Courseiva

Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 751825

940 questions total · 13pages · All types, answers revealed

Page 10

Page 11 of 13

Page 12
751
MCQeasy

Which FortiGate security feature can reconstruct files to remove potentially malicious content while preserving the file's usability?

A.Antivirus outbreak prevention
B.Content Disarm and Reconstruction
C.FortiSandbox
D.IPS application control
AnswerB

CDR disinfects files by removing active content and rebuilding them.

Why this answer

Content Disarm and Reconstruction (CDR) is the correct answer because it actively removes potentially malicious content—such as macros, scripts, or embedded objects—from files (e.g., Office documents, PDFs) and then reconstructs a clean, usable version. Unlike detection-based approaches, CDR eliminates threats by sanitizing the file structure itself, ensuring the file remains functional for the end user while blocking exploits.

Exam trap

The trap here is that candidates often confuse FortiSandbox's detection capabilities with CDR's proactive sanitization, mistakenly thinking sandboxing can reconstruct files when it only analyzes and blocks them.

How to eliminate wrong answers

Option A is wrong because Antivirus outbreak prevention relies on signature-based detection and blocking of known malware patterns, not on file reconstruction or sanitization. Option C is wrong because FortiSandbox uses behavioral analysis and sandboxing to detect unknown threats, but it does not reconstruct files to remove malicious content; it only provides verdicts and can block or quarantine files. Option D is wrong because IPS application control focuses on detecting and preventing network-level attacks and application misuse, not on file-level content sanitization or reconstruction.

752
MCQeasy

A network engineer is deploying a FortiGate in transparent mode at a branch office. The goal is to insert the firewall without changing the existing IP subnet scheme. Which statement about transparent mode is TRUE?

A.The FortiGate must have a unique IP subnet for each interface
B.Transparent mode supports all routing protocols like OSPF and BGP
C.NAT is required for traffic to pass through the FortiGate
D.The FortiGate acts as a Layer 2 bridge and forwards traffic based on MAC addresses
AnswerD

This is the definition of transparent mode. It operates at Layer 2.

Why this answer

In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without modifying the IP subnet scheme. This allows the firewall to be inserted into an existing network segment without requiring IP reconfiguration of connected devices.

Exam trap

The trap here is that candidates often confuse transparent mode with routed mode, assuming that IP addressing or routing protocols are required, when in fact transparent mode operates purely at Layer 2.

How to eliminate wrong answers

Option A is wrong because in transparent mode, all interfaces share the same IP subnet (the management IP is assigned to the bridge, not per interface). Option B is wrong because transparent mode does not support routing protocols like OSPF or BGP; it operates at Layer 2 and forwards traffic based on MAC addresses, not IP routing tables. Option C is wrong because NAT is not required; traffic passes through the FortiGate as a transparent bridge, and NAT is typically used in routed (Layer 3) modes.

753
Multi-Selecthard

An administrator is configuring automation stitches to respond to a detected ransomware outbreak. Which THREE components are essential for an automation stitch?

Select 3 answers
A.Schedule
B.Condition
C.Log device
D.Action
E.Trigger
AnswersB, D, E

Conditions refine when the action should be taken.

Why this answer

In Fortinet's NSE7 context, an automation stitch requires three essential components: a Trigger (which initiates the stitch), a Condition (which filters or qualifies the trigger), and an Action (which executes the response). The Condition is correct because it allows the stitch to evaluate specific criteria—such as a ransomware detection event—before proceeding to the Action, ensuring precise and efficient automated responses.

Exam trap

The trap here is that candidates often confuse 'Schedule' as a required component because they think automation must be time-based, but Fortinet's automation stitches are event-driven, and the Schedule is only an optional trigger type, not a core structural element.

754
MCQhard

An administrator is configuring FortiClient EMS to enforce compliance for remote users. The requirement is that all remote devices must have disk encryption enabled. The administrator has created a compliance rule in EMS that checks for 'Full Disk Encryption' and set the action to 'Block'. However, users with unencrypted drives are still able to connect to the VPN. What is the most likely missing configuration?

A.The FortiClient telemetry is not sending compliance status
B.The compliance rule is not enabled on the FortiGate via ZTNA tag
C.The VPN policy on the FortiGate does not require compliance check
D.The compliance rule is not assigned to a FortiClient configuration profile
AnswerD

In EMS, compliance rules must be part of a configuration profile that is assigned to endpoints. Without assignment, the rule is not enforced.

Why this answer

In FortiClient EMS, compliance rules are enforced only when they are added to a configuration profile that is assigned to endpoints. The rule itself is just a definition; it must be included in a profile that is deployed to clients. Without being assigned to a profile, the rule is not applied, so unencrypted devices are not blocked.

Option D correctly identifies this missing step.

755
Multi-Selecteasy

An administrator is configuring FortiMail to be more secure against advanced email threats. Which THREE features should they enable to protect against email-based phishing attacks?

Select 3 answers
A.DKIM signing/verification
B.CDR (Content Disarm and Reconstruction)
C.FortiSandbox inline scanning
D.SPF verification
E.DMARC policy enforcement
AnswersA, D, E

DKIM verifies message integrity and sender domain.

Why this answer

DKIM (DomainKeys Identified Mail) signing and verification allow the receiving mail server to cryptographically verify that an email was not tampered with during transit and that it originated from an authorized domain. This prevents attackers from spoofing the sender domain in phishing emails, as the DKIM signature will fail validation if the message body or headers are altered.

Exam trap

The trap here is that candidates often confuse features that block malicious content (like CDR or sandboxing) with those that verify sender authenticity (like DKIM, SPF, and DMARC), leading them to select options that address malware rather than the specific threat of email-based phishing via domain spoofing.

756
Multi-Selectmedium

An administrator is configuring SD-WAN with two members: MPLS and Broadband. The requirement is that voice traffic (UDP ports 16384-32768) should use MPLS primarily, and if MPLS fails SLA, then use Broadband. Which two configurations are needed? (Choose TWO.)

Select 2 answers
A.Disable the Broadband member from the SD-WAN zone
B.Configure a performance SLA for the MPLS member
C.Create an SD-WAN rule that matches voice traffic and uses 'best quality' strategy
D.Configure policy-based routing for voice traffic
E.Set the load balancing algorithm to 'sessions'
AnswersB, C

Required to monitor link quality.

Why this answer

A performance SLA must be configured on the MPLS member to monitor its link quality (e.g., latency, jitter, packet loss). If the SLA fails, the SD-WAN rule can then trigger a failover to the Broadband member. Option C is correct because an SD-WAN rule matching voice traffic with the 'best quality' strategy ensures that the traffic uses the highest-quality link (MPLS) as long as its SLA is met, automatically switching to Broadband when MPLS fails SLA.

Exam trap

The trap here is that candidates often confuse SD-WAN rules with policy-based routing or assume that disabling a member is needed to force traffic to MPLS, but SD-WAN rules with SLA monitoring are the correct mechanism for primary/backup failover without manual intervention.

757
MCQhard

An administrator configures OSPF on a FortiGate with multiple areas. After configuration, the FortiGate does not become an ABR. What is the most likely reason?

A.The router-id is not configured
B.The OSPF process is not enabled
C.The network type is set to point-to-point
D.There is no interface assigned to area 0
AnswerD

An ABR must have at least one interface in area 0 and one in another area.

Why this answer

For a FortiGate to function as an OSPF Area Border Router (ABR), it must have at least one interface assigned to the backbone area (area 0) and at least one interface assigned to a non-backbone area. Without an interface in area 0, the FortiGate cannot generate Type 3 summary LSAs or perform inter-area routing, so it remains an internal router. Option D is correct because the absence of an interface in area 0 is the most direct and common reason for a FortiGate not becoming an ABR.

Exam trap

The trap here is that candidates often assume ABR status is tied to router-id configuration or OSPF process enablement, but the critical requirement is the presence of an interface in area 0, which is a fundamental OSPF design rule that is frequently overlooked.

How to eliminate wrong answers

Option A is wrong because the router-id is used for OSPF router identification and DR/BDR election, but it does not determine ABR status; a router can become an ABR without a manually configured router-id (it will use the highest loopback or physical interface IP). Option B is wrong because if the OSPF process were not enabled, the FortiGate would not participate in OSPF at all, not simply fail to become an ABR; the question implies OSPF is configured but ABR status is missing. Option C is wrong because setting the network type to point-to-point affects neighbor adjacency behavior and LSA flooding, but it does not prevent a router from becoming an ABR as long as it has interfaces in both area 0 and another area.

758
MCQeasy

Which load balancing algorithm in SD-WAN sends new sessions to the member interface with the least number of active sessions?

A.Sessions
B.Volume
C.Spillover
D.Source-dest IP
AnswerA

Sessions algorithm sends to the interface with the fewest active sessions.

Why this answer

The Sessions algorithm in Fortinet SD-WAN selects the member interface with the fewest active sessions when a new session is initiated. This is the default load-balancing method and ensures even distribution of session counts across WAN links, preventing any single interface from becoming overloaded with connections.

Exam trap

The trap here is that candidates often confuse 'Sessions' with 'Volume' because both involve load distribution, but Sessions focuses on connection count while Volume focuses on data throughput, and Fortinet explicitly tests this distinction in the SD-WAN configuration context.

How to eliminate wrong answers

Option B (Volume) is wrong because it distributes traffic based on the total bytes transferred through each interface, not the number of active sessions. Option C (Spillover) is wrong because it is not a load-balancing algorithm; it is a failover mechanism that sends traffic to a backup interface only when the primary interface exceeds a configured bandwidth threshold. Option D (Source-dest IP) is wrong because it uses a hash of source and destination IP addresses to consistently map sessions to the same interface, which does not consider the current number of active sessions.

759
MCQeasy

An administrator wants to verify that a BGP route is being advertised to a neighbor. Which command displays the routes that FortiGate is advertising to a specific BGP neighbor?

A.get router info bgp network
B.get router info bgp neighbor <ip> advertised-routes
C.diagnose ip router bgp routes
D.show ip bgp summary
AnswerB

Correct command.

Why this answer

The command 'get router info bgp neighbor <ip> advertised-routes' is the specific FortiOS CLI command that displays the BGP routes that the FortiGate has advertised to a particular BGP neighbor. This command queries the BGP table for routes that have been sent to the neighbor and are in the Adj-RIB-Out, which is exactly what the administrator needs to verify outbound route advertisement.

Exam trap

The trap here is that candidates often confuse the FortiOS 'get router info bgp neighbor <ip> advertised-routes' command with Cisco's 'show ip bgp neighbors <ip> advertised-routes' or mistakenly use a generic 'show ip bgp summary' command, which only shows neighbor state and not the actual advertised routes.

How to eliminate wrong answers

Option A is wrong because 'get router info bgp network' is not a valid FortiOS command; the correct command to view BGP network statements is 'get router info bgp network' but it shows locally originated networks configured under BGP, not routes advertised to a specific neighbor. Option C is wrong because 'diagnose ip router bgp routes' is not a valid FortiOS command; the 'diagnose' commands are used for debugging and diagnostics, not for displaying BGP advertised routes. Option D is wrong because 'show ip bgp summary' is a Cisco IOS command, not a FortiOS command; the FortiOS equivalent is 'get router info bgp summary', which shows BGP neighbor states and statistics but not advertised routes.

760
MCQmedium

A network administrator has configured an IPsec VPN between two FortiGates using IKEv2 with pre-shared keys. The tunnel establishes successfully, but after a few minutes, traffic stops passing through. The administrator runs 'diagnose vpn ike log' and sees 'DPD timeout' messages. What is the most likely cause of this issue?

A.The remote FortiGate is behind a NAT device without proper NAT-T configuration
B.The IPsec phase2 proposal is mismatched, causing rekey failures
C.The IKE SA lifetime is set too long, causing the tunnel to expire
D.The local FortiGate's DPD interval is set too low, causing false positives
AnswerA

NAT-T is required when one peer is behind NAT. Without it, DPD packets may be dropped, causing the tunnel to be considered dead.

Why this answer

DPD timeout indicates that the remote peer is not responding to Dead Peer Detection probes. The most common cause is a misconfigured firewall on the path dropping UDP 500 or 4500 packets, or NAT keepalive issues if NAT is involved. Option A is correct because if the remote FortiGate is behind a NAT device without proper NAT-T configuration, the DPD packets may be dropped or not reach the peer, causing the timeout.

761
MCQeasy

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per interface?

A.Sessions
B.Volume
C.Source-destination IP
D.Spillover
AnswerA

Sessions algorithm distributes based on number of sessions per interface.

Why this answer

The Sessions algorithm in Fortinet SD-WAN distributes new sessions by selecting the interface with the fewest currently active sessions. This ensures balanced session distribution across WAN links, preventing any single interface from becoming overloaded with connections while others remain underutilized.

Exam trap

The trap here is that candidates often confuse 'Sessions' with 'Volume' because both involve traffic distribution, but Volume measures bytes while Sessions measures connection counts, and the exam expects you to distinguish between these two distinct load-balancing metrics.

How to eliminate wrong answers

Option B is wrong because Volume distributes traffic based on the total bytes transferred per interface, not the number of active sessions. Option C is wrong because Source-destination IP uses a hash of source and destination IP addresses to consistently route traffic from the same flow to the same interface, ignoring session counts. Option D is wrong because Spillover forwards traffic to a preferred interface until its bandwidth or session threshold is exceeded, then spills over to a backup interface, rather than balancing based on active session counts.

762
MCQhard

An administrator configures Multi-Peer VPN (MPVPN) on a FortiGate aggregator. The aggregator has two phase1 configurations for the same remote subnet but different peers. The aggregator's routing table shows both peers as next hops. The administrator notices that traffic between the aggregator and the remote subnet is load-balanced across both peers. What is the cause?

A.The MPVPN feature automatically load-balances traffic across all active peers.
B.The phase1 configurations have the same proposal settings, causing implicit load balancing.
C.The aggregator has two static routes with equal cost to the remote subnet.
D.The remote peers are both advertising the same subnet via BGP with equal metrics.
AnswerC

Why this answer

The administrator configured two static routes with equal administrative distance and cost to the remote subnet, each pointing to a different peer. This causes ECMP (Equal-Cost Multi-Path) routing, which load-balances traffic across both peers. MPVPN itself does not automatically load-balance; it relies on the underlying routing table to determine next-hop selection.

Exam trap

The trap here is that candidates confuse the MPVPN feature's ability to manage multiple peers with automatic load balancing, when in fact load balancing is a routing-layer function that must be explicitly configured via ECMP static or dynamic routes.

How to eliminate wrong answers

Option A is wrong because MPVPN does not automatically load-balance traffic across all active peers; it requires explicit routing configuration (e.g., ECMP static routes or dynamic routing with equal metrics) to achieve load balancing. Option B is wrong because identical phase1 proposal settings do not cause implicit load balancing; phase1 parameters only affect IKE negotiation and tunnel establishment, not traffic distribution. Option D is wrong because the scenario does not mention BGP; the routing table shows both peers as next hops, which is consistent with static routes, not BGP advertisements with equal metrics.

763
MCQmedium

A network administrator notices that several endpoints are infected with ransomware despite having FortiGate ATP enabled. The logs show that the files were downloaded over HTTPS, and the antivirus profile did not detect them. What is the most likely reason?

A.SSL inspection was not enabled on the antivirus profile
B.Application control profile blocked the download
C.FortiSandbox was not configured to analyze the files
D.IPS signature database was outdated
AnswerA

Without SSL inspection, encrypted traffic bypasses antivirus scanning.

Why this answer

FortiGate ATP's antivirus engine cannot inspect encrypted HTTPS traffic unless SSL inspection is explicitly enabled on the antivirus profile. Without SSL inspection, the antivirus profile only sees encrypted payloads and cannot match file signatures or heuristics, allowing ransomware to pass undetected. The logs confirm files were downloaded over HTTPS, making this the most likely root cause.

Exam trap

The trap here is that candidates assume FortiGate's antivirus can automatically inspect HTTPS traffic because it is part of the ATP suite, but FortiGate requires explicit SSL inspection configuration to decrypt and scan encrypted downloads.

How to eliminate wrong answers

Option B is wrong because an application control profile blocks applications or categories, not files; it would not prevent the download of a ransomware file over HTTPS unless the application itself (e.g., a specific browser) was blocked, which is unrelated to the antivirus detection failure. Option C is wrong because FortiSandbox is an additional analysis layer that can detect unknown threats, but the primary reason the file was not detected is that the antivirus profile never saw the decrypted content; even if FortiSandbox were configured, it would not receive the file for analysis without SSL inspection. Option D is wrong because an outdated IPS signature database affects intrusion prevention, not antivirus file scanning; IPS signatures are for network-level attacks, not for detecting malware in downloaded files, and the antivirus engine uses its own signature database.

764
MCQmedium

A FortiGate administrator wants to integrate FortiClient EMS to enforce compliance before granting VPN access. The FortiGate is the SSL VPN gateway. Which configuration is required on the FortiGate to use FortiClient's posture check?

A.Add the FortiClient EMS server as a telemetry source and create a ZTNA tag based on posture data.
B.Configure the FortiGate as a SAML IdP for FortiClient EMS.
C.Configure FortiClient EMS as a user group server and assign it to the SSL VPN portal.
D.Enable 'compliance check' under SSL VPN settings and specify the EMS IP address.
AnswerA

Why this answer

FortiClient EMS sends posture data to FortiGate via telemetry. The admin must define ZTNA tags for conditions (e.g., antivirus running) and use those tags in firewall policies or SSL VPN permissions. There is no direct 'compliance check' setting in SSL VPN; it's done via ZTNA.

765
MCQhard

Two FortiGate units in an HA cluster are experiencing synchronization issues. The administrator runs 'diagnose sys ha checksum cluster' and sees different checksum values for the 'system' and 'router' objects. What is the FIRST step to resolve the mismatch?

A.Execute 'execute ha synchronize start' from the primary unit
B.Upgrade the firmware on both units to the same version
C.Reboot both units to force a full sync
D.Disable and re-enable HA on both units
AnswerA

This command forces configuration synchronization from primary to secondary.

Why this answer

The 'diagnose sys ha checksum cluster' command reveals checksum mismatches for 'system' and 'router' objects, indicating that the HA cluster's configuration synchronization is incomplete or out of sync. The first step is to initiate a manual synchronization using 'execute ha synchronize start' from the primary unit, which forces the primary to push its full configuration database to the secondary unit, resolving the mismatch without disrupting services. This command is designed to trigger a full sync of all configuration objects, including system and router settings, without requiring a reboot or HA restart.

Exam trap

The trap here is that candidates often assume a checksum mismatch requires a disruptive action like a reboot or HA restart, when in fact FortiGate provides a non-disruptive manual sync command that is the correct first step in the troubleshooting process.

How to eliminate wrong answers

Option B is wrong because upgrading firmware to the same version is a prerequisite for HA formation, not a troubleshooting step for a checksum mismatch that occurs after HA is already established; the units must already be on the same firmware version to form the cluster. Option C is wrong because rebooting both units would cause a service outage and does not directly address the synchronization issue; while a reboot might trigger a sync, it is an unnecessarily disruptive first step compared to the targeted sync command. Option D is wrong because disabling and re-enabling HA on both units would tear down and rebuild the cluster, causing a full HA election and potential traffic disruption, which is excessive when a simple manual sync can resolve the checksum mismatch.

766
MCQmedium

An administrator is configuring a FortiGate in transparent mode for a data center segment. Which of the following is true about transparent mode operation in an enterprise environment?

A.The FortiGate requires an IP address on each interface to route between VLANs
B.Transparent mode operates at Layer 2, so no IP configuration is needed on the FortiGate interfaces
C.Transparent mode is only available on specific hardware models
D.Transparent mode supports NAT and VPN termination
AnswerB

The FortiGate acts as a transparent bridge; interfaces have no IP addresses.

Why this answer

In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. This means the FortiGate interfaces do not require IP addresses for traffic forwarding; a management IP is configured on a VLAN interface or the root VDOM for administrative access only. Option B correctly identifies that transparent mode functions at Layer 2, so no IP configuration is needed on the physical interfaces for data plane operation.

Exam trap

The trap here is that candidates assume a firewall always needs IP addresses on its interfaces to function, but in transparent mode the FortiGate acts as a bump-in-the-wire at Layer 2, requiring only a management IP for administrative access, not for traffic forwarding.

How to eliminate wrong answers

Option A is wrong because in transparent mode, the FortiGate does not route between VLANs; it bridges traffic at Layer 2, and inter-VLAN routing would require a Layer 3 device upstream or a separate VDOM in NAT/route mode. Option C is wrong because transparent mode is available on all FortiGate models that support the current FortiOS version, not limited to specific hardware. Option D is wrong because transparent mode does not support NAT or VPN termination; these features require the FortiGate to operate in NAT/route mode (Layer 3) with IP routing enabled.

767
MCQmedium

A network administrator notices that FortiGate is not blocking a known malicious file that was submitted to FortiSandbox and received a 'malicious' verdict. The firewall policy includes a FortiSandbox inline scan profile. What is the MOST likely cause?

A.The antivirus signature database is outdated
B.The FortiSandbox license has expired
C.The FortiSandbox is not configured as an inline scanner in the antivirus profile
D.The file is larger than the maximum file size allowed for scanning
AnswerC

Inline scanning requires configuration in the antivirus profile to forward files to FortiSandbox for real-time analysis and enforce blocking based on verdict.

Why this answer

The FortiGate uses an antivirus profile to define how files are scanned, including whether to send files to FortiSandbox for inline analysis. Even if the firewall policy references a FortiSandbox inline scan profile, the antivirus profile must have the 'FortiSandbox inline scan' option enabled to actually forward files to the FortiSandbox appliance. Without this setting, the FortiGate will not submit files for sandboxing, so a malicious verdict from FortiSandbox is never applied to the traffic.

Exam trap

The trap here is that candidates confuse the firewall policy's 'FortiSandbox inline scan profile' with the antivirus profile's inline scan setting, assuming that referencing a sandbox profile in the policy is sufficient to enable file submission, when in fact the antivirus profile must also have the inline scan option explicitly enabled.

How to eliminate wrong answers

Option A is wrong because an outdated antivirus signature database would affect signature-based detection, but the question states the file was submitted to FortiSandbox and received a 'malicious' verdict, indicating the sandbox analysis worked; the issue is that the verdict is not being enforced, not that signatures are missing. Option B is wrong because an expired FortiSandbox license would prevent the FortiSandbox from processing files or returning verdicts, but the scenario says the file received a malicious verdict, meaning the sandbox is operational and licensed. Option D is wrong because if the file were larger than the maximum file size allowed for scanning, the FortiGate would typically skip scanning or pass the file without sandboxing, but the question states the file was submitted to FortiSandbox and received a verdict, so size is not the blocking factor.

768
MCQhard

A security analyst is investigating a phishing email that bypassed email security. The email's headers show SPF=pass, DKIM=pass, but DMARC=quarantine. The email was delivered to the inbox. What is the most likely reason DMARC did not block or quarantine the email?

A.The email was sent from a subdomain not covered by DMARC
B.The SPF and DKIM alignment checks passed, so DMARC treated the email as authentic
C.The DMARC record had a pct (percentage) of less than 100
D.The DMARC policy was set to 'none'
AnswerB

DMARC uses alignment of SPF and DKIM. If both pass, DMARC passes, and the policy (quarantine) is not triggered.

Why this answer

DMARC uses SPF and DKIM alignment to determine authenticity. When both SPF and DKIM pass and are aligned (i.e., the domain in the From header matches the domain used in SPF/DKIM), DMARC considers the email authentic and applies the policy accordingly. In this case, the DMARC policy was set to 'quarantine', but because alignment checks passed, DMARC treated the email as legitimate and allowed delivery to the inbox, rather than quarantining it.

Exam trap

Fortinet often tests the misconception that a DMARC policy of 'quarantine' or 'reject' will always block or quarantine emails that fail SPF or DKIM, but the trap here is that DMARC only applies its policy when both SPF and DKIM fail alignment; if either passes alignment, DMARC considers the email authentic and does not enforce the policy.

How to eliminate wrong answers

Option A is wrong because if the email was sent from a subdomain not covered by DMARC, DMARC would not apply at all, and the email would be subject to the parent domain's policy only if the subdomain is explicitly included; however, the question states DMARC=quarantine, indicating DMARC did apply. Option C is wrong because a pct value less than 100 would only reduce the percentage of emails subject to the DMARC policy, but the email still passed alignment, so DMARC would not quarantine it regardless of the pct setting. Option D is wrong because if the DMARC policy was set to 'none', DMARC would not quarantine or reject the email, but the header shows DMARC=quarantine, meaning the policy was indeed set to quarantine, yet the email was delivered because alignment passed.

769
MCQeasy

What is the primary function of FortiDeceptor in a network security architecture?

A.To provide network access control for endpoints
B.To aggregate logs from multiple security devices
C.To lure attackers into interacting with decoys and generate alerts
D.To detect and block malware at the endpoint
AnswerC

FortiDeceptor uses decoys to detect lateral movement.

Why this answer

FortiDeceptor is a deception-based threat detection solution that deploys decoys (fake assets) across the network to lure attackers. When an attacker interacts with a decoy, FortiDeceptor generates a high-fidelity alert, enabling early detection of lateral movement or reconnaissance without relying on signatures.

Exam trap

The trap here is that candidates confuse FortiDeceptor's deception-based detection with endpoint protection or log aggregation, but the exam specifically tests that its primary function is to lure attackers into interacting with decoys and generate alerts.

How to eliminate wrong answers

Option A is wrong because network access control for endpoints is the function of FortiNAC, not FortiDeceptor, which focuses on deception rather than admission control. Option B is wrong because log aggregation from multiple security devices is the role of FortiAnalyzer or a SIEM, not FortiDeceptor, which generates its own alerts from decoy interactions. Option D is wrong because detecting and blocking malware at the endpoint is the domain of FortiEDR or endpoint security solutions, whereas FortiDeceptor does not execute or block code on endpoints.

770
MCQmedium

An administrator is configuring a FortiGate as a SAML Identity Provider (IdP) for a third-party service provider. Which of the following is REQUIRED for the FortiGate IdP configuration?

A.The SP's metadata must be imported as a firewall address
B.User accounts must be synchronized with an LDAP server
C.A certificate for signing SAML assertions
D.A pre-shared key between FortiGate and the SP
AnswerC

The IdP must have a certificate to sign SAML responses. This certificate is trusted by the SP.

Why this answer

When FortiGate acts as a SAML IdP, it must sign SAML assertions to prove their authenticity to the SP. A certificate is required for this signing, as the SP will validate the assertion using the IdP's public key. Without a signing certificate, the SAML response cannot be cryptographically verified, breaking the trust model defined in the SAML 2.0 specification.

Exam trap

The trap here is that candidates confuse SAML's asymmetric signing requirement with symmetric pre-shared keys used in VPNs, or assume that external user synchronization is mandatory, when in fact local users or other identity stores suffice.

How to eliminate wrong answers

Option A is wrong because SP metadata is imported as a SAML service provider object, not as a firewall address; firewall addresses are used for network policies, not SAML identity federation. Option B is wrong because user accounts can be defined locally on the FortiGate or via other identity sources such as RADIUS or FSSO; LDAP synchronization is not mandatory for SAML IdP operation. Option D is wrong because SAML uses asymmetric cryptography (X.509 certificates) for signing and optionally encryption, not a pre-shared key; a PSK is used in protocols like IPsec or IKE, not in SAML.

771
Multi-Selectmedium

An organization wants to implement email authentication to prevent spoofing. Which TWO standards should they configure? (Choose two.)

Select 2 answers
A.SPF
B.DMARC
C.TLS
D.STARTTLS
E.DKIM
AnswersA, E

SPF specifies which servers are authorized to send email.

Why this answer

SPF (Sender Policy Framework) is correct because it allows the domain owner to publish a list of authorized sending IP addresses in a DNS TXT record, enabling receiving mail servers to verify that the email originated from an approved source. DKIM (DomainKeys Identified Mail) is correct because it adds a digital signature to email headers, which the receiving server validates against a public key published in DNS, ensuring the message was not tampered with and truly came from the claimed domain. Together, SPF and DKIM form the foundational layers of email authentication that DMARC builds upon.

Exam trap

Fortinet often tests the distinction between authentication standards (SPF, DKIM) and transport security protocols (TLS, STARTTLS), leading candidates to mistakenly select TLS or STARTTLS as anti-spoofing measures when they only provide encryption, not sender verification.

772
Multi-Selecthard

A FortiGate has two VDOMs: VDOM-A and VDOM-B. The administrator wants VDOM-A to have administrative access to VDOM-B for troubleshooting. The administrator configures a management VDOM. Which THREE steps are required to allow administrative access from VDOM-A to VDOM-B? (Choose three.)

Select 3 answers
A.Designate VDOM-A as the management VDOM
B.Enable 'inter-vdom-routing' globally
C.Configure static routes on the management VDOM to reach VDOM-B's management network
D.Create a firewall policy on VDOM-B allowing administrative access from VDOM-A's management IP
E.Disable 'admin-sport' to allow HTTP access
AnswersA, C, D

Management VDOM provides central administrative access to other VDOMs.

Why this answer

Designating VDOM-A as the management VDOM is the first required step because it establishes VDOM-A as the administrative container that can access other VDOMs. In FortiOS, a management VDOM is a special VDOM that has visibility and control over other VDOMs for management purposes. Without this designation, VDOM-A would not have the inherent privilege to initiate administrative sessions into VDOM-B.

Exam trap

The trap here is that candidates often confuse inter-VDOM routing (for data traffic) with the management VDOM feature (for administrative access), leading them to incorrectly select Option B as a required step.

773
Multi-Selectmedium

An administrator needs to integrate a FortiSwitch with a FortiGate for LAN edge management. The FortiSwitch will be used to provide access ports for end users. Which THREE configuration steps are required on the FortiGate?

Select 3 answers
A.Create a port profile that defines VLAN and security settings for the access ports
B.Configure a DHCP server on the FortiGate to assign IP addresses to FortiSwitch management
C.Enable STP on the FortiGate interface
D.Enable CAPWAP on the FortiGate interface connected to the FortiSwitch
E.Authorize the FortiSwitch in the FortiGate's managed switch list
AnswersA, D, E

Port profiles are used to configure the switch ports from the FortiGate.

Why this answer

A port profile on the FortiGate defines the VLAN membership, allowed VLANs, and security policies (e.g., 802.1X, MAC authentication bypass) that are pushed to the FortiSwitch for its access ports. This is the primary mechanism for centrally managing access port configuration in a FortiSwitch deployment.

Exam trap

The trap here is that candidates often confuse the DHCP server requirement with the need for IP address assignment, but the FortiSwitch can use an existing DHCP server or static IP, making option B unnecessary and incorrect.

774
Multi-Selecthard

A FortiGate administrator wants to generate customized reports in FortiAnalyzer for different departments. The administrator needs to ensure that each department can only see its own logs. Which TWO configurations are necessary?

Select 2 answers
A.Configure meta fields on FortiGate objects
B.Create separate ADOMs for each department
C.Use dataset filters in FortiView reports to restrict data per device group
D.Enable per-device logging on FortiGate
E.Assign each administrator the 'super_admin' profile
AnswersB, C

ADOMs isolate logs and reports per department.

Why this answer

ADOMs (Administrative Domains) in FortiAnalyzer provide administrative isolation, allowing each department to have its own segregated management domain. This ensures that administrators assigned to a specific ADOM can only view and generate reports from logs belonging to that ADOM, enforcing strict data separation.

Exam trap

The trap here is that candidates often confuse data filtering (e.g., datasets or FortiView filters) with administrative access control, mistakenly believing that filters alone can prevent a user from seeing other departments' logs, whereas filters only hide data from view but do not enforce security boundaries.

775
Multi-Selecthard

An administrator configures ZTNA with FortiClient EMS. The goal is to restrict access to an internal application based on device posture. The administrator configures a ZTNA tag for 'Compliant' that checks antivirus and OS patch status. Which TWO additional steps are required on the FortiGate to enforce access based on this tag?

Select 2 answers
A.Enable SSL deep inspection on the firewall policy
B.Create a ZTNA policy that includes the 'Compliant' tag as a required condition
C.Create a ZTNA access proxy for the internal application
D.Import the FortiClient EMS certificate to FortiGate
E.Configure a firewall policy with source set to the EMS connector
AnswersB, C

The ZTNA policy defines which tags are required for access.

Why this answer

To use ZTNA tags, the administrator must configure a ZTNA access proxy to publish the application and a ZTNA policy that references the tag to grant access.

776
MCQmedium

A FortiGate VPN administrator is configuring IKEv2 with certificate-based authentication using a PKI. The administrator has imported the CA certificate and the local certificate onto the FortiGate. When initiating the VPN, the tunnel fails to establish. The CLI log shows 'IKEv2 authentication failed' and 'certificate validation failure'. What is the most likely missing configuration?

A.The IKEv2 proposal includes an incompatible encryption algorithm
B.The local certificate is not associated with the phase1 interface
C.The remote peer's certificate is not signed by the imported CA
D.The CA certificate is not configured for peer certificate validation
AnswerD

The phase1 must include a reference to the CA certificate (via 'set ca-cert' or 'set certificate-peer') to validate the peer's certificate. Without this, the FortiGate does not know which CA to trust.

Why this answer

For certificate-based authentication, the FortiGate must be configured to verify the peer's certificate against the trusted CA. Option D is correct because the peer's certificate must be validated, and if the CA certificate is not properly referenced in the phase1 configuration (e.g., 'set certificate-peers' or 'set enforcesecrets'), validation fails.

777
MCQeasy

An administrator wants to use SAML SSO with FortiGate as the Service Provider (SP) to allow users to authenticate via an external IdP. What must be configured first on the FortiGate to establish the SAML trust?

A.A firewall policy to allow SAML traffic
B.A RADIUS server for user authentication
C.An LDAP server for group membership lookup
D.A certificate for SAML signing and encryption
AnswerD

The FortiGate must have a certificate to sign SAML messages; this certificate's public key is shared with the IdP to verify signatures.

Why this answer

SAML SSO requires the FortiGate to have a certificate that the IdP trusts for signing assertions. Option D is correct because the FortiGate needs to import a CA-signed certificate (or use a self-signed) to sign SAML requests and also to establish the trust relationship with the IdP.

778
MCQhard

You deploy a FortiGate in transparent mode for a retail branch. The upstream router's ARP table shows the FortiGate's management IP, but end users cannot reach the internet. The FortiGate's management IP is on the same subnet as the users. What should you verify first?

A.The upstream router is forwarding traffic to the FortiGate's management MAC
B.The firewall policy allows traffic from internal to external
C.The FortiGate's routing table has a default route
D.The FortiGate's management interface is in the same VDOM as user traffic
AnswerB

Transparent mode firewalling still requires policies. If no policy permits the traffic, it will be denied by default.

Why this answer

In transparent mode, the FortiGate acts as a Layer 2 bridge and does not require a routing table for user traffic; forwarding decisions are based on firewall policies. Since the management IP is on the same subnet as users, the upstream router can ARP for it, but user traffic must be explicitly allowed by a firewall policy from the internal to external zone. Without such a policy, packets are dropped even if Layer 2 connectivity exists.

Exam trap

The trap here is that candidates assume transparent mode operates like a simple switch or bridge without policy enforcement, overlooking that FortiGate still requires explicit firewall policies to forward traffic even in Layer 2 mode.

How to eliminate wrong answers

Option A is wrong because the upstream router's ARP table already shows the FortiGate's management IP, indicating it has resolved the MAC; the issue is not ARP resolution but policy enforcement. Option C is wrong because in transparent mode, the FortiGate does not route traffic based on its own routing table; user traffic is bridged and subject to firewall policies, not IP routing. Option D is wrong because the management interface is implicitly in the same VDOM as user traffic in transparent mode (management IP shares the subnet), and VDOM separation is not the cause of the connectivity failure.

779
MCQhard

A FortiGate has ECMP configured with two equal-cost routes to a destination. The administrator wants to ensure that all packets from a given source IP use the same next-hop. Which ECMP load balancing method should be configured?

A.Source IP
B.Destination IP
C.Source-destination IP
D.Round robin
AnswerA

Source IP hash ensures all traffic from the same source uses the same path, regardless of destination.

Why this answer

Source IP-based ECMP load balancing uses the source IP address to select the next-hop for all packets in a flow. This ensures that packets from a given source IP always take the same path, maintaining session consistency without requiring stateful inspection.

Exam trap

The trap here is that candidates often confuse 'source IP' with 'source-destination IP' or 'round robin', mistakenly thinking that more hash inputs or per-packet distribution provides better load balancing, but the question specifically requires per-source-IP stickiness, which only source IP-based hashing guarantees.

How to eliminate wrong answers

Option B (Destination IP) is wrong because it uses only the destination IP for hash calculation, which would not guarantee that packets from the same source IP use the same next-hop if the destination varies. Option C (Source-destination IP) is wrong because it hashes both source and destination IPs together, which could still cause different flows from the same source IP to different destinations to use different next-hops, but the question specifically requires all packets from a given source IP to use the same next-hop regardless of destination. Option D (Round robin) is wrong because it distributes packets sequentially across next-hops without any affinity to source IP, causing packets from the same source IP to potentially take different paths.

780
Multi-Selecteasy

An administrator wants to integrate a FortiSwitch with a FortiGate for LAN edge management. Which TWO steps are required for initial setup? (Choose two.)

Select 2 answers
A.Configure OSPF on the FortiSwitch
B.Connect the FortiSwitch to the FortiGate's managed switch port
C.Set the FortiSwitch to 'transparent' mode
D.Authorize the FortiSwitch in the FortiGate's switch controller
E.Create a firewall policy allowing traffic between FortiSwitch and FortiGate
AnswersB, D

The switch must be physically connected to a port that is configured as a managed switch port.

Why this answer

A FortiSwitch must be physically connected to a FortiGate port that has been configured as a managed switch port (via config system interface and set type switch). This dedicated port enables the FortiGate to discover and manage the FortiSwitch using the FortiLink protocol, which encapsulates control and data traffic over a single link. Without this physical connection to a managed switch port, the FortiGate cannot establish the FortiLink adjacency required for LAN edge management.

Exam trap

The trap here is that candidates often assume a firewall policy is required for all traffic between devices, but FortiLink management traffic bypasses firewall rules because it uses a dedicated control channel that is implicitly permitted by the FortiGate's internal switch controller logic.

781
MCQhard

A FortiGate administrator wants to block a custom protocol anomaly where a client sends an HTTP request with a malformed header containing a null byte. Which advanced IPS feature should be used?

A.Create a custom IPS signature to match the null byte pattern
B.Enable 'Outbreak Prevention' in the IPS sensor
C.Use the 'http-policy' setting in the WAF profile
D.Enable Protocol Anomaly Detection in the IPS sensor
AnswerD

Protocol anomaly detection identifies malformed packets that violate protocol standards.

Why this answer

Protocol Anomaly Detection in the IPS sensor is designed to identify deviations from standard protocol behavior, such as malformed headers or null bytes in HTTP requests. This feature inspects traffic for known protocol violations without requiring custom signatures, making it the correct choice for blocking a null byte anomaly in HTTP headers.

Exam trap

The trap here is that candidates often confuse custom IPS signatures with protocol anomaly detection, assuming any pattern match requires a signature, when in fact FortiGate's IPS engine includes built-in protocol decoders that automatically detect RFC violations like null bytes.

How to eliminate wrong answers

Option A is wrong because creating a custom IPS signature to match a null byte pattern is unnecessary and less efficient; Protocol Anomaly Detection already handles such protocol violations natively. Option B is wrong because Outbreak Prevention is a feature for blocking emerging threats based on real-time intelligence, not for detecting protocol anomalies like malformed headers. Option C is wrong because the 'http-policy' setting in a WAF profile is used for web application firewall rules (e.g., SQL injection, XSS), not for low-level protocol anomaly detection like null bytes in headers.

782
MCQhard

A FortiGate administrator runs 'diagnose ips anomaly list' and sees many entries with 'protocol anomaly - tcp_port_scan'. The administrator wants to reduce false positives. Which action should be taken in the IPS sensor configuration?

A.Increase the threshold for the port scan detection in the IPS sensor.
B.Add the trusted server IPs to an exemption list in the IPS sensor.
C.Disable the TCP port scan filter entirely.
D.Change the action from 'block' to 'monitor' for all IPS filters.
AnswerA

Increasing the threshold reduces false positives by requiring more ports to be scanned in the time window.

Why this answer

Increasing the threshold for port scan detection in the IPS sensor reduces false positives by requiring a higher number of scan attempts within the detection window before an alert is triggered. The 'diagnose ips anomaly list' output shows 'protocol anomaly - tcp_port_scan' entries, which are generated by the IPS engine's anomaly-based detection; raising the threshold makes the sensor less sensitive to benign network scanning activity, such as legitimate port sweeps by monitoring tools.

Exam trap

The trap here is that candidates may confuse 'reducing false positives' with 'changing the action to monitor' (Option D), thinking that logging instead of blocking reduces false positives, when in fact the number of alerts remains the same; the correct approach is to adjust the detection sensitivity via threshold tuning.

How to eliminate wrong answers

Option B is wrong because adding trusted server IPs to an exemption list in the IPS sensor would only suppress alerts for those specific IPs, but the administrator wants to reduce false positives globally without disabling detection for legitimate traffic. Option C is wrong because disabling the TCP port scan filter entirely would remove all detection of port scans, including malicious ones, which is an overreaction and not a targeted reduction of false positives. Option D is wrong because changing the action from 'block' to 'monitor' for all IPS filters would only change the response (e.g., from blocking to logging), but would not reduce the number of false positive alerts generated; the sensor would still trigger the same number of events.

783
MCQmedium

A FortiGate administrator uses FortiAnalyzer for log analysis and wants to identify all sessions that were blocked by a specific firewall policy ID 10. Which log filter should be applied?

A.Filter by 'action eq block' and then manually look for policy 10
B.Filter by 'policyid == 10'
C.Filter by 'policyid eq 10'
D.Filter by 'devid contains 10'
AnswerC

Correct. Using 'policy_id = 10' directly filters for all sessions handled by policy ID 10, including those blocked, using the accepted '=' operator.

Why this answer

The correct filter to identify sessions from a specific policy in FortiAnalyzer is 'policyid eq 10'. This uses the proper field name 'policyid' and the 'eq' operator. Option B uses '==' which is invalid, and option C uses the incorrect field name 'policy_id'.

784
MCQeasy

Which SD-WAN load balancing algorithm distributes new sessions based on the number of active sessions on each link?

A.Source-dest IP
B.Spillover
C.Volume
D.Sessions
AnswerD

Sessions algorithm distributes based on the number of active sessions.

Why this answer

The Sessions algorithm distributes new sessions based on the current number of active sessions on each SD-WAN link. When a new session is initiated, the SD-WAN controller selects the link with the fewest active sessions, ensuring a balanced load across all available transport interfaces. This is distinct from algorithms that consider source/destination IP pairs, traffic volume, or bandwidth thresholds.

Exam trap

The trap here is that candidates often confuse 'Sessions' with 'Volume' because both involve load balancing, but Sessions counts active connections while Volume measures data throughput, leading to incorrect selection of Volume when the question explicitly mentions 'number of active sessions'.

How to eliminate wrong answers

Option A is wrong because Source-dest IP uses a hash of the source and destination IP addresses to consistently map sessions to a specific link, not the number of active sessions. Option B is wrong because Spillover is a bandwidth-based algorithm that shifts traffic to another link only when a predefined bandwidth threshold is exceeded, not based on session count. Option C is wrong because Volume distributes traffic based on the total volume of data (bytes) transmitted over each link, not the number of active sessions.

785
Drag & Dropmedium

Drag and drop the steps to configure a FortiGate as a DNS server (DNS proxy) into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Enable DNS proxy, set interface and port, configure upstream, set caching, then allow traffic.

786
Multi-Selecthard

You are troubleshooting BGP route advertisement issues. Which THREE debug commands would be useful to identify why a route is not being advertised to a neighbor? (Choose three.)

Select 3 answers
A.diagnose debug router bgp <neighbor>
B.get router info bgp neighbors <neighbor> received-routes
C.get router info bgp summary
D.get router info bgp neighbors <neighbor> advertised-routes
E.get router info routing-table bgp
AnswersA, D, E

Shows BGP debug messages including updates.

Why this answer

The 'diagnose debug router bgp <neighbor>' command enables real-time debugging of BGP events for a specific neighbor, allowing you to see why a route is being filtered or not advertised (e.g., due to prefix-list, AS-path, or next-hop unreachable issues). This is a Fortinet-specific debug command that provides granular insight into the BGP decision process for that neighbor.

Exam trap

The trap here is that candidates often confuse 'received-routes' (inbound) with 'advertised-routes' (outbound) and think a summary command provides enough detail to diagnose per-neighbor advertisement issues.

787
Multi-Selectmedium

A FortiGate is integrated with FortiSwitch and FortiAP. The administrator wants to manage both devices from the FortiGate GUI using the LAN edge management features. Which THREE conditions must be met for this integration to work?

Select 3 answers
A.FortiAP must be in CAPWAP mode to connect to the FortiGate.
B.The FortiGate must be in NAT mode.
C.FortiSwitch must be in the same Layer 2 domain as the FortiGate management interface.
D.The FortiGate must operate in transparent mode.
E.The FortiGate must have a separate VDOM for each managed device.
AnswersA, B, C

FortiAP uses CAPWAP to tunnel traffic to the FortiGate.

Why this answer

FortiAP must operate in CAPWAP (Control and Provisioning of Wireless Access Points) mode to establish a control tunnel to the FortiGate. This allows the FortiGate to act as the wireless controller, managing AP configuration, firmware, and client traffic via CAPWAP encapsulation. Without CAPWAP mode, the FortiAP cannot be discovered or managed through the FortiGate's LAN edge management features.

Exam trap

The trap here is that candidates often assume transparent mode is acceptable for wireless management, but FortiGate must be in NAT mode to route CAPWAP traffic and provide the necessary network address translation for AP management.

788
MCQmedium

An admin wants to ensure that office documents (e.g., Word, Excel) downloaded from the internet are safe before users open them. Which feature should be used to remove potentially malicious macros and active content?

A.Machine learning engine
B.Content Disarm and Reconstruction (CDR)
C.Antivirus pattern matching
D.FortiSandbox file submission
AnswerB

CDR strips active content like macros, scripts, and embedded objects from documents.

Why this answer

Content Disarm and Reconstruction (CDR) is the correct feature because it proactively removes potentially malicious macros, scripts, and active content from office documents by stripping the original file's active elements and rebuilding a safe, sanitized version. Unlike detection-based methods, CDR eliminates threats before the file reaches the user, ensuring that even unknown or zero-day macro-based attacks are neutralized.

Exam trap

The trap here is that candidates often confuse CDR with sandboxing or signature-based detection, mistakenly thinking that analyzing or scanning a file is sufficient to ensure safety, when in fact only CDR actively removes the threat vector (macros/active content) from the document itself.

How to eliminate wrong answers

Option A is wrong because the Machine Learning engine is a detection-based technology that identifies threats by analyzing file characteristics and behavior patterns, but it does not remove macros or active content from documents—it only flags or blocks files based on risk scores. Option C is wrong because Antivirus pattern matching relies on signature databases to detect known malware, which cannot protect against unknown or polymorphic macro-based attacks that have no existing signature. Option D is wrong because FortiSandbox file submission is a dynamic analysis tool that detonates files in a sandboxed environment to observe malicious behavior, but it does not sanitize or reconstruct the document; it only provides a verdict after execution, which still requires the user to open the original file if no threat is detected.

789
MCQmedium

You run 'diagnose sys session filter dport 443' and see sessions with a duration of 7200 seconds and expire time of 3600 seconds. What does this indicate?

A.The session has been idle for 7200 seconds
B.The session helper is interfering with the session
C.The session has been alive for 7200 seconds and will expire in 3600 seconds
D.The session has already expired
AnswerC

Duration is time alive; expire is remaining lifetime.

Why this answer

The 'duration' field in the 'diagnose sys session filter' output shows how long the session has been active (7200 seconds), while the 'expire' field indicates the remaining time before the session times out (3600 seconds). Option C correctly interprets both values. This is standard FortiGate session table behavior, where each session has a configurable timeout (e.g., default TCP timeout is 3600 seconds for established sessions).

Exam trap

The trap here is confusing 'duration' with 'idle time' — candidates often assume duration measures inactivity, but FortiGate's session table uses separate fields for idle time and total session age.

How to eliminate wrong answers

Option A is wrong because 'duration' measures total session lifetime, not idle time; idle time is tracked separately via the 'idle' field in the session output. Option B is wrong because session helpers (e.g., ALG for SIP or FTP) do not cause a discrepancy between duration and expire time; they modify session behavior but are not indicated by these two fields alone. Option D is wrong because an expired session would not appear in the session list; the expire time of 3600 seconds means the session is still active and will expire in one hour.

790
Multi-Selectmedium

An administrator needs to configure a FortiGate to allow inter-VDOM routing between VDOM-1 and VDOM-2. Which TWO actions are required? (Choose two.)

Select 2 answers
A.Configure firewall policies on each VDOM to permit traffic across the VDOM link
B.Create a VDOM link between the two VDOMs
C.Disable NAT on all policies
D.Enable inter-VDOM routing under system settings
E.Assign an IP address to the VDOM link in only one VDOM
AnswersA, B

Correct.

Why this answer

Inter-VDOM routing requires explicit firewall policies on each VDOM to control and permit traffic traversing the VDOM link. Without these policies, the FortiGate will drop the traffic at the VDOM boundary, even if the VDOM link is up and IP addresses are configured.

Exam trap

The trap here is that candidates often assume inter-VDOM routing is automatically allowed once the VDOM link is created, forgetting that firewall policies are mandatory on both sides to explicitly permit the traffic.

791
MCQmedium

An administrator wants to use FortiManager to manage multiple FortiGates, each in a separate customer environment. The administrator needs to isolate configuration changes per customer and ensure each customer's admin can only see their own devices. What FortiManager feature should be used?

A.Administrative domains (ADOMs)
B.Administrator profiles
C.Policy packages
D.VDOMs on managed FortiGates
AnswerA

ADOMs partition FortiManager into separate management domains, each with its own devices and policy packages, ensuring isolation.

Why this answer

Administrative Domains (ADOMs) in FortiManager allow the administrator to logically partition the management plane, isolating configuration changes per customer. Each ADOM can contain a set of FortiGates, and administrators assigned to an ADOM can only see and manage devices within that ADOM, ensuring strict separation of customer environments.

Exam trap

The trap here is that candidates often confuse VDOMs (a FortiGate-level virtualization feature) with ADOMs (a FortiManager-level management isolation feature), assuming that VDOMs on the managed devices can provide the administrative separation required at the FortiManager level, but VDOMs only virtualize the firewall itself, not the management plane in FortiManager.

How to eliminate wrong answers

Option B (Administrator profiles) is wrong because administrator profiles define permissions (read/write/access control) for a user but do not isolate which devices or configurations the user can see; they work in conjunction with ADOMs but cannot provide device-level isolation alone. Option C (Policy packages) is wrong because policy packages are containers for firewall policies that can be assigned to ADOMs or devices, but they do not enforce administrative isolation between customers; they are a configuration object, not a management boundary. Option D (VDOMs on managed FortiGates) is wrong because VDOMs are a FortiGate feature for virtualizing a single FortiGate into multiple logical firewalls, not a FortiManager feature for isolating management of multiple FortiGates; FortiManager uses ADOMs to manage VDOMs across devices, but VDOMs themselves do not provide the administrative separation required at the FortiManager level.

792
MCQhard

A FortiGate with FortiExtender is using LTE as a backup WAN link. When the primary link fails, the LTE link does not take over. What could be the cause?

A.The primary link's performance SLA is still passing.
B.The FortiExtender is not configured in pass-through mode.
C.The FortiExtender firmware is out of date.
D.The LTE interface is not added as an SD-WAN member.
AnswerD

Without adding to SD-WAN, the backup link won't be used for failover.

Why this answer

For an LTE interface to be used as a backup WAN link in an SD-WAN setup, it must be explicitly added as an SD-WAN member. Without this, the FortiGate will not consider the LTE interface for traffic steering or failover, even if the primary link fails. The SD-WAN rules and performance SLA are only evaluated against interfaces that are members of the SD-WAN zone.

Exam trap

The trap here is that candidates often assume any working backup interface will automatically take over when the primary fails, but FortiGate SD-WAN requires explicit membership in the SD-WAN zone for failover to occur.

How to eliminate wrong answers

Option A is wrong because if the primary link's performance SLA is still passing, the SD-WAN logic would not trigger a failover to the backup link; the LTE link would not take over because the primary is considered healthy. Option B is wrong because pass-through mode is relevant for extending the FortiGate's interfaces via the FortiExtender, but it is not a prerequisite for LTE failover; the LTE interface can be used in normal mode as long as it is properly configured and added to SD-WAN. Option C is wrong while outdated firmware can cause various issues, the most direct and common reason for LTE not taking over is that the interface is not a member of the SD-WAN zone, not a firmware version problem.

793
MCQmedium

A user reports that they cannot connect to a remote office via IPsec VPN. Phase 1 is up, but Phase 2 fails to establish. The administrator runs 'diagnose vpn ike log' and sees 'no matching phase2 proposal'. What should be checked?

A.The firewall policies allow IKE traffic
B.The local and remote subnet definitions are correct
C.The pre-shared key is correct
D.The Phase 2 proposal settings (encryption, authentication, PFS) match on both peers
AnswerD

Mismatched Phase 2 proposals prevent the tunnel from establishing.

Why this answer

The error 'no matching phase2 proposal' indicates that the IPsec peers cannot agree on the Phase 2 parameters (encryption, authentication, PFS group, lifetime). Since Phase 1 is up, IKE negotiation for the secure channel succeeded, but the subsequent IPsec SA negotiation fails because the proposed transforms do not match. Option D directly addresses this mismatch by requiring verification of the Phase 2 proposal settings on both peers.

Exam trap

The trap here is that candidates confuse Phase 1 and Phase 2 failures, assuming any 'no matching proposal' error relates to IKE parameters, when in fact Phase 1 being up isolates the issue to the IPsec SA negotiation in Phase 2.

How to eliminate wrong answers

Option A is wrong because IKE traffic (UDP 500/4500) is already allowed for Phase 1 to be up; a firewall policy blocking IKE would prevent Phase 1 entirely. Option B is wrong because incorrect local/remote subnet definitions would cause a different error, such as 'no matching selector' or traffic not matching the proxy ID, not a proposal mismatch. Option C is wrong because the pre-shared key is used only in Phase 1 authentication; if it were incorrect, Phase 1 would fail to establish, not Phase 2.

794
MCQeasy

What is the purpose of FortiDeceptor in an enterprise security architecture?

A.To simulate real assets and detect attackers attempting to interact with decoys
B.To provide VPN access for remote users
C.To encrypt all data at rest on endpoints
D.To block all inbound traffic from suspicious IP addresses
AnswerA

FortiDeceptor creates decoys to attract and detect attackers.

Why this answer

FortiDeceptor is a deception-based threat detection solution that deploys decoys (simulated real assets like servers, databases, or IoT devices) across the network. When an attacker probes or interacts with these decoys, FortiDeceptor generates high-fidelity alerts, enabling early detection of lateral movement or reconnaissance without relying on signatures. This aligns with the Advanced Threat Protection domain by shifting from reactive blocking to proactive deception.

Exam trap

The trap here is that candidates confuse FortiDeceptor's deception-based detection with traditional prevention mechanisms like firewalls or VPNs, assuming it blocks threats directly rather than detecting them through interaction with decoys.

How to eliminate wrong answers

Option B is wrong because FortiDeceptor does not provide VPN access; that is the function of FortiClient or FortiGate's IPsec/SSL VPN capabilities. Option C is wrong because FortiDeceptor does not encrypt data at rest on endpoints; endpoint encryption is typically handled by solutions like FortiClient with full disk encryption or third-party tools. Option D is wrong because FortiDeceptor does not block inbound traffic from suspicious IPs; that is the role of FortiGate's firewall policies, IPS, or FortiGuard IP reputation filtering.

795
MCQmedium

An administrator configures SD-WAN with two members (wan1, wan2) and a performance SLA for ICMP to 1.1.1.1. The SD-WAN rule is set to 'Best Quality' with 'latency' metric. The admin notices that traffic sometimes switches to the other link even when the current link has acceptable latency. Which action can reduce unnecessary flapping?

A.Configure a hysteresis value for the SLA
B.Increase the SLA probe interval
C.Use 'manual' strategy instead
D.Increase the 'update-cascade-interface' setting
AnswerA

Hysteresis adds a buffer: the link must be significantly better before switching, reducing flapping.

Why this answer

Configuring a hysteresis value for the SLA introduces a buffer or deadband around the latency threshold. This prevents the SD-WAN from switching links when latency fluctuates slightly above and below the threshold, which is the root cause of flapping. Without hysteresis, even a minor transient spike in latency can trigger a switch, even if the link's overall performance is acceptable.

Exam trap

The trap here is that candidates often confuse 'hysteresis' with 'increasing the probe interval' (Option B), thinking that less frequent measurements will reduce flapping, but hysteresis is the correct mechanism because it introduces a deadband to prevent switching on minor fluctuations, whereas a longer interval only delays detection and does not prevent the oscillation.

How to eliminate wrong answers

Option B is wrong because increasing the SLA probe interval reduces the frequency of measurements, which can delay the detection of actual link degradation but does not prevent flapping caused by minor latency fluctuations around the threshold. Option C is wrong because using a 'manual' strategy would disable automatic link selection based on SLA metrics entirely, which is an overreaction and does not address the flapping issue while sacrificing the benefits of dynamic path selection. Option D is wrong because 'update-cascade-interface' is a FortiGate setting related to updating routing tables when an interface's status changes, not a mechanism to dampen SLA-triggered path switching.

796
MCQmedium

An admin receives an email from FortiMail regarding a message that was rejected due to SPF failure. What does this indicate about the email?

A.The email's From address domain does not match the sending server's IP per the domain's SPF record
B.The email's DKIM signature is invalid
C.The email contains a virus
D.The email is missing a Message-ID header
AnswerA

SPF checks the envelope sender domain against the sending IP.

Why this answer

SPF (Sender Policy Framework) validation checks whether the sending mail server's IP address is authorized to send mail for the domain in the envelope 'From' (RFC 5321.MailFrom) or the header 'From' address. When FortiMail rejects a message due to SPF failure, it means the IP of the connecting server does not match any of the authorized IPs listed in the domain's SPF TXT record (as defined in RFC 7208). This is a direct authentication failure, not a content-based or signature-based issue.

Exam trap

The trap here is that candidates often confuse SPF with DKIM or assume SPF validates the 'From' header domain, when in fact SPF validates the envelope sender domain (Return-Path) against the connecting IP, and a failure does not imply the message is malicious—only that it failed an authorization check.

How to eliminate wrong answers

Option B is wrong because DKIM (DomainKeys Identified Mail) uses a digital signature to verify message integrity and domain association, not the sending server's IP; an SPF failure is unrelated to DKIM signature validity. Option C is wrong because SPF failure indicates a sending server authorization problem, not the presence of a virus; antivirus scanning is a separate content inspection process. Option D is wrong because a missing Message-ID header is a formatting issue that may affect message threading or compliance but is not checked by SPF; SPF operates at the transport level, not on header completeness.

797
MCQeasy

What is the primary benefit of using FortiClient with ATP features in conjunction with FortiGate?

A.It allows users to bypass security policies
B.It replaces the need for a firewall
C.It enables endpoint detection and response with automated quarantine through FortiGate
D.It provides a single sign-on portal for all users
AnswerC

FortiClient ATP can detect threats and trigger FortiGate to isolate the endpoint.

Why this answer

FortiClient with ATP (Advanced Threat Protection) features, such as Antivirus, Web Filtering, and Vulnerability Scan, integrates with FortiGate via the FortiTelemetry protocol. This integration enables endpoint detection and response (EDR) capabilities, allowing FortiGate to automatically quarantine compromised endpoints based on telemetry and threat intelligence from FortiClient, thereby containing threats at the network edge.

Exam trap

The trap here is that candidates often confuse FortiClient's ATP features with basic VPN or compliance-only modes, overlooking the automated quarantine and EDR integration that requires FortiTelemetry and Security Fabric coordination.

How to eliminate wrong answers

Option A is wrong because FortiClient with ATP does not bypass security policies; instead, it enforces and augments them by providing endpoint compliance and threat telemetry to FortiGate. Option B is wrong because FortiClient does not replace the need for a firewall; it works as a complementary endpoint security agent, while FortiGate remains the core network firewall enforcing access control and inspection. Option D is wrong because FortiClient does not provide a single sign-on portal; SSO is typically handled by FortiAuthenticator or FSSO agents, not by FortiClient ATP features.

798
MCQmedium

An administrator wants to prevent users from downloading known malicious files from the internet. The administrator has enabled FortiGuard Outbreak Prevention and applied an antivirus profile to the outbound policy. However, some malicious files are still reaching users. What configuration step is most likely missing?

A.The antivirus profile has 'FortiGuard Outbreak Prevention' enabled
B.The FortiGuard subscription has expired
C.The antivirus profile does not have 'FortiGuard Outbreak Prevention' enabled
D.The security policy is not configured for proxy-based inspection
AnswerC

Outbreak prevention is an additional toggle in the antivirus profile; without it, the feature does not activate.

Why this answer

FortiGuard Outbreak Prevention is a separate toggle within the antivirus profile that must be explicitly enabled to leverage real-time outbreak intelligence. Even if the administrator believes they have enabled it, the profile may have the feature disabled by default or inadvertently left off, allowing known malicious files to bypass detection. Without this toggle, the antivirus engine relies only on static signatures and cannot block files flagged by FortiGuard's outbreak database.

Exam trap

The trap here is that candidates assume enabling FortiGuard Outbreak Prevention at the system or global level automatically applies it to all antivirus profiles, when in fact it must be explicitly enabled within each antivirus profile's settings.

How to eliminate wrong answers

Option A is wrong because stating that the antivirus profile has 'FortiGuard Outbreak Prevention' enabled would contradict the scenario where malicious files are still reaching users; if it were enabled, the outbreak prevention would block those files. Option B is wrong because an expired FortiGuard subscription would affect all FortiGuard services, not just outbreak prevention, and the question specifies that the administrator enabled FortiGuard Outbreak Prevention, implying the subscription is active. Option D is wrong because proxy-based inspection is not a prerequisite for FortiGuard Outbreak Prevention; the feature works with both proxy-based and flow-based inspection modes as long as the antivirus profile is applied and the toggle is enabled.

799
Multi-Selecthard

A FortiGate administrator is configuring OSPF over an IPsec VPN overlay in a hub-and-spoke topology. The spokes have dynamic IPs and use ADVPN. Which THREE conditions are necessary for OSPF to work correctly over the VPN tunnels?

Select 3 answers
A.The OSPF router ID must be unique across all spokes
B.The OSPF hello interval must be less than the DPD retry interval
C.The hub must have all spoke routes in its routing table before OSPF starts
D.The tunnel interfaces must have an IP address configured
E.The OSPF network type on the tunnel interfaces must be set to point-to-point
AnswersA, D, E

OSPF router IDs must be unique to prevent routing issues.

Why this answer

OSPF requires stable network types and correct interface configuration. For ADVPN, OSPF should use point-to-point network type to avoid DR elections and ensure proper neighbor relationships.

800
MCQeasy

A FortiGate administrator needs to configure BFD (Bidirectional Forwarding Detection) on a BGP peer to quickly detect link failures. Which CLI command enables BFD on the BGP neighbor 10.1.1.1?

A.config router policy set bfd enable end
B.config system interface edit port1 set bfd enable next end
C.config router static set bfd enable end
D.config router bgp config neighbor edit 10.1.1.1 set bfd enable next end end
AnswerD

BFD is enabled per neighbor under the BGP configuration.

Why this answer

BFD must be enabled specifically under the BGP neighbor configuration to associate BFD with the BGP session. The `config router bgp` → `config neighbor` → `set bfd enable` command activates BFD for that neighbor, allowing rapid link failure detection independent of BGP hold timers.

Exam trap

The trap here is that candidates often confuse enabling BFD on the interface (Option B) with enabling it on the BGP neighbor, not realizing that interface-level BFD only supports protocols like OSPF or static routes, not BGP sessions directly.

How to eliminate wrong answers

Option A is wrong because `config router policy` is not a valid FortiGate CLI context; BFD is not configured under a router policy. Option B is wrong because `set bfd enable` under `config system interface` enables BFD on the interface itself (for routing protocols like OSPF or static routes), but it does not bind BFD to a specific BGP neighbor session. Option C is wrong because `config router static` with `set bfd enable` enables BFD for static routes, not for BGP peers.

801
MCQmedium

A FortiGate administrator sees the following syslog message repeatedly: 'IPsec phase 2 failed to establish SA with peer due to proposal mismatch.' The administrator has already verified that the phase 2 parameters (encryption, authentication, PFS, and lifetime) match on both sides. What else should the administrator check?

A.The local and remote subnets defined in the phase 2 selector
B.The phase 1 proposal settings
C.The DPD configuration
D.The pre-shared key
AnswerA

Mismatched traffic selectors will cause phase 2 negotiation to fail.

Why this answer

Phase 2 negotiation can also fail due to mismatched traffic selectors (local and remote subnets).

802
Drag & Dropmedium

Drag and drop the steps to configure an HA cluster on FortiGate into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First set HA mode and priority, then connect heartbeat, then configure management IP and VIP, and finally verify.

803
MCQmedium

An administrator wants to detect lateral movement and early stages of an attack using decoy systems that mimic production assets. Which Fortinet product should they deploy?

A.FortiSIEM
B.FortiEDR
C.FortiNDR
D.FortiDeceptor
AnswerD

FortiDeceptor uses decoys to detect attacks.

Why this answer

FortiDeceptor is specifically designed to detect lateral movement and early-stage attacks by deploying decoy systems (honeypots) that mimic production assets. It uses deception technology to lure attackers away from real targets and trigger alerts when decoys are probed or compromised, enabling early threat detection without impacting production systems.

Exam trap

The trap here is that candidates may confuse FortiDeceptor with FortiNDR or FortiEDR because all three involve threat detection, but only FortiDeceptor uses active decoy systems to mimic production assets for deception-based detection.

How to eliminate wrong answers

Option A is wrong because FortiSIEM is a security information and event management solution that aggregates logs and correlates events, but it does not deploy decoy systems or actively mimic production assets for deception. Option B is wrong because FortiEDR is an endpoint detection and response solution that protects endpoints via behavioral analysis and threat hunting, but it does not create decoy systems or honeypots to simulate production assets. Option C is wrong because FortiNDR is a network detection and response solution that analyzes network traffic for anomalies and threats using machine learning, but it does not deploy decoy systems or mimic production assets for deception-based detection.

804
Multi-Selecthard

A FortiGate HA cluster is configured with VDOMs. Each VDOM is assigned to different physical interfaces. The cluster is in active-passive mode. Which TWO statements about VDOM synchronization in HA are correct?

Select 2 answers
A.VDOM configuration, including interfaces and policies, is synchronized between cluster members.
B.In active-passive HA, traffic for each VDOM can be distributed across cluster members.
C.Each VDOM can have its own HA mode (active-passive or active-active) independent of the global HA mode.
D.The HA virtual MAC address feature can be enabled per VDOM to handle ARP issues during failover.
E.If one VDOM fails, the entire HA cluster fails over to the standby unit.
AnswersA, D

All configuration, including VDOM-specific settings, is synchronized in an HA cluster.

Why this answer

In a FortiGate HA cluster, VDOM configuration—including interfaces, policies, and other settings—is fully synchronized between cluster members. This ensures that both the active and passive units have identical VDOM configurations, enabling seamless failover without manual reconfiguration.

Exam trap

The trap here is that candidates often confuse VDOM-level failover behavior with global HA failover, mistakenly thinking a single VDOM failure triggers a full cluster failover, when in reality FortiGate HA only fails over on unit-level failures.

805
MCQmedium

A network engineer is troubleshooting a Security Fabric where a downstream FortiGate (model 60F) is not appearing in the Fabric topology of the root FortiGate (model 600E). Both devices are running FortiOS 7.4. The root FortiGate shows the downstream device as 'Unreachable' in the Security Fabric widget. The engineer has verified that the downstream FortiGate can ping the root FortiGate's management IP. What is the most likely cause of this issue?

A.The root FortiGate does not have HTTPS access to the downstream FortiGate.
B.The downstream FortiGate has insufficient memory to support Security Fabric features.
C.The downstream FortiGate's management interface is configured on a different VLAN.
D.The administrator account on the downstream FortiGate does not have 'super_admin' privileges.
AnswerB

Low-end models may not meet the minimum memory requirements for Fabric operations.

Why this answer

The FortiGate 60F has limited memory (typically 512 MB or less), and FortiOS 7.4 enforces a minimum memory requirement for downstream devices to participate in the Security Fabric. When the downstream device has insufficient memory, the root FortiGate marks it as 'Unreachable' even though basic IP connectivity (ping) works. This is a known hardware limitation for lower-end models like the 60F when running newer FortiOS versions.

Exam trap

The trap here is that candidates assume connectivity issues (ping working) imply Fabric should work, but Fortinet deliberately tests the hardware memory limitation as a non-obvious cause for 'Unreachable' status in the Security Fabric topology.

How to eliminate wrong answers

Option A is wrong because HTTPS access from the root to the downstream is required for Fabric establishment, but the root already shows the downstream as 'Unreachable' (not 'Discovered' or 'Pending'), indicating the issue is not about HTTPS reachability; the root has already attempted discovery. Option C is wrong because the management interface VLAN mismatch would prevent the downstream from being discovered at all, yet the root sees the device (as 'Unreachable'), meaning Layer 3 connectivity exists. Option D is wrong because the administrator account on the downstream does not need 'super_admin' privileges for Fabric join; a 'profi_admin' or 'restricted_admin' with appropriate Fabric permissions is sufficient, and the root would not show 'Unreachable' if the account lacked privileges—it would show an authentication failure.

806
MCQhard

A FortiGate is configured with policy-based routing (PBR) to route certain traffic through a specific next hop. However, some traffic that should match the PBR rule is not being affected. What is a likely reason?

A.The PBR rule uses a route map that references an incorrect prefix list.
B.The PBR rule is applied on the wrong interface or direction.
C.The PBR rule has a higher priority than the SD-WAN rule, but the traffic is hitting the SD-WAN rule first because of firewall policy order.
D.The traffic is generated locally from the FortiGate and PBR does not affect locally generated traffic.
AnswerB

PBR must be applied to the ingress interface where traffic arrives. If applied to the wrong interface or direction, traffic will not match.

Why this answer

Policy-based routing (PBR) in FortiOS is applied per interface and per direction (incoming or outgoing). If the PBR rule is applied on the wrong interface or in the wrong direction, traffic will never be evaluated against the route map, causing the rule to have no effect. This is the most common misconfiguration when PBR does not work as expected.

Exam trap

The trap here is that candidates often assume PBR is applied globally or at the firewall policy level, when in fact it is strictly interface- and direction-specific in FortiOS, and misapplying it on the wrong interface or direction is the most frequent root cause of PBR not working.

How to eliminate wrong answers

Option A is wrong because an incorrect prefix list in the route map would cause the PBR rule to match no traffic or the wrong traffic, but it would not cause traffic that should match to be unaffected—it would simply not match. Option C is wrong because PBR is evaluated before SD-WAN rules and before firewall policy order; PBR operates at the routing decision level, not at the firewall policy level, so priority between PBR and SD-WAN is not determined by firewall policy order. Option D is wrong because PBR does affect locally generated traffic on FortiGate; locally originated traffic can be subject to PBR if the route map matches the source or destination, though special considerations apply for management traffic.

807
MCQhard

A company uses FortiWeb to protect its web application. They want to block SQL injection attempts. Which FortiWeb feature should be configured to inspect HTTP requests for malicious SQL patterns?

A.URL Access Rule
B.Web Application Firewall (WAF) Signatures
C.HTTP Protocol Constraint
D.IP List
AnswerB

WAF Signatures include pre-defined rules for SQL injection, XSS, etc.

Why this answer

FortiWeb's WAF Signatures (option B) are specifically designed to inspect HTTP request payloads for known attack patterns, including SQL injection signatures. This feature uses a regularly updated signature database to match malicious SQL syntax (e.g., UNION, OR 1=1) within GET/POST parameters, cookies, or headers, making it the correct choice for blocking SQL injection attempts.

Exam trap

The trap here is that candidates confuse 'HTTP Protocol Constraint' (which only checks protocol compliance) with content inspection features like WAF Signatures, leading them to select option C instead of B.

How to eliminate wrong answers

Option A is wrong because URL Access Rules control access based on URL patterns or source IPs, not by inspecting request content for SQL injection patterns. Option C is wrong because HTTP Protocol Constraints enforce RFC compliance (e.g., header length, method restrictions) and do not perform content-level pattern matching for SQL injection. Option D is wrong because IP Lists allow or block traffic based on source IP addresses, with no capability to analyze the payload for malicious SQL syntax.

808
Multi-Selectmedium

An administrator is configuring FortiDeceptor to detect threats within the network. Which TWO statements about FortiDeceptor are correct?

Select 2 answers
A.It requires a separate hardware appliance for each network segment
B.It sends alerts to FortiSIEM or FortiSOAR for automated response
C.It uses decoys and lures to attract attackers
D.It uses signature-based detection to identify malware
E.It can replace firewall functionality
AnswersB, C

Integration with SIEM/SOAR enables automated response to detected threats.

Why this answer

FortiDeceptor integrates with FortiSIEM and FortiSOAR to automatically trigger incident response workflows when a threat is detected. This integration allows security teams to quickly contain and remediate attacks without manual intervention, leveraging the Fortinet Security Fabric's automation capabilities.

Exam trap

The trap here is that candidates may confuse FortiDeceptor's deception-based detection with traditional signature-based IDS/IPS, leading them to incorrectly select option D, or assume it requires dedicated hardware per segment (option A) due to misunderstanding its deployment flexibility.

809
MCQhard

A FortiGate is configured as a SAML SP for user authentication. When a user attempts to access a protected resource, the FortiGate redirects the user to the IdP login page, but after successful authentication, the user is not redirected back to the original resource. What is the MOST likely cause?

A.The user's browser has cookies disabled
B.The IdP certificate is not trusted by the FortiGate
C.The SAML assertion consumer service URL on the IdP does not include a trailing slash
D.The FortiGate is configured as a SAML IdP instead of SP
AnswerC

FortiGate expects the ACS URL to match exactly; a missing trailing slash can cause the IdP to send the response to an unexpected endpoint.

Why this answer

The SAML assertion consumer service (ACS) URL must exactly match the endpoint configured on the FortiGate. If the IdP's ACS URL lacks a trailing slash that the FortiGate expects, the SAML response will be sent to an incorrect or mismatched endpoint, causing the redirect to fail. This is a common misconfiguration in SAML SP setups where URL normalization differs between the SP and IdP.

Exam trap

The trap here is that candidates often assume the issue is with certificate trust or browser settings, but the real problem is a subtle URL mismatch in the SAML ACS endpoint configuration.

How to eliminate wrong answers

Option A is wrong because cookies are not required for SAML redirect-based flows; the browser handles HTTP redirects and POST bindings without relying on cookies for the SAML assertion exchange. Option B is wrong because the IdP certificate is used to verify the SAML assertion signature, not to establish the redirect back to the SP; an untrusted certificate would cause an assertion validation failure, not a redirect failure. Option D is wrong because if the FortiGate were configured as an IdP, it would not redirect the user to an external IdP login page; the scenario explicitly states the user is redirected to the IdP login page, confirming the FortiGate is acting as an SP.

810
Multi-Selectmedium

A FortiGate administrator is troubleshooting a scenario where traffic between two VDOMs is not working. The admin has configured inter-VDOM routing. Which TWO steps should the administrator verify? (Choose two.)

Select 2 answers
A.Check that NAT is enabled on the policies
B.Check that there is a firewall policy in the destination VDOM allowing the return traffic
C.Check that the inter-VDOM link is configured as a physical interface
D.Check that there is a firewall policy in the source VDOM allowing traffic to the destination VDOM
E.Check that both VDOMs are in the same administrative VDOM
AnswersB, D

Return traffic must be permitted by a policy in the destination VDOM.

Why this answer

Inter-VDOM routing requires firewall policies in both the source and destination VDOMs to permit traffic. The destination VDOM must have a policy allowing the return traffic (from the destination to the source) for the session to be established. Without this, the FortiGate will drop the return packets, breaking the bidirectional flow.

Exam trap

The trap here is that candidates assume a single policy in the source VDOM is sufficient, overlooking that inter-VDOM routing requires explicit policies in both VDOMs to allow the forward and return traffic.

811
MCQeasy

A FortiGate is configured with OSPF multi-area. The administrator wants to ensure that routes from area 0 are redistributed into area 1. Which OSPF configuration is required?

A.Enable 'redistribute connected' on the ABR
B.Set the 'area type' to 'nssa' on area 1
C.Configure a route redistribution policy under OSPF
D.No additional configuration is needed; ABRs automatically advertise inter-area routes
AnswerD

OSPF ABRs by default advertise routes from one area to another.

Why this answer

OSPF ABRs (Area Border Routers) automatically advertise inter-area routes between areas by default. In a multi-area OSPF setup, the ABR learns Type 3 LSAs from area 0 and floods them into other areas (like area 1) without any additional redistribution configuration. No explicit redistribution policy is needed for inter-area route advertisement.

Exam trap

The trap here is that candidates confuse route redistribution (importing external routes) with the automatic inter-area route advertisement performed by ABRs, leading them to select options involving redistribution policies or area type modifications.

How to eliminate wrong answers

Option A is wrong because 'redistribute connected' is used to inject directly connected routes into OSPF, not to advertise routes between areas; inter-area routes are handled natively by ABRs via Type 3 LSAs. Option B is wrong because setting area 1 as NSSA would actually restrict Type 5 LSAs and require special handling for external routes, but it does not affect the automatic advertisement of inter-area routes from area 0; in fact, NSSA still allows Type 3 LSAs by default. Option C is wrong because a route redistribution policy under OSPF is used for importing routes from other protocols (e.g., BGP, static) or from different OSPF processes, not for inter-area route propagation within the same OSPF domain.

812
Matchingmedium

Match each high availability (HA) mode to its characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

One unit handles traffic; standby takes over on failure

Both units handle traffic simultaneously

FortiGate Clustering Protocol

Synchronizes sessions between HA members

Link used for HA communication and synchronization

Why these pairings

The correct matches are A and B. Common confusions involve swapping the characteristics: Active-Passive uses a single active unit with standby, while Active-Active uses all units to handle traffic.

813
MCQmedium

An administrator configures a route map to control redistribution of connected routes into OSPF. The route map uses a prefix list to match routes. After applying the redistribution, no routes are redistributed. What is the most likely oversight?

A.The route map is missing a 'permit' action, so it denies all routes
B.The prefix list is configured with the wrong sequence number
C.OSPF process ID is incorrect
D.The connected routes are not in the routing table
AnswerA

A route map must have an explicit 'permit' action to allow routes; without it, the implicit deny blocks all routes.

Why this answer

The route map used for redistribution into OSPF must have at least one 'permit' statement to allow routes. If only a prefix list is referenced in the route map without an explicit 'permit' action, the implicit deny at the end of the route map blocks all routes. The common mistake is to assume that simply matching with a prefix list is sufficient; however, an explicit 'permit' action is required.

Exam trap

The trap here is that candidates assume a route map with a matching prefix list automatically permits routes, forgetting that route maps require an explicit 'permit' action and that the default action is deny, not permit.

How to eliminate wrong answers

Option B is wrong because a prefix list with a wrong sequence number would still match routes if the sequence numbers are correctly ordered; the issue is not about sequence numbers but about the route map lacking a permit action. Option C is wrong because an incorrect OSPF process ID would prevent the redistribution command from being applied to the correct OSPF instance, but the question states redistribution was configured, so the process ID is likely correct. Option D is wrong because connected routes are automatically present in the routing table when an interface is up and has an IP address; if they were missing, the administrator would see no connected routes at all, not just a redistribution failure.

814
Multi-Selectmedium

A FortiGate administrator wants to detect and block protocol anomalies as part of advanced IPS. Which three options are available in FortiGate's custom IPS signatures? (Choose three.)

Select 3 answers
A.Protocol-specific fields
B.Protocol anomaly detection
C.Packet length constraints
D.Application signatures
E.URL filtering
AnswersA, B, C

Can specify fields like TCP flags, HTTP headers.

Why this answer

Custom IPS signatures in FortiGate allow matching on protocol-specific fields such as TCP flags, ICMP type/code, or DNS query types. This enables detection of anomalies like invalid flag combinations or malformed protocol headers, which is a core part of advanced IPS.

Exam trap

The trap here is that candidates confuse application control signatures (which identify applications by traffic patterns) with IPS protocol anomaly signatures, or mistakenly think URL filtering is part of IPS when it is a separate security profile feature.

815
MCQmedium

A FortiGate is configured with SD-WAN and multiple members. The administrator notices that traffic to a critical application is consistently routed over a low-quality link, even though a better link is available. The SD-WAN rule uses the 'Best Quality' strategy with a performance SLA. What is the most likely reason?

A.The better link is failing its SLA probes
B.The better link is in 'standby' mode
C.The SD-WAN rule is using source-based routing
D.The application traffic is not matching the SD-WAN rule
AnswerA

Correct. If a link fails SLA, it is considered out of compliance and not selected by 'Best Quality'.

Why this answer

When an SD-WAN rule uses the 'Best Quality' strategy with a performance SLA, the FortiGate selects the member link that best meets the SLA targets (e.g., jitter, latency, packet loss). If the better link is failing its SLA probes, it is considered out of compliance and will not be selected, even if it is physically available and has higher bandwidth. This causes traffic to be routed over the lower-quality link that still passes the SLA.

Exam trap

The trap here is that candidates assume 'Best Quality' always picks the link with the highest bandwidth or lowest cost, when in fact it strictly selects based on SLA compliance, not raw capacity or administrative preference.

How to eliminate wrong answers

Option B is wrong because a link in 'standby' mode is only used for failover when all active links fail; it would not be considered a 'better link' that is available for selection under normal SD-WAN rules. Option C is wrong because source-based routing is a different strategy that ignores SLA performance; the question explicitly states the rule uses 'Best Quality' with a performance SLA, so source-based routing is not in effect. Option D is wrong because if the application traffic were not matching the SD-WAN rule, it would be handled by the regular routing table or policy-based routing, not consistently routed over a low-quality link via the SD-WAN rule.

816
MCQeasy

In a Zero Trust Network Access architecture, which component acts as the policy enforcement point for access decisions?

A.FortiClient agent
B.FortiAnalyzer
C.FortiGate ZTNA gateway
D.FortiClient EMS
AnswerC

The FortiGate enforces access based on tags and policies.

Why this answer

In a Zero Trust Network Access (ZTNA) architecture, the FortiGate ZTNA gateway acts as the policy enforcement point (PEP). It terminates encrypted ZTNA tunnels from FortiClient agents, inspects traffic against configured access policies, and enforces decisions based on identity, device posture, and context. This is distinct from the control plane (FortiClient EMS) or logging (FortiAnalyzer).

Exam trap

The trap here is that candidates confuse the ZTNA gateway (PEP) with the EMS (controller) or FortiClient (client), but only the gateway sits inline and enforces access decisions based on the ZTNA access proxy protocol.

How to eliminate wrong answers

Option A is wrong because FortiClient is the ZTNA client that initiates connections and reports device posture, not the enforcement point. Option B is wrong because FortiAnalyzer is a logging and analytics platform that collects logs and generates reports, not a real-time policy enforcement component. Option D is wrong because FortiClient EMS is the management server that distributes ZTNA configurations and verifies device compliance, but it does not enforce access decisions inline.

817
MCQeasy

A company wants to ensure that only company-managed laptops with up-to-date antivirus can access the internal file server remotely. Which Fortinet solution integrates with FortiGate to enforce device compliance before granting ZTNA access?

A.FortiClient EMS
B.FortiAnalyzer
C.FortiSandbox
D.FortiWeb
AnswerA

FortiClient EMS manages endpoint security and compliance, and provides posture data to FortiGate for ZTNA access control.

Why this answer

FortiClient EMS (Endpoint Management Server) manages FortiClient endpoints and can enforce compliance policies. It integrates with FortiGate to provide device posture information via ZTNA tags, enabling access control based on compliance.

818
MCQmedium

An administrator is deploying a FortiGate in transparent mode to seamlessly integrate into an existing network. The administrator needs to manage the FortiGate remotely over the network. Which configuration is required?

A.Configure a management IP address under the VDOM settings
B.Create a VLAN interface and assign an IP
C.Assign an IP address to the physical interfaces
D.Enable DHCP client on the interfaces
AnswerA

A management IP allows remote access to the FortiGate in transparent mode.

Why this answer

In transparent mode, FortiGate operates as a Layer 2 bridge and does not route traffic, so physical interfaces cannot have IP addresses. To enable remote management, a dedicated management IP must be configured under the VDOM settings, which allows the FortiGate to be reachable via protocols like HTTPS, SSH, or SNMP without participating in Layer 3 forwarding.

Exam trap

The trap here is that candidates often assume transparent mode still requires an IP on an interface (like a VLAN or physical port) for management, but FortiGate transparent mode uses a VDOM-level management IP that is not tied to any specific interface, which is a key distinction from routed mode.

How to eliminate wrong answers

Option B is wrong because creating a VLAN interface and assigning an IP is used in transparent mode only if the management IP is placed on a specific VLAN, but the question asks for the general requirement, and the management IP is configured under VDOM settings, not as a separate VLAN interface. Option C is wrong because assigning an IP address to physical interfaces is not allowed in transparent mode; interfaces remain unnumbered and operate at Layer 2. Option D is wrong because enabling DHCP client on interfaces is not applicable in transparent mode, as interfaces do not have IP addresses and the FortiGate does not obtain an IP via DHCP for management; the management IP is statically configured under VDOM settings.

819
Multi-Selectmedium

A company has deployed FortiClient with advanced threat protection (ATP) features. Which TWO capabilities does FortiClient ATP provide beyond basic antivirus?

Select 2 answers
A.Exploit prevention and vulnerability scanning
B.Application control and inventory
C.Real-time malware protection using machine learning
D.VPN connectivity
E.Web filtering and URL rating
AnswersA, C

FortiClient ATP includes exploit prevention and vulnerability assessment.

820
Multi-Selecthard

An administrator is deploying a hub-and-spoke ADVPN with three spoke sites. The spokes have dynamic IP addresses. The hub has a static IP. The administrator wants the spokes to establish direct shortcut tunnels when they communicate with each other. Which THREE conditions must be met for shortcut tunnels to be established? (Choose three.)

Select 3 answers
A.The spoke tunnel interfaces must be in the same IP subnet
B.The spokes must have static public IP addresses
C.The hub must be configured with 'set shortcuthub enable' to act as a shortcut hub
D.Auto-discovery must be enabled in the phase1 settings on all spokes
E.The hub must have routes to all spoke local subnets
AnswersA, D, E

Shortcut tunnels require the spoke tunnel interfaces to be in the same subnet (e.g., 10.0.0.0/24) to allow direct communication.

Why this answer

For ADVPN shortcuts to be established, three conditions must be met: (A) The spoke tunnel interfaces must be in the same IP subnet to allow direct routing. (D) Auto-discovery must be enabled in the phase1 settings on all spokes to exchange shortcut information. (E) The hub must have routes to all spoke local subnets so it can forward shortcut initiation packets. Option B is incorrect because spokes can have dynamic IP addresses with ADVPN. Option C is incorrect because 'set shortcuthub enable' is not required; the hub functions as a shortcut hub by default.

821
Multi-Selectmedium

An administrator wants to implement ZTNA with FortiClient EMS to control access to an internal web application. Which TWO components are essential for the ZTNA proxy to function correctly?

Select 2 answers
A.A static route on FortiGate pointing to the application server's network
B.SSL certificate installed on the application server
C.A public DNS record for the ZTNA gateway's FQDN
D.A firewall policy allowing traffic from the ZTNA gateway to the application server
E.An application mapping object that specifies the internal server IP and port
AnswersD, E

The gateway forwards traffic to the server; policy must permit it.

Why this answer

A ZTNA proxy requires a configured application mapping (defining the internal server) and a firewall policy that permits traffic from the ZTNA gateway to the internal server.

822
MCQhard

Refer to the exhibit. An administrator runs the 'diagnose vpn ike stats' command on a FortiGate. What does the output indicate?

A.The tunnel is vulnerable to a man-in-the-middle attack because the IPsec SAs are using the same encryption algorithm.
B.The tunnel configuration is incorrect because there are two IPsec SAs under one IKE SA.
C.The tunnel is using two IKE SAs for redundancy.
D.The tunnel has one IKE SA and two IPsec SAs, which is normal for a single VPN tunnel.
AnswerD

A single tunnel uses two IPsec SAs (one for each direction) under one IKE SA.

Why this answer

The 'diagnose vpn ike stats' output shows one IKE SA (phase 1) and two IPsec SAs (phase 2). This is normal for a single VPN tunnel when using IPsec with both inbound and outbound SAs, or when the tunnel is configured with separate SAs for different traffic selectors. The presence of two IPsec SAs under one IKE SA does not indicate an error or vulnerability; it is the expected behavior for a standard IPsec VPN tunnel.

Exam trap

The trap here is that candidates may misinterpret the presence of two IPsec SAs as a redundancy or error, when in fact it is the normal and expected result of IPsec's directional SA model.

How to eliminate wrong answers

Option A is wrong because using the same encryption algorithm for both IPsec SAs does not inherently make the tunnel vulnerable to a man-in-the-middle attack; the vulnerability would depend on the algorithm's strength and key management, not the mere duplication. Option B is wrong because having two IPsec SAs under one IKE SA is not a configuration error; it is standard for IPsec to create separate SAs for each direction (inbound and outbound) or for different traffic selectors. Option C is wrong because the output shows only one IKE SA, not two; redundancy would require multiple IKE SAs, which is not indicated here.

823
MCQhard

A FortiGate in transparent mode is deployed in a data center. The admin notices that ARP requests from a downstream switch for the default gateway are not being answered. The FortiGate's management IP is configured on the same subnet as the switch. What is the most likely cause?

A.The management IP is configured on the same VLAN as the downstream switch, causing a conflict
B.The downstream switch has port security enabled
C.The FortiGate has a firewall policy blocking ARP
D.The FortiGate's ARP table is full
AnswerA

In transparent mode, the FortiGate should not have the management IP on the same broadcast domain as its interfaces; it must be on a dedicated management interface or VLAN.

Why this answer

In transparent mode, the FortiGate acts as a Layer 2 bridge and does not participate in ARP for traffic passing through it. However, the management IP is used for administrative access and must be unique on the network. If the management IP is configured on the same VLAN as the downstream switch, it creates an IP address conflict with the switch's own interface or the default gateway, causing the switch to either ignore or not forward ARP requests for that IP.

The FortiGate will not respond to ARP requests for the management IP if it detects a duplicate IP on the same broadcast domain, as per RFC 5227.

Exam trap

The trap here is that candidates assume transparent mode FortiGates always forward ARP transparently, but they forget that the management IP is a Layer 3 exception that must be unique and can cause ARP conflicts if placed on the same subnet as other devices.

How to eliminate wrong answers

Option B is wrong because port security on a switch typically limits MAC addresses per port or disables the port upon violation, but it does not prevent the FortiGate from responding to ARP requests for its management IP; the symptom described is a lack of ARP replies, not a port being err-disabled. Option C is wrong because FortiGate firewall policies operate at Layer 3 and above (IP, TCP, UDP) and do not filter or block ARP, which is a Layer 2 protocol; ARP handling is controlled by the kernel and interface settings, not by firewall policies. Option D is wrong because a full ARP table would prevent the FortiGate from learning new ARP entries, but it would not stop the FortiGate from responding to ARP requests for its own IP address; the device always replies to ARP requests for its own configured IPs regardless of table capacity.

824
MCQmedium

An admin wants to block malicious files detected by FortiSandbox at the FortiGate level. Which configuration is required on the FortiGate to automatically block files based on FortiSandbox verdict?

A.Enable Threat Feeds on FortiGate and subscribe to FortiSandbox feeds
B.Enable 'FortiSandbox inline prevention' in the antivirus profile
C.Configure an Automation Stitch that triggers on malware detected events and blocks the source IP
D.Configure a security policy with a Web Filter profile that blocks malware categories
AnswerB

This setting allows the FortiGate to block files immediately based on FortiSandbox verdicts.

Why this answer

Enabling 'FortiSandbox inline prevention' in the antivirus profile allows FortiGate to automatically block files based on the verdict received from FortiSandbox. When this option is enabled, the FortiGate will hold the file until the sandbox analysis completes, then either allow or block the file based on the verdict (e.g., malware detected). This is the direct configuration for automatic file blocking at the gateway level.

Exam trap

The trap here is that candidates confuse reactive automation (Option C) with proactive inline prevention, or mistake web filtering (Option D) for file-based sandbox verdict enforcement.

How to eliminate wrong answers

Option A is wrong because Threat Feeds are used to consume external threat intelligence (e.g., IP reputation lists), not to block files based on FortiSandbox verdicts; FortiSandbox feeds are not a standard subscription for file blocking. Option C is wrong because an Automation Stitch that blocks the source IP after malware detection is a reactive, post-infection response, not a real-time file blocking mechanism at the FortiGate level. Option D is wrong because a Web Filter profile blocks URLs or web categories, not individual files based on sandbox verdicts; malware categories in web filtering are URL-based, not file-based.

825
MCQhard

In FortiManager, what is the purpose of an automation stitch?

A.To combine multiple ADOMs into a single management domain
B.To trigger automated actions based on predefined events
C.To automatically deploy configuration changes to devices
D.To stitch together multiple policy packages into one
AnswerB

Automation stitches respond to events with actions like scripts or notifications.

Why this answer

An automation stitch in FortiManager is a sequence of automated actions triggered by a predefined event, such as a log message, SNMP trap, or schedule. It allows administrators to define a set of actions (e.g., run a script, send an alert, or change a policy) that execute in response to specific conditions, streamlining incident response and network management without manual intervention.

Exam trap

The trap here is that candidates confuse automation stitches with FortiManager's automatic policy deployment or ADOM management features, mistakenly thinking the stitch is about pushing configurations or merging domains rather than event-driven reaction.

How to eliminate wrong answers

Option A is wrong because combining multiple ADOMs into a single management domain is not a function of an automation stitch; that is achieved through ADOM federation or merging, not through event-driven automation. Option C is wrong because automatically deploying configuration changes to devices is a broader capability of FortiManager's provisioning and policy installation workflows, not the specific purpose of an automation stitch, which focuses on reactive actions based on events. Option D is wrong because stitching together multiple policy packages into one is not a feature of automation stitches; policy package consolidation is done via policy import/export or manual merging, not through event-triggered automation.

Page 10

Page 11 of 13

Page 12