; disable the HTTPS session helper.
AnswerA

Forward policy check denials are caused by traffic shaping or application control.

Why this answer

The debug flow output shows the packet matches the correct security policy but is still denied by 'forward policy check'. This indicates that a secondary policy component, such as a traffic shaping policy or application control profile, is blocking the traffic. These features can override the security policy action if they are configured to deny or drop matching traffic, even when the security policy itself is set to allow.

Exam trap

The trap here is that candidates often assume a security policy 'allow' rule is sufficient, overlooking that FortiGate's forward policy check evaluates additional policy layers (like traffic shaping or application control) that can independently deny traffic even after a security policy match.

How to eliminate wrong answers

Option B is wrong because route flapping would cause 'no route to host' errors, not 'denied by forward policy check' in the debug flow; the administrator has already verified routing is correct. Option C is wrong because security profiles (AV, IPS) would show specific block messages in the logs (e.g., 'IPS: blocked') and the debug flow would indicate the profile action, not a generic 'forward policy check' denial. Option D is wrong because the HTTPS session helper is used for non-standard ports or explicit proxy scenarios and does not cause 'forward policy check' denials; disabling it would not resolve a policy-based block.

Full explanation →
42
MCQeasy

What is the purpose of FortiAnalyzer in a Fortinet security fabric?

A.To provide sandboxing and advanced threat protection
B.To act as a network firewall and IPS
C.To collect and analyze logs, generate reports, and provide visibility into security events
D.To manage and deploy configurations to FortiGates
AnswerC

FortiAnalyzer aggregates logs from multiple devices.

Why this answer

FortiAnalyzer is the centralized logging and analytics platform within the Fortinet Security Fabric. It aggregates logs from FortiGate and other Fabric devices, correlates events, generates compliance reports, and provides a single-pane-of-glass view for security monitoring and forensic analysis. This directly supports visibility and reporting, not real-time threat prevention or configuration management.

Exam trap

The trap here is confusing FortiAnalyzer with FortiManager, as both are central management tools, but FortiAnalyzer focuses on log collection and reporting, while FortiManager handles configuration deployment and policy management.

How to eliminate wrong answers

Option A is wrong because sandboxing and advanced threat protection are functions of FortiSandbox, not FortiAnalyzer; FortiAnalyzer can integrate with FortiSandbox for log correlation but does not perform sandboxing itself. Option B is wrong because network firewall and IPS are core functions of FortiGate, not FortiAnalyzer; FortiAnalyzer is a log collector and analyzer, not an inline security device. Option D is wrong because managing and deploying configurations to FortiGates is the role of FortiManager, which uses the FortiGate API and policy packages; FortiAnalyzer has no configuration deployment capabilities.

Full explanation →
43
MCQmedium

An administrator configures a FortiGate with VDOMs and notices that the 'config vdom' command lists multiple VDOMs, but only one VDOM is shown in the 'show full-configuration' output. What is the most likely reason?

A.The administrator is in the context of a specific VDOM
B.The VDOMs are not properly synchronized
C.The VDOMs are not assigned any interfaces
D.The FortiGate is in transparent mode
AnswerA

In VDOM mode, 'show full-configuration' shows only the current VDOM's config. The admin must be in the root VDOM to see all VDOMs.

Why this answer

The 'config vdom' command lists all VDOMs configured on the FortiGate because it operates in the global context. However, 'show full-configuration' only displays the configuration of the current VDOM context. If the administrator is inside a specific VDOM (e.g., after executing 'config vdom' and 'edit <vdom-name>'), the output is scoped to that VDOM, not the global configuration.

This is a fundamental behavior of VDOM-based CLI navigation in FortiOS.

Exam trap

The trap here is that candidates assume 'config vdom' lists all VDOMs because they are all active, but they forget that 'show full-configuration' output is context-dependent and only reflects the current VDOM or global scope, not the entire device configuration.

How to eliminate wrong answers

Option B is wrong because VDOM synchronization is not relevant to CLI output scoping; synchronization affects configuration replication between HA members, not the visibility of VDOMs in 'show full-configuration'. Option C is wrong because unassigned interfaces do not prevent a VDOM from appearing in 'show full-configuration'; a VDOM without interfaces still has its own configuration block. Option D is wrong because transparent mode is a separate operational mode that does not affect VDOM listing or configuration display; a FortiGate in transparent mode can still have multiple VDOMs and the same CLI scoping rules apply.

Full explanation →
44
MCQmedium

A FortiGate is configured with two VRF instances (VRF1 and VRF2). The admin needs to allow traffic from VRF1 to reach a server in VRF2. The server is directly connected to the FortiGate on an interface in VRF2. What configuration is required?

A.Add both VRFs to the same VDOM
B.Use VRF route leaking with route maps to export necessary routes between VRFs
C.Configure a static route in VRF1 pointing to the server's IP via the VRF2 interface
D.Configure a firewall policy with source VRF1 and destination VRF2
AnswerB

Route leaking allows redistribution of routes between VRFs, enabling inter-VRF communication.

Why this answer

B is correct because VRF route leaking is the standard method to enable communication between separate VRF instances on a FortiGate. This involves using route maps to selectively export routes from VRF2 into VRF1, allowing traffic from VRF1 to reach the server in VRF2. Without route leaking, VRFs are isolated by default, and no other mechanism (like static routes or firewall policies alone) can bridge the routing table separation.

Exam trap

The trap here is that candidates often assume a firewall policy with source and destination VRF selection is sufficient to allow inter-VRF traffic, but they overlook that routing must first be established via route leaking before any policy can be applied.

How to eliminate wrong answers

Option A is wrong because adding both VRFs to the same VDOM does not enable inter-VRF routing; VRFs within a VDOM remain isolated unless explicit route leaking is configured. Option C is wrong because a static route in VRF1 pointing to the server's IP via the VRF2 interface is invalid—the interface belongs to a different VRF, and the FortiGate will not forward traffic across VRF boundaries based solely on a static route. Option D is wrong because a firewall policy alone cannot route traffic between VRFs; it only controls permitted traffic after routing decisions are made, and without route leaking, the packets from VRF1 will not have a route to the VRF2 server.

Full explanation →
45
MCQmedium

A network admin configures OSPF on a FortiGate with multiple areas, including one area that is not directly connected to the backbone (Area 0). To ensure that routes from that area are advertised into other areas, which OSPF feature must be properly configured?

A.OSPF route redistribution
B.OSPF passive interface
C.OSPF virtual-link
D.OSPF network type
AnswerC

Correct. OSPF virtual-links create a logical connection from a non-backbone area to the backbone area, enabling inter-area route advertisement through Type 3 LSAs generated by ABRs.

Why this answer

OSPF virtual-links are used to connect a non-backbone area to the backbone area through a transit area. This ensures that the area has a logical path to the backbone, allowing ABRs to generate Type 3 summary LSAs and advertise routes between areas. Without proper virtual-link configuration, routes from an area not directly connected to the backbone cannot be advertised to other areas.

Exam trap

The trap is that candidates may think OSPF route redistribution is needed for inter-area routes, but OSPF internally uses ABRs to automatically generate Type 3 LSAs. Virtual-links are a specific feature to connect isolated areas to the backbone, which is necessary for inter-area routing in such topologies.

How to eliminate wrong answers

Option B (OSPF passive interface) is wrong because it prevents OSPF hello packets from being sent on an interface, suppressing neighbor discovery and route exchange, but it does not control inter-area route advertisement. Option C (OSPF virtual-link) is wrong because it is used to connect a non-backbone area to the backbone area through a transit area when a direct physical connection is missing, not to advertise routes between areas. Option D (OSPF network type) is wrong because it determines how OSPF operates on a given interface (e.g., broadcast, point-to-point) and affects neighbor formation and LSA flooding, but it does not enable inter-area route propagation.

Full explanation →
46
MCQeasy

An administrator needs to monitor the FortiGate's CPU usage in real-time from the CLI. Which command should be used?

A.diagnose debug application httpsd
B.diagnose hardware sysinfo memory
C.get system performance status
D.diagnose sys top
AnswerD

This is the correct command for real-time CPU monitoring.

Why this answer

'diagnose sys top' is the FortiGate CLI command that provides a real-time, top-like display of CPU usage per process, including process IDs and CPU consumption percentages. This command is specifically designed for live performance monitoring and troubleshooting from the CLI, unlike static snapshots or debug outputs.

Exam trap

The trap here is that candidates often confuse 'get system performance status' (a static snapshot) with a real-time monitoring tool, or they mistakenly think debug commands like 'diagnose debug application' are used for performance metrics instead of debugging specific daemon logs.

How to eliminate wrong answers

Option A is wrong because 'diagnose debug application httpsd' enables debug logging for the HTTPS daemon, not CPU monitoring; it outputs verbose HTTP-related debug messages. Option B is wrong because 'diagnose hardware sysinfo memory' displays memory usage statistics (total, used, free), not CPU usage. Option C is wrong because 'get system performance status' shows a static summary of CPU, memory, and session utilization at the moment of execution, but it does not provide the real-time, continuously updating process-level view that 'diagnose sys top' offers.

Full explanation →
47
MCQeasy

Which technology uses DMARC reports to help administrators identify unauthorized use of their email domain?

A.SPF
B.DKIM
C.FortiMail
D.DMARC
AnswerD

DMARC provides aggregate and forensic reports about email authentication.

Why this answer

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the correct answer because it specifically uses aggregate and forensic reports (DMARC reports) to provide administrators with visibility into how their email domain is being used, including unauthorized or spoofed emails. These reports are generated by receiving mail servers and sent back to the domain owner, detailing authentication results from SPF and DKIM checks, which helps identify and mitigate domain abuse.

Exam trap

The trap here is that candidates confuse DMARC's reporting and policy enforcement features with the underlying authentication mechanisms (SPF and DKIM), thinking those protocols alone provide visibility into unauthorized use, when in fact only DMARC defines the reporting format and feedback loop.

How to eliminate wrong answers

Option A (SPF) is wrong because SPF only defines which IP addresses are authorized to send mail for a domain via DNS TXT records, but it does not generate reports or provide visibility into unauthorized use. Option B (DKIM) is wrong because DKIM provides a cryptographic signature to verify email integrity and sender authenticity, but it does not produce reports on domain usage or abuse. Option C (FortiMail) is wrong because FortiMail is a secure email gateway product that can implement DMARC policies and process reports, but it is not the technology that uses DMARC reports itself; DMARC is the standard that defines the reporting mechanism.

Full explanation →
48
MCQhard

A FortiGate administrator configures a multi-peer IPsec VPN with two remote gateways for redundancy. The phase 1 configuration has 'set proposal aes256-sha256' and 'set dpd on-idle'. The tunnel is established but traffic fails over to the backup peer only after a long delay. What change would improve failover time?

A.Increase the phase 2 lifetime
B.Enable NAT traversal
C.Use IKEv1 instead of IKEv2
D.Change DPD mode to 'on-demand' and reduce retry count
AnswerD

On-demand sends DPD probes regularly regardless of traffic, enabling faster detection.

Why this answer

DPD on-idle sends probes only when there is no traffic. With DPD on-idle, failure detection can be slow. Changing to DPD on-demand (active probing) or reducing retry intervals speeds up failure detection.

Full explanation →
49
MCQeasy

Which SD-WAN load balancing algorithm is best for ensuring that all traffic from a specific source-destination pair uses the same WAN link?

A.Spillover
B.Source-dest IP
C.Volume
D.Lowest-cost
AnswerB

Source-dest IP hashes both IPs, ensuring same pair goes to same link.

Why this answer

Source-dest IP (B) is the correct algorithm because it uses a hash of both the source and destination IP addresses to deterministically select a WAN link. This ensures that all packets belonging to the same flow (same source-destination pair) are consistently forwarded over the same link, preserving packet order and avoiding reordering issues.

Exam trap

The trap here is that candidates often confuse 'Spillover' with a load-balancing algorithm, but Spillover is actually a bandwidth-based failover or overflow mechanism, not a deterministic per-flow hashing method.

How to eliminate wrong answers

Option A (Spillover) is wrong because it is a traffic-steering method that shifts traffic to another link only after a configured bandwidth threshold is exceeded, not a load-balancing algorithm that ensures per-flow stickiness. Option C (Volume) is wrong because it balances traffic based on the volume of data sent over each link, which can cause flows to be split across multiple links and break source-destination pair consistency. Option D (Lowest-cost) is wrong because it selects the link with the lowest cost metric (e.g., based on link quality or administrative weight), which does not guarantee that all traffic from a specific source-destination pair will use the same link; cost-based decisions can change dynamically.

Full explanation →
50
MCQmedium

An administrator wants to group firewall objects by department (e.g., Sales, Engineering) and easily filter them in FortiManager policy packages. Which feature should be used?

A.Tags in FortiGate
B.ADOM overrides
C.Meta fields
D.Policy package folders
AnswerC

Why this answer

Meta fields in FortiManager allow administrators to define custom attributes (e.g., Department) for firewall objects. These fields can then be used to group and filter objects within policy packages, enabling efficient management by department without requiring separate ADOMs or VDOMs.

Exam trap

The trap here is that candidates may confuse meta fields with FortiGate tags, but tags are device-local and not available for filtering in FortiManager policy packages, whereas meta fields are a FortiManager-specific feature designed for cross-device object grouping.

How to eliminate wrong answers

Option A is wrong because Tags in FortiGate are local to the FortiGate device and are not synchronized to FortiManager for filtering in policy packages; they are used for object categorization on the device itself. Option B is wrong because ADOM overrides are used to manage configuration differences across ADOMs, not to group or filter objects by custom attributes like department. Option D is wrong because Policy package folders organize policy packages themselves, not individual firewall objects within a package.

Full explanation →
51
MCQmedium

A FortiGate administrator notices that traffic from a specific subnet is being dropped unexpectedly. The security policy allows the traffic, and there are no firewall policies blocking it. What is the most efficient first step to identify the cause of the drops?

A.Use the 'diag sniffer packet any "host 10.0.1.0/24" 4' command to capture packets and analyze where they are dropped.
B.Run 'diagnose debug flow' with the source IP and look for 'no matching policy' or 'dropped' messages.
C.Enable 'deny-log' on all policies and check logs for the subnet.
D.Enable global traffic logging and review logs after some traffic passes.
AnswerA

Packet sniffer with filter can capture the actual packets and show the drop reason in the output.

Why this answer

The 'diag sniffer packet any "host 10.0.1.0/24" 4' command captures packets at the kernel level before firewall processing, allowing you to see if traffic is reaching the FortiGate and where it is being dropped (e.g., due to reverse-path forwarding, session helper, or DoS policies). This is the most efficient first step because it provides immediate, low-level visibility into packet drops without requiring configuration changes or waiting for logs.

Exam trap

The trap here is that candidates often jump to 'diagnose debug flow' as the default troubleshooting tool, but it only works after a session is created, missing pre-session drops that the sniffer can immediately expose.

How to eliminate wrong answers

Option B is wrong because 'diagnose debug flow' is a session-level debug that requires traffic to first match a session; if traffic is dropped before session creation (e.g., by ASIC, DoS policy, or RPF check), the debug flow may show no output or misleading 'no matching policy' messages, wasting time. Option C is wrong because enabling 'deny-log' on all policies only logs drops caused by explicit firewall policies, but the question states no policies are blocking the traffic, so this would not capture the actual drop cause (e.g., session helper, DoS, or routing issues). Option D is wrong because enabling global traffic logging requires a configuration change and waiting for traffic to pass, which is inefficient; logs may also not show the specific drop reason (e.g., kernel-level drops are not always logged).

Full explanation →
52
MCQmedium

Two FortiGates in an HA cluster are experiencing a split-brain scenario where both units become primary. The administrator checks the HA configuration and sees that the heartbeat interfaces are configured correctly but the link status is 'down' on both units. What could cause this?

A.The heartbeat interface has been administratively disabled
B.The physical cable connecting the heartbeat interfaces is faulty
C.The HA group ID is different on each unit
D.The HA priority values are the same on both units
AnswerB

Correct. A faulty cable causes link down, leading to loss of heartbeat and split-brain.

Why this answer

A split-brain occurs when heartbeat communication is lost. If the heartbeat interfaces show link down, it indicates a physical or layer-1 issue, such as a faulty cable or switch port.

Full explanation →
53
MCQeasy

An administrator wants to enforce that only devices with antivirus software installed and up-to-date can access the corporate network. Which FortiGate feature should be used?

A.Application control profile
B.ZTNA tags and posture checks
C.IPsec VPN with pre-shared key
D.Web filtering profile
AnswerB

ZTNA tags can reflect compliance status from EMS.

Why this answer

FortiGate uses ZTNA device posture checks via FortiClient EMS to enforce endpoint compliance, such as antivirus status.

Full explanation →
54
MCQeasy

An administrator needs to verify if a FortiGate is receiving BGP routes from a peer. Which command should the admin run to see the BGP routing table?

A.get router info routing-table bgp
B.show ip bgp
C.diagnose ip router bgp table
D.get router info bgp table
AnswerD

This command shows the BGP routing table entries.

Why this answer

'get router info bgp table' is the exact FortiOS CLI command to display the BGP routing table, showing all BGP-learned routes and their attributes. This command is specific to FortiGate's proprietary CLI syntax, which differs from Cisco IOS or generic Linux networking commands. The administrator needs this output to verify received BGP prefixes from a peer.

Exam trap

The trap here is that candidates familiar with Cisco IOS might instinctively choose 'show ip bgp' (Option B) or misremember FortiGate syntax as similar to Cisco's 'show ip bgp table', but FortiGate uses a distinct CLI structure where 'get router info bgp table' is the correct command for viewing the BGP table.

How to eliminate wrong answers

Option A is wrong because 'get router info routing-table bgp' is not a valid FortiOS command; the correct syntax for viewing the routing table filtered by BGP is 'get router info routing-table bgp' on FortiGate, but this shows the actual routing table (RIB) entries, not the raw BGP table (Adj-RIB-In). Option B is wrong because 'show ip bgp' is a Cisco IOS command, not a FortiGate command; FortiGate uses 'get' instead of 'show' and has different syntax. Option C is wrong because 'diagnose ip router bgp table' is not a valid FortiOS command; the 'diagnose' commands are for debugging and do not include a 'table' subcommand for BGP.

Full explanation →
55
MCQmedium

An administrator wants to integrate FortiGate with an external threat intelligence feed to block known malicious IP addresses automatically. Which object should be used to consume the feed?

A.External Threat Intelligence Feed
B.IP Pool
C.Address Group
D.Security Profile Group
AnswerA

This object dynamically updates with threat indicators.

Why this answer

The External Threat Intelligence Feed object in FortiGate is specifically designed to consume external threat intelligence feeds (e.g., STIX/TAXII, CSV, or plain text lists) and automatically update a dynamic address object with indicators of compromise (IoCs) such as malicious IP addresses. This enables automated blocking of known malicious sources without manual intervention, making it the correct choice for integrating an external feed.

Exam trap

The trap here is that candidates often confuse the External Threat Intelligence Feed with an Address Group, thinking they can manually add IPs from a feed into a group, but FortiGate requires the dedicated feed object to automate the ingestion and dynamic updates.

How to eliminate wrong answers

Option B (IP Pool) is wrong because an IP Pool is used for source NAT (SNAT) to translate private IPs to public IPs, not for consuming threat intelligence feeds. Option C (Address Group) is wrong because an Address Group is a static or dynamic grouping of address objects used in firewall policies, but it cannot directly consume an external threat feed; it would require a separate feed object to populate it. Option D (Security Profile Group) is wrong because a Security Profile Group is a container for security profiles (e.g., antivirus, IPS, web filter) applied to policies, not a mechanism to ingest external threat data.

Full explanation →
56
MCQeasy

A FortiGate administrator needs to delegate firewall policy management to different teams for different departments. Each team should have full control over their policies but should not see or modify policies of other departments. Which feature allows this separation?

A.ADOMs in FortiAnalyzer
B.Policy packages in FortiManager
C.Security fabric tags
D.Administrative profiles (admin profiles) with restricted VDOM access
AnswerD

Admin profiles can be created that limit an administrator's access to specific VDOMs, providing the required separation.

Why this answer

Administrative profiles with restricted VDOM access allow a FortiGate administrator to assign specific VDOMs to different admin accounts. By creating separate VDOMs for each department and granting admin accounts access only to their respective VDOMs, each team can fully manage firewall policies within their VDOM without seeing or modifying policies in other VDOMs. This leverages FortiGate's VDOM-based multi-tenancy and role-based access control (RBAC) to enforce strict policy isolation.

Exam trap

The trap here is that candidates often confuse FortiManager's policy packages (Option B) as the solution for policy delegation, but FortiManager alone does not enforce visibility restrictions without ADOMs, and the question explicitly asks for a FortiGate feature, not a management platform feature.

How to eliminate wrong answers

Option A is wrong because ADOMs (Administrative Domains) are a FortiAnalyzer feature used to segregate log and report data, not to delegate firewall policy management on FortiGate. Option B is wrong because policy packages in FortiManager are used for centralized policy management and revision control, but they do not inherently prevent an administrator from seeing or modifying policies of other departments unless combined with ADOMs or admin profiles; the question specifically asks for a FortiGate feature, not FortiManager. Option C is wrong because security fabric tags are metadata labels used for grouping and automation within the Security Fabric, not for RBAC or policy isolation between administrative teams.

Full explanation →
57
MCQeasy

A FortiGate is configured with multiple virtual routers (VRFs). The administrator wants to allow communication between two VRFs using a firewall policy. Which type of interface is required for the policy?

A.VDOM link
B.VLAN subinterface
C.Loopback interface
D.Virtual-wire pair
AnswerA

VDOM links are used to connect VDOMs or VRFs; firewall policies can be applied to allow traffic between VRFs.

Why this answer

A VDOM link is a virtual interface that connects two VDOMs (Virtual Domains) and inherently supports routing between different VRFs (Virtual Routing and Forwarding instances) within a FortiGate. When a firewall policy is applied to a VDOM link, it can control traffic flowing between the two VRFs, as the link itself is a Layer 3 interface that belongs to both VDOMs and can be assigned to different VRFs on each side. This is the only interface type that natively allows inter-VRF communication with firewall policy enforcement.

Exam trap

The trap here is that candidates often confuse VDOM links with VLAN subinterfaces, assuming that VLAN tagging alone can separate VRFs, but VLAN subinterfaces cannot cross VRF boundaries without additional routing constructs like route leaking, which is not handled by a firewall policy directly.

How to eliminate wrong answers

Option B (VLAN subinterface) is wrong because VLAN subinterfaces operate within a single VRF and cannot directly route traffic between different VRFs; they are used for segmenting traffic within the same VRF or VDOM. Option C (Loopback interface) is wrong because loopback interfaces are virtual interfaces used for management, routing protocol stability, or as tunnel endpoints, and they cannot be used to forward traffic between VRFs via a firewall policy. Option D (Virtual-wire pair) is wrong because virtual-wire pairs are transparent Layer 2 interfaces that bridge traffic without routing, and they do not support VRF separation or inter-VRF firewall policies.

Full explanation →
58
MCQeasy

Which FortiManager feature allows an administrator to view the exact CLI commands that will be pushed to a managed FortiGate before installation?

A.Policy Check
B.Revision History
C.Device Manager Dashboard
D.Install Preview
AnswerD

Install Preview displays the CLI commands that will be pushed.

Why this answer

Install Preview is the correct answer because it allows an administrator to review the exact CLI commands that FortiManager will push to a managed FortiGate during the next installation. This feature provides a pre-installation view of the configuration changes, enabling verification before committing changes to the device.

Exam trap

The trap here is that candidates may confuse Install Preview with Revision History, thinking that viewing past configurations is the same as previewing pending changes, but Revision History only shows saved snapshots, not the upcoming installation script.

How to eliminate wrong answers

Option A is wrong because Policy Check is used to validate policy consistency and conflicts across FortiGates, not to preview CLI commands. Option B is wrong because Revision History stores previous configuration backups and allows rollback, but does not show the pending CLI commands for the next installation. Option C is wrong because the Device Manager Dashboard provides a summary view of device status and configuration, but does not display the exact CLI commands that will be pushed.

Full explanation →
59
MCQmedium

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGate devices. The tunnel is established, but traffic is not passing. Which configuration should the administrator check first?

A.Firewall policies
B.NAT traversal configuration
C.Static routes
D.Phase1 parameters
AnswerA

Firewall policies must explicitly permit the traffic between the IPsec interface and the destination zone.

Why this answer

When an IPsec VPN tunnel is established but traffic does not pass, the most common cause is missing or misconfigured firewall policies. Even with correct Phase 1 and Phase 2 settings, the FortiGate will not forward traffic between the tunnel interface and the destination network unless an explicit firewall policy permits it. This is because FortiGate uses a stateful inspection model where all traffic must be allowed by a policy, regardless of the VPN being up.

Exam trap

The trap here is that candidates assume a working Phase 1 and Phase 2 automatically allows traffic, but FortiGate requires explicit firewall policies to permit traffic through the tunnel, unlike some other vendors where the VPN configuration itself implies a permit.

How to eliminate wrong answers

Option B (NAT traversal configuration) is wrong because NAT traversal is only relevant when there is a NAT device between the VPN peers; if the tunnel is already established, NAT-T is likely working or not needed, and it does not block traffic flow. Option C (Static routes) is wrong because while routes are necessary for traffic to reach the tunnel interface, the tunnel being established indicates that routing is likely correct; the issue is that even with correct routes, traffic is dropped at the policy layer. Option D (Phase1 parameters) is wrong because if Phase 1 parameters were mismatched, the tunnel would not establish at all; the fact that the tunnel is up means Phase 1 negotiation succeeded.

Full explanation →
60
MCQhard

You have configured a route map named 'RM-BGP' to filter routes redistributed from OSPF into BGP. The route map uses 'set community 65000:100' and 'set metric 50'. After applying the route map under 'config router bgp' with 'redistribute ospf route-map RM-BGP', you see that routes are being redistributed but without the community and metric. What is wrong?

A.The route map does not have any 'match' criteria, so it never applies
B.The route map is missing a 'set community' statement with 'additive' option
C.The BGP neighbor requires 'soft-reconfiguration inbound' to see the changes
D.The 'set metric' command is not supported for BGP redistribution
AnswerA

Without match statements, the route map may not be applied. A common configuration error.

Why this answer

A route map without any 'match' statements is considered a 'permit all' by default, but it does not apply 'set' actions unless a 'match' condition is explicitly met. In FortiOS, a route map with only 'set' commands and no 'match' criteria will not execute those 'set' actions during redistribution. Therefore, the routes are redistributed with default BGP attributes, not the configured community or metric.

Exam trap

The trap here is that candidates assume a route map with only 'set' commands will always apply those actions, but FortiOS requires at least one 'match' statement to trigger the 'set' operations during redistribution.

How to eliminate wrong answers

Option A is correct because the route map lacks 'match' criteria, so the 'set' actions are never applied. Option B is wrong because the 'additive' keyword is only needed when you want to append a community to an existing community list, not when setting a community for the first time; the core issue is the missing 'match' statement. Option C is wrong because 'soft-reconfiguration inbound' is used to store inbound updates from a neighbor for policy changes, not for outbound redistribution policies applied under 'redistribute ospf'.

Option D is wrong because 'set metric' is fully supported for BGP redistribution in FortiOS; it is a standard attribute that can be set via route maps.

Full explanation →
61
MCQhard

In a FortiManager deployment with global ADOM enabled, an administrator creates a firewall policy in the global ADOM. What is the effect of this policy on the per-ADOM devices?

A.The policy is used only if no per-ADOM policy exists with the same name
B.The policy is applied only to devices in the same ADOM as the global ADOM
C.The policy is ignored unless explicitly assigned to each ADOM
D.The policy is installed as a header policy on all managed FortiGates
AnswerD

Global policies are typically inserted as header policies in each device's policy list.

Why this answer

In FortiManager with global ADOM enabled, policies created in the global ADOM are installed as header policies on all managed FortiGates across all ADOMs. These header policies are processed first, before any per-ADOM policies. They apply to all devices unless overridden by per-ADOM policies with higher priority.

Therefore, option D is correct.

Full explanation →
62
Multi-Selectmedium

An administrator is troubleshooting why a new firewall policy on a managed FortiGate is not taking effect. The policy was created in FortiManager and installed successfully. Which TWO steps should the administrator verify to identify the issue? (Select TWO.)

Select 2 answers
A.Reboot the FortiGate
B.Review the FortiGate's routing table
C.Check if the policy is disabled
D.Check the policy order in the policy list
E.Verify the FortiGate's HA status
AnswersC, D

A policy must be enabled to match traffic.

Why this answer

A policy that is disabled in FortiManager will be installed to the managed FortiGate in a disabled state, meaning it will not process any traffic. The administrator must verify that the policy is enabled in FortiManager before or after installation, as a disabled policy is effectively inactive regardless of installation success.

Exam trap

The trap here is that candidates often assume a successful installation guarantees the policy is active, overlooking the disabled state or the impact of policy order on traffic matching.

Full explanation →
63
Matchingmedium

Match each FortiGate security profile to its category.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Malware protection

URL and content filtering

DNS-based threat protection

Application visibility and control

Intrusion prevention

Why these pairings

The correct matches are: Antivirus for malware scanning, Web Filter for URL categorization, and Application Control for app identification. Common confusions arise between Antivirus and Web Filter roles.

Full explanation →
64
MCQmedium

A FortiGate has OSPF configured in multiple areas. The administrator wants to redistribute routes from area 0 into area 1 with a metric of 10. Which command is correct?

A.config router ospf config redistribute "ospf" set status enable set metric 10 end
B.config router ospf config redistribute "connected" set metric 10 end
C.config router ospf config area edit 1 set type nssa end
D.config router ospf set redistribute "ospf" metric 10
AnswerD

It directly sets the metric for redistributed OSPF routes to 10 using the proper FortiOS command syntax.

Why this answer

None of the provided commands correctly set the metric for inter-area OSPF routes. OSPF automatically floods Type 3 LSAs between areas; the metric is determined by interface costs and cannot be directly set via redistribution. Redistributing OSPF into the same process is not a supported method for inter-area metric control.

Exam trap

The trap is that candidates may assume the 'set redistribute' command can be used to influence inter-area OSPF metrics, but this is invalid for routes already within the same OSPF process.

How to eliminate wrong answers

Option B is wrong because 'redistribute connected' redistributes directly connected routes into OSPF, not OSPF routes between areas, and it does not target area 0 to area 1 redistribution. Option C is wrong because setting area 1 as NSSA changes the area type but does not redistribute routes from area 0 into area 1 with a specific metric; NSSA controls which external routes are allowed, not inter-area redistribution. Option D is wrong because 'set redistribute ospf metric 10' is not a valid command at the top level of OSPF configuration; redistribution must be configured under the 'redistribute' subcommand, not as a direct attribute of the OSPF process.

Full explanation →
65
MCQeasy

An administrator needs to check the health of an SD-WAN link by viewing the last SLA probe results. Which command should be used?

A.diagnose sys sdwan sla-log
B.get system interface physical
C.diagnose debug application sdwan -1
D.diagnose sys virtual-wan-link health-check
AnswerD

This command shows the results of SD-WAN health checks including SLA status.

Why this answer

The command `diagnose sys virtual-wan-link health-check` displays the last SLA probe results for SD-WAN links, including metrics like latency, jitter, and packet loss. This command is specifically designed for FortiGate SD-WAN (formerly virtual-wan-link) to verify real-time health-check status, which is essential for troubleshooting link performance.

Exam trap

The trap here is that candidates confuse the SD-WAN SLA log command (`diagnose sys virtual-wan-link sla-log`) with the health-check command, or mistakenly think debug commands show historical results, when in fact only the health-check command provides the last probe results.

How to eliminate wrong answers

Option A is wrong because `diagnose sys sdwan sla-log` is not a valid FortiGate command; the correct command for viewing SLA logs is `diagnose sys virtual-wan-link sla-log`. Option B is wrong because `get system interface physical` shows physical interface status and statistics, not SD-WAN SLA probe results. Option C is wrong because `diagnose debug application sdwan -1` enables debug logging for the SD-WAN daemon, which is used for real-time troubleshooting but does not display historical SLA probe results.

Full explanation →
66
MCQmedium

An admin wants to create a custom IPS signature to detect a specific exploit that sends a string 'EXPLOIT' in the HTTP Host header. Which signature syntax is correct?

A.F-SBID( --name "HTTP_EXPLOIT" --protocol http --header Host --content "EXPLOIT" )
B.F-SBID( --name "HTTP_EXPLOIT" --service HTTP --header Host --content "EXPLOIT" )
C.F-SBID( --name "HTTP_EXPLOIT" --protocol tcp --header Host --content "EXPLOIT" )
D.F-SBID( --name "HTTP_EXPLOIT" --protocol http --header Host --content "EXPLOIT" )
AnswerD

This follows correct F-SBID syntax with protocol http and header Host.

Why this answer

The FortiGate custom IPS signature syntax requires the `--protocol http` flag to specify the application-layer protocol for HTTP inspection, and `--header Host` to target the HTTP Host header field. The `--content` parameter then defines the string 'EXPLOIT' to match within that header, enabling precise detection of the exploit.

Exam trap

The trap here is that candidates often confuse `--protocol tcp` with `--protocol http`, not realizing that HTTP header inspection requires the application-layer protocol keyword to enable the HTTP parser, even though HTTP traffic uses TCP as its transport.

How to eliminate wrong answers

Option A is wrong because it uses `--protocol http` (correct) but the syntax is identical to D and listed as incorrect in the question context; however, the actual error is that A is a duplicate of D and the question marks D as correct, so A is considered wrong due to the answer key. Option B is wrong because it uses `--service HTTP` instead of `--protocol http`; the `--service` flag is not a valid parameter in FortiGate IPS signatures for specifying the protocol layer, and the correct keyword is `--protocol`. Option C is wrong because it uses `--protocol tcp`, which specifies the transport-layer protocol rather than the application-layer HTTP protocol; while HTTP runs over TCP, the signature must use `--protocol http` to enable HTTP header parsing and the `--header` directive.

Full explanation →
67
MCQmedium

A FortiGate administrator configures an antivirus profile with Machine Learning (ML) engine enabled. The ML engine is not detecting any threats, even though new unknown malware is present. What is the MOST likely reason?

A.The ML engine requires a separate subscription
B.The ML engine is only for outbreak prevention
C.The FortiGuard antivirus subscription is expired, preventing ML model updates
D.The antivirus profile is set to flow-based inspection
AnswerC

ML engine needs updated models from FortiGuard; expired subscription stops updates.

Why this answer

The FortiGate ML engine relies on FortiGuard for model updates that enable it to detect new and unknown malware. If the FortiGuard antivirus subscription is expired, the ML engine cannot receive these updates, rendering it unable to identify novel threats. This is the most likely reason the ML engine is not detecting any threats despite the presence of new unknown malware.

Exam trap

The trap here is that candidates may assume the ML engine works independently of subscriptions or that flow-based inspection disables it, when in fact the engine's effectiveness is entirely dependent on current FortiGuard updates.

How to eliminate wrong answers

Option A is wrong because the ML engine is included with the FortiGuard Antivirus subscription and does not require a separate subscription; it is an integrated feature. Option B is wrong because the ML engine is not limited to outbreak prevention; it provides continuous, real-time detection of unknown malware using behavioral analysis and static file analysis. Option D is wrong because flow-based inspection does not disable the ML engine; the ML engine works with both proxy-based and flow-based inspection modes, though flow-based may have reduced detection granularity.

Full explanation →
68
Multi-Selecthard

A security team is configuring FortiMail for email security. They want to ensure that incoming emails are authenticated using SPF, DKIM, and DMARC, and that emails failing authentication are quarantined. Which THREE settings must be configured in FortiMail? (Choose three.)

Select 3 answers
A.Enable DKIM verification in the anti-spam policy
B.Enable TLS encryption for incoming SMTP
C.Enable DMARC verification and set the action for DMARC failure to quarantine
D.Enable SPF verification in the anti-spam policy
E.Configure a recipient verification policy
AnswersA, C, D

DKIM verification must be enabled to verify DKIM signatures.

Why this answer

DKIM verification must be explicitly enabled in the anti-spam policy to allow FortiMail to validate the DKIM signature on incoming emails. Without this setting, DKIM authentication is not performed, and the email's DKIM status will not be evaluated.

Exam trap

The trap here is that candidates often confuse transport security (TLS) with email authentication protocols, mistakenly thinking TLS is required for SPF/DKIM/DMARC enforcement, when in fact TLS is optional and unrelated to the authentication chain.

Full explanation →
69
MCQhard

An administrator is troubleshooting a ZTNA issue where users are able to authenticate but the application access is still blocked. The ZTNA status on FortiClient shows 'Connected' but the application does not load. What is the MOST likely cause?

A.The user's FortiClient does not have the required ZTNA tags assigned
B.The ZTNA application is not configured with HTTPS
C.The FortiClient EMS server is not reachable from the FortiGate
D.The FortiGate is not configured with the correct ZTNA application gateway
AnswerA

ZTNA tags define access permissions. If the user's client lacks the required tags, the FortiGate blocks access even though the client is connected.

Why this answer

When users can authenticate and the ZTNA status shows 'Connected' on FortiClient, but the application still fails to load, the most likely cause is that the client lacks the required ZTNA tags. ZTNA tags are used by the FortiGate to enforce access policies; without the correct tags, the FortiGate will block the application traffic even though the tunnel is established. This scenario indicates a tag assignment or synchronization issue between FortiClient and EMS.

Exam trap

The trap here is that candidates assume a 'Connected' ZTNA status means full application access is granted, overlooking that ZTNA tags are the critical enforcer of granular access control beyond just tunnel establishment.

How to eliminate wrong answers

Option B is wrong because ZTNA applications can use any TCP-based protocol (e.g., HTTPS, SSH, RDP); HTTPS is not mandatory, and the issue is not protocol-specific. Option C is wrong because if the FortiClient EMS server were unreachable from the FortiGate, the ZTNA status would not show 'Connected' — the tunnel would fail to establish. Option D is wrong because if the FortiGate were not configured with the correct ZTNA application gateway, the user would not be able to authenticate or see a 'Connected' status; the gateway configuration is a prerequisite for the tunnel to form.

Full explanation →
70
Multi-Selectmedium

A FortiGate administrator is setting up automation stitches in FortiManager to remediate threats. The stitch should run a CLI script on a managed FortiGate when a specific event is logged. Which THREE components must be configured in the automation stitch?

Select 3 answers
A.Trigger
B.Schedule
C.Conditions
D.Recovery action
E.Action (CLI script)
AnswersA, C, E

The trigger defines what event starts the automation. It is mandatory.

Why this answer

An automation stitch in FortiManager requires a trigger to define the event that initiates the stitch. Without a trigger, the stitch has no starting condition and cannot execute. The trigger specifies the log event that, when matched, causes the stitch to run.

Exam trap

The trap here is that candidates often confuse the 'recovery action' (used for rollback in automation stitches) as a required component, but it is optional and only relevant when the stitch includes a recovery step; the three mandatory components are trigger, conditions, and action.

Full explanation →
71
Multi-Selectmedium

An administrator is troubleshooting why a custom IPS signature for protocol anomaly detection is not triggering. The signature is designed to detect abnormal DNS query lengths. Which TWO steps should the administrator take to verify the signature is working? (Choose two.)

Select 2 answers
A.Reboot the FortiGate to reset the IPS engine
B.Disable the firewall policy to see if the signature triggers
C.Verify that the IPS sensor containing the signature is applied to the correct firewall policy
D.Generate traffic that matches the signature and check the IPS logs for alerts
E.Increase the signature's severity to see it in logs
AnswersC, D

If the sensor is not applied, the signature will not inspect traffic.

Why this answer

An IPS sensor must be explicitly applied to a firewall policy for the signatures it contains to be evaluated against traffic passing through that policy. Without this binding, the custom signature for DNS protocol anomaly detection will never be inspected, regardless of its configuration or the traffic type.

Exam trap

The trap here is that candidates assume a custom signature will automatically be evaluated once created, but FortiGate requires explicit policy attachment for any IPS sensor to process traffic, and rebooting or changing severity settings cannot compensate for a missing policy binding.

Full explanation →
72
MCQhard

During a routine audit, a FortiGate administrator discovers that all traffic from a specific user group is being denied by a firewall policy. The policy uses a ZTNA rule that requires the device tag 'Compliant'. The administrator checks the user's device in EMS and sees it is tagged as 'Compliant'. However, the traffic is still denied. What could be the problem?

A.The FortiGate's EMS connector is not syncing tag information in real-time
B.The user's IP address has changed and the tag is mapped to a different IP
C.The ZTNA rule is configured with the wrong application port
D.The device posture compliance check requires additional criteria not met
AnswerA

ZTNA tags are pulled from EMS periodically. If the connector hasn't synced recently, the FortiGate might still have old tag information for that device.

Why this answer

Even if the tag exists, the FortiGate may not have updated tag information from EMS or the session may have been established before the tag was applied. Option A is correct because the FortiGate must re-evaluate tags for new connections; if the EMS connector is not syncing or the session is cached with old tags, it may deny.

Full explanation →
73
MCQmedium

A multi-area OSPF network includes a FortiGate as an ABR. The administrator needs to redistribute a static route into OSPF. Which command is required on the FortiGate to achieve this?

A.config router ospf config redistribute edit 'static' set status enable end
B.config router prefix-list edit 'static' set action permit end
C.config router policy set src 0.0.0.0/0 set dst 0.0.0.0/0 end
D.config router static set redistribute ospf enable end
AnswerA

Correct method to enable redistribution of static into OSPF.

Why this answer

To redistribute a static route into OSPF on a FortiGate, you must enter the OSPF configuration context, navigate to the 'redistribute' subcommand, select the 'static' route type, and set its status to 'enable'. This is the standard method for enabling route redistribution from one routing protocol (or static routes) into OSPF, as defined in the FortiGate CLI reference.

Exam trap

The trap here is that candidates often confuse redistribution configuration with route filtering or policy routing, mistakenly thinking a prefix-list (Option B) or policy-based routing (Option C) is needed, or they incorrectly assume static routes have a 'redistribute' knob (Option D) instead of configuring it under the OSPF process.

How to eliminate wrong answers

Option B is wrong because a prefix-list is used for filtering route advertisements (e.g., in route maps or distribute lists), not for enabling redistribution; it does not inject static routes into OSPF. Option C is wrong because 'config router policy' configures policy-based routing (PBR) to override the routing table for specific traffic, not OSPF redistribution. Option D is wrong because 'config router static' does not have a 'set redistribute ospf enable' command; redistribution is configured under the OSPF process, not under static routes.

Full explanation →
74
MCQmedium

An administrator sees the following log entry: 'id=13593 msg="CDR: File attachment sanitized"' Which feature generated this log?

A.Content Disarm and Reconstruction
B.FortiSandbox
C.Machine Learning Engine
D.Outbreak Prevention
AnswerA

CDR sanitizes attachments and logs such events.

Why this answer

The log entry 'CDR: File attachment sanitized' is generated by Content Disarm and Reconstruction (CDR). CDR works by removing active content (e.g., macros, scripts, embedded objects) from files and rebuilding them into a safe, sanitized version. This is distinct from sandboxing or machine learning, as CDR does not rely on detection but instead proactively neutralizes threats by reconstructing the file.

Exam trap

The trap here is that candidates confuse the 'sanitized' action with sandboxing or ML-based detection, but CDR is a distinct proactive technology that does not rely on detection—it always sanitizes regardless of threat verdict.

How to eliminate wrong answers

Option B is wrong because FortiSandbox generates logs related to file submission, verdict (malicious/clean), and behavioral analysis, not 'CDR: File attachment sanitized' which is specific to the CDR engine. Option C is wrong because the Machine Learning Engine produces logs for ML-based detection events (e.g., 'ML: File detected as malicious'), not for file sanitization which is a static transformation process. Option D is wrong because Outbreak Prevention is a FortiGuard service that provides real-time threat intelligence and signatures, not a feature that performs file sanitization; its logs would reference outbreak alerts or signature updates, not CDR actions.

Full explanation →
75
MCQmedium

An administrator wants to integrate a FortiExtender with a FortiGate to provide cellular WAN connectivity. Which configuration step is required on the FortiGate to use the FortiExtender as an SD-WAN member?

A.Enable BGP on the FortiExtender interface
B.Create a firewall policy allowing traffic from the FortiExtender
C.Add the FortiExtender's interface to the SD-WAN zone
D.Configure a static route pointing to the FortiExtender
AnswerC

The interface representing the FortiExtender must be added as an SD-WAN member.

Why this answer

To use a FortiExtender as an SD-WAN member, the FortiExtender's physical or logical interface must be added to the SD-WAN zone on the FortiGate. This allows the FortiGate to apply SD-WAN rules, load balancing, and SLA-based path selection to traffic traversing the cellular WAN link. Without this step, the interface remains a standard WAN interface and cannot participate in SD-WAN policies.

Exam trap

The trap here is that candidates often confuse the need for a firewall policy or static route with the SD-WAN membership requirement, but the FortiGate treats the FortiExtender interface as a local interface, so only adding it to the SD-WAN zone is necessary for SD-WAN participation.

How to eliminate wrong answers

Option A is wrong because BGP is not required on the FortiExtender interface for SD-WAN membership; SD-WAN operates at the interface level and does not mandate dynamic routing protocols. Option B is wrong because a firewall policy is needed for traffic to pass through the FortiExtender interface, but it is not a prerequisite for adding the interface to the SD-WAN zone; the SD-WAN membership is configured independently of firewall policies. Option D is wrong because a static route pointing to the FortiExtender is not required; the FortiExtender appears as a directly connected interface on the FortiGate, and SD-WAN uses the interface itself, not a next-hop route.

Full explanation →

Page 1 of 13

Page 2

All pages

12345678910111213

Practice NSE7 by domain

Target a specific domain to shore up weak areas.

Advanced Networking and SD-WANAdvanced VPN and Zero TrustEnterprise Firewall and VDOMsAdvanced Threat ProtectionTroubleshooting and Diagnostics
See all domains with question counts →