Fortinet NSE 7 Advanced Security NSE7 NSE7 Questions 676–750 | Page 10/13

676

MCQmedium

A security administrator wants to generate a weekly report in FortiAnalyzer that shows the top threats detected by the FortiGate. Which feature should the administrator use to create this report?

A.Incidents

B.Reports

C.Playbooks

D.FortiView

AnswerB

Reports allow custom report generation with scheduling.

Why this answer

The Reports feature in FortiAnalyzer is specifically designed to generate scheduled, customizable reports that aggregate security event data from FortiGate devices. By creating a report template with threat-based charts and tables, the administrator can schedule a weekly output showing top threats, leveraging the ADOM and SQL-based report engine for granular data selection.

Exam trap

The trap here is that candidates confuse FortiView's real-time dashboards with the scheduled reporting capability, assuming that a dashboard can be exported weekly, but FortiView lacks the scheduling engine and template-based output that Reports provide.

How to eliminate wrong answers

Option A is wrong because Incidents in FortiAnalyzer are used for tracking and managing security incidents as they occur, not for generating scheduled summary reports. Option C is wrong because Playbooks are automation workflows for incident response actions, not for report generation. Option D is wrong because FortiView provides real-time dashboards and ad-hoc visualizations, but it lacks the scheduling and templating capabilities needed for a weekly report.

Full explanation →

677

Multi-Selecteasy

A company is deploying FortiGate in transparent mode between an existing router and LAN switch. Which TWO statements about transparent mode are true?

Select 2 answers

A.The FortiGate forwards traffic based on MAC addresses

B.Each interface requires an IP address

C.The FortiGate can perform routing

D.Transparent mode supports multiple VDOMs

E.The FortiGate does not perform NAT by default

AnswersA, E

As a Layer 2 device, forwarding is based on MAC addresses.

Why this answer

In transparent mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. It inspects packets at the application layer but does not modify the Layer 3 header, making it transparent to the network.

Exam trap

The trap here is that candidates often assume transparent mode requires IP addresses on all interfaces (like route mode) or that it can perform routing, but FortiGate transparent mode is strictly a Layer 2 bridge with no routing capability.

Full explanation →

678

MCQmedium

An administrator is configuring a FortiGate as a LAN edge device with FortiSwitch and FortiAP. Which feature must be enabled on the FortiGate to centrally manage the FortiSwitch and FortiAP devices?

A.CAPWAP

B.LLDP

C.SNMP

D.FortiLink

AnswerD

FortiLink is the proprietary protocol for managing FortiSwitch and FortiAP from FortiGate.

Why this answer

FortiLink is the proprietary protocol that enables a FortiGate to centrally manage FortiSwitch and FortiAP devices as logical extensions of the FortiGate itself. When FortiLink is enabled on a FortiGate interface, the FortiGate automatically discovers, provisions, and manages connected FortiSwitch and FortiAP units, handling VLAN assignment, PoE control, and firmware synchronization without requiring separate management platforms.

Exam trap

The trap here is that candidates often confuse CAPWAP (a standard wireless control protocol) with FortiLink, not realizing that Fortinet uses FortiLink as a unified management protocol for both wired and wireless devices, and that CAPWAP is not the correct answer even though it is a valid wireless management protocol in other ecosystems.

How to eliminate wrong answers

Option A is wrong because CAPWAP (Control and Provisioning of Wireless Access Points) is a standard protocol used by Cisco and other vendors for wireless AP management, but Fortinet uses FortiLink (which encapsulates CAPWAP-like control within its proprietary tunnel) for both wired and wireless management. Option B is wrong because LLDP (Link Layer Discovery Protocol) is a vendor-neutral neighbor discovery protocol used for topology discovery and device identification, not for centralized management or control of FortiSwitch and FortiAP devices. Option C is wrong because SNMP (Simple Network Management Protocol) is used for monitoring and read-only or limited write access to device statistics, but it does not provide the full lifecycle management, configuration push, or automatic provisioning required for FortiSwitch and FortiAP management.

Full explanation →

679

MCQhard

You run the following command on a FortiGate: `diagnose sys session filter dport 443` Output: `proto=6 proto_state=01 duration=3600 expire=3599` What does this output indicate?

A.The session is for UDP port 443, is in state ESTABLISHED, and has 3599 bytes remaining.

B.The session is for TCP port 443, is in state SYN_SENT, and has been active for 3600 seconds.

C.The session is for TCP port 443, is in state TIME_WAIT, and will expire in 3600 seconds.

D.The session is for TCP port 443, is in state FIN_WAIT, and will expire in 3599 seconds.

AnswerB

proto=6 is TCP, proto_state=01 is SYN_SENT, duration is 3600 seconds, expire is 3599 seconds remaining.

Why this answer

The output shows `proto=6`, which is the protocol number for TCP, and `dport 443` filters for destination port 443. The `proto_state=01` indicates the TCP state is SYN_SENT (state 1 in the FortiGate session table). The `duration=3600` means the session has been active for 3600 seconds, and `expire=3599` shows the remaining time in seconds before the session times out.

Thus, Option B correctly interprets these fields.

Exam trap

The trap here is that candidates confuse the `proto_state` value (0x01) with a common TCP state like ESTABLISHED (0x0A) or TIME_WAIT, or misinterpret `expire` as bytes remaining instead of seconds, leading them to select Option A or C.

How to eliminate wrong answers

Option A is wrong because `proto=6` is TCP, not UDP (UDP is protocol 17), and `expire=3599` represents seconds remaining, not bytes. Option C is wrong because `proto_state=01` corresponds to SYN_SENT, not TIME_WAIT (which would be state 11 or 12 depending on the implementation). Option D is wrong because `proto_state=01` is SYN_SENT, not FIN_WAIT (state 5 or 6), and `expire=3599` is the remaining time, not the time until expiration in 3600 seconds.

Full explanation →

680

Multi-Selectmedium

An administrator wants to integrate a FortiExtender into an existing SD-WAN deployment. Which TWO steps are required for proper integration?

Select 2 answers

A.Disable all other WAN interfaces

B.Authorize the FortiExtender on the FortiGate

C.Enable NAT on the FortiExtender interface

D.Configure a separate VDOM for the FortiExtender

E.Configure the FortiExtender as an SD-WAN member

AnswersB, E

Authorization is needed for management and integration.

Why this answer

The FortiExtender must first be authorized on the FortiGate to establish a secure management and data plane connection. Once authorized, it must be added as an SD-WAN member interface so that SD-WAN rules and load-balancing algorithms can be applied to traffic traversing the FortiExtender's cellular or LTE link.

Exam trap

The trap here is that candidates assume the FortiExtender requires a separate VDOM or NAT configuration, when in fact it simply needs authorization and SD-WAN membership to function as a standard WAN interface within the existing SD-WAN topology.

Full explanation →

681

MCQeasy

What is the purpose of a management VDOM in a multi-VDOM FortiGate deployment?

A.To route traffic between different VDOMs

B.To aggregate logs from all other VDOMs

C.To enforce inter-VDOM traffic policies centrally

D.To host the management interfaces and administrative services (GUI, SSH) while other VDOMs carry user traffic

AnswerD

Correct.

Why this answer

A management VDOM is dedicated to hosting all administrative interfaces (GUI, SSH, SNMP, syslog) and management services, isolating them from user traffic VDOMs. This separation ensures that management access remains available even if a data VDOM is overloaded or compromised, and it centralizes administrative control without mixing management and data plane functions.

Exam trap

The trap here is that candidates confuse the management VDOM's role with inter-VDOM routing or policy enforcement, mistakenly thinking it controls traffic between VDOMs, when in fact it only provides isolated administrative access.

How to eliminate wrong answers

Option A is wrong because inter-VDOM routing is handled by inter-VDOM links (IVL) or VDOM peering, not by a management VDOM; the management VDOM does not forward user traffic. Option B is wrong because log aggregation is typically done via syslog to an external server or a dedicated log VDOM, not by the management VDOM; the management VDOM can receive logs but its primary purpose is not aggregation. Option C is wrong because inter-VDOM traffic policies are enforced using firewall policies within each VDOM or via VDOM peering, not centrally by the management VDOM; the management VDOM does not inspect or control traffic between other VDOMs.

Full explanation →

682

MCQmedium

A FortiGate administrator is troubleshooting a VPN tunnel that is up but no traffic passes through. The Phase 2 selectors match. The administrator runs 'diagnose vpn tunnel list' and sees that the tunnel has '0 bytes' in both directions. What is the MOST likely cause?

A.The firewall policy is not configured to allow traffic through the tunnel

B.The static route for the remote subnet does not point to the VPN tunnel interface

C.The IPsec SA rekey interval is too short

D.The NAT traversal is not enabled

AnswerB

Without proper routing, traffic is not sent to the tunnel.

Why this answer

When a VPN tunnel is up but shows 0 bytes in both directions, it indicates that the control plane (IKE/IPsec SA negotiation) succeeded, but the data plane has no traffic. The most likely cause is that the static route for the remote subnet does not point to the VPN tunnel interface (e.g., 'tunnel.1'), so the FortiGate does not know to send traffic into the tunnel. Without a correct route, packets destined for the remote subnet are dropped or sent out the wrong interface, resulting in zero bytes on the tunnel.

Exam trap

The trap here is that candidates assume a 'tunnel is up' means traffic should flow, but FortiGate separates control plane (IKE/SA negotiation) from data plane (routing/policy); the tunnel being up only confirms Phase 1 and Phase 2 SAs exist, not that traffic is routed into the tunnel.

How to eliminate wrong answers

Option A is wrong because if the firewall policy were missing, the tunnel would still show bytes for encapsulated traffic (e.g., ESP packets) that are dropped by the policy; 0 bytes indicates no traffic even reached the tunnel interface. Option C is wrong because a short IPsec SA rekey interval would cause frequent renegotiations and potential brief interruptions, but it would not prevent all traffic from passing; bytes would still accumulate between rekeys. Option D is wrong because NAT traversal (NAT-T) is only needed when a NAT device exists between the VPN peers; if NAT-T were missing and a NAT device were present, the tunnel would not come up at all (Phase 1 would fail), not show 0 bytes with the tunnel up.

Full explanation →

683

MCQmedium

An administrator needs to ensure that traffic from the internal network (10.0.0.0/8) destined to the Internet is routed through a specific next-hop (192.168.1.1) only if a more specific route for the destination does not exist. Which routing feature should be used?

A.Configure route redistribution from BGP to OSPF.

B.Enable ECMP load balancing.

C.Use policy-based routing with a deny rule for the specific prefixes that have more specific routes.

D.Create a static default route with a higher administrative distance.

AnswerC

PBR can be configured to not match traffic that matches a more specific route by using a deny policy in the route map or by setting a higher priority for the specific route.

Why this answer

Policy-based routing (PBR) allows you to define a policy that matches traffic destined to specific prefixes and applies a deny action, effectively bypassing the PBR for those destinations. This ensures that traffic with a more specific route in the routing table uses that route, while all other traffic (without a more specific route) is forced through the next-hop 192.168.1.1 via a set ip next-hop command in the PBR policy.

Exam trap

The trap here is that candidates often confuse policy-based routing with static routes and administrative distance, thinking that a higher AD default route will somehow be ignored when a more specific route exists, but in reality, the default route is only used when no other route matches, so it does not provide the conditional override that PBR with a deny rule does.

How to eliminate wrong answers

Option A is wrong because route redistribution from BGP to OSPF does not control the next-hop selection based on route specificity; it simply injects routes from one protocol into another, which could actually create more specific routes and defeat the requirement. Option B is wrong because ECMP load balancing distributes traffic across multiple equal-cost paths, but it does not provide a mechanism to force traffic through a specific next-hop only when no more specific route exists; it requires equal-cost routes to the same destination. Option D is wrong because creating a static default route with a higher administrative distance would only be used if no other route to the destination exists, but it would not allow traffic with a more specific route to be routed normally; the static default would still be used for all destinations not in the routing table, which is the same behavior as a normal default route, and it does not provide the conditional logic to skip the default when a more specific route is present.

Full explanation →

684

Multi-Selectmedium

An administrator needs to configure a FortiGate to ensure that antivirus scanning is performed on SMTP traffic. Which two configuration items are required? (Choose two.)

Select 2 answers

A.Firewall policy applying the antivirus profile

B.SSL/SSH inspection profile

C.Application control profile

D.Email filter profile

E.Antivirus profile

AnswersA, E

The policy must reference the profile for it to be active.

Why this answer

A firewall policy is required to apply an antivirus profile to SMTP traffic. Without a firewall policy that matches the SMTP traffic (typically on port 25), the FortiGate will not inspect the traffic at all. Option E is correct because the antivirus profile itself defines the scanning settings, signatures, and actions for detecting malware in SMTP attachments and message bodies.

Exam trap

The trap here is that candidates often think an email filter profile (Option D) is sufficient for antivirus scanning, but the email filter profile handles spam and content filtering, not malware signature detection, which requires a separate antivirus profile.

Full explanation →

685

Multi-Selectmedium

Which THREE conditions must be met for an IPsec VPN to successfully establish phase2?

Select 3 answers

A.Proxy IDs (local and remote subnets) match on both sides

B.Firewall policies allow traffic between the subnets

C.Perfect Forward Secrecy (PFS) settings match if enabled

D.Phase2 proposals match between peers

E.NAT traversal is enabled on both sides

AnswersA, C, D

Phase2 uses proxy IDs to define interesting traffic; they must match.

Why this answer

IPsec Phase 2 uses Proxy IDs (local and remote subnets) to negotiate the security associations (SAs) that define which traffic is protected. If the proxy IDs do not match on both peers, the IKEv1 or IKEv2 Quick Mode exchange will fail, preventing the establishment of Phase 2 SAs. This is a fundamental requirement for matching traffic selectors in the IPsec SA negotiation.

Exam trap

The trap here is that candidates often confuse firewall policy requirements with Phase 2 negotiation requirements, mistakenly thinking that firewall policies must allow traffic before Phase 2 can establish, when in fact Phase 2 only requires matching proxy IDs, proposals, and PFS settings.

Full explanation →

686

MCQmedium

A company uses FortiGate ZTNA to provide remote access to an internal web application. The application requires client certificates for authentication. The administrator has configured the ZTNA rule to use certificate authentication. However, users report that they are prompted for credentials repeatedly. What is the most likely cause?

A.The user's password has expired.

B.The ZTNA rule is configured to use SAML authentication instead.

C.The client certificate is not trusted by the FortiGate.

D.The FortiClient EMS server is not reachable from the client.

AnswerC

An untrusted certificate causes authentication failures.

Why this answer

When a ZTNA rule is configured for certificate authentication, the FortiGate must trust the client certificate's issuing CA. If the CA certificate is not imported into the FortiGate's trusted CA list, the certificate chain validation fails, causing the authentication to be rejected and the client to be repeatedly prompted for credentials. This is the most common cause of repeated credential prompts in certificate-based ZTNA setups.

Exam trap

The trap here is that candidates often assume repeated credential prompts are caused by password issues or SAML misconfiguration, but in a certificate-based ZTNA rule, the root cause is almost always a trust issue with the client certificate's CA on the FortiGate.

How to eliminate wrong answers

Option A is wrong because a password expiration would not cause repeated credential prompts in a certificate-based authentication scenario; certificate authentication does not rely on user passwords. Option B is wrong because if the ZTNA rule were configured to use SAML, the user would be redirected to a SAML IdP for authentication, not repeatedly prompted for credentials in the same manner as a failing certificate handshake. Option D is wrong because the FortiClient EMS server being unreachable would affect endpoint compliance and posture checks, but not the certificate authentication process itself; the repeated credential prompt is a direct result of certificate validation failure, not EMS connectivity.

Full explanation →

687

MCQeasy

What is the function of a route map in FortiGate routing?

A.To configure load balancing between multiple WAN links.

B.To filter and modify routing information during redistribution.

C.To enable BFD on a specific interface.

D.To create a static route for a specific destination.

AnswerB

Route maps are used to match routes based on criteria and then set attributes or permit/deny the route during redistribution or policy routing.

Why this answer

A route map in FortiGate routing is primarily used to filter and modify routing information during route redistribution between different routing protocols (e.g., OSPF, BGP, RIP). It allows granular control over which routes are accepted, advertised, or tagged with attributes like metric or community values, ensuring policy-based routing decisions.

Exam trap

The trap here is that candidates often confuse route maps with policy-based routing (PBR) or SD-WAN rules, but route maps are specifically for redistribution filtering and attribute manipulation, not for direct traffic steering or load balancing.

How to eliminate wrong answers

Option A is wrong because load balancing between multiple WAN links is typically achieved using ECMP (Equal-Cost Multi-Path) routing or SD-WAN rules, not a route map. Option C is wrong because BFD (Bidirectional Forwarding Detection) is enabled on an interface or neighbor using specific BFD configuration commands, not a route map. Option D is wrong because creating a static route for a specific destination is done via the 'config router static' CLI or GUI, and a route map is not used for static route creation.

Full explanation →

688

Multi-Selecthard

An administrator is configuring BGP on a FortiGate to peer with an ISP router. The FortiGate is advertising a prefix (203.0.113.0/24) to the ISP. To ensure that traffic to the prefix is load balanced across two WAN links (port1 and port2) using SD-WAN, the administrator must configure which THREE of the following? (Select THREE.)

Select 3 answers

A.Define both port1 and port2 as SD-WAN members

B.Configure a performance SLA to monitor each link

C.Enable 'set load-balance-mode' on the SD-WAN rule to 'sessions' or another algorithm

D.Configure BGP to use the same AS number on both members

E.Create an SD-WAN rule that matches traffic and uses a load balancing algorithm like 'sessions'

AnswersA, C, E

SD-WAN members are the interfaces to be load balanced.

Why this answer

SD-WAN load balancing requires that both WAN interfaces (port1 and port2) are defined as SD-WAN members. Without adding them to the SD-WAN zone, the FortiGate cannot distribute traffic across them using SD-WAN rules or load-balancing algorithms.

Exam trap

The trap here is that candidates often confuse performance SLA monitoring (which is for failover and link quality) with load balancing, or they incorrectly assume BGP AS number configuration affects SD-WAN load balancing, when in fact SD-WAN operates independently of BGP AS numbering.

Full explanation →

689

MCQeasy

A FortiGate is configured with two static routes to the same destination 0.0.0.0/0 with equal distance but different priorities. The priority values are 10 and 20. Which route will be used for traffic matching the default route?

A.The route with priority 20 will be used.

B.The route with lower distance will be used.

C.The route with priority 10 will be used.

D.Both routes will be used for load balancing.

AnswerC

Priority 10 is higher preference than 20.

Why this answer

In FortiGate, when multiple static routes have the same distance (administrative distance) to the same destination, the route with the lowest priority value is selected. Priority is a FortiGate-specific metric that breaks ties among routes with equal distance. Since priority 10 is lower than 20, the route with priority 10 will be installed in the routing table and used for traffic matching 0.0.0.0/0.

Exam trap

The trap here is that candidates often confuse priority with administrative distance or assume higher priority is better, but FortiGate uses lower priority values as more preferred, opposite to the common intuition from other vendors like Cisco where a lower metric is better but the term 'priority' can be misleading.

How to eliminate wrong answers

Option A is wrong because a higher priority value (20) is less preferred; FortiGate selects the route with the lowest priority, not the highest. Option B is wrong because the question states both routes have equal distance, so distance does not differentiate them; the selection is based on priority, not distance. Option D is wrong because load balancing between static routes requires equal distance and equal priority; with different priorities, only the lowest priority route is active, and the other serves as a backup.

Full explanation →

690

MCQmedium

An administrator configures FortiGate as a SAML identity provider (IdP) for a cloud application. The application (SP) initiates the login. Users are redirected to the FortiGate login page and authenticate successfully, but then receive an error from the SP. What is a common cause?

A.The SP's ACS (Assertion Consumer Service) URL is misconfigured on the FortiGate

B.The FortiGate's certificate is not trusted by the user's browser

C.The user's account is locked

D.The SAML attribute mapping is incorrect

AnswerA

If the ACS URL is wrong, the SP won't accept the assertion, causing an error after login.

Why this answer

When FortiGate is the IdP, it must be configured with the SP's ACS URL and entity ID. If these are incorrect, the SAML assertion is not accepted by the SP.

Full explanation →

691

MCQhard

An administrator configures a custom IPS signature to detect traffic to a specific malicious domain. Which syntax is correct for a custom IPS signature in FortiGate?

A.config ips custom signature edit "malicious_domain" set signature "alert tcp any any -> any any (msg:"malicious"; content:"example.com";)" end

B.config firewall policy edit 1 set ips-filter "malicious_domain" end

C.set ips-sensor custom-signature "malicious_domain" pattern "example.com"

D.F-SBID( --name "malicious_domain"; --pattern "example.com"; --service HTTP; )

AnswerD

This is the correct FortiGate custom IPS signature syntax using F-SBID.

Why this answer

FortiGate custom IPS signatures use the F-SBID (Fortinet Signature-Based IDentification) syntax, which requires the --name and --pattern keywords to define the signature name and the malicious pattern to match. This syntax is specific to FortiGate's IPS engine and is not based on Snort or Suricata rule syntax.

Exam trap

The trap here is that candidates familiar with open-source IDS/IPS systems like Snort or Suricata may mistakenly apply their syntax (Option A) to FortiGate, not realizing that FortiGate uses its own F-SBID syntax for custom IPS signatures.

How to eliminate wrong answers

Option A is wrong because it uses Snort-like syntax (e.g., 'alert tcp any any -> any any') which is not supported by FortiGate's custom IPS signatures; FortiGate uses F-SBID syntax. Option B is wrong because it references a firewall policy configuration with an 'ips-filter' object, but custom IPS signatures are not applied via firewall policies directly; they are used in IPS sensors. Option C is wrong because it uses a 'set ips-sensor custom-signature' command with a 'pattern' keyword, which is not valid; custom IPS signatures are defined under 'config ips custom' and use F-SBID syntax, not a simple pattern assignment.

Full explanation →

692

MCQhard

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The Phase 1 status shows 'init' and the debug output indicates 'no suitable proposal found'. The remote peer is a third-party VPN device. Which of the following is the MOST likely cause?

A.The pre-shared key is incorrect on one side

B.The remote peer's IP address is not reachable

C.The IKE version or encryption algorithm does not match between the peers

D.The firewall policy allowing the VPN traffic is missing

AnswerC

Proposal mismatch is caused by incompatible IKE parameters like encryption, hash, or DH group.

Why this answer

The 'no suitable proposal found' error in Phase 1 indicates that the IKE proposal parameters (such as encryption algorithm, hash algorithm, Diffie-Hellman group, or IKE version) do not match between the FortiGate and the third-party peer. Since the status is 'init', the peers have exchanged initial packets but cannot agree on a common proposal, which is a classic proposal mismatch issue. A pre-shared key mismatch would typically cause an authentication failure later in Phase 1, not a 'no suitable proposal' error.

Exam trap

The trap here is that candidates often confuse 'no suitable proposal' with a pre-shared key mismatch, but the error occurs earlier in the IKE exchange before authentication begins, so it must be a proposal parameter mismatch.

How to eliminate wrong answers

Option A is wrong because a pre-shared key mismatch would result in an authentication failure (e.g., 'invalid cookie' or 'authentication failed') after the proposal is accepted, not a 'no suitable proposal found' error. Option B is wrong because if the remote peer's IP address were unreachable, the Phase 1 status would show 'down' or the debug would show 'no response' or 'timeout', not an active exchange with a proposal rejection. Option D is wrong because a missing firewall policy allowing VPN traffic would prevent the IKE packets from being forwarded, resulting in no response or a timeout, not a proposal negotiation failure.

Full explanation →

693

MCQmedium

In a multi-VDOM deployment, an administrator needs to route traffic between VDOM-A and VDOM-B. The administrator creates a VDOM link between the two VDOMs. What additional configuration is required on each VDOM to enable inter-VDOM traffic?

A.Only a firewall policy on VDOM-A allowing traffic to VDOM-B

B.Assign the VDOM link interfaces to the same VDOM

C.Enable 'inter-vdom-routing' under system settings only

D.Configure a static route on each VDOM pointing to the other VDOM's networks via the VDOM link, and create a firewall policy allowing traffic

AnswerD

Routes direct traffic to the VDOM link, and policies permit the traffic. Both are needed.

Why this answer

Inter-VDOM traffic via a VDOM link requires both a static route on each VDOM pointing to the remote VDOM's networks through the VDOM link interface, and a firewall policy on each VDOM that permits the desired traffic. Without the static route, the VDOM does not know how to reach the other VDOM's subnets; without the firewall policy, traffic is blocked by the implicit deny rule. The VDOM link itself provides the Layer 2 or Layer 3 connectivity between the VDOMs, but routing and policy enforcement are mandatory for traffic to flow.

Exam trap

The trap here is that candidates often assume a VDOM link alone provides full connectivity, forgetting that FortiOS requires explicit routing and firewall policies on both sides of the link to actually forward traffic between VDOMs.

How to eliminate wrong answers

Option A is wrong because a firewall policy on VDOM-A alone is insufficient; VDOM-B also needs a firewall policy to allow return traffic, and both VDOMs require static routes to direct traffic to the other VDOM. Option B is wrong because assigning both VDOM link interfaces to the same VDOM would defeat the purpose of a multi-VDOM deployment, as traffic would remain within a single VDOM rather than crossing VDOM boundaries. Option C is wrong because 'inter-vdom-routing' is not a valid system setting in FortiOS; inter-VDOM routing is achieved through VDOM links or inter-VDOM links, not a global toggle, and static routes and firewall policies are still required.

Full explanation →

694

MCQmedium

An administrator configures an SD-WAN rule with the 'volume' load balancing algorithm. The two WAN members have bandwidth capacities: port1 = 100 Mbps, port2 = 50 Mbps. Traffic is HTTP and HTTPS from internal users to the internet. How will the traffic be distributed?

A.Traffic is sent to the member with the least number of bytes transmitted, resulting in a balanced distribution proportional to bandwidth

B.All traffic uses port1 until it reaches 100 Mbps, then uses port2

C.Traffic is distributed evenly session-by-session (round-robin)

D.Source-destination IP pairs are hashed to a specific member

AnswerA

Volume algorithm tracks bytes transmitted and sends new traffic to the least loaded member.

Why this answer

The 'volume' load balancing algorithm distributes traffic based on the cumulative bytes transmitted on each WAN member, sending new traffic to the member with the least total bytes transmitted. This results in a distribution proportional to the bandwidth capacities (port1: 100 Mbps, port2: 50 Mbps), ensuring that port1 carries approximately twice the traffic volume of port2 over time.

Exam trap

The trap here is that candidates confuse 'volume' with 'spillover' or 'session' algorithms, assuming traffic fills one link before using another, or that it distributes evenly per session, rather than understanding it balances based on cumulative bytes transmitted.

How to eliminate wrong answers

Option B is wrong because it describes a 'session-persistent' or 'failover' behavior, not the volume algorithm; volume does not fill one link to capacity before using the other. Option C is wrong because it describes round-robin session distribution, which is a different algorithm (e.g., 'session' or 'spillover' mode), not volume-based. Option D is wrong because it describes source-destination IP hashing, which is used in 'source-destination IP' or 'hash' algorithms, not in volume-based load balancing.

Full explanation →

695

Multi-Selecthard

A FortiGate is configured with two VPN tunnels to different remote sites. The administrator notices that traffic is not load-balanced across the tunnels; all traffic uses the first tunnel. The administrator wants to use ECMP (Equal Cost Multi-Path) routing. Which two actions are required? (Choose two.)

Select 2 answers

A.Set the same distance and priority for both static routes

B.Configure both tunnels to use the same IKE version

C.Set the same phase2 lifetime for both tunnels

D.Enable ECMP in the FortiGate's routing settings

AnswersA, D

For ECMP to work, routes must have equal administrative distance and priority.

Why this answer

ECMP requires that routes have the same distance and priority. Also, the administrator must enable ECMP in the routing settings. Option A and D are correct: set the same distance and priority for the static routes, and enable ECMP.

Note: ECMP is enabled by default in policy-based routing? Actually, for static routes, ECMP is automatically used when multiple routes have the same distance and priority. Option D is correct: enable ECMP in the routing settings (if not already). But the question asks for two actions.

So A and D.

Full explanation →

696

MCQeasy

What is the purpose of a global ADOM in FortiManager?

A.To create global firewall policies applicable to all devices

B.To provide a common object repository that can be referenced by other ADOMs

C.To manage all devices in a single ADOM regardless of location

D.To store global logs from all FortiGates

AnswerB

Why this answer

A global ADOM in FortiManager serves as a shared object repository (e.g., addresses, services, schedules) that can be referenced by other ADOMs, enabling centralized management of common objects across multiple administrative domains. This avoids duplication and ensures consistency, as changes in the global ADOM propagate to all ADOMs that reference those objects. It does not directly create or push firewall policies; instead, it provides the building blocks for policies within individual ADOMs.

Exam trap

The trap here is that candidates confuse the global ADOM's role as a shared object repository with the ability to create and push global policies, leading them to select Option A, when in fact policies are always ADOM-specific and only objects are shared globally.

How to eliminate wrong answers

Option A is wrong because a global ADOM does not create global firewall policies applicable to all devices; policies are defined per ADOM and can reference global objects, but the global ADOM itself only stores objects, not policies. Option C is wrong because a global ADOM does not manage all devices in a single ADOM; devices are assigned to specific ADOMs (e.g., per customer or region), and the global ADOM is a separate container for shared objects, not a device management scope. Option D is wrong because a global ADOM does not store logs; log storage is handled by FortiAnalyzer or the local FortiGate storage, and FortiManager's global ADOM is focused on configuration objects, not log aggregation.

Full explanation →

697

MCQhard

In a multi-VDOM deployment, inter-VDOM routing is configured using VDOM links. After configuring the VDOM links and adding static routes, traffic between VDOMs is not working. The administrator verifies that the VDOM link interfaces are up and have correct IP addresses. What is the most likely missing configuration?

A.The inter-VDOM routing mode is set to 'nat' instead of 'route'

B.The VDOM links are not assigned to the correct VDOM

C.Firewall policies are missing or not allowing the traffic

D.The VDOMs are in different administrative domains

AnswerC

Each VDOM needs a policy to allow traffic from the VDOM link interface to the destination.

Why this answer

In a FortiGate multi-VDOM deployment, VDOM links create a direct Layer 3 connection between VDOMs, but traffic is still subject to firewall policies. Even with correct IP addresses and static routes, inter-VDOM traffic will be dropped unless explicit firewall policies are configured on both VDOMs to permit the traffic. This is because FortiGate enforces stateful inspection at every VDOM boundary, including VDOM links.

Exam trap

The trap here is that candidates assume VDOM links bypass firewall policies because they are internal virtual connections, but FortiGate treats all inter-VDOM traffic as requiring explicit policy approval, unlike a simple router-on-a-stick design.

How to eliminate wrong answers

Option A is wrong because inter-VDOM routing mode on a VDOM link can be set to 'nat' or 'route', but both modes require firewall policies to permit traffic; the mode affects NAT behavior, not the fundamental need for policies. Option B is wrong because the administrator already verified that the VDOM link interfaces are up and have correct IP addresses, which implies they are assigned to the correct VDOMs; misassignment would cause the interfaces to be down or unreachable. Option D is wrong because VDOMs are logical partitions within a single FortiGate, and 'administrative domains' is not a FortiGate concept; VDOMs operate under the same administrative domain by default, and inter-VDOM routing does not depend on administrative domain separation.

Full explanation →

698

Multi-Selecthard

An administrator is troubleshooting SD-WAN and wants to verify that performance SLA probes are being sent correctly. Which THREE CLI commands can provide information about the SLA probes and their results?

Select 3 answers

A.diagnose sys sdwan health-check

B.diagnose sys sdwan probe-detail

C.diagnose sys sdwan member-sla

D.diagnose sys sdwan route

E.diagnose sys sdwan config

AnswersA, B, C

This command shows health check results.

Why this answer

The 'diagnose sys sdwan health-check' command displays the current status and results of performance SLA probes for each SD-WAN health-check server, including metrics like latency, jitter, and packet loss. This allows the administrator to verify that probes are being sent and whether they meet the configured SLA thresholds.

Exam trap

The trap here is that candidates confuse configuration commands (like 'diagnose sys sdwan config') with diagnostic commands that show live probe results, or they assume 'route' commands include SLA data, but only the three listed commands (A, B, C) directly expose probe transmission and SLA compliance details.

Full explanation →

699

MCQhard

Refer to the exhibit. An administrator notices that some malware files are not being detected by FortiGate. The antivirus profile uses flow-based scanning with FortiSandbox disabled. What is the most likely reason for missed detections?

A.Flow-based scanning is less thorough than proxy-based

B.FortiSandbox inline-scan is disabled, so unknown malware is not analyzed

C.Quarantine is enabled, which causes files to be dropped before scanning

D.The antivirus profile is not applied to the firewall policy

AnswerB

Without FortiSandbox, new malware may not be detected by signatures alone.

Why this answer

Flow-based scanning inspects files as they traverse the firewall, but it relies on signatures and heuristics for detection. Without FortiSandbox inline-scan enabled, unknown or zero-day malware that does not match existing signatures will not be sent to the sandbox for behavioral analysis, so it can pass undetected. Option B correctly identifies that disabling FortiSandbox removes the ability to analyze unknown threats, which is the most likely reason for missed detections.

Exam trap

The trap here is that candidates often assume flow-based scanning is always less thorough than proxy-based, but the real issue is the lack of FortiSandbox integration for unknown malware analysis, not the scanning mode itself.

How to eliminate wrong answers

Option A is wrong because flow-based scanning is not inherently less thorough than proxy-based; it uses a single-pass, low-latency approach that can still detect known malware effectively, and the question specifies that FortiSandbox is disabled, not that flow-based scanning is the cause. Option C is wrong because quarantine is a post-detection action that stores files after they are flagged as malicious; it does not cause files to be dropped before scanning, and enabling quarantine would not prevent detection. Option D is wrong because the question states that the antivirus profile is applied to the firewall policy (the administrator notices missed detections, implying the profile is in use), and if it were not applied, no malware would be detected at all, not just some files.

Full explanation →

700

MCQhard

An administrator is investigating a security incident and needs to determine which firewall policy allowed a specific malicious traffic flow. The traffic is no longer active. Which FortiAnalyzer log type should the admin query?

A.Event logs

B.Security logs

C.Traffic logs

D.Audit logs

AnswerC

Traffic logs contain policy ID and action for each session, perfect for this investigation.

Why this answer

Traffic logs record every session that passes through the FortiGate, including the source/destination IPs, ports, policy ID, and action taken. Since the traffic is no longer active, the administrator must query historical traffic logs in FortiAnalyzer to identify which firewall policy permitted the malicious flow. Event logs, security logs, and audit logs do not contain the per-session policy mapping needed for this forensic analysis.

Exam trap

The trap here is that candidates confuse 'security logs' (which log threat detections) with 'traffic logs' (which log all permitted sessions), mistakenly thinking that a security event log would contain the policy ID that allowed the malicious flow, when in fact traffic logs are the only source for historical policy-to-session mapping.

How to eliminate wrong answers

Option A is wrong because event logs capture system events (e.g., HA state changes, interface up/down, admin logins) and do not record per-session firewall policy decisions. Option B is wrong because security logs (e.g., IPS, antivirus, web filter) record threat detections but not the specific firewall policy that allowed the traffic; they reference a policy ID only if the traffic was already permitted. Option D is wrong because audit logs track administrative actions (e.g., config changes, CLI commands) and contain no information about individual traffic flows or firewall policy matches.

Full explanation →

701

Multi-Selecteasy

A FortiGate administrator is planning to deploy VDOMs to separate customer traffic. The administrator wants to use FortiManager for centralized management. Which TWO prerequisites must be met before the VDOMs can be managed from FortiManager?

Select 2 answers

A.Inter-VDOM routing must be enabled

B.FortiAnalyzer must be registered with FortiManager

C.The FortiGate must be assigned to an ADOM

D.The FortiGate must be added to the FortiManager device list

E.All VDOMs must be in the same ADOM

AnswersC, D

ADOM assignment organizes and isolates management.

Why this answer

FortiManager uses ADOMs (Administrative Domains) to logically group managed devices, and a FortiGate must be assigned to an ADOM before its VDOMs can be managed. Option D is correct because the FortiGate must be added to the FortiManager device list (via model or managed registration) to establish communication and allow policy/object provisioning to its VDOMs.

Exam trap

The trap here is confusing inter-VDOM routing (a Layer 3 forwarding feature) with the management-plane requirement of ADOM assignment, leading candidates to incorrectly select Option A as a prerequisite for centralized management.

Full explanation →

702

Multi-Selectmedium

A FortiGate is configured with an SD-WAN zone containing two WAN interfaces. The administrator wants to use the 'spillover' load balancing algorithm to ensure that the primary link carries traffic until its bandwidth reaches 80% utilization, after which new sessions are sent to the secondary link. Which THREE configuration steps are necessary?

Select 3 answers

A.Create a performance SLA to measure bandwidth utilization

B.Add both interfaces as members of the SD-WAN rule

C.Configure the 'spillover-threshold' on the primary interface to 80 percent

D.Assign a weight of 80 to the primary interface and 20 to the secondary

E.In the SD-WAN rule, set the load balancing method to 'spillover'

AnswersB, C, E

Why this answer

Both WAN interfaces must be added as members of the SD-WAN rule to define which interfaces participate in the spillover load balancing. Without adding them as members, the SD-WAN rule cannot distribute traffic between the primary and secondary links based on the spillover algorithm.

Exam trap

The trap here is confusing performance SLA (which measures link quality) with bandwidth utilization monitoring (which is a separate interface-level feature), leading candidates to incorrectly select Option A.

Full explanation →

703

MCQeasy

An administrator wants to view the current number of active sessions on a FortiGate. Which CLI command should be used?

A.exec system session count

B.show system session count

C.diagnose sys session list

D.get system performance status

AnswerD

Correct. This command displays session count, CPU, and memory usage.

Why this answer

The command 'get system performance status' displays real-time system performance metrics, including the current number of active sessions (sessions in the session table). This is the correct CLI command for an administrator to view the active session count on a FortiGate.

Exam trap

The trap here is that candidates often confuse 'diagnose sys session list' (which shows detailed session information) with the simpler command needed to just view the session count, or they incorrectly assume 'exec' or 'show' are valid FortiGate command prefixes for this purpose.

How to eliminate wrong answers

Option A is wrong because 'exec system session count' is not a valid FortiGate CLI command; the correct syntax for counting sessions is 'diagnose sys session count'. Option B is wrong because 'show system session count' uses 'show', which is not a valid FortiGate command prefix; FortiGate uses 'get' for configuration and status, and 'diagnose' for diagnostic commands. Option C is wrong because 'diagnose sys session list' lists all sessions in detail, not just the count; it is used for deep inspection, not for quickly viewing the current number of active sessions.

Full explanation →

704

Multi-Selectmedium

An administrator is configuring SD-WAN and wants to ensure that traffic matching a specific SLA rule uses the best-performing member. Which TWO commands can be used to verify the SLA performance and route selection? (Choose two.)

Select 2 answers

A.diagnose sys session list

B.diagnose sys sdwan health-check

C.get router info routing-table

D.diagnose sys sdwan info

E.show system sdwan

AnswersB, D

Shows health-check results per member.

Why this answer

The 'diagnose sys sdwan health-check' command displays real-time SLA performance metrics for each SD-WAN member, including latency, jitter, and packet loss. Option D is correct because 'diagnose sys sdwan info' provides detailed information about SD-WAN zones, rules, and the current best-performing member selected for each SLA rule. Both commands are essential for verifying SLA compliance and route selection in FortiGate SD-WAN.

Exam trap

The trap here is that candidates confuse 'diagnose sys sdwan info' with 'get router info routing-table', assuming the routing table reflects SD-WAN decisions, but SD-WAN uses a separate policy-based routing mechanism that does not always update the kernel routing table for per-session steering.

Full explanation →

705

MCQmedium

A network administrator is configuring SD-WAN on a FortiGate with two WAN links (port1 and port2). They want traffic to destination 10.0.0.0/8 to use port1 as long as its latency is below 50ms and jitter below 10ms; otherwise, fail over to port2. Which SD-WAN configuration components are required?

A.SD-WAN members, one performance SLA, one SD-WAN member with a static route

B.SD-WAN members, two performance SLAs (one per interface), one SD-WAN rule

C.SD-WAN members, one performance SLA, two SD-WAN rules (one for each interface)

D.SD-WAN members, one performance SLA, one SD-WAN rule with the performance SLA as a strategy

AnswerD

The performance SLA defines latency/jitter thresholds. The SD-WAN rule references the SLA and sets the strategy to 'best quality' or 'manual' to enforce failover based on SLA compliance.

Why this answer

SD-WAN failover based on latency and jitter thresholds requires a single performance SLA to measure both metrics on the active link (port1), and one SD-WAN rule that uses that SLA as the strategy to determine best path. The rule defines the destination (10.0.0.0/8) and the SLA's thresholds trigger failover to port2 when exceeded. Only one SLA is needed since the condition is applied to the primary link, not both.

Exam trap

The trap here is that candidates often think each interface needs its own performance SLA (Option B) or that multiple rules are required for failover (Option C), but FortiGate SD-WAN consolidates monitoring and policy into one SLA and one rule, with the SLA applied to the primary member and failover handled by the rule's member list.

How to eliminate wrong answers

Option A is wrong because a static route is not part of SD-WAN configuration; SD-WAN uses SD-WAN rules and performance SLAs, not static routes for policy-based forwarding. Option B is wrong because two performance SLAs are unnecessary—only one SLA is needed to monitor the primary link (port1) for latency and jitter; the second link (port2) is a backup and does not require its own SLA for this failover scenario. Option C is wrong because two SD-WAN rules are redundant; a single rule with the performance SLA as the strategy can handle both the primary path and failover to the secondary interface when thresholds are breached.

Full explanation →

706

Multi-Selectmedium

An organization uses FortiMail and wants to validate that incoming emails are from legitimate senders by checking the sender's domain against a published policy. Which two email authentication mechanisms can FortiMail use? (Choose two.)

Select 1 answer

A.DKIM and DMARC

B.STARTTLS and SPF

C.DMARC and SPF

D.SPF and DKIM

AnswersD

SPF verifies the sending IP, DKIM verifies the signature.

Why this answer

FortiMail can use SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to validate that incoming emails originate from legitimate senders by checking the sender's domain against a published policy. SPF verifies that the sending IP address is authorized by the domain's DNS TXT record, while DKIM uses a digital signature in the email header that can be validated against a public key published in the sender's DNS. Both mechanisms allow FortiMail to authenticate the sender's domain before accepting the message.

Exam trap

The trap here is that candidates often confuse DMARC as an authentication mechanism when it is actually a policy framework that relies on SPF and DKIM results, leading them to select options that include DMARC instead of the two core authentication protocols.

Full explanation →

707

MCQeasy

An administrator wants to monitor CPU usage of specific processes on a FortiGate. Which command should be used?

A.get system performance status

B.diagnose sys top

C.get system performance

D.top

AnswerB

This shows process-level CPU and memory usage.

Why this answer

The 'diagnose sys top' command is the correct tool for monitoring CPU usage of specific processes on a FortiGate because it provides a real-time, interactive view of process-level CPU and memory utilization, allowing the administrator to identify which processes are consuming resources. Unlike the other options, this diagnostic command is specifically designed for granular process monitoring in FortiOS.

Exam trap

The trap here is that candidates may confuse the generic Linux 'top' command with FortiOS's 'diagnose sys top', or assume that 'get system performance status' provides process-level detail when it only shows aggregate system metrics.

How to eliminate wrong answers

Option A is wrong because 'get system performance status' displays overall system performance statistics (e.g., CPU, memory, sessions) but does not show per-process CPU usage. Option C is wrong because 'get system performance' is not a valid FortiGate command; the correct command for overall performance is 'get system performance status'. Option D is wrong because 'top' is a standard Linux command that is not available in the FortiGate CLI; FortiOS uses 'diagnose sys top' as its equivalent for process-level monitoring.

Full explanation →

708

MCQeasy

A BGP peering between two FortiGates is not establishing. The admin runs 'get router info bgp summary' and sees the neighbor state as 'Idle'. What is the most common cause of a BGP session stuck in Idle?

A.The BGP update timer is set too high

B.The remote AS number is misconfigured

C.The neighbor IP is not reachable or the TCP port 179 is blocked

D.The route advertisement is disabled

AnswerC

BGP uses TCP port 179; if the neighbor is unreachable or port is blocked, the session cannot start, staying in Idle.

Why this answer

The Idle state in BGP indicates that the session has not started or has been reset, often because the underlying TCP connection cannot be established. The most common cause is that the neighbor IP is unreachable or TCP port 179 is blocked by a firewall or ACL, preventing the three-way handshake. Without TCP connectivity, BGP cannot transition out of Idle, regardless of other configurations.

Exam trap

The trap here is that candidates often confuse the Idle state with the Active state, assuming any misconfiguration (like wrong AS number) causes Idle, but in BGP FSM, an AS mismatch typically results in the Active state or a notification error, not Idle.

How to eliminate wrong answers

Option A is wrong because the BGP update timer (which controls the interval for sending route updates) does not affect the session establishment state; it only influences how often updates are sent after the session is up. Option B is wrong because a misconfigured remote AS number typically causes the session to go to Active state (not Idle) as the router attempts to connect but receives an incorrect OPEN message. Option D is wrong because disabling route advertisement does not prevent the BGP session from establishing; it only stops the advertisement of routes once the session is up.

Full explanation →

709

MCQhard

A FortiGate with two WAN interfaces configured in an SD-WAN setup uses the 'lowest-cost' load balancing algorithm. The performance SLA monitors latency and jitter. If wan1 has a cost of 10 and wan2 has a cost of 20, but wan1 is experiencing 50% packet loss, what will happen to traffic?

A.Traffic is distributed equally between both links

B.Traffic is dropped until wan1 recovers

C.Traffic continues using wan1 because cost is lower

D.Traffic is sent to wan2 because wan1 is considered dead

AnswerD

wan1 fails SLA so it's dead, traffic uses wan2.

Why this answer

When an SD-WAN member interface fails the performance SLA (e.g., 50% packet loss), FortiGate marks it as 'dead' and removes it from the active member set. The 'lowest-cost' algorithm then selects the next lowest-cost member that is alive, which is wan2 (cost 20). Traffic is not load-balanced equally because wan1 is dead, and it is not dropped because wan2 is available.

Exam trap

The trap here is that candidates assume the 'lowest-cost' algorithm always uses the link with the lowest cost regardless of link health, but FortiGate SD-WAN first checks the SLA status and only considers active (alive) members for the cost comparison.

How to eliminate wrong answers

Option A is wrong because the 'lowest-cost' algorithm does not distribute traffic equally; it selects the link with the lowest cost among active members, and since wan1 is dead, all traffic goes to wan2. Option B is wrong because FortiGate does not drop traffic when a link fails; it fails over to the next available link in the SD-WAN zone. Option C is wrong because even though wan1 has a lower cost, it is marked dead due to SLA failure, so it is no longer considered for traffic forwarding.

Full explanation →

710

Multi-Selectmedium

Which TWO email authentication mechanisms does FortiMail support to verify sender identity and reduce spoofing? (Choose two.)

Select 2 answers

A.DMARC (Domain-based Message Authentication, Reporting & Conformance)

B.SPF (Sender Policy Framework)

C.STARTTLS

D.S/MIME

E.DKIM (DomainKeys Identified Mail)

AnswersB, E

Checks if the sending IP is authorized.

Why this answer

FortiMail supports SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) as email authentication mechanisms to verify sender identity and reduce spoofing. SPF allows the domain owner to publish authorized sending IP addresses in DNS TXT records, while DKIM uses a digital signature added to the email header, verified against a public key in the sender's DNS. Both are core components of email authentication that FortiMail can enforce or validate.

Exam trap

The trap here is that candidates confuse DMARC as an authentication mechanism rather than a policy framework that relies on SPF and DKIM results, and they may also mistake STARTTLS or S/MIME for sender verification when they are actually transport or message security protocols.

Full explanation →

711

MCQeasy

What is the function of FortiAnalyzer in a Fortinet Security Fabric?

A.To collect logs and generate reports and incidents

B.To manage VDOM configurations

C.To act as a VPN concentrator

D.To provide real-time firewall management

AnswerA

FortiAnalyzer is the logging and analytics platform.

Why this answer

FortiAnalyzer is the centralized logging and reporting appliance within the Fortinet Security Fabric. It collects logs from FortiGate and other Fabric components, correlates events, generates compliance reports, and creates incidents for security analysis. This aligns directly with option A, as its primary function is log aggregation and report generation, not real-time management or VPN termination.

Exam trap

The trap here is that candidates often confuse FortiAnalyzer with FortiManager, assuming both handle configuration management, but FortiAnalyzer is strictly for logging and reporting, while FortiManager handles centralized policy and VDOM management.

How to eliminate wrong answers

Option B is wrong because managing VDOM configurations is a function of FortiGate itself (via CLI or FortiManager), not FortiAnalyzer. Option C is wrong because acting as a VPN concentrator is a role of FortiGate or FortiClient, not FortiAnalyzer, which lacks IPsec/SSL VPN termination capabilities. Option D is wrong because providing real-time firewall management is the domain of FortiGate's local management interface or FortiManager, whereas FortiAnalyzer is focused on historical log analysis and reporting, not live policy changes.

Full explanation →

712

Multi-Selecthard

An administrator is investigating an alert from FortiEDR indicating a suspicious process on an endpoint. The administrator wants to gather more context. Which TWO sources can provide threat intelligence to enrich the investigation?

Select 2 answers

A.Local antivirus signature database

B.FortiGate traffic logs

C.FortiGuard Outbreak Prevention

D.Third-party threat intelligence feeds

E.FortiClient local cache

AnswersC, D

FortiGuard Outbreak Prevention provides real-time threat intelligence about outbreaks.

Why this answer

Options C and D are correct. FortiGuard Outbreak Prevention and third-party threat feeds provide external threat intelligence about indicators of compromise.

Full explanation →

713

MCQhard

A FortiGate has two WAN interfaces (port1, port2) as SD-WAN members. The performance SLA monitor is configured for both with a latency threshold of 50 ms. The measured latency on port1 is 45 ms and on port2 is 55 ms. An SD-WAN rule uses 'lowest-cost' algorithm. Which interface will be selected for new sessions?

A.port1 because its latency is within threshold and lower than port2

B.port2 because port1's latency is close to threshold

C.The session is dropped

D.Both interfaces are used equally

AnswerA

port1 meets the SLA and has lower latency, hence lower cost.

Why this answer

The SD-WAN rule uses the 'lowest-cost' algorithm, which selects the interface with the lowest cost among those that meet the performance SLA threshold. Here, port1 has a measured latency of 45 ms, which is below the 50 ms threshold, while port2's latency of 55 ms exceeds the threshold, making port2 ineligible. Therefore, port1 is the only qualifying interface and is selected for new sessions.

Exam trap

The trap here is that candidates assume the 'lowest-cost' algorithm compares raw latency values directly, but it actually first filters out interfaces that fail the SLA threshold, so port2 is excluded despite having a lower cost or being otherwise functional.

How to eliminate wrong answers

Option B is wrong because port2's latency of 55 ms exceeds the 50 ms threshold, so it is considered out of SLA and is not eligible for selection by the lowest-cost algorithm, regardless of port1's proximity to the threshold. Option C is wrong because the session is not dropped; the SD-WAN rule will still select an interface that meets the SLA (port1), and if no interface meets the SLA, the session may use the best-effort path or fall back to a configured action, but not drop outright. Option D is wrong because the lowest-cost algorithm does not load-balance equally; it selects a single interface based on cost, and since only port1 meets the SLA, it is chosen exclusively.

Full explanation →

714

MCQhard

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route (192.168.100.0/24) into OSPF area 0. The route is configured as a static route on the FortiGate. Which configuration step is essential to ensure the static route is redistributed into OSPF?

A.Create a prefix list to allow the static route and apply it to the OSPF area

B.Set the administrative distance of the static route to 110

C.Configure a route map to match the static route and set OSPF type

D.Enable 'redistribute static' under the OSPF router configuration

AnswerD

Without enabling redistribution on the OSPF process, static routes will not be advertised.

Why this answer

The 'redistribute static' command under OSPF router configuration is the essential step to inject static routes into the OSPF domain. Without this explicit redistribution command, OSPF will not advertise any static routes, regardless of other filtering or metric settings. This is a fundamental requirement for route redistribution in OSPF.

Exam trap

The trap here is that candidates often think a route map or prefix list is mandatory for redistribution, but the essential step is simply enabling 'redistribute static' under OSPF; filters are optional refinements.

How to eliminate wrong answers

Option A is wrong because a prefix list controls which routes are allowed or denied during redistribution, but it is not essential; the redistribution itself must first be enabled. Option B is wrong because setting the administrative distance of the static route to 110 (the default OSPF distance) does not trigger redistribution; it only affects route preference within the routing table. Option C is wrong because a route map is optional for filtering or modifying route attributes during redistribution, but the core requirement is enabling 'redistribute static'.

Full explanation →

715

MCQmedium

A company uses FortiManager to manage multiple FortiGate firewalls. After making changes to a policy package, the administrator runs an install preview and sees a warning: 'Policy ID 10 will be deleted on device XYZ'. What is the most likely reason for this warning?

A.Policy ID 10 was manually added on the device but is not present in the policy package

B.The policy package has been corrupted and needs to be re-imported

C.The device is in a different ADOM and cannot use the same policy ID

D.A revision history conflict exists that prevents the install

AnswerA

The install preview shows actions to align the device with the package.

Why this answer

The warning 'Policy ID 10 will be deleted on device XYZ' indicates that the policy package on FortiManager does not contain Policy ID 10, but the device currently has it. During an install, FortiManager synchronizes the device's policy set with the policy package, so any policy present on the device but absent from the package is flagged for deletion. This is a standard consistency check to prevent unintended policy loss.

Exam trap

The trap here is that candidates assume the warning indicates an error or conflict, when in fact it is a normal behavior of FortiManager's policy synchronization to remove policies that were manually added on the device outside of FortiManager management.

How to eliminate wrong answers

Option B is wrong because a corrupted policy package would typically cause install failures or error messages about parsing or integrity, not a specific warning about a single policy ID being deleted. Option C is wrong because ADOMs are administrative domains that separate management; a device in a different ADOM cannot be targeted by the same policy package at all, so the warning would not appear. Option D is wrong because a revision history conflict would prevent the install from proceeding or generate a conflict error, not a specific deletion warning for a single policy ID.

Full explanation →

716

MCQmedium

A FortiGate administrator configures inter-VDOM routing. Traffic from VDOM-A to VDOM-B is blocked. The administrator checks the policy in VDOM-A allowing traffic to the VDOM link interface. What else must be verified?

A.That there is a corresponding policy in VDOM-B allowing traffic from the VDOM link to the destination

B.That the VDOM link uses a different interface type

C.That the VDOM link interface is in the same subnet

D.That inter-VDOM routing is enabled in system settings

AnswerA

Traffic must be allowed in both directions.

Why this answer

In inter-VDOM routing, traffic traverses a VDOM link, which consists of two interfaces—one in each VDOM. A policy in VDOM-A permits traffic to the VDOM link interface, but the packet must also be allowed by a policy in VDOM-B from the VDOM link interface to the destination. Without this second policy, VDOM-B will drop the traffic, even if VDOM-A's policy is correct.

Exam trap

The trap here is that candidates assume a single policy in the source VDOM is sufficient, overlooking that inter-VDOM routing requires explicit policy approval in both VDOMs due to the independent security domains.

How to eliminate wrong answers

Option B is wrong because the VDOM link interface type does not affect policy requirements; it is always a point-to-point logical link, and changing the type does not bypass the need for policies in both VDOMs. Option C is wrong because VDOM link interfaces are not required to be in the same subnet; they are typically in different subnets or use unnumbered interfaces, and subnet configuration does not influence policy enforcement. Option D is wrong because inter-VDOM routing is implicitly enabled when a VDOM link is created; there is no separate system setting to toggle, and the issue is policy-based, not a global routing toggle.

Full explanation →

717

MCQmedium

Which command is used on a FortiGate to view the current state of BFD sessions?

A.get router info bfd

B.show bfd sessions

C.execute bfd show

D.diagnose sys bfd session list

AnswerD

This shows BFD session details.

Why this answer

'diagnose sys bfd session list' is the FortiGate CLI command used to display the current state of Bidirectional Forwarding Detection (BFD) sessions, including session state, local/remote discriminators, and timers. This command is part of the 'diagnose' utility, which provides detailed operational and diagnostic information for troubleshooting BFD in SD-WAN or routing contexts.

Exam trap

The trap here is that candidates familiar with Cisco IOS may instinctively choose 'show bfd sessions' (Option B), but FortiGate uses a different CLI syntax where 'diagnose' is the proper command for detailed operational state, not 'show' or 'execute'.

How to eliminate wrong answers

Option A is wrong because 'get router info bfd' is not a valid FortiGate command; the correct 'get' command for BFD is 'get router info bfd session' or 'get router info bfd neighbor', but the given syntax is incomplete and incorrect. Option B is wrong because 'show bfd sessions' is a Cisco IOS command, not a FortiGate command; FortiGate uses 'get' or 'diagnose' syntax, not 'show'. Option C is wrong because 'execute bfd show' is not a valid FortiGate command; 'execute' commands are used for actions like ping or traceroute, not for displaying BFD session state.

Full explanation →

718

MCQmedium

An administrator runs 'diagnose debug application ipsmonitor -1' and sees repeated messages: 'IPS engine restarting'. What is the MOST likely cause of this behavior?

A.The FortiGate is overloaded with too many concurrent sessions

B.The IPS engine is running out of memory

C.The firewall policy is configured for flow-based inspection

D.The IPS signatures are outdated and need updating

AnswerB

Memory exhaustion causes the IPS engine to restart to free resources.

Why this answer

The 'IPS engine restarting' message in the output of 'diagnose debug application ipsmonitor -1' indicates that the IPS engine process is crashing and being automatically restarted by the FortiGate's watchdog. The most common cause of IPS engine crashes is memory exhaustion, as the engine requires a dedicated memory heap to process signatures and sessions; when this heap is depleted, the engine terminates to prevent system instability.

Exam trap

The trap here is that candidates often confuse 'IPS engine restarting' with general system overload or policy misconfiguration, but the specific debug output points directly to a process crash, which is almost always caused by memory exhaustion in the IPS engine heap.

How to eliminate wrong answers

Option A is wrong because an overload of concurrent sessions would typically cause high CPU usage or session table exhaustion, not a specific IPS engine restart; the IPS engine can handle high session counts if memory is sufficient. Option C is wrong because flow-based inspection is a valid inspection mode that uses the IPS engine, but it does not inherently cause engine restarts; the engine restart issue is related to resource exhaustion, not the inspection mode itself. Option D is wrong because outdated IPS signatures do not cause the engine to restart; they may result in missed detections or false positives, but the engine process remains stable unless memory or other critical resources are exhausted.

Full explanation →

719

Multi-Selectmedium

A FortiGate administrator is investigating a security incident and needs to identify which user initiated a specific outbound connection to a malicious IP address. The company uses FSSO for authentication. Which THREE pieces of information from FortiAnalyzer logs would be MOST useful? (Choose three.)

Select 3 answers

A.Username from the FortiGate authentication log

B.Destination IP address

C.Event type (e.g., traffic, event, attack)

D.Source IP address of the session

E.Timestamp of the session

AnswersA, D, E

Links the session to the authenticated user.

Why this answer

FSSO (Fortinet Single Sign-On) maps network sessions to Active Directory usernames via the FortiGate authentication log. When investigating which user initiated an outbound connection to a malicious IP, the username from this log directly ties the session to a specific identity, enabling attribution beyond just IP addresses.

Exam trap

The trap here is that candidates often select 'Destination IP address' thinking it helps identify the user, but it only identifies the target of the attack, not the initiator, and fails to leverage the FSSO authentication mapping required for user attribution.

Full explanation →

720

MCQeasy

A network administrator needs to create a separate firewall policy for the guest network while keeping management traffic in the main VDOM. Which VDOM type should be configured for the guest network?

A.Root VDOM

B.Administrative VDOM

C.Management VDOM

D.Traffic VDOM

AnswerD

Traffic VDOMs are used to create separate firewall policies for different network segments.

Why this answer

A Traffic VDOM is a lightweight VDOM type designed specifically to handle user traffic, such as guest network traffic, without the overhead of management-plane functions. It allows the administrator to separate guest traffic into its own firewall policy domain while keeping management traffic (e.g., SSH, HTTPS, SNMP) in the main Root VDOM, ensuring that guest users cannot access the management interface or configuration.

Exam trap

The trap here is that candidates often confuse 'Management VDOM' with a real VDOM type, but FortiGate does not have a dedicated Management VDOM—management is always tied to the Root VDOM, and guest traffic separation requires a Traffic VDOM.

How to eliminate wrong answers

Option A is wrong because the Root VDOM is the default VDOM that contains both management and traffic functions; configuring the guest network in the Root VDOM would mix guest traffic with management traffic, defeating the purpose of separation. Option B is wrong because an Administrative VDOM is not a standard VDOM type in FortiGate; it is a misconception—FortiGate uses 'Admin VDOM' only in the context of multi-tenancy or VDOM administration, not for traffic separation. Option C is wrong because a Management VDOM does not exist as a separate VDOM type; management traffic is always handled by the Root VDOM or a dedicated management interface, and creating a separate VDOM for management is not supported—guest traffic must be isolated in a Traffic VDOM.

Full explanation →

721

MCQhard

An administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA state is 'UP' but the IPsec SA state is 'DOWN'. The remote peer is a FortiGate. What is the most likely cause of this issue?

A.The pre-shared key is incorrect

B.The tunnel interface is down

C.The Phase2 parameters (encryption, authentication, proxy IDs) do not match between the peers

D.The firewall policy on the remote FortiGate is blocking UDP 500

AnswerC

Phase2 negotiations use separate parameters; if they mismatch, IPsec SA fails while IKE SA remains up.

Why this answer

If IKE is up but IPsec is down, the Phase2 parameters are not matching between peers. Common causes include mismatched encryption algorithms, proxy IDs, or lifetimes.

Full explanation →

722

Multi-Selecthard

A FortiGate with multiple VDOMs is experiencing high CPU usage. The administrator suspects that one VDOM is consuming excessive resources. Which THREE methods can be used to limit resource usage per VDOM?

Select 3 answers

A.Apply per-VDOM traffic shaping policies

B.Enable HA resource reservation

C.Configure VDOM resource limits (CPU/memory)

D.Enable VDOM logging

E.Set the VDOM CPU quota

AnswersA, C, E

Traffic shaping limits bandwidth per VDOM.

Why this answer

Per-VDOM traffic shaping policies allow the administrator to apply bandwidth limits and QoS policies specifically to traffic within a particular VDOM, preventing that VDOM from monopolizing the FortiGate's CPU resources. This is achieved by configuring shaping policies under the VDOM's firewall policy that match traffic and apply a traffic shaper, which can limit bandwidth and prioritize traffic, thereby reducing CPU load from that VDOM.

Exam trap

The trap here is that candidates often confuse 'resource reservation' (which guarantees resources for HA) with 'resource limits' (which cap usage per VDOM), leading them to select Option B, which is unrelated to per-VDOM CPU control.

Full explanation →

723

Multi-Selectmedium

A network administrator is configuring SD-WAN rules with load balancing. They want to distribute HTTP traffic evenly across two WAN links based on the number of sessions. Which TWO settings should they use? (Choose two.)

Select 2 answers

A.Ensure the SD-WAN rule matches HTTP traffic (e.g., using protocol or port criteria).

B.Set the load balancing algorithm to 'volume'.

C.Create a performance SLA to monitor the links.

D.Enable 'set update-static-route' on the SD-WAN rule.

E.Set the load balancing algorithm to 'session'.

AnswersA, E

The rule must match HTTP traffic to apply the load balancing algorithm to that traffic.

Why this answer

The SD-WAN rule must match HTTP traffic (e.g., using destination port 80 or protocol 6) to ensure only HTTP sessions are load-balanced. Option E is correct because setting the load balancing algorithm to 'session' distributes traffic based on the number of sessions, which aligns with the requirement to distribute HTTP traffic evenly across two WAN links by session count.

Exam trap

The trap here is confusing 'session' with 'volume' or assuming that performance SLA monitoring is required for any SD-WAN rule, when in fact load balancing algorithms are independent of SLA-based path selection.

Full explanation →

724

MCQhard

A FortiGate has multiple VRFs. The administrator wants to leak a route from VRF1 to VRF2. Which configuration is required?

A.Configure route leaking using route maps and set vrf command under VRF1's routing process

B.Use the config router vrf-leak command to define leaking rules

C.Enable inter-VRF routing on the VDOM

D.Configure a static route in VRF2 pointing to the next-hop in VRF1 with a different administrative distance

AnswerA

Route leaking between VRFs is achieved by configuring route maps with set vrf and applying them under the routing process of the source VRF.

Why this answer

Route leaking between VRFs on a FortiGate is achieved by configuring route maps with the `set vrf` command under the source VRF's routing process. This allows specific routes from VRF1 to be imported into VRF2, enabling controlled inter-VRF communication without requiring a VDOM or static route workaround.

Exam trap

The trap here is that candidates confuse the FortiGate-specific route leaking method (route maps with `set vrf`) with generic Cisco-style VRF leaking commands or assume that a static route with a different administrative distance can bypass VRF isolation, which fails because VRFs are isolated at Layer 3 and require explicit route redistribution.

How to eliminate wrong answers

Option B is wrong because the `config router vrf-leak` command does not exist in FortiOS; route leaking is configured using route maps and the `set vrf` command under the routing process, not a dedicated vrf-leak command. Option C is wrong because enabling inter-VRF routing on a VDOM is a different concept—it allows all VRFs within a VDOM to communicate without explicit route leaking, which is not the same as selective route leaking between specific VRFs. Option D is wrong because configuring a static route in VRF2 pointing to a next-hop in VRF1 with a different administrative distance does not leak the route; it creates a static route that may fail because the next-hop is in a different VRF and not reachable without proper route leaking or inter-VRF connectivity.

Full explanation →

725

MCQeasy

An administrator runs 'diagnose sys top' and sees process 'httpsd' consuming 95% CPU. What is the best immediate action to alleviate the issue?

A.Change the administration HTTPS port and restrict access to trusted hosts

B.Kill the httpsd process

C.Disable HTTPS administration access

D.Reboot the FortiGate

AnswerA

Correct. Changing the port and restricting source IPs can mitigate the attack without losing access.

Why this answer

The 'httpsd' process handles HTTPS administration traffic. A CPU spike to 95% indicates a possible DoS attack or excessive management connections. Changing the HTTPS port and restricting access to trusted hosts immediately mitigates the attack surface without disrupting other services, as it limits the source of the malicious traffic.

Exam trap

The trap here is that candidates often choose to kill the process or disable HTTPS entirely, thinking it will stop the CPU usage, but they overlook that the root cause is likely an external attack or misconfiguration that requires access control, not process termination.

How to eliminate wrong answers

Option B is wrong because killing the httpsd process would terminate all HTTPS management sessions, potentially locking out the administrator and requiring console access to restart the process, without addressing the root cause. Option C is wrong because disabling HTTPS administration access entirely would prevent any future secure management, which is an overreaction and may violate security policies; it also does not stop the current attack if the process is already overwhelmed. Option D is wrong because rebooting the FortiGate is a temporary fix that does not prevent the attack from recurring immediately after the system comes back up, and it causes unnecessary downtime.

Full explanation →

726

Multi-Selecthard

A FortiGate is experiencing high CPU usage due to IPsec VPN traffic. The admin wants to offload cryptographic operations to the hardware. Which THREE conditions must be met for hardware acceleration to work? (Choose three.)

Select 3 answers

A.The FortiGate must have a compatible NP7 or CP9 processor

B.The IPsec phase 2 proposal must use encryption algorithms supported by the hardware accelerator (e.g., AES-GCM)

C.The VPN interface must be configured with 'set acceleration-mode ipsec'

D.The VPN tunnel must not be configured with features that disable offload, such as IPsec interface mode with kernel-version-dependent features

E.The firewall policy using the VPN interface must not have NAT enabled

AnswersA, B, D

Hardware acceleration requires specific processor models.

Why this answer

Hardware acceleration (CP8/CP9) requires specific conditions: supported encryption algorithms, no advanced features that disable offload, and the traffic must match a VPN policy that uses the hardware acceleration capable interface.

Full explanation →

727

Multi-Selectmedium

A network administrator is configuring SD-WAN rules and wants to ensure that voice traffic is sent over the link with the lowest jitter. Which TWO configurations should the administrator apply? (Choose two.)

Select 2 answers

A.Set the SD-WAN rule strategy to 'lowest cost'

B.Configure the SD-WAN rule to use 'volume' load balancing

C.Set the SD-WAN rule strategy to 'best quality'

D.Enable 'set jitter-threshold' on the SD-WAN rule

E.Ensure the performance SLA measures jitter

AnswersC, E

Best quality uses the priority order of metrics, which can include jitter.

Why this answer

Setting the SD-WAN rule strategy to 'best quality' instructs FortiGate to select the link with the best performance metrics, such as lowest jitter, based on the configured performance SLA. This strategy dynamically routes traffic to the interface that meets the SLA targets, ensuring voice traffic uses the link with the lowest jitter.

Exam trap

The trap here is that candidates confuse 'set jitter-threshold' as a direct SD-WAN rule parameter, when in fact jitter thresholds are defined within the performance SLA configuration and the rule only references the SLA via the 'best quality' strategy.

Full explanation →

728

MCQeasy

In a multi-VDOM deployment, what is the purpose of inter-VDOM routing?

A.To route traffic between the management VDOM and data VDOMs

B.To provide redundancy for VDOMs in an HA setup

C.To allow traffic to pass between different VDOMs via firewall policies

D.To connect VDOMs to external routers

AnswerC

Inter-VDOM routing uses VDOM links and policies.

Why this answer

Inter-VDOM routing allows traffic to be forwarded between different VDOMs on the same FortiGate unit. This is achieved by configuring inter-VDOM links (IVL) or using VDOM peering, and then applying firewall policies to control and secure the traffic flow between VDOMs. Option C correctly identifies that firewall policies are the mechanism used to permit or deny inter-VDOM traffic.

Exam trap

The trap here is that candidates often assume inter-VDOM routing is automatic or purely a routing function, but Fortinet requires explicit firewall policies to permit traffic between VDOMs, making it a security-controlled feature rather than a simple routing path.

How to eliminate wrong answers

Option A is wrong because inter-VDOM routing is not limited to traffic between the management VDOM and data VDOMs; it applies to any pair of VDOMs. Option B is wrong because inter-VDOM routing does not provide redundancy for VDOMs in an HA setup; HA redundancy is handled by the HA configuration itself, not by inter-VDOM routing. Option D is wrong because inter-VDOM routing is an internal FortiGate function, not a method to connect VDOMs to external routers; external connectivity is achieved through physical interfaces or VLANs assigned to VDOMs.

Full explanation →

729

MCQmedium

A FortiGate admin runs the following command: 'diagnose sys session filter dport 443' and sees output indicating sessions with state 'proto_state=01' and 'duration=3600, expire=3599'. What does this indicate about the session?

A.The session is established and has been active for 3600 seconds

B.The session has timed out and is being removed

C.The session is in a closing state

D.The session is in a half-open state

AnswerA

proto_state=01 means established. Duration is how long it's been active.

Why this answer

The command 'diagnose sys session filter dport 443' filters sessions with destination port 443 (HTTPS). The output shows 'duration=3600, expire=3599', meaning the session has been active for 3600 seconds and will expire in 3599 seconds. The 'proto_state=01' indicates a TCP session in the established state (state 1 = TCP_ESTABLISHED).

This confirms the session is fully established and actively tracked by the FortiGate session table.

Exam trap

The trap here is that candidates confuse 'duration' with 'timeout' or assume a high duration means the session is about to expire, when in fact 'expire' shows remaining time and 'proto_state=01' confirms an established session.

How to eliminate wrong answers

Option B is wrong because 'expire=3599' shows the session still has time remaining, not that it has timed out; a timed-out session would have an expire value of 0 or be absent from the table. Option C is wrong because a closing state (e.g., TCP_FIN_WAIT or TCP_CLOSE_WAIT) would show a different proto_state value (e.g., 02, 03, or 04), not '01'. Option D is wrong because a half-open state (e.g., TCP_SYN_SENT) would have a proto_state of 00 or a very short duration, not 3600 seconds with an established state.

Full explanation →

730

Multi-Selecthard

During a BGP troubleshooting session, an administrator sees that the BGP neighbor state is 'Active'. Which three conditions could cause this state? (Choose THREE.)

Select 3 answers

A.The remote AS number is misconfigured

B.The BGP update timer is too short

C.The neighbor IP address is incorrectly configured

D.The maximum-prefix limit has been exceeded

E.A firewall is blocking TCP port 179

AnswersA, C, E

ASN mismatch causes the remote end to reject the open message, leading to Active state.

Why this answer

A misconfigured remote AS number causes the BGP neighbor to remain in the 'Active' state. BGP uses the remote AS number to validate the OPEN message; if the AS number in the OPEN message does not match the configured remote AS, the session is rejected, and the neighbor stays in Active, repeatedly attempting to establish a TCP connection.

Exam trap

The trap here is that candidates often confuse 'Active' with 'Idle' or 'Connect' states, mistakenly thinking that a firewall block or misconfiguration would cause 'Idle' instead of 'Active', but 'Active' specifically indicates the router is retrying TCP connection attempts after a failure.

Full explanation →

731

MCQmedium

An administrator wants to ensure that all traffic from a specific LAN subnet (192.168.10.0/24) to the internet uses a particular WAN interface (wan1) in an SD-WAN setup, while other traffic uses wan2. What is the correct configuration to achieve this?

A.Create a policy-based routing rule with source 192.168.10.0/24 and set outgoing interface to wan1

B.Configure an SD-WAN rule with source address matching 192.168.10.0/24 and set the preferred member to wan1

C.Set the default route for wan1 with a higher distance

D.Use a route map with prefix list to match the subnet and set next-hop to wan1

AnswerB

SD-WAN rules allow source-based matching and preferred member selection.

Why this answer

In Fortinet SD-WAN, traffic steering is achieved through SD-WAN rules, not policy routes. An SD-WAN rule with a source address matching 192.168.10.0/24 and a preferred member set to wan1 ensures that all traffic from that subnet is directed to wan1, while other traffic falls through to the default SD-WAN rule or other rules using wan2. This is the correct method because SD-WAN rules are evaluated before the routing table and provide granular control over member selection based on application, source, or destination.

Exam trap

The trap here is that candidates confuse policy-based routing (PBR) with SD-WAN rules, assuming PBR can achieve the same outcome, but Fortinet's SD-WAN requires explicit SD-WAN rules to control member selection within the SD-WAN zone.

How to eliminate wrong answers

Option A is wrong because policy-based routing (PBR) in FortiOS is used for specific traffic steering but does not integrate with SD-WAN member selection or load-balancing algorithms; it bypasses SD-WAN logic entirely. Option C is wrong because setting a higher distance on the default route for wan1 would make it less preferred in the routing table, causing traffic to use wan2 instead of wan1, which is the opposite of the requirement. Option D is wrong because route maps with prefix lists are used in BGP or OSPF route redistribution, not for SD-WAN traffic steering; they influence routing table entries, not SD-WAN member selection.

Full explanation →

732

Multi-Selecthard

An administrator configures FortiManager automation stitches to respond to high CPU usage on a FortiGate. The stitch should trigger a script to run diagnostics. Which THREE components are required in an automation stitch?

Select 3 answers

A.Condition (e.g., severity threshold)

B.Trigger (e.g., event type)

C.Result (e.g., email notification)

D.Action (e.g., CLI script)

E.Target (e.g., device or device group)

AnswersB, D, E

Defines when the stitch activates.

Why this answer

An automation stitch in FortiManager requires a trigger to define the event that initiates the stitch, such as a high CPU usage event. The trigger specifies the event type (e.g., 'CPU Usage High') that the FortiGate reports, which then activates the stitch. Without a trigger, the automation stitch has no starting point to respond to the condition.

Exam trap

The trap here is that candidates often confuse 'Condition' (like a severity threshold) as a separate component, but in FortiManager automation stitches, conditions are embedded within the trigger or action, not a standalone required element.

Full explanation →

733

MCQeasy

A FortiGate administrator wants to verify whether a specific session is being offloaded to the NP6 processor. Which CLI command should the administrator use?

A.diagnose sys session filter src 10.0.0.1 ; diagnose sys session list

B.get system performance status

C.diagnose hardware sysinfo memory

D.diagnose npu np6 session list

AnswerA

This shows session details and offload status.

Why this answer

The 'diagnose sys session filter src 10.0.0.1' command sets a filter to isolate sessions from a specific source IP, and 'diagnose sys session list' then displays the session details, including the 'offload' field. This field explicitly indicates whether the session is offloaded to the NP6 processor (e.g., 'offload yes' or 'np6 offload'). This is the standard method to verify NP6 offloading for a specific session.

Exam trap

The trap here is that candidates may confuse the generic 'diagnose sys session list' command with the NP6-specific 'diagnose npu np6 session-list' command, but the latter lacks filtering capabilities and is not the correct way to verify offload for a specific session; the exam tests the ability to combine session filtering with the session list output to check the offload flag.

How to eliminate wrong answers

Option B is wrong because 'get system performance status' provides a high-level overview of system resource usage (CPU, memory, sessions) but does not show per-session offload status or NP6-specific details. Option C is wrong because 'diagnose hardware sysinfo memory' reports memory hardware information and usage statistics, not session offloading to NP6 processors. Option D is wrong because 'diagnose npu np6 session list' is not a valid FortiGate CLI command; the correct command to list NP6 offloaded sessions is 'diagnose npu np6 session-list' (with a hyphen), and even then it lists all offloaded sessions without filtering, making it impractical for verifying a specific session without additional filters.

Full explanation →

734

MCQeasy

Which FortiGate feature allows multiple independent routing tables on a single device, enabling traffic separation for different departments or customers?

A.ECMP

B.VRF

C.VDOM

D.Policy-based routing

AnswerB

VRF creates independent routing tables on the same FortiGate.

Why this answer

VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, each with its own set of interfaces, routes, and forwarding decisions. This enables traffic separation for different departments or customers without requiring separate physical devices, as each VRF instance operates as a logically isolated router within the same hardware.

Exam trap

The trap here is that candidates often confuse VRF with VDOM, assuming both provide the same level of isolation, but VRF only virtualizes the routing table while VDOM virtualizes the entire device, making VRF the correct answer when the question specifically asks about 'multiple independent routing tables' rather than full device virtualization.

How to eliminate wrong answers

Option A (ECMP) is wrong because ECMP (Equal-Cost Multi-Path) is a load-balancing technique that distributes traffic across multiple equal-cost paths within a single routing table, not a mechanism for creating independent routing tables. Option C (VDOM) is wrong because while VDOMs (Virtual Domains) also provide traffic separation, they virtualize the entire FortiGate (including firewall policies, administrators, and routing tables) as separate logical devices, whereas VRF is specifically a routing-table-level virtualization that can be used within a single VDOM or global context. Option D (Policy-based routing) is wrong because PBR allows traffic to be forwarded based on policies (e.g., source/destination IP) rather than the destination-based routing table, but it does not create multiple independent routing tables; it overrides the routing table for specific traffic flows.

Full explanation →

735

Multi-Selecteasy

Which TWO statements about VDOM limits on FortiGate are correct? (Choose TWO.)

Select 2 answers

A.VDOMs can be created only in NAT mode

B.All FortiGate models support at least 10 VDOMs

C.VDOM support requires a valid FortiGate license

D.The maximum number of VDOMs is fixed per model and cannot be exceeded

E.VDOMs can be added without additional memory

AnswersC, D

VDOMs often require an advanced feature license.

Why this answer

VDOM support on FortiGate is a licensed feature. Without a valid FortiGate license (e.g., an Advanced or Enterprise license bundle), the VDOM functionality is disabled, and the device operates in a single-VDOM (split-task) mode. This licensing requirement ensures that only authorized models and configurations can utilize VDOM isolation.

Exam trap

The trap here is that candidates often assume VDOMs are a free feature available on all models without licensing, or that VDOM count is unlimited, when in fact both a valid license and model-specific hard limits apply.

Full explanation →

736

MCQmedium

A FortiGate is receiving BGP routes from a neighbor but not advertising them to other peers. The administrator runs 'get router info bgp network' and sees the routes are in the BGP table but not advertised. What is the most likely cause?

A.BGP synchronization is enabled and the routes are not in the IGP

B.An outbound route map is applied that filters these routes

C.The next hop is unreachable

D.The router-id is the same as the peer

AnswerB

Correct. A route map can selectively permit or deny routes from being advertised.

Why this answer

An outbound route map can explicitly filter which routes are advertised to BGP peers. Even though routes are present in the BGP table (as shown by 'get router info bgp network'), an outbound route map applied to the neighbor configuration can deny or modify those routes before they are sent, preventing their advertisement.

Exam trap

The trap here is that candidates often assume BGP synchronization (Option A) is the cause, but synchronization only affects IBGP-learned routes and is disabled by default in modern implementations, whereas an outbound route map is the direct mechanism controlling advertisement to peers.

How to eliminate wrong answers

Option A is wrong because BGP synchronization (RFC 1771, deprecated in RFC 4271) is disabled by default on FortiGate and, even if enabled, would only affect routes learned from an IBGP peer—not routes being advertised to other peers; the issue here is about outbound advertisement, not IGP reachability. Option C is wrong because if the next hop were unreachable, the routes would not appear in the BGP table as valid; they would be marked as invalid or not installed, but the question states the routes are in the BGP table, implying the next hop is reachable. Option D is wrong because having the same router-id as a peer would cause BGP session establishment to fail (due to duplicate router-id detection), preventing any routes from being received or advertised at all, which contradicts the scenario where routes are already in the BGP table.

Full explanation →

737

MCQmedium

A company wants to deploy ZTNA to secure access to internal applications for remote employees. They have a FortiGate with a public IP and internal servers. Which deployment mode should they choose to minimize changes to existing firewall rules?

A.SSL VPN with ZTNA

B.IPsec VPN with ZTNA

C.Both proxy-based and IPsec VPN

D.Proxy-based ZTNA

AnswerD

Proxy-based ZTNA uses a single policy and does not require modifying existing rules.

Why this answer

Proxy-based ZTNA (Option D) is correct because it uses a forward proxy architecture that intercepts traffic at Layer 7, allowing the FortiGate to enforce ZTNA access policies without modifying existing firewall rules. The proxy terminates the client connection and initiates a new connection to the internal server, so no inbound port forwarding or firewall rule changes are needed for the internal servers.

Exam trap

The trap here is that candidates often assume any ZTNA deployment requires VPN tunnels (SSL or IPsec) and overlook the proxy-based mode, which is specifically designed to avoid firewall rule changes by operating at Layer 7 without tunnel overhead.

How to eliminate wrong answers

Option A is wrong because SSL VPN with ZTNA still requires traditional VPN tunnel termination and typically needs firewall rules to allow the VPN traffic and forward it to internal servers, which contradicts the goal of minimizing changes to existing firewall rules. Option B is wrong because IPsec VPN with ZTNA also requires tunnel configuration and firewall rules to permit IPsec traffic and route it to internal servers, adding complexity rather than minimizing rule changes. Option C is wrong because combining both proxy-based and IPsec VPN introduces unnecessary complexity and still requires firewall rule modifications for the IPsec VPN component, failing to achieve the minimal-change objective.

Full explanation →

738

MCQmedium

An administrator is deploying ZTNA for a legacy application that uses a fixed IP address and port. Which ZTNA component is responsible for securely proxying traffic from the user to the application without exposing the application's actual network location?

A.ZTNA access proxy

B.ZTNA inline CASB

C.IPsec VPN gateway

D.FortiClient EMS

AnswerA

The ZTNA access proxy sits between the user and the application, terminating the user's connection and establishing a secure connection to the application server.

Why this answer

The ZTNA proxy component acts as an intermediary, hiding the application server's IP address and providing secure access based on identity and posture.

Full explanation →

739

MCQmedium

A network engineer is configuring an HA pair of FortiGate firewalls. They want to ensure that session failover occurs for UDP-based voice traffic with minimal interruption. Which HA configuration setting is most important for achieving this goal?

A.Enable session-pickup

B.Enable session-pickup-delay

C.Set ha-pickup-delay to 0

D.Configure ha-mgmt-interfaces

AnswerA

session-pickup enables the backup unit to take over existing sessions.

Why this answer

Session-pickup is the correct setting because it enables the secondary FortiGate to synchronize UDP session state information from the primary, allowing seamless failover of voice traffic without requiring new session establishment. UDP is connectionless, so without session-pickup, the secondary would drop the traffic as unknown, causing noticeable interruption in real-time voice streams.

Exam trap

The trap here is that candidates confuse 'session-pickup-delay' or 'ha-pickup-delay' with the actual session synchronization mechanism, assuming any delay-related setting is key, when in fact the fundamental enabler is session-pickup itself.

How to eliminate wrong answers

Option B is wrong because session-pickup-delay introduces a delay before the secondary takes over sessions, which would increase interruption for UDP voice traffic, not minimize it. Option C is wrong because ha-pickup-delay controls the delay for the HA cluster to start picking up sessions after failover, not the session synchronization itself; setting it to 0 does not enable session-pickup. Option D is wrong because ha-mgmt-interfaces are used for out-of-band management access to each unit in the HA cluster and have no effect on session failover or synchronization of UDP sessions.

Full explanation →

740

MCQmedium

A FortiGate has two WAN interfaces configured as SD-WAN members. The administrator wants traffic to specific destination IP addresses to use a particular member. Which SD-WAN configuration object should be used to achieve this?

A.SD-WAN rule

B.Route map

C.Prefix list

D.Performance SLA

AnswerA

SD-WAN rules define which traffic goes to which member based on matching criteria.

Why this answer

SD-WAN rules are the correct configuration object because they allow you to define policy-based forwarding (PBF) criteria, such as source/destination IP addresses, to steer traffic to a specific SD-WAN member interface. Unlike static routes, SD-WAN rules evaluate traffic against match conditions and then apply an explicit action to use a designated member or strategy, making them the precise tool for this requirement.

Exam trap

The trap here is that candidates confuse Performance SLA with the actual traffic-steering mechanism, thinking that a Performance SLA object alone can direct traffic to a specific member, when in fact it only provides link quality data that must be referenced by an SD-WAN rule to influence path selection.

How to eliminate wrong answers

Option B is wrong because a route map is used for route redistribution and policy-based routing in traditional routing contexts, not for SD-WAN member selection; it cannot directly force traffic to a specific SD-WAN member interface. Option C is wrong because a prefix list is a filter used in route maps or BGP to match IP prefixes, not an object that defines traffic steering to an SD-WAN member. Option D is wrong because a Performance SLA is used to measure link quality (latency, jitter, packet loss) and can be referenced by SD-WAN rules, but it does not itself direct traffic to a specific member; it only provides metrics for dynamic path selection.

Full explanation →

741

Drag & Dropmedium

Drag and drop the steps to configure a FortiGate to use an external authentication server (e.g., RADIUS) for admin login into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence ensures that the RADIUS server is defined with full details before it is referenced by a user group, which is then assigned to an admin profile. Testing validates the entire chain, confirming that authentication works as expected.

Full explanation →

742

MCQmedium

A FortiGate administrator is configuring a multi-peer IPsec VPN where two remote sites connect to a central hub. The administrator wants to ensure that if one remote site loses connectivity, the other site can still reach the hub. Which configuration is essential?

A.Use the same preshared key for both remote sites

B.Configure separate phase1 interfaces for each remote site

C.Enable auto-negotiation on all phase1 interfaces

D.Configure a single phase1 interface with multiple remote IPs

AnswerB

Each remote site requires its own phase1 configuration so that they operate independently. If one fails, the other remains up.

Why this answer

In a multi-peer IPsec VPN hub-and-spoke topology, each remote site must have its own phase1 interface to maintain independent security associations (SAs). If a single phase1 interface is shared, the loss of one remote peer can disrupt the SA state for all peers, potentially breaking connectivity for the other remote site. Configuring separate phase1 interfaces ensures that each remote site's VPN tunnel operates independently, so a failure at one site does not affect the other.

Exam trap

The trap here is that candidates often confuse 'multiple remote IPs on a single phase1' (which is for dynamic or dialup VPNs) with the need for independent tunnels, leading them to choose option D, but that design shares a single IKE SA and is not fault-tolerant for multi-peer scenarios.

How to eliminate wrong answers

Option A is wrong because using the same preshared key for both remote sites does not provide any resilience; it only simplifies authentication but does not isolate the SAs, so a failure at one site can still corrupt the shared SA state. Option C is wrong because auto-negotiation is a physical-layer feature for Ethernet interfaces, not applicable to IPsec phase1 interfaces, and does not address multi-peer isolation. Option D is wrong because a single phase1 interface with multiple remote IPs (a 'dialup' or 'aggregate' configuration) shares a single SA database; if one remote peer goes down, the phase1 interface may renegotiate or fail, potentially disrupting the other peer's tunnel.

Full explanation →

743

MCQhard

A FortiGate administrator receives a report that a user downloaded a malicious PDF file. The antivirus profile has machine learning engine enabled, CDR enabled, and FortiSandbox integration. However, the file was allowed. The log shows: 'file=malicious.pdf, action=allow, ml_score=85, cd_result=clean, sandbox=not_submitted'. What is the most likely reason the file was not submitted to FortiSandbox?

A.The file size exceeded the maximum file size for FortiSandbox submission

B.CDR reconstructed the file, making it appear clean

C.The machine learning engine scored the file as clean (score below threshold)

D.The file was excluded by a file type filter in the antivirus profile

AnswerA

FortiSandbox has a configurable file size limit; files larger than that are not submitted.

Why this answer

The log shows 'sandbox=not_submitted', which directly indicates the file was never sent to FortiSandbox. FortiGate has a configurable maximum file size limit for sandbox submission (default 10 MB). If the PDF exceeds this limit, the file is allowed without sandbox inspection, even if other engines like ML or CDR are enabled.

The ml_score of 85 indicates a high malicious probability, but the sandbox submission was skipped due to size constraints.

Exam trap

The trap here is that candidates assume a high ML score (85) would automatically trigger sandbox submission, but FortiGate's sandbox submission is governed by separate size and protocol filters, not by ML score alone.

How to eliminate wrong answers

Option B is wrong because CDR (Content Disarm and Reconstruction) reconstructs the file to remove active content, but the log shows 'cd_result=clean', meaning CDR did not detect an issue; however, the file was still allowed, and CDR does not prevent sandbox submission. Option C is wrong because the ml_score of 85 is above typical thresholds (often 50-70), indicating the ML engine flagged it as malicious, not clean. Option D is wrong because a file type filter would block the file entirely (action=block), not allow it; the log shows 'action=allow', so no exclusion filter was applied.

Full explanation →

744

MCQmedium

After upgrading FortiGate firmware, an admin notices that several sessions using SIP are failing. The SIP ALG was enabled before the upgrade. What is the MOST likely cause?

A.The SIP session helper is now deprecated

B.The SIP service port changed

C.The SIP ALG configuration was reset to default, affecting session handling

D.The FortiGate's SIP inspection profile was removed

AnswerC

Upgrades can reset ALG settings, causing SIP sessions to fail.

Why this answer

Upgrading FortiGate firmware can reset the SIP ALG configuration to its default settings, which may alter session handling parameters such as timeouts, port ranges, or application-layer gateway (ALG) behavior. This default reset often causes previously working SIP sessions to fail, especially if custom SIP ALG settings were used to accommodate specific VoIP environments. The SIP ALG remains enabled after the upgrade, but its default configuration may not match the pre-upgrade customizations, leading to session failures.

Exam trap

The trap here is that candidates may assume the SIP ALG is disabled or removed after an upgrade, but the actual issue is that its configuration is reset to default, altering session handling behavior without disabling the feature itself.

How to eliminate wrong answers

Option A is wrong because the SIP session helper is not deprecated; it is a separate mechanism from the SIP ALG and remains available in FortiOS for SIP traffic handling. Option B is wrong because the SIP service port (typically UDP/TCP 5060) does not change during a firmware upgrade; SIP ALG configuration changes, not port changes, cause session failures. Option D is wrong because the SIP inspection profile is not removed during a firmware upgrade; it may be reset to default, but the profile itself persists in the configuration.

Full explanation →

745

Multi-Selectmedium

Which THREE statements are true about FortiGate SD-WAN health-check configuration?

Select 3 answers

A.Health-check probes can be sent from any interface, including loopback.

B.Health-check can only be configured on physical interfaces, not VLANs or subinterfaces.

C.Health-check can be configured with multiple thresholds for jitter, latency, and packet loss.

D.Health-check can update the routing table by setting 'update-static-route' to enable fallback.

E.Health-check can be configured to use HTTP or DNS protocols to verify link health.

AnswersC, D, E

Performance SLA thresholds can be defined for jitter, latency, and packet loss.

Why this answer

FortiGate SD-WAN health-check allows configuring multiple thresholds for jitter, latency, and packet loss. These thresholds are used to determine the quality of a link; if any threshold is exceeded, the link is considered failed. This enables granular control over link health assessment beyond simple reachability.

Exam trap

The trap here is that candidates often assume health-check can use any interface as a source (like loopback) or that it only works on physical interfaces, but FortiGate restricts probe source to the member interface and supports VLANs and aggregates.

Full explanation →

746

MCQhard

You run the following command on a FortiGate: diagnose sys session filter dport 443 diagnose sys session list Output: proto=6 proto_state=01 duration=3600 expire=3599 What does the 'proto_state=01' indicate?

A.The session is fully established and in the 'established' state

B.The session is in the 'init' state, meaning the first SYN packet has been seen but the handshake is not complete

C.The session is a UDP or ICMP session with no state tracking

D.The session is being torn down (FIN or RST received)

AnswerB

proto_state=01 indicates the session is being initiated (SYN seen).

Why this answer

In FortiGate session diagnostics, 'proto_state=01' for TCP (proto=6) indicates the session is in the 'init' state, meaning only the initial SYN packet has been observed and the three-way handshake has not yet completed. This is a transient state before the session transitions to 'established' (proto_state=02) once the final ACK of the handshake is received.

Exam trap

The trap here is that candidates often assume 'proto_state=01' means 'established' because they associate '1' with 'active' or 'open', but FortiGate uses a specific state numbering where '01' explicitly means the TCP handshake is incomplete.

How to eliminate wrong answers

Option A is wrong because 'proto_state=01' is the init state, not the established state; the established state is represented by 'proto_state=02' in FortiGate session output. Option C is wrong because UDP and ICMP sessions do not use TCP state tracking and would not show 'proto_state=01' for TCP; they typically show 'proto_state=00' or no state value. Option D is wrong because a session being torn down (FIN or RST received) would show a different state, such as 'proto_state=04' (close) or 'proto_state=05' (timewait), not '01'.

Full explanation →

747

Multi-Selectmedium

A network administrator is configuring SD-WAN on a FortiGate with three WAN links: MPLS (10 Mbps), Broadband (50 Mbps), and LTE (20 Mbps). They want to load balance traffic based on link bandwidth, with the option to manually steer critical traffic to the MPLS link. Which TWO steps must be taken to achieve this?

Select 2 answers

A.Set the SD-WAN rule strategy to 'Maximize Bandwidth' with volume algorithm for general traffic.

B.Create a separate SD-WAN rule for critical traffic with strategy 'Manual' and select MPLS as the preferred member.

C.Set the load balancing algorithm to 'Spillover' on all rules.

D.Enable ECMP on the FortiGate.

E.Configure a performance SLA for each link.

AnswersA, B

This enables bandwidth-based load balancing.

Why this answer

Setting the SD-WAN rule strategy to 'Maximize Bandwidth' with the volume algorithm distributes traffic proportionally based on link bandwidth (10:50:20 ratio), achieving load balancing. Option B is correct because creating a separate SD-WAN rule with strategy 'Manual' and selecting MPLS as the preferred member allows manual steering of critical traffic to the MPLS link, overriding the load-balancing behavior for that traffic.

Exam trap

The trap here is that candidates often confuse 'Spillover' with bandwidth-based load balancing, or assume ECMP is required for SD-WAN load balancing, when in fact FortiGate SD-WAN uses policy-based routing with its own load-balancing algorithms independent of ECMP.

Full explanation →

748

MCQhard

A large enterprise uses FortiGate as their perimeter firewall with ATP features enabled. They have a mix of internal users and remote VPN users. Recently, several remote users reported that their machines became infected with ransomware after connecting to the VPN. The IT team suspects that the ransomware entered through the VPN tunnel. The FortiGate has an antivirus profile applied to the VPN policy with SSL inspection enabled for all traffic. However, the logs show that no malware was detected. Upon investigation, the team finds that the remote users' machines are not managed by the company and do not have any endpoint protection. The ransomware was delivered via a spear-phishing email that the users opened on their remote machines. The email traffic passed through the VPN tunnel to the corporate mail server first, then back to the user. The FortiGate antivirus profile is configured to scan SMTP traffic but the email was sent from an external source to the corporate mail server, and the mail server uses STARTTLS to receive emails. The FortiGate does not perform SSL inspection on the SMTP traffic because the SMTP service is not included in the SSL inspection profile. What action should the administrator take to prevent this in the future?

A.Disable STARTTLS on the corporate mail server to force plaintext SMTP

B.Add SMTP to the SSL inspection profile to decrypt and scan email traffic

C.Require remote users to install endpoint protection with FortiClient

D.Block all SMTP traffic from remote VPN users

AnswerB

This allows the antivirus to inspect encrypted SMTP traffic and detect malware.

Why this answer

The FortiGate's antivirus profile is configured to scan SMTP traffic, but the email was encrypted via STARTTLS, and SMTP is not included in the SSL inspection profile. By adding SMTP to the SSL inspection profile, the FortiGate can decrypt the SMTP traffic, allowing the antivirus engine to inspect the email content for malware, including ransomware delivered via spear-phishing.

Exam trap

The trap here is that candidates assume the antivirus profile is sufficient because it is applied to the VPN policy and includes SMTP scanning, but they overlook that SSL inspection must be explicitly configured for the SMTP service to decrypt STARTTLS-encrypted traffic before scanning can occur.

How to eliminate wrong answers

Option A is wrong because disabling STARTTLS on the mail server would force plaintext SMTP, but this does not address the root cause—the FortiGate is already configured to scan SMTP traffic; the issue is that the traffic is encrypted and not being decrypted for inspection. Option C is wrong because requiring remote users to install FortiClient endpoint protection is a good security practice but does not solve the immediate problem of the FortiGate not inspecting encrypted SMTP traffic; the ransomware entered through the VPN tunnel and was not detected due to lack of SSL inspection on SMTP. Option D is wrong because blocking all SMTP traffic from remote VPN users would prevent legitimate email communication and is an overly restrictive measure; the goal is to inspect the traffic, not block it entirely.

Full explanation →

749

MCQeasy

You receive an alert that FortiAnalyzer log disk usage is at 95%. Which action should you take to immediately free up space without losing important logs?

A.Delete all logs older than 30 days

B.Enable log compression

C.Configure log archiving to an external storage

D.Increase log disk quota

AnswerC

Archiving moves old logs off the device.

Why this answer

Configuring log archiving to an external storage immediately offloads logs from the FortiAnalyzer local disk to a remote location (e.g., NFS, FTP, or SCP), freeing up disk space without deleting any logs. This preserves all historical log data for compliance and forensic analysis while resolving the high disk usage alert.

Exam trap

The trap here is that candidates often choose to delete logs or increase the quota, mistakenly thinking these are safe or immediate fixes, but the exam tests the understanding that archiving preserves data while freeing space, and that compression or quota changes do not provide instant relief.

How to eliminate wrong answers

Option A is wrong because deleting all logs older than 30 days permanently removes historical data, which may violate compliance requirements and loses important logs that could be needed for incident response or auditing. Option B is wrong because enabling log compression reduces the size of logs on disk but does not immediately free up space—it only affects newly stored logs and requires existing logs to be recompressed, which is not an instant fix. Option D is wrong because increasing the log disk quota does not free up existing space; it merely raises the threshold for disk usage, allowing more logs to be stored until the disk eventually fills again, which does not resolve the immediate 95% usage issue.

Full explanation →

750

MCQhard

An administrator runs the following CLI command on a FortiGate and sees the output below: diagnose vpn ike gateway list vd: root/0 name: REMOTE_GW vrf: 0 version: 2 state: UP IKE SA: created 1s ago 1.2.3.4:500->5.6.7.8:500 What is the most likely explanation for the IKE SA being created only 1 second ago?

A.The remote peer changed its IP address

B.DPD detected a dead peer and renegotiated

C.The phase 2 SA expired and triggered phase 1 rekey

D.The VPN tunnel was just configured or a configuration change was applied

AnswerD

Recent creation time indicates the SA was just negotiated, typical after applying config changes or restarting IKE.

Why this answer

The IKE SA was recently created, suggesting a previous SA was deleted and a new one established. This often happens after configuration changes or a restart of IKE negotiation.

Full explanation →

Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 676–750