Fortinet NSE 7 Advanced Security NSE7 NSE7 Questions 826–900 | Page 12/13

826

MCQmedium

A network admin notices that files submitted to FortiSandbox are not being analyzed. The FortiGate is configured to send files to FortiSandbox. What is the MOST likely cause?

A.FortiSandbox license is expired

B.FortiGate firewall policy is blocking the connection to FortiSandbox on port 443

C.FortiSandbox is in quarantine mode

D.File size exceeds the maximum submission size limit on FortiGate

AnswerA

An expired license prevents analysis. The file submission queue will accumulate.

Why this answer

The most likely cause is an expired FortiSandbox license. When the license expires, FortiSandbox stops analyzing submitted files and may reject new submissions, even though the FortiGate is configured to send them. The FortiGate will still attempt to forward files, but FortiSandbox will not process them, resulting in no analysis results being returned.

Exam trap

The trap here is that candidates assume connectivity or configuration issues (like firewall rules or file size limits) are the cause, but FortiSandbox will still accept submissions with an expired license and simply not analyze them, making the license status the most likely root cause.

How to eliminate wrong answers

Option B is wrong because FortiGate uses port 514 (syslog) or a dedicated API port (typically 443 for HTTPS) to communicate with FortiSandbox, but a firewall policy blocking port 443 would prevent the initial connection, not cause files to be submitted but not analyzed. Option C is wrong because quarantine mode on FortiSandbox isolates detected threats but does not prevent file analysis; files are still analyzed before being quarantined. Option D is wrong because if the file size exceeds the maximum submission size limit on FortiGate, the file would not be sent to FortiSandbox at all, whereas the issue is that files are submitted but not analyzed.

Full explanation →

827

MCQmedium

A FortiGate administrator needs to inspect traffic between two VLANs in the same VDOM. The administrator has configured a firewall policy that applies an antivirus profile, but traffic is passing without inspection. What should the administrator check first?

A.The FortiGuard subscription status

B.Whether the antivirus profile is configured to use flow-based inspection

C.The antivirus profile's scan mode

D.That the firewall policy's source and destination interfaces match the VLAN interfaces

AnswerD

If the policy uses wrong interfaces, traffic may be matched by a different policy or by implicit deny.

Why this answer

The most common reason for traffic passing without inspection in a VDOM is a misconfiguration in the firewall policy's interface matching. Since the traffic is between two VLANs, the policy must explicitly specify the correct source and destination VLAN interfaces. If the policy uses the wrong interfaces (e.g., a physical interface instead of the VLAN subinterface), the traffic will bypass the policy and its associated security profiles entirely.

Exam trap

The trap here is that candidates often jump to troubleshooting the antivirus profile itself (e.g., subscription, inspection mode, or scan settings) instead of verifying the fundamental policy matching, which is the first thing to check in any traffic inspection issue.

How to eliminate wrong answers

Option A is wrong because the FortiGuard subscription status affects signature updates and cloud-based lookups, but it does not prevent an already configured antivirus profile from being applied to traffic that matches a policy. Option B is wrong because flow-based inspection is a valid mode for antivirus, and if the profile is configured correctly, traffic would still be inspected; the issue here is that the policy itself is not matching the traffic. Option C is wrong because the scan mode (e.g., quick, normal, or full) controls the depth of scanning, not whether the profile is applied at all; traffic would still be inspected regardless of the scan mode if the policy matched.

Full explanation →

828

Multi-Selectmedium

An administrator is troubleshooting an IPsec VPN tunnel that uses PKI certificates for authentication. The tunnel fails to establish. The administrator checks the certificates and finds that the local certificate is valid and the CA certificate is trusted. Which two additional checks should the administrator perform? (Choose TWO)

Select 2 answers

A.Verify that the certificate is installed in the local certificate store on the FortiGate

B.Ensure that the certificate is using RSA 2048-bit keys

C.Confirm that the certificate's private key is exportable

D.Verify that the certificate's CN matches the peer's IP address

E.Check the certificate revocation list (CRL) to ensure the certificate is not revoked

AnswersD, E

The CN (or SAN) must match the peer identifier used in IKE.

Why this answer

Common certificate issues include: the certificate's Common Name (CN) does not match the peer's IP address, or the certificate has expired. Also, the certificate must have the 'IPsec tunnel' extended key usage (EKU) and the subject alternate name (SAN) must include the peer's IP.

Full explanation →

829

MCQhard

A FortiGate has two WAN links and uses ECMP load balancing for default routes. The administrator wants to ensure that all packets belonging to the same TCP session go out the same interface. Which setting should be enabled?

A.Persistent NAT

B.ECMP source-destination-ip hash

C.ECMP with source-ip hash

D.ECMP with 'session-based' algorithm

AnswerD

Session-based ECMP uses a hash of the 5-tuple (src IP, dst IP, protocol, src port, dst port) to ensure all packets of a session use the same interface.

Why this answer

The 'session-based' algorithm (also known as 'source-ip-based' or 'ECMP with session-based' in FortiOS) ensures that all packets belonging to the same TCP session are forwarded out the same interface by hashing the 5-tuple (source IP, destination IP, source port, destination port, protocol). This guarantees session stickiness across ECMP paths, preventing out-of-order delivery and TCP retransmissions. Option D is correct because it directly addresses the requirement for per-session interface consistency.

Exam trap

The trap here is that candidates often confuse 'source-ip hash' or 'source-destination-ip hash' with session-based stickiness, but FortiOS requires the 'session-based' algorithm to include Layer 4 port information in the hash, which is the only way to guarantee per-session path consistency in ECMP.

How to eliminate wrong answers

Option A is wrong because Persistent NAT is a NAT feature that maintains the same source IP/port for all connections from a host, but it does not control ECMP path selection or ensure session stickiness across WAN links. Option B is wrong because ECMP source-destination-ip hash uses only source and destination IP addresses for hashing, which can cause packets from the same TCP session to take different paths if the source or destination IP changes (e.g., due to NAT or asymmetric routing), breaking session affinity. Option C is wrong because ECMP with source-ip hash uses only the source IP address, which is insufficient for session stickiness when multiple sessions share the same source IP (e.g., from a single client), as it may still spread packets across interfaces for different sessions but does not guarantee per-session consistency.

Full explanation →

830

Multi-Selectmedium

An administrator wants to protect against zero-day malware that has not yet been discovered by signature-based detection. Which TWO technologies can help mitigate such threats?

Select 2 answers

A.Machine Learning Engine

B.Outbreak Prevention

C.Signature-based antivirus

D.Web filtering

E.Application control

AnswersA, B

ML engine analyzes file characteristics to detect unknown malware.

Why this answer

The Machine Learning Engine (A) is correct because it uses behavioral analysis and static file analysis to detect previously unknown malware based on patterns and anomalies, without relying on signatures. This allows it to identify zero-day threats by analyzing file characteristics and runtime behavior in real time.

Exam trap

The trap here is that candidates often confuse Outbreak Prevention with signature-based antivirus, but Outbreak Prevention uses cloud-based reputation and sandboxing, not static signatures, to block emerging threats.

Full explanation →

831

MCQhard

You have configured VRF on a FortiGate with two VRFs: VRF 1 for guest traffic and VRF 2 for corporate traffic. You want to allow limited communication from guests to a corporate DNS server. What is the correct configuration step?

A.Create a firewall policy from VRF 1 to VRF 2 allowing DNS traffic

B.Enable 'set allow-vrf' on the DNS server's interface

C.Configure route leaking between VRF 1 and VRF 2 for the DNS server's IP

D.Place the DNS server in a management VDOM and use inter-VDOM links

AnswerC

Route leaking allows one VRF to know routes of another, enabling inter-VRF communication.

Why this answer

VRF isolation by default prevents traffic from crossing between VRFs. To allow a guest in VRF 1 to reach a corporate DNS server in VRF 2, you must leak the DNS server's route from VRF 2 into VRF 1. This is achieved by configuring route leaking (e.g., using route maps or VRF route leaking on FortiGate), which installs the DNS server's IP prefix into the guest VRF's routing table, enabling reachability without breaking VRF separation for other traffic.

Exam trap

The trap here is that candidates assume a firewall policy between VRFs is sufficient, but without route leaking, the source VRF has no route to the destination, so the firewall policy never sees the traffic.

How to eliminate wrong answers

Option A is wrong because a firewall policy alone cannot forward traffic between VRFs; VRFs are separate routing tables, and inter-VRF traffic requires route leaking to make the destination reachable in the source VRF's routing table. Option B is wrong because 'set allow-vrf' is not a valid FortiGate command; FortiGate uses route leaking or inter-VRF policies with proper routing, not an interface-level VRF permission flag. Option D is wrong because placing the DNS server in a management VDOM and using inter-VDOM links is an unnecessary and complex approach for a simple DNS access requirement; VRF route leaking is the correct and lightweight method for inter-VRF communication within the same VDOM.

Full explanation →

832

MCQhard

A FortiGate in NAT mode has a VDOM with interface port1 (10.0.1.0/24) and port2 (203.0.113.0/24). A policy allows traffic from port1 to port2 with source NAT using the IP of port2. A user at 10.0.1.10 initiates a connection to a web server at 198.51.100.1. What will be the source IP after NAT?

A.The IP address of port2 (e.g., 203.0.113.1)

B.A random IP from the port2 subnet

C.10.0.1.10

D.198.51.100.1

AnswerA

Why this answer

When source NAT is configured to use the IP address of the egress interface (port2), the FortiGate performs dynamic PAT (Port Address Translation) and translates the source IP of the packet to the primary IP address of port2 (203.0.113.1). This is the default behavior when 'set srcaddr' is set to the interface IP in the firewall policy. The user at 10.0.1.10 will therefore appear to the web server at 198.51.100.1 as coming from 203.0.113.1.

Exam trap

The trap here is that candidates often assume source NAT uses a random IP from the subnet (Option B) or forget that the source IP must be the egress interface IP, leading them to select the original private IP (Option C) or the destination IP (Option D).

How to eliminate wrong answers

Option B is wrong because source NAT with 'IP of port2' does not use a random IP from the subnet; it uses the specific primary IP of the egress interface, not a pool or dynamic assignment. Option C is wrong because 10.0.1.10 is the original private source IP, which is translated by NAT; without NAT, the packet would be dropped or unroutable on the public internet. Option D is wrong because 198.51.100.1 is the destination web server IP, not the source; confusing source and destination addresses is a common error.

Full explanation →

833

MCQhard

A FortiGate is configured with multiple IPsec VPNs to remote branches. One of the branch VPN tunnels goes down frequently. The administrator runs 'diagnose vpn ike log' and sees repeated INITIAL_CONTACT notifications from the remote peer. What does this indicate?

A.The remote peer is rekeying the VPN tunnel

B.The local FortiGate has a mismatched pre-shared key

C.A dead peer detection timeout occurred

D.The remote peer has rebooted or restarted its VPN service

AnswerD

INITIAL_CONTACT is sent after a peer loses its state, typically due to reboot or IKE process restart. The local peer should delete old SAs and accept new ones.

Why this answer

INITIAL_CONTACT is a notify message sent by an IKE peer to indicate that it has rebooted or lost its state. When the remote peer sends this, it means the peer has restarted, causing the tunnel to re-establish. This is normal behavior after a reboot but if frequent, indicates instability at the remote end.

Full explanation →

834

MCQeasy

An administrator wants to use FortiManager to push a new firewall policy to a managed FortiGate. Before installing, the administrator wants to review what changes will be applied. Which FortiManager feature should be used?

A.Install Preview

B.Policy & Objects - Install Wizard

C.Configuration Rollback

D.Revision History

AnswerA

Install Preview displays the CLI commands that will be executed, enabling pre-installation review.

Why this answer

Install Preview (Option A) is the correct feature because it allows the administrator to see a detailed, side-by-side comparison of the current configuration on the managed FortiGate versus the pending changes that FortiManager will push. This preview is generated by FortiManager's policy compilation engine, which calculates the exact CLI commands and object modifications required to synchronize the device database (ADOM) with the managed FortiGate. It provides a safe, non-disruptive way to validate changes before committing them, reducing the risk of misconfiguration.

Exam trap

The trap here is that candidates often confuse the Install Wizard (which guides the installation process) with Install Preview (which shows the actual changes), leading them to select Option B thinking it includes a review step, but the Install Wizard does not generate a detailed diff of pending modifications.

How to eliminate wrong answers

Option B (Policy & Objects - Install Wizard) is wrong because the Install Wizard is used to select the target devices and initiate the actual installation of policies and objects, not to preview the specific changes that will be applied; it does not provide a granular diff view. Option C (Configuration Rollback) is wrong because rollback is a recovery mechanism used to revert a FortiGate to a previous configuration revision after an installation has occurred, not a tool for previewing pending changes. Option D (Revision History) is wrong because Revision History stores past configuration snapshots for audit and rollback purposes, but it does not show the delta between the current device state and the pending changes in FortiManager's database.

Full explanation →

835

MCQmedium

A FortiGate is configured with SD-WAN using BGP. The administrator wants to influence outbound traffic to prefer one SD-WAN member over another based on BGP attributes. Which BGP attribute, when modified on the FortiGate, can achieve this for outbound traffic?

A.Local-preference

B.Weight

C.AS-Path prepending

D.MED

AnswerA

Local-preference is used to influence outbound traffic within the local AS. Higher local-preference makes a route more preferred for outbound traffic.

Why this answer

Local-preference is a well-known mandatory BGP attribute that is propagated within an AS to influence outbound traffic by indicating the preferred exit point. When modified on the FortiGate, a higher local-preference value makes the route more preferred for outbound traffic, allowing the administrator to steer traffic toward a specific SD-WAN member without affecting inbound routing.

Exam trap

The trap here is that candidates often confuse outbound and inbound traffic influence, mistakenly selecting AS-Path prepending or MED, which are designed to affect how other ASes route traffic toward the local network, not how the local FortiGate chooses its outbound path.

How to eliminate wrong answers

Option B (Weight) is wrong because weight is a Cisco-proprietary attribute that is local to the router and not supported in FortiGate's BGP implementation; FortiGate uses local-preference for similar outbound path selection. Option C (AS-Path prepending) is wrong because it influences inbound traffic by making the AS path longer, discouraging others from sending traffic to that router, not outbound traffic from the FortiGate. Option D (MED) is wrong because MED is a non-transitive attribute used to influence inbound traffic from neighboring ASes by suggesting a preferred entry point, not for outbound traffic control within the local AS.

Full explanation →

836

MCQhard

An administrator runs the following CLI output: 'diagnose sys session filter dport 443' and sees 'proto=6 proto_state=01 duration=3600 expire=3599'. Which statement BEST describes the session?

A.The session is in the process of being torn down

B.The session is established and has been active for one hour

C.The session is a UDP session incorrectly classified as TCP

D.The TCP session is still in the SYN-SENT state

AnswerB

proto_state=01 indicates an established TCP session; duration=3600 seconds equals one hour.

Why this answer

The session shows 'proto=6' (TCP), 'proto_state=01' (TCP_ESTABLISHED), and 'duration=3600' seconds, which equals one hour. The 'expire=3599' indicates the session has 3599 seconds left before timeout, confirming it is active and established. Option B correctly identifies this as an established session that has been active for one hour.

Exam trap

The trap here is that candidates may misinterpret 'proto_state=01' as a starting state or teardown state, when in Fortinet's session table it specifically represents TCP_ESTABLISHED, and the combination of duration and expire values confirms the session is active and not in transition.

How to eliminate wrong answers

Option A is wrong because 'proto_state=01' indicates TCP_ESTABLISHED, not a teardown state; a session being torn down would show a state like TCP_FIN_WAIT or TCP_CLOSE. Option C is wrong because 'proto=6' explicitly indicates TCP, not UDP (which would be proto=17), and the state '01' is a valid TCP established state, not a misclassification. Option D is wrong because 'proto_state=01' corresponds to TCP_ESTABLISHED, not SYN-SENT (which would be state '02' or '03' depending on the Fortinet implementation); the session has already completed the three-way handshake.

Full explanation →

837

MCQeasy

An administrator wants to load balance traffic across two ISP links using SD-WAN. The requirement is that sessions from the same source IP address must always use the same ISP link. Which SD-WAN load balancing algorithm should be used?

A.Source-destination IP

B.Sessions

C.Volume

D.Spillover

AnswerA

This algorithm hashes source and destination IP to consistently select the same member for flows between the same two hosts.

Why this answer

The Source-destination IP algorithm creates a hash based on both the source and destination IP addresses, ensuring that all packets belonging to sessions from the same source IP to the same destination IP are consistently forwarded over the same ISP link. This meets the requirement of session persistence for traffic from a given source IP without relying on stateful inspection or session tracking.

Exam trap

The trap here is that candidates often confuse 'source IP persistence' with 'session-based load balancing' and select 'Sessions' (Option B), not realizing that Sessions algorithm distributes individual sessions arbitrarily and does not guarantee that all sessions from the same source IP use the same link.

How to eliminate wrong answers

Option B (Sessions) is wrong because it distributes traffic based on the number of active sessions, not on source IP consistency, so a source IP could use different ISP links for different sessions. Option C (Volume) is wrong because it balances based on traffic volume (bytes transferred), which has no correlation with source IP stickiness and can cause sessions from the same source to be split across links. Option D (Spillover) is wrong because it sends traffic to a secondary link only when the primary link's bandwidth threshold is exceeded, which does not guarantee that sessions from the same source IP always use the same ISP link.

Full explanation →

838

MCQmedium

A network administrator configures SD-WAN on a FortiGate with two WAN members (port1, port2). They set up a performance SLA to measure latency to 8.8.8.8. The SLA shows both members are 'alive'. However, traffic matching an SD-WAN rule with 'best quality' strategy is not using the lowest-latency link. What is the MOST likely cause?

A.Both WAN members have the same cost in the SD-WAN configuration

B.The SD-WAN rule is configured with 'manual' strategy

C.The SD-WAN rule has 'set-match' enabled for source IP

D.The performance SLA does not have 'latency' as the first metric in the priority order

AnswerD

Best quality uses the configured metric order; if latency is not first, another metric determines the selection.

Why this answer

The 'best quality' strategy selects the link with the highest priority based on the performance SLA's metric order. If latency is not the first metric in the priority list (e.g., jitter or packet loss is first), the algorithm will prefer the link that best satisfies the first metric, not necessarily the lowest latency. Thus, even though both links are alive, the link with lower latency may be deprioritized if it performs worse on the first metric.

Exam trap

The trap here is that candidates assume 'best quality' always means lowest latency, but FortiGate's implementation uses a configurable metric priority order, so the first metric in the list determines the 'best' link, not latency by default.

How to eliminate wrong answers

Option A is wrong because equal cost does not affect the 'best quality' strategy; cost is used for load-balancing strategies like 'lowest cost', not for quality-based selection. Option B is wrong because a 'manual' strategy would require explicit interface selection and would not use SLA metrics at all, so the scenario of SLA showing 'alive' would be irrelevant. Option C is wrong because 'set-match' for source IP is a matching condition for the rule, not a factor in how the 'best quality' strategy selects the link; it only determines which traffic is subject to the rule.

Full explanation →

839

MCQeasy

An administrator is configuring a FortiGate HA cluster and wants to ensure that the cluster can tolerate a failure of one unit without administrative intervention. The cluster must also support upgrading firmware with minimal downtime. Which HA mode should the administrator select?

A.Standalone mode

B.Active-active HA

C.Active-passive HA

D.FGCP mode

AnswerC

Provides automatic failover and supports rolling firmware upgrades.

Why this answer

Active-passive HA (option C) is correct because it provides automatic failover without administrative intervention when a unit fails, and it supports hitless firmware upgrades by upgrading the standby unit first, then performing a failover to make it active, followed by upgrading the original active unit. This mode uses a single management IP and synchronizes configuration and session state between the primary and backup units, ensuring minimal downtime during both failure and upgrade scenarios.

Exam trap

The trap here is that candidates confuse FGCP (the protocol) with an HA mode, leading them to select option D, when FGCP is simply the underlying mechanism used by both active-active and active-passive modes, not a mode itself.

How to eliminate wrong answers

Option A is wrong because standalone mode offers no redundancy or failover capability, so a single unit failure causes complete service loss. Option B is wrong because active-active HA distributes traffic across all units but does not inherently support hitless firmware upgrades without additional complexity and potential session loss; it also requires careful load-balancing configuration and may not meet the 'minimal downtime' upgrade requirement as cleanly as active-passive. Option D is wrong because FGCP (FortiGate Cluster Protocol) is not an HA mode but the underlying protocol that enables both active-active and active-passive HA; selecting FGCP alone does not specify the operational mode needed for automatic failover and minimal-downtime upgrades.

Full explanation →

840

Multi-Selectmedium

A FortiGate administrator is deploying a multi-VDOM setup for a service provider. The provider wants each customer VDOM to have its own administrative access, yet the overall device management (including firmware upgrades) should be centralized from the management VDOM. Which TWO statements are true regarding administrative VDOMs?

Select 2 answers

A.The management VDOM can be used to manage all other VDOMs

B.Traffic VDOMs cannot have any administrative access

C.Each VDOM must have a separate management IP address

D.The management VDOM is responsible for device-level functions like firmware upgrades

E.An administrator assigned to one VDOM can automatically view configurations of other VDOMs

AnswersA, D

By default, the management VDOM (or any admin with super_admin profile) can access all VDOMs.

Why this answer

The management VDOM in a multi-VDOM FortiGate setup is specifically designed to provide centralized management. Administrators logged into the management VDOM can use the `execute` commands or the GUI to manage all other VDOMs, including configuration changes and monitoring, without needing to log into each VDOM individually.

Exam trap

The trap here is that candidates often assume traffic VDOMs cannot have any administrative access, but FortiGate allows per-VDOM admin accounts for delegated management, as long as the administrator is assigned to that specific VDOM.

Full explanation →

841

MCQeasy

What is the primary purpose of Dead Peer Detection (DPD) in an IPsec VPN configuration?

A.To establish a backup tunnel in case the primary tunnel fails.

B.To detect if a VPN peer is alive by sending periodic probes and bringing down the tunnel if no response is received.

C.To automatically renegotiate IKE phase1 keys before they expire.

D.To verify the integrity of encrypted packets using HMAC authentication.

AnswerB

Why this answer

DPD sends keepalive messages to detect peer reachability. If the peer does not respond, the tunnel is marked down, allowing failover. Key renegotiation is handled by IKE lifetime settings, not DPD.

Full explanation →

842

MCQmedium

An administrator configures a ZTNA rule with an inline CASB profile to protect access to a SaaS application. The rule uses a ZTNA tag that requires 'OS Type = Windows' and 'Antivirus = running'. A user with a Windows 10 device and Symantec antivirus running is denied access. What is the MOST likely cause?

A.The user's device is not connected to the corporate network.

B.The inline CASB profile is blocking all traffic from the ZTNA rule.

C.The ZTNA tag requires the FortiClient EMS to be installed on the device.

D.The Symantec antivirus is not listed in the FortiGate's supported antivirus list.

AnswerD

Why this answer

The ZTNA tag requires 'Antivirus = running', which means the FortiGate must receive a compliance report from the FortiClient EMS indicating that a supported antivirus is active. Symantec is not in FortiGate's supported antivirus list, so the EMS reports the antivirus status as 'not compliant', causing the ZTNA rule to deny access even though the user has antivirus running.

Exam trap

The trap here is that candidates assume any running antivirus satisfies the 'Antivirus = running' condition, but FortiGate only recognizes antivirus products that are explicitly supported and reported by FortiClient EMS.

How to eliminate wrong answers

Option A is wrong because ZTNA access control is based on device posture tags from FortiClient EMS, not on network connectivity; the user can be off-network and still be evaluated. Option B is wrong because an inline CASB profile applies content inspection and policy enforcement to the SaaS traffic, but it does not block all traffic from the ZTNA rule; it only acts on traffic that matches the rule's conditions. Option C is wrong because the ZTNA tag does not require FortiClient EMS to be installed on the device; FortiClient EMS is the server-side management system, while the FortiClient agent (or a supported third-party EPP) must be installed on the device to report compliance.

Full explanation →

843

MCQmedium

A network admin runs 'diagnose sys top' on a FortiGate and sees that the process 'httpsd' is consistently using 95% CPU. Which of the following actions is MOST appropriate to troubleshoot this issue?

A.Restart the FortiGate firewall engine with 'diagnose test application fgwbd 255'

B.Disable the antivirus profile on all policies to reduce processing load

C.Increase the log rate to capture more details about the httpsd process

D.Check the number of active admin sessions and consider stopping the web GUI service temporarily

AnswerD

httpsd handles web management; high CPU may be due to many admin sessions or a stuck process.

Why this answer

The httpsd process handles the FortiGate web GUI (HTTPS) and API requests. High CPU usage by httpsd typically indicates excessive admin sessions or web GUI activity. Option D is correct because checking active admin sessions and temporarily stopping the web GUI service (e.g., via 'config system global set admin-https-redirect disable' or stopping the service) directly addresses the likely cause without disrupting firewall processing or requiring policy changes.

Exam trap

The trap here is that candidates may confuse the httpsd process with the firewall engine (fgwbd) and attempt to restart the firewall engine, or assume high CPU is always due to security profiles, when in fact httpsd is a management-plane process that requires a different troubleshooting approach.

How to eliminate wrong answers

Option A is wrong because 'diagnose test application fgwbd 255' restarts the firewall engine (fgwbd), which handles firewall processing, not the httpsd process; this would disrupt traffic without addressing the root cause. Option B is wrong because disabling antivirus profiles on all policies reduces security and does not affect the httpsd process, which is a web server process unrelated to AV scanning. Option C is wrong because increasing the log rate adds overhead to the system and does not provide diagnostic details specific to httpsd; logs for httpsd are already captured in the event log and increasing rate would worsen CPU usage.

Full explanation →

844

MCQmedium

An administrator is configuring a FortiGate HA cluster in active-passive mode. The company has two ISPs, and the primary FortiGate is connected to ISP1 and ISP2. The secondary FortiGate is connected only to ISP2. The administrator wants to ensure that failover occurs only if both ISP1 and ISP2 connections are lost on the primary device. Which configuration approach should be used?

A.Use gateway monitoring with virtual router failover, and set the failure threshold to 2.

B.Configure gateway monitoring on the primary for ISP1 only, and set the HA failover threshold to 1.

C.Set the HA priority of the primary to 1 and the secondary to 0, and enable link-fail-signal on both ISP interfaces on the primary.

D.Set the HA priority of the primary to 1 and the secondary to 0, and enable link-fail-signal on both ISP interfaces on the primary, then set 'set ha-priority 1' on the primary and 'set ha-priority 0' on the secondary.

AnswerD

This ensures that the primary's priority drops to 0 only when both ISP links fail, since link-fail-signal reduces priority by 1 for each failed link.

Why this answer

It uses link-fail-signal on both ISP interfaces of the primary FortiGate to detect physical link loss, and sets HA priorities (primary=1, secondary=0) so that failover occurs only when both ISP links are down. Link-fail-signal triggers an HA failover only when the monitored interface loses carrier, and since both ISP1 and ISP2 interfaces are monitored, the primary will only relinquish control when both links fail, meeting the requirement.

Exam trap

The trap here is that candidates often confuse link-fail-signal with gateway monitoring or assume that setting HA priorities alone is sufficient, overlooking the need to explicitly enable link-fail-signal on the specific interfaces to trigger failover based on link status.

How to eliminate wrong answers

Option A is wrong because gateway monitoring with virtual router failover monitors reachability to a gateway IP, not physical link status, and setting a failure threshold of 2 would require two consecutive failures on a single monitored gateway, not both ISPs. Option B is wrong because configuring gateway monitoring on ISP1 only would cause failover if ISP1 alone fails, even if ISP2 is still up, violating the requirement that both ISPs must be lost. Option C is wrong because it sets HA priority but does not include the 'set ha-priority' commands on the interfaces; the description is incomplete and the syntax is incorrect for the actual configuration needed.

Full explanation →

845

MCQmedium

A FortiGate administrator wants to implement Content Disarm and Reconstruction (CDR) for email attachments. Which security profile must be configured to enable CDR?

A.Web Filter profile

B.Antivirus profile

C.IPS profile

D.Application Control profile

AnswerB

CDR is part of the antivirus profile; it disarms and reconstructs files to remove active content.

Why this answer

Content Disarm and Reconstruction (CDR) is a security feature that removes active content (e.g., macros, scripts, embedded objects) from files and reconstructs them into a safe version. In FortiOS, CDR is configured within the Antivirus profile because it operates as part of the antivirus scanning engine, specifically under the 'File Filter' or 'Content Disarm' tab, where you can enable CDR for supported file types like Office documents and PDFs.

Exam trap

The trap here is that candidates mistakenly associate CDR with Web Filter (thinking it's a web content sanitization feature) or IPS (confusing it with file-based exploit prevention), when in fact CDR is a file-level sanitization feature tightly integrated with the antivirus engine and configured within the Antivirus profile.

How to eliminate wrong answers

Option A is wrong because Web Filter profiles control HTTP/HTTPS URL access and content categorization, not email attachment processing or file-level content sanitization. Option C is wrong because IPS profiles focus on network-based intrusion prevention by inspecting traffic for exploit signatures and anomalies, not on file reconstruction or active content removal. Option D is wrong because Application Control profiles manage application visibility and usage policies (e.g., blocking or allowing specific apps like Skype or Dropbox), not file attachment scanning or CDR operations.

Full explanation →

846

MCQhard

An admin configures a FortiManager ADOM for a customer with multiple FortiGates. The admin wants to use meta fields to group firewalls by location. After defining a meta field 'Location' and assigning values to devices, where can the admin use the meta field for policy targeting?

A.Meta fields are automatically synced to FortiGate and used in firewall policies

B.In the ADOM level policy package, meta fields are used as variables in policy names

C.Meta fields are only used for generating reports in FortiAnalyzer

D.In the installation target of a policy package, the admin can filter devices by meta field values

AnswerD

This allows policy packages to be targeted to specific groups of devices based on meta fields.

Why this answer

In FortiManager, meta fields are used within ADOM-level policy packages to filter devices during installation targeting. This allows the admin to select only FortiGates with a specific 'Location' meta field value, enabling policy targeting based on location without manual device grouping.

Exam trap

The trap here is that candidates often assume meta fields are automatically propagated to FortiGate devices or used in policy definitions, but FortiManager treats them strictly as administrative metadata for filtering and targeting during installation, not as runtime variables on the FortiGate.

How to eliminate wrong answers

Option A is wrong because meta fields are not automatically synced to FortiGate devices; they remain within FortiManager for administrative grouping and targeting, and are not used directly in FortiGate firewall policies. Option B is wrong because meta fields cannot be used as variables in policy names; they are used for filtering devices in installation targets, not for naming policies. Option C is wrong because meta fields are not limited to FortiAnalyzer reporting; they are primarily used in FortiManager for device grouping and policy targeting.

Full explanation →

847

MCQeasy

An administrator wants to monitor real-time CPU usage per process on a FortiGate. Which command should be used?

A.diagnose hardware sysinfo cpu

B.get system performance status

C.diagnose sys top

D.show system performance monitor

AnswerC

This command displays a real-time list of processes and their resource usage.

Why this answer

The 'diagnose sys top' command on FortiGate displays real-time CPU usage per process, similar to the Linux 'top' command. This is the standard diagnostic tool for monitoring per-process CPU and memory consumption in real time, which directly meets the administrator's requirement.

Exam trap

The trap here is that candidates may confuse 'diagnose sys top' with 'get system performance status' or 'diagnose hardware sysinfo cpu', which provide aggregate CPU data but not per-process granularity, leading to an incorrect choice when the question explicitly asks for per-process monitoring.

How to eliminate wrong answers

Option A is wrong because 'diagnose hardware sysinfo cpu' shows overall CPU utilization and hardware information, not per-process breakdown. Option B is wrong because 'get system performance status' provides a summary of system performance metrics (e.g., CPU, memory, sessions) but does not list individual processes. Option D is wrong because 'show system performance monitor' is not a valid FortiGate CLI command; the correct command for a performance monitor view is 'diagnose sys perf' or 'diagnose sys top'.

Full explanation →

848

Multi-Selectmedium

A network administrator is configuring a hub-and-spoke ADVPN with BGP over the VPN tunnels. Which TWO conditions are necessary for the spokes to establish direct shortcut tunnels between each other?

Select 2 answers

A.The spokes must have identical phase2 proposals

B.BGP must be configured on all FortiGates (hub and spokes) to exchange routing information

C.The spokes must use the same IKE version

D.The hub must be configured with 'set next-hop-self disable' for the spoke BGP neighbors

E.The hub must have static routes for each spoke's LAN subnet

AnswersB, D

BGP is used to propagate routes. Each spoke learns the other spoke's subnets via BGP from the hub.

Why this answer

Shortcut tunnels require that the hub propagates routes without setting itself as next-hop (next-hop-self disabled), and that spokes have overlapping routing information so they know the other spoke's subnet via BGP. Options B and D are correct: BGP must be configured on all spokes to exchange routes, and the hub must not set next-hop-self so that the next-hop remains the remote spoke's tunnel IP.

Full explanation →

849

MCQmedium

A company uses FortiWeb as a reverse proxy for their web application. They want to protect against SQL injection attacks. Which FortiWeb feature should be configured?

A.Enable 'SQL Injection Prevention' in the Web Protection Profile

B.Enable 'IPS Sensor' with SQL injection signatures

C.Use the FortiGate WAF profile instead

D.Configure a custom HTTP header validation rule

AnswerA

FortiWeb has predefined signatures for SQL injection.

Why this answer

FortiWeb's Web Protection Profile includes a dedicated 'SQL Injection Prevention' module that uses signature-based and behavioral analysis to detect and block SQL injection attempts at the application layer. This is the correct feature because FortiWeb is a web application firewall (WAF) designed specifically for HTTP/HTTPS traffic, and SQL injection protection is a core WAF function, not a general IPS or network-layer feature.

Exam trap

The trap here is that candidates assume IPS signatures can handle SQL injection because they see 'SQL injection' in signature names, but they overlook that FortiWeb's dedicated module provides application-layer decoding and context that a generic IPS sensor lacks.

How to eliminate wrong answers

Option B is wrong because IPS Sensors on FortiGate or FortiWeb are designed for network-layer attack detection (e.g., protocol anomalies, buffer overflows) and lack the application-layer context (e.g., HTTP parameter parsing, URL decoding) needed to reliably detect SQL injection. Option C is wrong because the FortiGate WAF profile is a simplified subset of FortiWeb's capabilities; it does not include the granular SQL injection prevention engine or the dedicated signature database that FortiWeb offers. Option D is wrong because custom HTTP header validation rules only inspect header fields, not the request body or URL parameters where SQL injection payloads typically reside.

Full explanation →

850

Multi-Selectmedium

A FortiGate administrator is troubleshooting an IKEv2 VPN tunnel that fails to establish. The remote peer logs show 'no acceptable proposal' error. Which TWO possible causes should the administrator check?

Select 2 answers

A.The remote peer's IP address is unreachable

B.The phase1 encryption algorithm or integrity algorithm is mismatched

C.The local FortiGate has the wrong IKE version configured

D.The remote peer's pre-shared key is incorrect

E.The Diffie-Hellman group configured is not supported by both peers

AnswersB, E

If the local and remote proposals do not have a common algorithm, negotiation fails with 'no acceptable proposal'.

Why this answer

The 'no acceptable proposal' error occurs when the two peers cannot agree on a set of parameters. Common causes are mismatched encryption/integrity algorithms (phase1 proposal) or mismatched Diffie-Hellman groups.

Full explanation →

851

MCQmedium

When troubleshooting a FortiGate that is not synchronizing configuration to its HA peer, which command should be used to check the HA synchronization status?

A.diagnose sys ha sync-status

B.get system ha status

C.diagnose sys ha status

D.show system ha

AnswerB

This command displays HA cluster status, sync state, and last sync error.

Why this answer

'get system ha status' is the standard operational command on FortiGate to display the current HA synchronization status, including whether the configuration is synchronized, the HA mode, and the peer status. This command provides a clear, human-readable output that directly indicates if the configuration is in sync or out of sync, which is essential for troubleshooting synchronization issues.

Exam trap

The trap here is that candidates confuse the diagnostic command 'diagnose sys ha status' (which shows raw internal HA data) with the operational command 'get system ha status' (which shows the synchronization status in a clear format), leading them to choose option C instead of the correct B.

How to eliminate wrong answers

Option A is wrong because 'diagnose sys ha sync-status' is not a valid FortiGate command; the correct diagnostic command for detailed HA synchronization debugging is 'diagnose sys ha dump sync-status' or similar, but this option is a distractor that does not exist. Option C is wrong because 'diagnose sys ha status' is a valid diagnostic command but it shows raw internal HA state information, not the user-friendly synchronization status; it is used for deep debugging, not for quickly checking sync status. Option D is wrong because 'show system ha' is a Cisco-style command, not a FortiGate command; FortiGate uses 'get' for operational status and 'show' is not used in the FortiOS CLI.

Full explanation →

852

Multi-Selecteasy

An administrator is configuring BGP with SD-WAN on a FortiGate. Which TWO statements are true about BGP and SD-WAN integration? (Choose two.)

Select 2 answers

A.BGP must be disabled on interfaces used for SD-WAN

B.BGP learned routes cannot be used as SD-WAN members

C.SD-WAN performance SLA can override BGP best path selection

D.SD-WAN rules can use BGP attributes such as AS path to influence path selection

E.BGP route redistribution is not supported with SD-WAN

AnswersC, D

SD-WAN can choose a different path based on SLA metrics.

Why this answer

SD-WAN performance SLA rules can override BGP best path selection by steering traffic over a different SD-WAN member interface, even if BGP would have chosen a different path. This is achieved through SD-WAN rules that match traffic and apply an action like 'best quality' or 'lowest cost', which takes precedence over the BGP routing table decision.

Exam trap

The trap here is that candidates often assume BGP always dictates the forwarding path in an SD-WAN setup, but FortiGate's SD-WAN rules can override BGP best path selection based on performance SLA metrics.

Full explanation →

853

MCQmedium

An administrator configured an SD-WAN rule to steer traffic to a specific member interface using the 'lowest-cost' strategy. After applying, the traffic is not being load-balanced as expected. Which configuration element is MOST likely missing?

A.The 'best-quality' strategy was inadvertently selected instead.

B.A performance SLA has not been assigned to the SD-WAN member interfaces.

C.The SD-WAN member interfaces are not in the same zone.

D.The 'update-static-route' option is disabled on the SD-WAN member.

AnswerB

The lowest-cost strategy relies on performance SLA metrics to determine cost. Without an SLA, the cost is not calculated.

Why this answer

The 'lowest-cost' strategy in Fortinet SD-WAN selects the member interface with the lowest cost value. However, without a performance SLA assigned to the SD-WAN member interfaces, the SD-WAN rule cannot dynamically measure link quality or update interface costs based on real-time conditions. As a result, the rule defaults to static cost values or may not load-balance traffic at all, because the SLA is required to trigger cost-based path selection and failover.

Assigning an SLA enables the FortiGate to monitor link performance and adjust the effective cost, allowing proper load balancing across multiple members.

Exam trap

The trap here is that candidates often assume the 'lowest-cost' strategy inherently load-balances across multiple interfaces with the same cost, but without a performance SLA, the FortiGate does not dynamically adjust costs or distribute traffic, leading to a single active path and no load balancing.

How to eliminate wrong answers

Option A is wrong because the 'best-quality' strategy selects the interface with the best SLA performance metrics (e.g., lowest latency or jitter), not cost; the administrator explicitly configured 'lowest-cost', so an inadvertent selection of 'best-quality' would change the strategy entirely, not cause a missing load-balance behavior due to missing SLA configuration. Option C is wrong because SD-WAN member interfaces do not need to be in the same zone; zones are used for firewall policy grouping, not for SD-WAN load balancing or cost-based steering. Option D is wrong because the 'update-static-route' option controls whether the FortiGate automatically updates static routes when an SD-WAN member interface goes down; disabling it would affect failover behavior but not prevent load balancing when the interfaces are up.

Full explanation →

854

MCQhard

A FortiGate administrator configures a hub-and-spoke ADVPN network. Spokes are behind NAT. After deployment, spokes can communicate with each other only through the hub. What must be configured to allow spokes to establish direct shortcut tunnels?

A.Enable auto-negotiate on the IPsec phase1 interface

B.Configure NAT traversal on the hub's phase1

C.Set 'add-route' to 'enable' on the hub's ADVPN configuration

D.Add a firewall policy allowing IKE from spoke to spoke

AnswerC

Why this answer

For shortcut tunnels to be established, the hub must have 'add-route' enabled so that it advertises routes to other spokes. Without this, spokes will not know how to reach each other directly and will continue to route through the hub.

Full explanation →

855

Multi-Selectmedium

An administrator is configuring SD-WAN and wants to ensure that voice traffic uses the lowest latency link. Which two configurations are required to achieve this? (Choose TWO.)

Select 2 answers

A.Configure a static route for the voice subnet

B.Configure a performance SLA with latency threshold

C.Set the SD-WAN rule to use 'manual' strategy

D.Create an SD-WAN rule that matches voice traffic and uses 'best quality' strategy

E.Enable NAT on the SD-WAN interface

AnswersB, D

The SLA measures latency and marks link quality.

Why this answer

A performance SLA with a latency threshold allows FortiGate to measure real-time latency to a target server and mark the link quality. Option D is correct because an SD-WAN rule using the 'best quality' strategy will dynamically select the link with the lowest latency (as determined by the SLA) for voice traffic, ensuring optimal voice quality.

Exam trap

The trap here is that candidates often confuse 'manual' strategy with 'best quality', assuming manual allows manual selection of the best link, but manual actually forces a fixed interface without dynamic SLA feedback.

Full explanation →

856

MCQeasy

An administrator wants to create a separate virtual firewall instance on a FortiGate to isolate a DMZ environment. The DMZ must have its own routing table, firewall policies, and administrators. Which FortiGate feature should be used?

A.Virtual Domains (VDOMs)

B.Virtual Router Redundancy Protocol (VRRP)

C.Virtual LANs (VLANs)

D.Security Fabric

AnswerA

VDOMs create separate virtual firewalls with independent configuration.

Why this answer

Virtual Domains (VDOMs) are the FortiGate feature that allows the creation of multiple independent virtual firewalls within a single physical appliance. Each VDOM operates with its own separate routing table, firewall policies, and administrative domains, making it the correct choice for isolating a DMZ environment with dedicated administrators and routing.

Exam trap

The trap here is that candidates often confuse VLANs (Layer 2 segmentation) with VDOMs (full virtual firewall instances), mistakenly thinking VLANs alone can provide independent routing tables and administrative domains, which they cannot.

How to eliminate wrong answers

Option B (VRRP) is wrong because VRRP is a first-hop redundancy protocol (RFC 5798) that provides high availability for default gateways, not a mechanism to create separate virtual firewall instances with independent routing and policies. Option C (VLANs) is wrong because VLANs operate at Layer 2 to segment broadcast domains and do not provide separate routing tables, firewall policies, or administrative domains; they require a VDOM or similar construct to achieve full isolation at Layer 3 and above. Option D (Security Fabric) is wrong because the Security Fabric is a framework for centralized management and threat sharing across multiple FortiGate devices, not a feature that creates isolated virtual firewall instances on a single unit.

Full explanation →

857

Multi-Selecthard

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. Phase 1 seems to complete, but Phase 2 fails with 'no proposal chosen'. The administrator checks the Phase 2 configuration and sees the following settings: 'Local address: 10.0.0.0/24, Remote address: 192.168.0.0/24, Proposal: aes256-sha1, Enable Perfect Forward Secrecy (PFS): Disabled'. Which TWO changes would most likely resolve the issue? (Choose two.)

Select 2 answers

A.Enable PFS on FortiGate

B.Verify that the Phase 2 selectors match exactly on both sides

C.Change the local address to 10.0.0.0/8

D.Add aes256-sha256 to the Phase 2 proposal

E.Increase the Phase 2 lifetime

AnswersA, B

If the remote side requires PFS, FortiGate must enable it to match.

Why this answer

When PFS is enabled on one side but disabled on the other, Phase 2 will fail with 'no proposal chosen'. PFS requires both peers to agree on the Diffie-Hellman (DH) group used for generating new keying material. If the remote peer requires PFS and the FortiGate has it disabled, the proposal mismatch causes the failure.

Exam trap

The trap here is that candidates often focus on encryption algorithms or lifetimes when 'no proposal chosen' appears, but the most common root causes are PFS mismatch and selector mismatch, not the cipher suite itself.

Full explanation →

858

MCQhard

A FortiGate has two equal-cost paths to a destination network. ECMP is enabled. The administrator notices that all traffic uses the first path. What is the most likely cause?

A.ECMP is configured with 'spillover' mode

B.The second path is administratively down

C.ECMP is configured to use 'source-dest-ip' hash and all sessions are from same source to same destination

D.The route metric is not equal

AnswerC

That hash would send all to same path.

Why this answer

When ECMP is configured with the 'source-dest-ip' hash algorithm, traffic is load-balanced based on a hash of both source and destination IP addresses. If all sessions originate from the same source IP and go to the same destination IP, the hash value is identical for every session, causing all traffic to be forwarded over the same path. This is the most likely cause because the administrator sees all traffic using the first path despite ECMP being enabled.

Exam trap

The trap here is that candidates assume ECMP always distributes traffic evenly across all paths, but they overlook that the hash algorithm's behavior depends on the diversity of source-destination pairs; when all sessions share the same IP pair, the hash produces the same result, causing all traffic to follow one path.

How to eliminate wrong answers

Option A is wrong because 'spillover' mode is an SD-WAN feature that shifts traffic to another path only when a bandwidth threshold is exceeded, but it does not cause all traffic to use a single path by default; it would still distribute traffic until the threshold is reached. Option B is wrong because if the second path were administratively down, the route would not be present in the routing table as an equal-cost path, and ECMP would not consider it; the question states two equal-cost paths exist. Option D is wrong because the question explicitly states the paths have equal cost, so the route metric is equal; unequal metrics would prevent ECMP from load-balancing, but that contradicts the given condition.

Full explanation →

859

MCQmedium

An IPS administrator wants to detect a new custom attack that sends malformed HTTP headers. The attack pattern is a specific sequence of bytes that is not covered by existing signatures. What is the BEST way to detect this attack on FortiGate?

A.Use an automation stitch to block traffic with unusual headers

B.Enable protocol anomaly detection in the IPS sensor

C.Deploy FortiWeb as a reverse proxy

D.Create a custom IPS signature

AnswerD

Custom signatures match specific content patterns defined by the administrator.

Why this answer

Custom IPS signatures allow you to define a specific byte sequence or pattern (e.g., via a regular expression or hex pattern) that matches the malformed HTTP header. FortiGate's IPS engine can then inspect HTTP traffic at the application layer and trigger an alert or block when the custom pattern is found, even if no existing signature covers it.

Exam trap

The trap here is that candidates confuse protocol anomaly detection (which catches generic RFC violations) with the ability to detect a specific, custom byte sequence, leading them to choose Option B instead of understanding that custom signatures are required for precise pattern matching.

How to eliminate wrong answers

Option A is wrong because automation stitches are used to automate responses to detected events (e.g., quarantine a source IP), not to detect new attack patterns; they rely on existing detection mechanisms. Option B is wrong because protocol anomaly detection in the IPS sensor detects deviations from RFC standards (e.g., malformed HTTP headers in a generic sense), but it cannot match a specific, custom byte sequence that the administrator defines. Option C is wrong because deploying FortiWeb as a reverse proxy adds a separate web application firewall, which is not the most direct or efficient way to detect a custom attack on FortiGate; it also requires additional hardware or licensing and does not leverage the existing IPS engine.

Full explanation →

860

MCQmedium

A FortiGate with SD-WAN enabled uses two members: MPLS (10 ms latency) and Internet (40 ms latency). The SD-WAN rule uses 'Best Quality' strategy with latency as the metric. Traffic to a critical application (10.1.1.0/24) is currently using the MPLS link. The MPLS link's latency increases to 60 ms due to a routing issue. How will FortiGate handle new sessions to 10.1.1.0/24?

A.New sessions will use the Internet link; existing sessions continue on MPLS.

B.FortiGate will wait for the MPLS link to recover before sending new traffic.

C.All sessions immediately switch to the Internet link.

D.Existing sessions continue on MPLS; new sessions will use MPLS until the next SLA probe.

AnswerA

Best Quality uses SLA metrics to steer new sessions to the best member, but does not affect existing sessions.

Why this answer

The 'Best Quality' strategy with latency metric selects the link with the lowest latency for new sessions. When MPLS latency rises to 60 ms, it exceeds the Internet link's 40 ms, so new sessions will be steered to the Internet. However, SD-WAN does not preemptively rehash existing sessions; they remain on the original link (MPLS) until they expire or are torn down.

Exam trap

The trap here is that candidates assume SD-WAN automatically re-routes all traffic (including existing sessions) when link quality degrades, but in reality, only new sessions are affected unless a session-based failover mechanism like session TTL or manual intervention is configured.

How to eliminate wrong answers

Option B is wrong because FortiGate does not wait for link recovery; it actively selects the best link based on current SLA metrics. Option C is wrong because SD-WAN does not force an immediate failover of all sessions; only new sessions are affected by the updated latency measurement. Option D is wrong because new sessions are evaluated immediately based on the latest SLA probe results, not deferred until the next probe cycle.

Full explanation →

861

MCQmedium

An administrator configures a FortiGate to integrate with FortiSandbox for inline scanning. The policy has an antivirus profile with FortiSandbox enabled. What condition must be met for files to be submitted to FortiSandbox?

A.The antivirus profile must use proxy-based inspection mode

B.The FortiSandbox must be on the same subnet as the FortiGate

C.The FortiGate must be in NAT mode

D.SSL inspection must be disabled

AnswerA

Proxy-based inspection is required for inline FortiSandbox file submission.

Why this answer

For files to be submitted to FortiSandbox during inline scanning, the antivirus profile must use proxy-based inspection mode. This is because proxy-based inspection allows the FortiGate to buffer the entire file, perform deep analysis, and then forward it to FortiSandbox for verdict-based blocking. Flow-based inspection, in contrast, streams packets and cannot hold files for submission, making proxy mode a prerequisite for inline FortiSandbox integration.

Exam trap

The trap here is that candidates assume flow-based inspection is sufficient for inline sandboxing, but FortiGate explicitly requires proxy-based inspection to buffer and submit files for verdict-based blocking.

How to eliminate wrong answers

Option B is wrong because FortiSandbox does not need to be on the same subnet as the FortiGate; it can be located anywhere reachable via network, and communication uses HTTPS (port 443) or FortiSandbox-specific protocols. Option C is wrong because the FortiGate can operate in NAT mode or transparent mode for FortiSandbox integration; NAT mode is not a requirement. Option D is wrong because SSL inspection must be enabled (not disabled) to decrypt HTTPS traffic and allow the antivirus profile to inspect files within encrypted sessions for FortiSandbox submission.

Full explanation →

862

MCQeasy

An administrator wants to use FortiGate as a SAML identity provider (IdP) for a third-party service. Which configuration is required on FortiGate?

A.Enable SAML authentication in the firewall policy

B.Configure FortiAuthenticator as an external IdP

C.Configure a SAML identity provider user and export FortiGate's metadata

D.Configure a SAML service provider user and import the SP metadata

AnswerC

FortiGate as IdP requires creating an IdP user and sharing its metadata with the SP.

Why this answer

FortiGate can act as an IdP by creating a SAML IdP user and configuring the service provider metadata.

Full explanation →

863

Multi-Selectmedium

An administrator is planning a multi-VDOM deployment with a management VDOM. Which TWO statements about management VDOMs are correct? (Choose two.)

Select 2 answers

A.The management VDOM can be used for FortiGuard updates

B.The management VDOM cannot have firewall policies

C.The management VDOM requires a separate license

D.The management VDOM can host the GUI and SSH services

E.All user traffic must pass through the management VDOM

AnswersA, D

Correct.

Why this answer

The management VDOM is specifically designed to handle administrative traffic, including FortiGuard updates. By isolating FortiGuard communications to the management VDOM, administrators ensure that security updates and threat intelligence downloads do not interfere with or consume bandwidth from the data VDOMs, and they can be centrally managed from a single VDOM.

Exam trap

The trap here is that candidates often assume a management VDOM cannot have firewall policies or requires a separate license, but in reality, it can have policies for administrative access and does not incur additional licensing costs.

Full explanation →

864

MCQmedium

An enterprise FortiGate is configured with multiple VDOMs, including a management VDOM. The admin logs in to the management VDOM and wants to create a new VDOM and assign interfaces. However, the 'config vdom' command requires entering a VDOM name that is not 'root'. What is the correct next step?

A.Configure a VDOM link between the management VDOM and the new VDOM

B.Use the 'config vdom' command directly in the management VDOM CLI

C.Run 'config global' from the management VDOM to enter the global context

D.Reboot the FortiGate in multi-VDOM mode

AnswerC

The management VDOM can access the global context via 'config global' to create VDOMs and assign interfaces.

Why this answer

The management VDOM operates within the multi-VDOM context, but VDOM creation and interface assignment are global-level operations. The 'config vdom' command to create a new VDOM must be executed from the global configuration context, not from within any VDOM (including the management VDOM). Therefore, the admin must first run 'config global' to exit the management VDOM and enter the global context, where VDOMs can be created and managed.

Exam trap

The trap here is that candidates assume the management VDOM has elevated privileges to create other VDOMs, but in FortiOS, VDOM management is strictly a global-level operation, not a VDOM-level operation.

How to eliminate wrong answers

Option A is wrong because a VDOM link is used to connect two existing VDOMs for traffic forwarding, not to create a new VDOM or assign interfaces. Option B is wrong because 'config vdom' within a VDOM (including the management VDOM) only allows entering an existing VDOM's configuration; it does not permit creating a new VDOM or assigning interfaces, as those operations require global context. Option D is wrong because the FortiGate is already in multi-VDOM mode (as indicated by the presence of multiple VDOMs); rebooting does not change the context needed to create a new VDOM.

Full explanation →

865

MCQmedium

An administrator configures a FortiGate in transparent mode for a VDOM. After switching to transparent mode, the administrator notices that the default route disappears and traffic fails. What must be configured to restore routing?

A.A static route on the upstream router

B.A management IP address and default gateway for the VDOM

C.Enable NAT mode to allow routing

D.Assign an IP address to each interface

AnswerB

Why this answer

In transparent mode, a FortiGate VDOM acts as a Layer 2 bridge and does not participate in Layer 3 routing. The default route disappears because the VDOM has no Layer 3 interface to host a routing table. To restore management connectivity and allow the FortiGate to reach remote networks (e.g., for firmware updates or logging), you must configure a management IP address and a default gateway for the VDOM.

This management IP is used solely for outbound management traffic and does not affect the bridged data plane.

Exam trap

The trap here is that candidates assume transparent mode still requires per-interface IPs or static routes for the data plane, when in fact only a single management IP and default gateway are needed for the FortiGate's own control-plane traffic.

How to eliminate wrong answers

Option A is wrong because configuring a static route on the upstream router does not provide the FortiGate itself with a default gateway; the FortiGate in transparent mode has no routed interfaces and cannot use an upstream router's route for its own management traffic. Option C is wrong because NAT mode is a separate operational mode (Layer 3) and cannot be enabled within a transparent-mode VDOM; transparent mode inherently disables routing and NAT. Option D is wrong because assigning an IP address to each interface in transparent mode is not supported; only a single management IP is assigned to the VDOM, not per-interface IPs.

Full explanation →

866

MCQhard

A security admin notices that FortiClient ATP is not blocking threats on a managed endpoint. The FortiClient is registered with FortiGate and the ATP feature is enabled in the FortiClient profile. What is the most likely cause?

A.The FortiGate's antivirus signatures are outdated

B.The FortiClient endpoint has a different antivirus product installed that conflicts

C.The FortiGate antivirus profile applied to the FortiClient policy has 'Scan on Access' disabled

D.FortiClient is in standalone mode instead of managed mode

AnswerC

ATP relies on on-access scanning to block threats immediately.

Why this answer

FortiClient ATP (AntiVirus/AntiMalware) relies on the FortiGate's antivirus profile to enforce real-time scanning. Even if the ATP feature is enabled in the FortiClient profile, the 'Scan on Access' setting in the FortiGate antivirus profile applied to the FortiClient policy must be enabled for the endpoint to block threats on access. If 'Scan on Access' is disabled, FortiClient will not perform real-time scanning, allowing threats to go undetected despite ATP being enabled.

Exam trap

The trap here is that candidates assume enabling the ATP feature in the FortiClient profile is sufficient for real-time blocking, overlooking that the FortiGate antivirus profile's 'Scan on Access' setting is the actual control that enables real-time scanning on the endpoint.

How to eliminate wrong answers

Option A is wrong because outdated FortiGate antivirus signatures would affect detection of new threats but would not prevent ATP from blocking threats entirely; the feature would still attempt to block based on available signatures. Option B is wrong because FortiClient is designed to coexist with other antivirus products; it can operate in a 'passive' mode or be configured to disable real-time scanning if a conflict is detected, but this is not the most likely cause given the ATP feature is enabled and the endpoint is managed. Option D is wrong because the question states the FortiClient is registered with FortiGate, which implies it is in managed mode; standalone mode would not allow registration or profile application.

Full explanation →

867

Multi-Selectmedium

An administrator wants to use policy-based routing to forward traffic from subnet 192.168.1.0/24 to a specific next-hop via port2. Which TWO configuration elements are needed?

Select 2 answers

A.An SD-WAN rule overriding the routing decision.

B.A route-map that matches the source subnet and sets the next-hop.

C.A static route with a higher administrative distance.

D.A prefix-list matching 192.168.1.0/24.

E.A firewall policy matching the traffic with action 'accept'.

AnswersB, D

PBR uses route-maps to match and set next-hop.

Why this answer

Policy-based routing (PBR) on FortiGate uses a route-map to override the normal routing table lookup. Option B is correct because the route-map must match the source subnet (e.g., via a prefix-list or access-list) and set the next-hop to the desired gateway. Option D is also correct because a prefix-list is the standard method to define the subnet match condition within the route-map.

Exam trap

The trap here is that candidates often confuse PBR with static routing or SD-WAN rules, mistakenly thinking a static route with higher administrative distance or an SD-WAN rule can achieve the same next-hop override, but PBR requires explicit route-map and prefix-list configuration.

Full explanation →

868

Multi-Selecthard

Which TWO configurations are required to enable SSL VPN authentication using a RADIUS server on a FortiGate?

Select 2 answers

A.Create a user group that includes the RADIUS server as an authentication method

B.Configure an LDAP server to synchronize user accounts

C.Configure an SSL VPN portal with 'Require Authentication' enabled

D.Define the RADIUS server under User & Authentication > RADIUS Servers

E.Set a local password policy for SSL VPN users

AnswersA, D

A user group ties the RADIUS server to SSL VPN authentication.

Why this answer

A user group must be created to reference the RADIUS server as an authentication method. This group is then applied to the SSL VPN portal or firewall policy, allowing FortiGate to forward authentication requests to the RADIUS server. Without the user group, the RADIUS server cannot be associated with SSL VPN authentication.

Exam trap

The trap here is that candidates often think configuring the RADIUS server alone is sufficient, but FortiGate requires the user group to link the RADIUS server to the SSL VPN authentication process.

Full explanation →

869

MCQeasy

A FortiGate is configured as a ZTNA proxy for a web application. Users report that after authenticating, they receive a '502 Bad Gateway' error. What is the most likely cause?

A.The backend server is unreachable from the FortiGate.

B.The ZTNA proxy is not configured with a valid SSL certificate.

C.The user's device posture is not compliant.

D.The ZTNA rule is not using the correct source interface.

AnswerA

Correct. A 502 Bad Gateway error means the ZTNA proxy (FortiGate) received the request but could not get a valid response from the backend server, indicating the backend is unreachable.

Why this answer

The 502 Bad Gateway error indicates that the ZTNA proxy successfully received the request but could not get a valid response from the backend server. Therefore, the most likely cause is that the backend server is unreachable from the FortiGate (option A). The other options would result in different errors.

Full explanation →

870

Multi-Selectmedium

A network administrator is configuring SD-WAN on a FortiGate to control outbound internet traffic. The requirement is to load balance traffic across two WAN interfaces (port1 and port2) based on the number of new sessions, but only when both links are healthy. The administrator has added both interfaces to the SD-WAN zone and configured performance SLAs. Which TWO additional configuration steps are necessary to implement this requirement?

Select 2 answers

A.Enable 'ECMP load balancing' in the routing settings

B.Configure the SD-WAN rule to use a performance SLA for health checking

C.Set the load balancing algorithm to 'sessions' in the SD-WAN rule for the traffic

D.Configure a policy-based routing rule to direct traffic to the SD-WAN zone

E.Set the 'sla-check' under config system sdwan to 'enable'

AnswersB, C

Why this answer

Configuring a performance SLA for health checking in the SD-WAN rule ensures that the FortiGate monitors link quality (latency, jitter, packet loss) and only considers links that meet the SLA thresholds as active for traffic distribution. This satisfies the requirement that load balancing occurs only when both links are healthy. Option C is correct because setting the load balancing algorithm to 'sessions' in the SD-WAN rule ensures that traffic is distributed based on the number of new sessions, as required.

Without Option C, the default algorithm (e.g., source-destination IP) would not meet the session-based requirement. Options A, D, and E are incorrect: ECMP load balancing (A) is a routing-level feature independent of SD-WAN rules; policy-based routing (D) is not needed when using SD-WAN rules; and the global 'sla-check' enable (E) activates SLA monitoring but does not apply the per-rule health check and algorithm configuration required here.

Exam trap

The trap here is that candidates often confuse the global 'sla-check' enable command (Option E) with the per-rule SLA configuration, or they assume ECMP load balancing (Option A) is required for SD-WAN, when in fact SD-WAN uses its own load balancing algorithms and health checks independent of ECMP.

Full explanation →

871

MCQeasy

An administrator observes that after a failover in an HA cluster, some established sessions are dropped. The cluster is configured with session pickup enabled. What is the most likely reason for the dropped sessions?

A.The failover occurred during a configuration synchronization

B.The HA uptime is less than the session TTL

C.Session pickup only synchronizes TCP sessions, and the dropped sessions are UDP

D.The session helper for the protocol is not enabled

AnswerC

Session pickup by default only synchronizes TCP sessions. UDP and other protocols are not preserved during failover.

Why this answer

Session pickup in FortiGate HA synchronizes state information for TCP sessions by default, but UDP sessions are not synchronized because they are connectionless and do not have a stateful handshake. When a failover occurs, the new primary unit does not have the UDP session state, causing those sessions to be dropped. This is a known limitation of session pickup, which only covers TCP sessions unless specifically configured for UDP via session-ttl or other mechanisms.

Exam trap

The trap here is that candidates assume session pickup covers all session types equally, but Fortinet specifically limits default synchronization to TCP sessions, and the question tests awareness of this protocol-specific behavior.

How to eliminate wrong answers

Option A is wrong because configuration synchronization occurs independently of session pickup and does not cause established sessions to drop during failover; it ensures configuration consistency, not session state. Option B is wrong because HA uptime being less than session TTL would affect session persistence only if session pickup were disabled or incomplete, but with session pickup enabled, sessions are synchronized regardless of TTL. Option D is wrong because session helpers are used for application-layer protocol inspection (e.g., FTP, SIP) and are not required for basic UDP session pickup; the issue is that UDP sessions are not synchronized by default, not that a helper is missing.

Full explanation →

872

MCQmedium

An email security administrator wants to prevent attackers from spoofing the company's domain. Which email authentication mechanism should be configured to allow receiving servers to verify that emails claiming to be from the domain are sent from authorized mail servers?

A.DMARC

B.SPF

C.TLS for SMTP

D.DKIM

AnswerB

SPF records list authorized sending IPs or hostnames.

Why this answer

SPF (Sender Policy Framework) is the correct answer because it allows domain owners to publish DNS records specifying which mail servers are authorized to send email on behalf of their domain. Receiving servers can then verify the envelope sender (Return-Path) against the SPF record to detect spoofed messages. This directly addresses the requirement to verify that emails claiming to be from the domain originate from authorized servers.

Exam trap

In Fortinet NSE7 exams, a common trap is confusing DMARC's policy enforcement with the actual verification of sending server authorization, leading candidates to select DMARC instead of SPF. Remember that SPF is the mechanism that explicitly lists authorized mail servers via DNS TXT records.

How to eliminate wrong answers

Option A is wrong because DMARC is a policy framework that builds on SPF and DKIM results to instruct receivers on how to handle authentication failures (e.g., quarantine or reject), but it does not itself verify the sending server's authorization. Option C is wrong because TLS for SMTP encrypts the communication channel between mail servers (RFC 3207) but provides no mechanism to verify the sender's domain or authorization. Option D is wrong because DKIM uses a digital signature linked to a domain to verify message integrity and signing domain, but it does not verify whether the sending server is authorized to send mail for that domain.

Full explanation →

873

MCQhard

A FortiGate administrator configures a custom IPS signature with the pattern 'attack' in the HTTP request URI. After applying the signature, no alerts are generated even though the traffic matches. What is the MOST likely cause?

A.The signature's protocol decoder is set to 'HTTP'

B.The signature action is set to 'pass'

C.The signature's protocol decoder is not set to 'HTTP'

D.The signature severity is too low

AnswerC

Without proper decoder, the pattern is not matched in HTTP URI.

Why this answer

The custom IPS signature pattern 'attack' will only be inspected against the HTTP request URI if the signature's protocol decoder is explicitly set to 'HTTP'. Without this decoder assignment, the IPS engine does not know which protocol layer to parse, and the pattern is never matched against the URI, resulting in no alerts despite matching traffic.

Exam trap

The trap here is that candidates often assume a signature will automatically inspect all traffic or that the 'pass' action suppresses alerts, when in fact the protocol decoder is a mandatory prerequisite for any application-layer pattern matching in FortiGate IPS.

How to eliminate wrong answers

Option A is wrong because setting the protocol decoder to 'HTTP' is exactly what is required for the signature to inspect HTTP request URIs; this would enable alerts, not prevent them. Option B is wrong because a 'pass' action would allow the traffic but still generate a log entry (alert) by default unless logging is disabled; the question states no alerts are generated, so action alone is not the cause. Option D is wrong because signature severity does not affect whether an alert is generated; severity only influences the event's priority in logs and reports, not the detection or alerting process.

Full explanation →

874

MCQmedium

A network administrator configures a hub-and-spoke ADVPN with FortiGates. Phase 1 and phase 2 settings are correct, and spoke gateways can communicate with the hub. However, shortcut tunnels between spokes are not being established. What is the most likely cause?

A.DPD is disabled on the phase 1 interface

B.The hub FortiGate has 'set auto-discovery-sender enable' configured

C.Dynamic routing (BGP/OSPF) is not configured over the VPN overlay

D.The spoke FortiGates do not have IKEv2 enabled

AnswerC

ADVPN shortcut establishment relies on dynamic routing to exchange spoke routes via the hub. Without it, spokes don't know about each other.

Why this answer

ADVPN requires policy-based routing or routing protocol to propagate routes and trigger shortcut setup. Without a routing protocol like BGP/OSPF, spokes will not learn routes to other spokes, and shortcut negotiation fails.

Full explanation →

875

Multi-Selectmedium

An administrator wants to configure FortiGate to automatically block a source IP when a high-severity IPS event is detected. Which TWO components must be configured? (Choose two.)

Select 2 answers

A.A firewall policy with IPS enabled

B.A FortiGuard category subscription

C.An automation stitch trigger set to 'IPS Event'

D.A static route to the source IP

E.An automation stitch action set to 'Quarantine'

AnswersC, E

Trigger defines when the stitch runs.

Why this answer

An automation stitch trigger set to 'IPS Event' is required to detect the high-severity IPS event and initiate the automated response. Option E is correct because the 'Quarantine' action within the automation stitch is the component that actually blocks the source IP by adding a dynamic block entry to the firewall policy.

Exam trap

The trap here is that candidates often assume enabling IPS on a firewall policy (Option A) is sufficient for automatic blocking, but FortiGate requires an explicit automation stitch to convert detection into an automated quarantine action.

Full explanation →

876

MCQhard

An administrator runs the command 'diagnose sys session filter dport 443' on a FortiGate and sees the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is in SYN_SENT state, meaning the three-way handshake is incomplete

B.The session is fully established and will expire in about 3599 seconds

C.The traffic is being blocked by the firewall policy

D.The session is using HTTPS and has been inspected

AnswerA

State 01 indicates SYN_SENT; the session has not yet received a SYN-ACK.

Why this answer

The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In FortiGate's session table, `proto_state=01` represents the TCP state `SYN_SENT`, which means the session has sent a SYN but has not yet received a SYN-ACK, so the three-way handshake is incomplete. The `expire=3599` indicates the session will time out in 3599 seconds if the handshake does not complete, but the session is not yet established.

Exam trap

The trap here is that candidates assume `dport 443` and `expire=3599` mean an established HTTPS session, but the `proto_state=01` value explicitly indicates an incomplete handshake, not a fully established connection.

How to eliminate wrong answers

Option B is wrong because `proto_state=01` is not the established state (which would be `08` for ESTABLISHED); a fully established TCP session would show `proto_state=08` and a much shorter expiry (e.g., 3600 seconds for idle timeout). Option C is wrong because the session is present in the session table with a valid state, meaning it is not being blocked by the firewall policy; blocked traffic would not create a session entry at all. Option D is wrong because `dport 443` only indicates the destination port, not that HTTPS inspection has occurred; inspection depends on the firewall policy's SSL inspection profile, not the port number alone.

Full explanation →

877

MCQmedium

An administrator receives an error when trying to create a ZTNA proxy rule: 'The ZTNA proxy rule requires a valid application mapping.' What does this indicate?

A.The FortiClient EMS is not reachable

B.The application mapping object is not defined

C.The SSL certificate is missing

D.The firewall policy is not in place

AnswerB

Each proxy rule must reference an application mapping.

Why this answer

A ZTNA proxy rule maps an external FQDN/port to an internal application. The error means the application mapping (which defines the internal server) is missing or misconfigured.

Full explanation →

878

MCQmedium

A company is implementing Zero Trust Network Access using Fortinet's ZTNA solution. They have deployed a FortiGate as the ZTNA gateway and are using FortiClient as the ZTNA agent. Users report that they can initiate ZTNA connections but the connections drop after a few minutes. The FortiGate logs show that the ZTNA session is being terminated due to a endpoint compliance check failure. Which action should the administrator take to resolve this issue?

A.Review and adjust the endpoint compliance rules in FortiClient EMS.

B.Disable endpoint compliance checks on the FortiGate.

C.Increase the session timeout on the FortiGate ZTNA gateway.

D.Change the authentication method from certificate to LDAP.

AnswerA

Adjusting compliance rules to match the actual endpoint state will allow the connection to persist.

Why this answer

The FortiGate logs explicitly indicate that the ZTNA session is being terminated due to an endpoint compliance check failure. This means the FortiGate is enforcing compliance rules defined in FortiClient EMS, and when the endpoint fails those checks (e.g., missing antivirus updates, firewall disabled), the session is dropped. Reviewing and adjusting the compliance rules in EMS allows the administrator to align the requirements with the actual endpoint posture or correct the misconfiguration causing the failure.

Exam trap

The trap here is that candidates may confuse session timeout (a timer-based disconnect) with compliance enforcement (a policy-based disconnect), leading them to incorrectly choose option C instead of recognizing that the log message directly points to a compliance rule issue in EMS.

How to eliminate wrong answers

Option B is wrong because disabling endpoint compliance checks on the FortiGate would bypass the Zero Trust principle entirely, leaving the network vulnerable to non-compliant endpoints, and does not address the root cause of why compliance checks are failing. Option C is wrong because increasing the session timeout would not prevent the session from being terminated due to a compliance check failure; the timeout controls idle session duration, not compliance enforcement. Option D is wrong because changing the authentication method from certificate to LDAP does not affect endpoint compliance checks; ZTNA session termination due to compliance failure is independent of the authentication method used.

Full explanation →

879

MCQmedium

A FortiGate administrator observes that traffic from an internal user to the internet is being blocked. The firewall policy allows the traffic, and the user can ping external hosts. The administrator runs 'diagnose debug flow' for the user's IP and sees 'session denied by forward policy check'. What is the MOST likely cause?

A.There is an implicit deny policy blocking the traffic

B.The antivirus profile has detected a threat and is blocking the session

C.The user's traffic is being rate-limited by a traffic shaper

D.The user's source IP is in a local-in policy that denies the traffic

AnswerA

The forward policy check indicates that no explicit policy matches the traffic, so it is denied by the implicit deny.

Why this answer

The 'session denied by forward policy check' message in a debug flow output indicates that the session was explicitly denied by a firewall policy check, not by a security profile or rate-limiting mechanism. Since the firewall policy allows the traffic, the most likely cause is the implicit deny policy at the end of the policy list, which blocks any traffic that does not match an explicit allow policy. The ability to ping external hosts suggests ICMP is allowed by a separate policy, while TCP/UDP traffic for other services is hitting the implicit deny.

Exam trap

The trap here is that candidates often confuse 'forward policy check' with local-in policies or security profiles, but the debug flow message specifically points to the firewall policy lookup stage, where the implicit deny is the default action when no explicit allow policy matches.

How to eliminate wrong answers

Option B is wrong because an antivirus profile blocking a threat would generate a 'denied by AV profile' or 'virus detected' message in the debug flow, not 'session denied by forward policy check'. Option C is wrong because rate-limiting by a traffic shaper would not deny the session; it would allow the session but shape the traffic, and the debug flow would show 'traffic shaped' or 'rate limited' messages, not a denial. Option D is wrong because a local-in policy controls traffic destined to the FortiGate itself (e.g., management traffic), not traffic passing through the FortiGate (forward traffic), and the debug flow for forward traffic would not reference local-in policies.

Full explanation →

880

MCQhard

A FortiGate cluster (A-P) has a session that is not synchronizing to the secondary unit. The administrator runs 'diagnose sys ha session-sync status' and sees that the session count is different between primary and secondary. Which is the most likely cause?

A.The session is using a custom application control profile that prevents synchronization.

B.The HA heartbeat interface is down.

C.The secondary unit has insufficient memory to accept new sessions.

D.The session was created by a local-in traffic (e.g., management traffic) which is not synchronized.

AnswerD

Local-in sessions are typically not synced across HA members.

Why this answer

FortiGate A-P clusters synchronize sessions via the HA heartbeat interface, but local-in traffic (e.g., management sessions like HTTPS, SSH, or SNMP) is never synchronized because it is destined to the cluster IP itself and is inherently unit-specific. The 'diagnose sys ha session-sync status' command shows a session count mismatch because the primary unit has local-in sessions that the secondary does not replicate, making D the correct answer.

Exam trap

The trap here is that candidates assume all sessions are synchronized by default, but FortiGate explicitly excludes local-in traffic (management sessions) from HA synchronization, so a session count difference is normal and expected for those sessions.

How to eliminate wrong answers

Option A is wrong because application control profiles do not affect session synchronization; they are inspection profiles applied to traffic policies, and session synchronization is controlled by HA settings and session type, not by security profiles. Option B is wrong because if the HA heartbeat interface were down, the cluster would not be able to maintain a synchronized state at all, and the secondary would likely be isolated or the cluster would split-brain; the question states the cluster is operational with a session count difference, not a total sync failure. Option C is wrong because insufficient memory on the secondary would cause it to reject new sessions or fail to synchronize, but the symptom would be a growing session count mismatch over time, not a persistent difference for a specific session; moreover, the secondary would still attempt synchronization and log memory pressure, not simply skip a session silently.

Full explanation →

881

MCQmedium

An administrator configures BGP over an IPsec VPN between two FortiGates. The BGP session is established, but routes from the remote site are not being installed in the local routing table. The admin verifies that the BGP neighbor configuration is correct and the remote site is advertising routes. What is the MOST likely cause?

A.The BGP timers are too aggressive causing route flapping

B.The BGP network statement is missing on the local FortiGate

C.A firewall policy is blocking BGP traffic on the VPN interface

D.The next-hop IP address is not reachable

AnswerC

The VPN interface or loopback used for BGP peering must have a firewall policy allowing inbound BGP traffic (TCP 179). Without it, BGP packets are dropped even though the VPN tunnel is up.

Why this answer

BGP routes must be allowed by a firewall policy on the loopback or interface used for BGP. Even if the VPN tunnel is up, BGP traffic (TCP port 179) may be blocked by the local-in policy or by the VPN interface's firewall policy if not explicitly allowed.

Full explanation →

882

MCQhard

A FortiGate is running OSPF in a multi-area topology. The administrator needs to redistribute connected routes from area 0 into area 1 but does not want to leak any other routes. Which configuration is correct?

A.Use policy-based routing to forward traffic to the connected networks.

B.Add the connected networks as networks in area 1 using 'network x.x.x.x 255.255.255.0 area 1'.

C.Configure route redistribution under OSPF with 'redistribute connected' and apply a route map that permits only the desired connected networks.

D.Use 'set redistribute connected' under the OSPF interface configuration for the connected interface in area 0.

AnswerC

Using redistribution with a route map allows selective advertisement of only the specified connected routes.

Why this answer

OSPF does not automatically redistribute connected routes between areas; it only advertises routes learned via OSPF. To inject connected routes from area 0 into area 1 without leaking other routes, you must use 'redistribute connected' under OSPF and apply a route map that explicitly permits only the desired connected networks. This ensures that only those specific prefixes are advertised as Type 5 or Type 7 LSAs into area 1, while all other routes remain unaffected.

Exam trap

The trap here is that candidates often confuse OSPF network statements (which enable OSPF on interfaces and advertise directly connected networks) with route redistribution, mistakenly thinking that adding a network statement in area 1 will selectively leak routes from area 0, when in fact network statements only advertise the interface's own subnet and cannot import routes from another area.

How to eliminate wrong answers

Option A is wrong because policy-based routing (PBR) controls forwarding decisions based on traffic attributes, not route advertisement; it cannot inject connected routes into OSPF or control which routes are leaked between areas. Option B is wrong because adding connected networks as networks in area 1 using 'network x.x.x.x 255.255.255.0 area 1' would cause OSPF to advertise those networks as intra-area routes, but it would also include any other networks matched by the network statement, and it does not selectively leak only specific connected routes from area 0; moreover, the connected interface itself is in area 0, so this approach would misrepresent the topology. Option D is wrong because 'set redistribute connected' is not a valid OSPF interface configuration command; redistribution is configured globally under the OSPF process, not per interface, and this option reflects a misunderstanding of where redistribution parameters are applied.

Full explanation →

883

MCQeasy

A FortiGate administrator wants to quickly identify which process is consuming the most CPU on the device. Which CLI command should be used?

A.diagnose hardware sysinfo memory

B.diagnose sys top

C.diagnose debug application crashlog read

D.get system performance status

AnswerB

This command shows real-time process CPU and memory usage, allowing identification of high CPU consumers.

Why this answer

'diagnose sys top' displays a real-time list of running processes sorted by CPU usage, allowing the administrator to quickly identify the most CPU-intensive process. This command is the standard FortiGate CLI tool for live process-level CPU monitoring, similar to the Linux 'top' command.

Exam trap

The trap here is that candidates often confuse 'get system performance status' (which shows aggregate CPU percentage) with the process-level detail needed, leading them to choose option D instead of the correct process-specific command.

How to eliminate wrong answers

Option A is wrong because 'diagnose hardware sysinfo memory' shows memory usage statistics, not CPU consumption by process. Option C is wrong because 'diagnose debug application crashlog read' is used to view crash logs for debugging application failures, not for real-time CPU monitoring. Option D is wrong because 'get system performance status' provides a high-level summary of system resource usage (CPU, memory, sessions) but does not break down CPU usage by individual process.

Full explanation →

884

MCQeasy

Refer to the exhibit. An administrator has configured an active-passive HA cluster. After reviewing the configuration and status, the administrator wants to ensure that the management interface (port2) is accessible on both units using the same IP address. What additional configuration is required?

A.Set the gateway to 0.0.0.0

B.Enable ha-mgmt-status on the secondary unit

C.Configure a virtual management IP under the cluster settings

D.Disable session-pickup to free resources

AnswerC

A virtual IP ensures the management interface is reachable via the same IP on both units.

Why this answer

In an active-passive HA cluster, the management interface (port2) must be reachable on both units using the same IP address. This is achieved by configuring a virtual management IP (also known as a management IP address) under the cluster settings. The virtual management IP is assigned to the active unit and, upon failover, is automatically moved to the new active unit, ensuring continuous management access without requiring separate IP addresses per unit.

Exam trap

The trap here is that candidates often confuse enabling ha-mgmt-status (which allows individual unit management) with configuring a virtual management IP (which provides a single shared IP for the cluster), leading them to incorrectly select Option B.

How to eliminate wrong answers

Option A is wrong because setting the gateway to 0.0.0.0 would remove the default route, making the management interface unreachable from remote networks; it does not provide a shared IP address. Option B is wrong because enabling ha-mgmt-status on the secondary unit only allows the secondary unit to be managed via its own dedicated management IP, not a shared IP address; it does not create a virtual management IP that follows the active unit. Option D is wrong because disabling session-pickup would prevent session synchronization between HA units, degrading failover performance and availability, and has no relation to management interface accessibility.

Full explanation →

885

MCQmedium

A FortiGate is using BFD for BGP fast failure detection. The administrator wants to ensure that if the BFD session goes down, the BGP neighbor is removed and routes are withdrawn immediately. Which configuration is necessary?

A.Enable BFD on the BGP neighbor and ensure BFD timers are set lower than BGP hold time

B.Configure BGP graceful restart

C.Set BGP hold time to 0

D.Use 'set bfd-desired-min-tx 100' on the interface

AnswerA

BFD must be enabled for the BGP neighbor; when BFD detects a failure, it notifies BGP to tear down the session.

Why this answer

BFD provides sub-second failure detection independent of BGP's hold timer. When BFD is enabled on a BGP neighbor and the BFD session goes down, the BGP neighbor is immediately declared dead and all routes from that neighbor are withdrawn, without waiting for the BGP hold timer to expire. This ensures rapid convergence as requested by the administrator.

Exam trap

The trap here is that candidates often think setting low BFD timers alone (Option D) is sufficient, but they forget that BFD must be explicitly enabled on the BGP neighbor configuration to link the BFD session to the BGP session and trigger route withdrawal.

How to eliminate wrong answers

Option B is wrong because BGP graceful restart is designed to preserve routes during a control plane restart, not to accelerate failure detection or withdrawal of routes when a BFD session fails. Option C is wrong because setting the BGP hold time to 0 disables keepalives and hold timers entirely, which would prevent BGP from detecting failures on its own and is not a recommended practice for fast failure detection. Option D is wrong because 'set bfd-desired-min-tx 100' only sets the minimum transmit interval for BFD packets on an interface, but without enabling BFD on the BGP neighbor itself, the BFD session will not be established for that neighbor and will not trigger route withdrawal.

Full explanation →

886

MCQhard

A FortiGate in an HA cluster with VDOMs enabled experiences a failover. After the failover, traffic that was passing before is now being dropped. The configuration is synchronized between the primary and secondary units. What is the most likely reason?

A.The new primary has a different VDOM configuration

B.The firewall policies are not synchronized

C.Session synchronization is not enabled between HA members

D.VDOM link interfaces are down on the new primary

AnswerC

Without session sync, the new primary lacks session information for existing connections, causing drops until clients retransmit.

Why this answer

The most likely reason is that session synchronization is not enabled between HA members. When a failover occurs, the new primary FortiGate does not have the existing session table entries from the original primary, so it treats incoming packets as new connections and may drop them if they do not match a firewall policy's initial handshake state. Even though the configuration is synchronized, session information is not shared unless session synchronization is explicitly configured, causing traffic to be dropped after failover.

Exam trap

The trap here is that candidates assume synchronized configuration includes session state, but FortiGate HA separates configuration sync from session sync, and session synchronization must be enabled as a separate setting under the HA configuration.

How to eliminate wrong answers

Option A is wrong because VDOM configuration is synchronized between HA members, so the new primary has the same VDOM configuration as the old primary. Option B is wrong because the question states that the configuration is synchronized, which includes firewall policies, so they are identical on both units. Option D is wrong because VDOM link interfaces are part of the synchronized configuration and would be in the same state on the new primary; if they were down, the issue would be a configuration or physical problem, not a failover-specific behavior.

Full explanation →

887

MCQmedium

A FortiGate is operating in transparent mode for a VDOM. Which statement about transparent mode is TRUE?

A.Virtual IP (VIP) objects are supported in transparent mode to map public to private IPs

B.The FortiGate operates as a Layer 2 bridge, forwarding frames without modifying source/destination MAC addresses

C.Each interface in the VDOM must have an IP address in the same subnet

D.The VDOM can have multiple IP subnets on the same broadcast domain, and the FortiGate inspects traffic between them

AnswerB

Transparent mode bridges traffic at Layer 2, preserving MAC addresses and performing security inspection.

Why this answer

In transparent mode, a FortiGate VDOM acts as a Layer 2 bridge, forwarding Ethernet frames based on MAC addresses without modifying the source or destination MAC addresses. This allows the FortiGate to inspect traffic between hosts on the same subnet without requiring IP address changes or routing, functioning as a security appliance that is transparent to the network.

Exam trap

The trap here is that candidates often confuse transparent mode with NAT or routing capabilities, assuming VIPs or multi-subnet routing are supported, when in fact transparent mode strictly operates at Layer 2 without IP address manipulation.

How to eliminate wrong answers

Option A is wrong because Virtual IP (VIP) objects are not supported in transparent mode; VIPs require NAT and routing, which are Layer 3 functions, and transparent mode operates strictly at Layer 2. Option C is wrong because interfaces in a transparent mode VDOM do not need IP addresses in the same subnet; they typically have no IP addresses or are assigned management IPs that can be in different subnets, as the FortiGate bridges frames without IP configuration. Option D is wrong because a transparent mode VDOM cannot have multiple IP subnets on the same broadcast domain for inspection; it bridges all traffic within the same broadcast domain and does not perform routing between subnets, which would require Layer 3 forwarding.

Full explanation →

888

MCQmedium

Which command is used on a FortiGate to view the current routing table including VRF instances?

A.show ip route

B.get router info routing-table all

C.diagnose ip route list

D.execute router list

AnswerB

This shows all VRFs routing tables.

Why this answer

'get router info routing-table all' is the FortiGate CLI command that displays the complete routing table, including all VRF instances. This command retrieves the kernel routing table entries for every VRF, showing routes from all routing protocols (static, OSPF, BGP, etc.) and is the standard way to view the full routing context on FortiGate.

Exam trap

The trap here is that candidates familiar with Cisco IOS often default to 'show ip route' (Option A), not realizing that FortiGate uses a completely different CLI syntax where 'get router info' is the equivalent operational command for viewing routing tables.

How to eliminate wrong answers

Option A is wrong because 'show ip route' is a Cisco IOS command, not a FortiGate command; FortiGate uses a different CLI syntax and does not support 'show' for routing table display. Option C is wrong because 'diagnose ip route list' is a FortiGate diagnostic command used for debugging or troubleshooting the routing table, but it is not the standard operational command to view the current routing table including VRF instances; it may show additional internal details but is not the intended production command. Option D is wrong because 'execute router list' is not a valid FortiGate command; FortiGate uses 'execute' for actions like ping or traceroute, not for listing routing tables.

Full explanation →

889

MCQmedium

An administrator configures a VDOM link between VDOMs A and B. In VDOM A, the VDOM link interface is assigned IP 10.10.10.1/24, and in VDOM B, it is assigned 10.10.10.2/24. A firewall policy on VDOM A allows traffic from a subnet in VDOM A to a subnet in VDOM B. However, traffic fails. The admin checks the routing table in VDOM A and sees a route to the destination subnet via 10.10.10.2. What is the most likely cause?

A.No firewall policy in VDOM B to allow traffic from the VDOM link

B.The VDOM link is not administratively up in VDOM B

C.Inter-VDOM routing is disabled globally

D.The subnet in VDOM B is not defined as an address object in VDOM A's policy

AnswerA

Traffic entering VDOM B must be permitted by a policy. If missing, packets are dropped.

Why this answer

In a VDOM link configuration, traffic must be permitted by firewall policies on both VDOMs. Even though VDOM A has a policy allowing traffic to the destination subnet and a valid route via 10.10.10.2, VDOM B must have a policy that allows traffic from the VDOM link interface to reach the destination subnet. Without this policy, VDOM B will drop the packets, causing the traffic failure.

Exam trap

The trap here is that candidates assume a single policy on the source VDOM is sufficient, overlooking that the destination VDOM also requires a policy to permit the traffic, which is a common misconfiguration in multi-VDOM setups.

How to eliminate wrong answers

Option B is wrong because if the VDOM link interface were administratively down in VDOM B, the route in VDOM A would not be present or the link would show as down; the admin sees a valid route via 10.10.10.2, indicating the link is up. Option C is wrong because inter-VDOM routing is enabled by default when VDOMs are configured; disabling it globally would prevent any VDOM-to-VDOM traffic, but the route and policy in VDOM A suggest it is enabled. Option D is wrong because the subnet in VDOM B does not need to be defined as an address object in VDOM A's policy; the policy in VDOM A can reference the destination subnet by IP or address object, and the route confirms the destination is reachable via the VDOM link.

Full explanation →

890

MCQhard

A network administrator is troubleshooting an IPsec VPN between two FortiGates. The phase1 is up, but phase2 keeps failing to establish. The administrator runs 'diagnose vpn ike log' and sees: 'no proposal chosen'. Both sides have the same phase2 configuration: AES256-SHA256, DH group 14, 3600 seconds lifetime. What is the MOST likely cause?

A.The NAT traversal setting is inconsistent

B.The IKE version is different on each side

C.The phase2 local and remote subnets do not match on both sides

D.The pre-shared key is incorrect

AnswerC

The 'no proposal chosen' error in phase2 usually indicates a mismatch in the traffic selectors (subnets). Both sides must have mirroring subnet definitions.

Why this answer

Even if the encryption/authentication proposals match, a common issue is a mismatch in the local and remote subnets (selectors). The phase2 negotiation requires matching traffic selectors. If one side has 192.168.1.0/24 and the other has 10.0.0.0/8, the proposals will be rejected.

Option C is correct.

Full explanation →

891

MCQmedium

An administrator configures a VDOM on a FortiGate and assigns two interfaces (port1, port2) to it. The administrator wants to route traffic between two different subnets within the same VDOM. Which configuration is required?

A.Configure a VDOM link

B.Create a policy with inter-VDOM link

C.Enable inter-VDOM routing

D.Configure static or dynamic routing

AnswerD

Standard routing within the VDOM is sufficient to route between subnets on different interfaces.

Why this answer

Routing between two subnets within the same VDOM is standard intra-VDOM routing. Since both interfaces (port1, port2) belong to the same VDOM, no inter-VDOM constructs are needed; the FortiGate simply requires a route (static or dynamic) to forward packets between the subnets. A firewall policy allowing the traffic is also necessary, but the question specifically asks for the routing configuration.

Exam trap

The trap here is that candidates confuse intra-VDOM routing (within the same VDOM) with inter-VDOM routing (between VDOMs) and incorrectly assume that a VDOM link or inter-VDOM routing must be enabled, when in fact standard routing is sufficient.

How to eliminate wrong answers

Option A is wrong because a VDOM link is used to connect two different VDOMs, not to route between subnets within the same VDOM. Option B is wrong because a policy with inter-VDOM link is a firewall rule that references a VDOM link, again for inter-VDOM traffic, not intra-VDOM routing. Option C is wrong because inter-VDOM routing is a global setting that enables routing between VDOMs; it is irrelevant when both interfaces reside in the same VDOM.

Full explanation →

892

MCQeasy

A FortiGate is connected to a FortiSwitch via a trunk port. The administrator wants to manage the FortiSwitch using FortiLink. Which of the following is a prerequisite for FortiLink to function?

A.The FortiSwitch must be running a firmware version that supports CAPWAP

B.The FortiSwitch must be configured with a DHCP server to assign IP addresses

C.The FortiSwitch must have a management IP in the same subnet as the FortiGate's management IP

D.A dedicated FortiLink interface (physical or VLAN) must be configured on the FortiGate

AnswerD

Why this answer

FortiLink requires a dedicated interface on the FortiGate, either a physical port or a VLAN sub-interface, to establish the proprietary control and management channel with the FortiSwitch. This interface is automatically configured with the necessary FortiLink settings, including an internal management IP range and DHCP server, to discover and manage the switch. Without this dedicated interface, the FortiGate cannot initiate the FortiLink adjacency.

Exam trap

The trap here is that candidates often confuse FortiLink with CAPWAP (Option A) because both involve centralized management, but FortiLink is a layer-2 Ethernet-based protocol specific to FortiSwitch, not a wireless control protocol.

How to eliminate wrong answers

Option A is wrong because FortiLink uses a proprietary protocol over a direct Ethernet or VLAN connection, not CAPWAP, which is used for wireless access point management. Option B is wrong because the DHCP server for FortiSwitch management IP assignment is automatically enabled on the FortiGate's FortiLink interface, not configured on the FortiSwitch itself. Option C is wrong because the FortiSwitch does not require a management IP in the same subnet as the FortiGate's management IP; the FortiLink interface on the FortiGate uses a dedicated link-local subnet (typically 169.254.0.0/16) for switch management.

Full explanation →

893

MCQeasy

Which of the following is a requirement for FortiGate to act as a SAML Identity Provider (IdP) for ZTNA?

A.A public IP address on the WAN interface

B.A configured user database and SAML IdP settings

C.Integration with FortiClient EMS

D.An SSL certificate from a public CA

AnswerB

FortiGate needs users to authenticate and SAML configuration.

Why this answer

FortiGate can be a SAML IdP, providing authentication to service providers. It requires a configured user database (e.g., local users, LDAP) and a SAML IdP profile.

Full explanation →

894

Multi-Selectmedium

A FortiGate administrator is troubleshooting a VPN tunnel that uses IKEv2 with certificate authentication. The tunnel fails to establish, and the IKE debug shows 'no acceptable proposal' for the initial exchange. Which TWO configuration mismatches could cause this error? (Choose two.)

Select 2 answers

A.Mismatched encryption algorithms between the two peers

B.Mismatched phase2 encryption algorithms

C.Mismatched IKE version (IKEv1 vs IKEv2)

D.Incorrect local certificate configuration on one peer

E.Mismatched authentication methods (pre-shared key vs certificate)

AnswersA, E

IKEv2 phase1 encryption must match; e.g., AES256 vs AES128.

Why this answer

'No acceptable proposal' in IKEv2 phase1 indicates a mismatch in proposal parameters. Encryption algorithm mismatch (A) and authentication method mismatch (E: pre-shared key vs certificate) can both cause this error. Phase2 mismatches (B) occur later, not during initial exchange.

Exam trap

The error 'no acceptable proposal' occurs during IKEv2 phase1 (SA_INIT), not phase2. Phase2 mismatches cause 'no acceptable proposal' at a different stage.

Full explanation →

895

MCQmedium

A FortiGate is configured with SD-WAN and has two WAN members: Member1 (ISP1) with priority 10, and Member2 (ISP2) with priority 5. The SD-WAN rule for traffic from the internal network uses the 'best quality' strategy. During normal operation, traffic flows through Member1. After a link failure on Member1, traffic correctly fails over to Member2. However, when Member1 is restored, traffic does not fail back. What is the most likely cause?

A.The static route for Member1 has a higher administrative distance than Member2.

B.The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'.

C.The SD-WAN rule is configured with 'set fallback' disabled.

D.The priority of Member2 is higher than Member1.

AnswerB

Passive monitoring does not trigger fallback; update-static-route must be enabled for the route to be reinstated when the link recovers.

Why this answer

When 'set probe-mode passive' is configured, the health-check server only monitors the link without actively generating probe traffic, and 'set update-static-route disable' prevents the static route associated with Member1 from being re-enabled after the link is restored. This means the route remains inactive, so SD-WAN cannot fail back to Member1 even though the physical link is up.

Exam trap

The trap here is that candidates assume failback is automatic with SD-WAN, but FortiGate requires explicit configuration of route updates or probe modes to re-enable a restored link; the 'best quality' strategy alone does not handle failback without proper health-check settings.

How to eliminate wrong answers

Option A is wrong because a higher administrative distance would make the route less preferred, but the question states traffic flows through Member1 normally, so its route must have a lower or equal AD; the issue is about failback, not initial selection. Option C is wrong because 'set fallback' is not a valid SD-WAN rule parameter; the correct parameter for controlling failback behavior is 'set update-static-route' or 'set probe-mode', not a 'fallback' toggle. Option D is wrong because priority 10 is higher than 5, making Member1 preferred; if Member2 had higher priority, traffic would not have flowed through Member1 initially.

Full explanation →

896

Multi-Selectmedium

An administrator is configuring a FortiGate to inspect SMTP traffic for spam and viruses. The traffic must be decrypted to inspect the content. Which THREE elements are required for this configuration? (Choose three.)

Select 3 answers

A.A spam filter profile applied to the firewall policy

B.A web filter profile applied to the firewall policy

C.An antivirus profile applied to the firewall policy

D.An application control profile applied to the firewall policy

E.A firewall policy that allows SMTP traffic and has SSL inspection enabled

AnswersA, C, E

Spam filtering is needed to identify and block spam.

Why this answer

A spam filter profile is required to inspect SMTP traffic for spam. FortiGate uses this profile to apply anti-spam techniques such as DNSBL, SURBL, and heuristic analysis on the email content after decryption. Without it, spam detection cannot occur.

Exam trap

The trap here is that candidates often assume a web filter profile can inspect email traffic because it handles content filtering, but web filters are strictly for HTTP/HTTPS protocols and cannot process SMTP MIME data.

Full explanation →

897

MCQmedium

An administrator is troubleshooting BGP with SD-WAN. They have configured BGP on the FortiGate and the SD-WAN rule uses 'best quality' strategy. However, failover does not happen when a WAN link goes down. The BGP session is still up. What is the most likely reason?

A.The performance SLA is not configured to track the BGP next hop.

B.The SD-WAN rule is configured with 'set update-static-route disable'.

C.The BGP session is using eBGP multihop.

D.The load balancing algorithm is set to 'volume'.

AnswerA

For SD-WAN to detect link failure, the performance SLA must monitor the actual path to the BGP next hop or internet. BGP session may remain up via an alternate path, but the link may be degraded.

Why this answer

The 'best quality' SD-WAN strategy selects the best path based on performance SLA metrics. Without a performance SLA monitoring the BGP next hop, the FortiGate cannot detect that the link has failed from a BGP perspective, so it will not trigger a failover even if the physical interface goes down. The BGP session remains up because it is still receiving keepalives, but the SD-WAN rule does not consider the link unusable without SLA tracking.

Exam trap

The trap here is that candidates assume BGP session state alone determines link usability, but FortiGate SD-WAN requires explicit performance SLA monitoring of the BGP next hop to trigger failover in a 'best quality' strategy.

How to eliminate wrong answers

Option B is wrong because 'set update-static-route disable' only prevents the FortiGate from installing BGP routes into the static route table; it does not affect SD-WAN failover behavior. Option C is wrong because eBGP multihop allows BGP sessions across multiple hops but does not prevent failover when a link goes down; the issue is SLA tracking, not BGP hop count. Option D is wrong because the load balancing algorithm set to 'volume' affects how traffic is distributed among multiple paths, not whether failover occurs when a link fails.

Full explanation →

898

MCQmedium

A security analyst notices repeated failed login attempts from a specific IP address to the FortiGate management interface. The administrator wants to automatically blacklist the IP after 3 failed attempts within 60 seconds. Which feature should be configured?

A.Intrusion Prevention System (IPS) with custom signature

B.FortiGate's built-in DoS policy and blacklist

C.Admin lockdown and intruder lockout settings

D.Administrative access trusted hosts

AnswerC

FortiGate can be configured to lock out IPs after failed admin login attempts via 'config system admin' settings or via 'config system global' set admin-lockout-threshold and admin-lockout-duration.

Why this answer

The 'Admin lockdown and intruder lockout' settings in FortiGate are specifically designed to detect repeated failed login attempts to the management interface and automatically blacklist the offending IP address after a configurable number of failures within a defined time window. This feature operates at the authentication layer, directly monitoring admin login attempts, and can enforce a lockout threshold (e.g., 3 failures in 60 seconds) to block the source IP, which matches the requirement exactly.

Exam trap

The trap here is that candidates confuse the 'intruder lockout' feature (which is an admin authentication control) with DoS policies or IPS, because all three can block IPs, but only the intruder lockout is triggered by failed login attempts to the management interface.

How to eliminate wrong answers

Option A is wrong because Intrusion Prevention System (IPS) with custom signatures is designed to detect and block network-level attacks (e.g., exploit attempts, malware patterns) based on traffic content, not to track failed login attempts to the management interface; IPS does not have visibility into authentication events. Option B is wrong because FortiGate's built-in DoS policy and blacklist are used to mitigate volumetric or protocol-based denial-of-service attacks (e.g., SYN floods, UDP floods) by rate-limiting or dropping traffic based on packet characteristics, not to monitor or respond to failed admin login attempts. Option D is wrong because Administrative access trusted hosts restricts which source IP addresses are allowed to reach the management interface at all, but it does not dynamically blacklist an IP after repeated failed logins; it is a static access control list, not a reactive lockout mechanism.

Full explanation →

899

Multi-Selectmedium

Which TWO of the following are required for FortiGate to successfully obtain file verdicts from FortiSandbox? (Choose two.)

Select 2 answers

A.Proxy-based inspection mode enabled on the policy

B.Valid FortiSandbox license on FortiGate

C.FortiSandbox inline scanning enabled in antivirus profile

D.FortiGuard Security Rating subscription

E.Network connectivity between FortiGate and FortiSandbox

AnswersB, E

Needed to enable the sandbox feature.

Why this answer

A valid FortiSandbox license on the FortiGate is required to authenticate and authorize communication with the FortiSandbox appliance or cloud service. Without this license, the FortiGate cannot register with the FortiSandbox or submit files for verdict analysis, even if network connectivity exists.

Exam trap

The trap here is that candidates often assume proxy-based inspection or inline scanning is mandatory for sandbox integration, but FortiGate can use flow-based inspection and retrieve verdicts asynchronously without inline mode enabled.

Full explanation →

900

MCQhard

A FortiGate is blocking HTTP traffic from 10.0.1.5 to 10.0.2.100, despite an explicit allow policy. The exhibit shows the configuration and debug flow output. What is the most likely cause?

A.The policy is applied to the wrong source interface.

B.The policy action is set to deny.

C.TCP SYN flood protection is dropping the incomplete session.

D.The source address object does not include 10.0.1.5.

AnswerC

The 'state proto not ready' indicates TCP handshake incomplete; often due to DoS protection thresholds.

Why this answer

The debug flow output shows the session is in a 'SYN_RECV' state and never transitions to 'ESTABLISHED', which is characteristic of TCP SYN flood protection. When the FortiGate's SYN flood protection threshold is exceeded, it drops incomplete sessions before they can be fully established, even if an explicit allow policy exists. This explains why HTTP traffic from 10.0.1.5 to 10.0.2.100 is blocked despite the policy being correctly configured.

Exam trap

The trap here is that candidates often assume a policy issue (wrong interface, wrong action, or wrong address object) when the debug flow shows a session being created but not completing, but the real cause is a DoS protection mechanism that drops the session after the initial SYN.

How to eliminate wrong answers

Option A is wrong because if the policy were applied to the wrong source interface, the debug flow would typically show a 'no matching policy' message or a policy lookup failure, not a session stuck in SYN_RECV. Option B is wrong because if the policy action were set to deny, the debug flow would show an explicit deny action or a 'deny' flag in the session table, not a session that is being tracked but never completes. Option D is wrong because if the source address object did not include 10.0.1.5, the policy lookup would fail to match, resulting in a 'no matching policy' or implicit deny, not a session that reaches SYN_RECV and then stalls.

Full explanation →

Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 826–900