Fortinet NSE 7 Advanced Security NSE7 NSE7 Questions 76–150 | Page 2/13

MCQmedium

A company wants to use FortiGate as a SAML service provider (SP) for authenticating administrators to the FortiGate GUI. The identity provider (IdP) is Azure AD. After configuration, administrators are redirected to Azure AD login but receive an error that the SAML request is invalid. What is the most likely misconfiguration?

A.The IdP's entity ID or SSO URL is incorrectly entered on FortiGate

B.The FortiGate's SP entity ID does not match the Azure AD application's identifier

C.The administrator's account is not synchronized with Azure AD

D.The certificate used for signing is not trusted by the IdP

AnswerA

If the IdP entity ID or SSO URL is wrong, the SAML request will be considered invalid by the IdP.

Why this answer

As an SP, FortiGate must be configured with the correct IdP entity ID and SSO URL. If the IdP entity ID is incorrect, the IdP rejects the SAML request.

Full explanation →

Multi-Selectmedium

A FortiGate in HA mode has two VDOMs: VDOM1 and VDOM2. The administrator needs to ensure that if the active unit fails, the standby unit takes over with minimal disruption. Which TWO steps should be taken?

Select 2 answers

A.Enable session synchronization

B.Set the HA mode to active-active

C.Enable HA on each VDOM individually

D.Configure the same VDOMs on both units

E.Use VDOM link for inter-VDOM traffic

AnswersA, D

Session sync ensures active sessions are preserved on failover.

Why this answer

Session synchronization ensures that stateful firewall sessions (e.g., TCP/UDP connections) are replicated from the active FortiGate to the standby unit. In HA active-passive mode, this allows the standby to seamlessly take over active sessions upon failover, minimizing disruption. Without session synchronization, all existing connections would be dropped and must be re-established.

Exam trap

The trap here is that candidates may think enabling HA on each VDOM individually is required (Option C), but FortiGate HA is a global feature that automatically synchronizes all VDOM configurations across cluster members, and per-VDOM HA configuration does not exist.

Full explanation →

MCQeasy

Which load balancing algorithm in SD-WAN distributes new sessions based on the source and destination IP addresses, ensuring that all sessions from a given source-destination pair go to the same member?

A.Lowest cost

B.Volume

C.Source-dest IP

D.Sessions

AnswerC

Hashes source and destination IP.

Why this answer

The Source-dest IP algorithm in Fortinet SD-WAN uses a hash of the source and destination IP addresses to determine the outbound member for each new session. This ensures that all sessions between the same source-destination pair are consistently forwarded to the same WAN member, preserving flow affinity without requiring session-based state tracking.

Exam trap

The trap here is that candidates often confuse 'Source-dest IP' with 'Sessions' because both involve distribution, but Sessions uses round-robin and does not guarantee source-destination affinity, while Source-dest IP uses a hash to ensure consistent member selection for the same pair.

How to eliminate wrong answers

Option A is wrong because Lowest cost selects the member with the lowest measured cost (e.g., latency or jitter) for each new session, which does not guarantee that sessions from the same source-destination pair go to the same member. Option B is wrong because Volume distributes sessions based on the current traffic volume on each member, aiming to balance load rather than enforce source-destination affinity. Option D is wrong because Sessions distributes sessions in a round-robin fashion across members, which can send sessions from the same source-destination pair to different members.

Full explanation →

MCQeasy

In FortiAnalyzer, which tool provides real-time traffic monitoring and allows drilling down into details such as top talkers, applications, and threats?

A.Reports

B.Incidents

C.FortiView

D.Log Viewer

AnswerC

FortiView provides real-time dashboards and drill-down for traffic analysis.

Why this answer

FortiView in FortiAnalyzer provides real-time traffic monitoring with drill-down capabilities into top talkers, applications, and threats. It aggregates data from FortiGate logs and presents it in an interactive dashboard, allowing administrators to identify and investigate network anomalies instantly without generating reports.

Exam trap

The trap here is that candidates confuse the Log Viewer's ability to display logs in real time with FortiView's purpose-built aggregation and drill-down features, leading them to select Log Viewer instead of FortiView.

How to eliminate wrong answers

Option A is wrong because Reports in FortiAnalyzer are scheduled or on-demand summaries of historical data, not real-time monitoring tools. Option B is wrong because Incidents are correlated event groupings for security analysis, not a tool for live traffic inspection. Option D is wrong because Log Viewer displays raw log entries in a tabular format without real-time aggregation or drill-down into top talkers, applications, or threats.

Full explanation →

Multi-Selectmedium

An administrator is deploying ZTNA with FortiClient EMS to secure access to a corporate web application. Which THREE components are required for a successful ZTNA deployment? (Choose three.)

Select 3 answers

A.FortiSandbox for threat analysis

B.FortiClient EMS server

C.FortiClient installed on endpoint devices

D.FortiGate configured as ZTNA access proxy

E.FortiAnalyzer for logging

AnswersB, C, D

EMS manages compliance rules, ZTNA tags, and pushes policies to FortiClient.

Why this answer

FortiClient EMS (Endpoint Management Server) is the central management and policy distribution point for ZTNA. It manages endpoint compliance, pushes ZTNA tags, and provides real-time telemetry to FortiGate, enabling dynamic access control based on device posture and user identity.

Exam trap

The trap here is that candidates often assume FortiSandbox or FortiAnalyzer are mandatory for ZTNA, but FortiSandbox is only needed for file inspection in advanced threat scenarios and FortiAnalyzer is purely for logging, neither of which are core to the ZTNA control plane.

Full explanation →

MCQmedium

A FortiGate admin runs 'diagnose sys session filter dport 443' and sees the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is a UDP session that has been idle for 1 hour

B.The session has a problem because duration and expire are not equal

C.The session has been active for 1 hour and will expire in about 1 hour

D.The session is a short-lived connection that started 3600 seconds ago

AnswerC

duration is the time since creation, expire is remaining lifetime.

Why this answer

The output shows 'duration=3600' and 'expire=3599', meaning the session has been active for 3600 seconds (1 hour) and has approximately 3599 seconds remaining before it times out. The 'proto=6' indicates TCP (protocol 6), and 'proto_state=01' is the TCP state (typically ESTABLISHED). The session is healthy and will expire in about 1 hour, confirming C.

Exam trap

The trap here is that candidates misinterpret 'duration' and 'expire' as being equal or assume a discrepancy indicates a problem, when in fact they represent different time metrics (elapsed vs. remaining) and are expected to differ for active sessions.

How to eliminate wrong answers

Option A is wrong because 'proto=6' indicates TCP, not UDP (UDP is protocol 17). Option B is wrong because duration and expire are not required to be equal; duration is the elapsed time since the session started, and expire is the remaining time before timeout — they naturally differ unless the session just started. Option D is wrong because a duration of 3600 seconds (1 hour) indicates a long-lived session, not a short-lived one.

Full explanation →

MCQhard

A FortiGate has an IPsec VPN with a remote peer that uses IKEv2. The administrator wants to ensure that child SA rekeying uses PFS (Perfect Forward Secrecy) with Diffie-Hellman group 14. Which CLI command should the administrator configure on the FortiGate's phase 2 proposal?

A.set auto-negotiate enable; set dh-group 14

B.set pfs enable; set dhgrp 14

C.set proposal aes256-sha256 dh-group 14

D.set pfs enable; set dh-group 14

AnswerB

This correctly enables PFS and sets the Diffie-Hellman group to 14.

Why this answer

To enable PFS with DH group 14 on the phase 2 proposal, the correct CLI command is 'set pfs enable' and 'set dhgrp 14'. The command 'set proposal aes256-sha256' defines encryption/integrity, not PFS. The other options do not set PFS correctly.

Full explanation →

MCQhard

A FortiGate is configured with an IPsec VPN that uses certificate-based authentication. The VPN fails to establish. The administrator checks the phase1 debug and sees the message: 'no suitable certificate found'. What is the most likely cause?

A.The peer's certificate is not trusted

B.The certificate revocation list (CRL) is outdated

C.The CA certificate is missing

D.The local certificate is not imported or does not match the certificate name

AnswerD

The FortiGate needs a local certificate with a subject that matches the local ID; otherwise it cannot present a certificate.

Why this answer

The 'no suitable certificate found' error in IPsec phase1 debug indicates that the FortiGate cannot locate a local certificate that matches the peer's expected certificate name (often the peer's ID or the configured local certificate name). This typically occurs when the local certificate is not imported or the certificate's Common Name (CN) or Subject Alternative Name (SAN) does not match the configured local ID or peer's expected identifier. Without a matching local certificate, the IKE exchange cannot proceed to authenticate the FortiGate to the remote peer.

Exam trap

The trap here is that candidates often confuse 'no suitable certificate found' with trust or revocation issues, but the error specifically points to a missing or mismatched local certificate, not problems with the peer's certificate or CA chain.

How to eliminate wrong answers

Option A is wrong because 'no suitable certificate found' refers to the local certificate not being found or matching, not the peer's certificate trust; a lack of trust in the peer's certificate would produce a different error like 'certificate validation failed' or 'untrusted certificate'. Option B is wrong because an outdated CRL would cause a certificate validation failure (e.g., 'certificate revoked' or 'CRL not checked'), not a failure to find a suitable local certificate. Option C is wrong because a missing CA certificate would prevent validation of the peer's certificate, resulting in a trust-related error, not the 'no suitable certificate found' message which is about the local certificate selection.

Full explanation →

Multi-Selecthard

A FortiGate administrator is investigating a slow network performance issue. The administrator suspects that session table limits are being reached. Which TWO metrics should be monitored to confirm this? (Choose two.)

Select 2 answers

A.Interface bandwidth utilization

B.Session fail rate

C.Current session count

D.CPU usage

E.Memory usage

AnswersB, C

A high session fail rate may indicate that new session creation is being denied due to table limits.

Why this answer

The session fail rate (B) directly indicates when the FortiGate is unable to establish new sessions because the session table is full, which is a clear symptom of hitting session table limits. The current session count (C) shows how many sessions are active; when this approaches the maximum session limit (e.g., 2 million on a FortiGate-600E), it confirms the table is near capacity. Monitoring both metrics together provides definitive evidence of session table exhaustion.

Exam trap

The NSE7 exam often tests the misconception that high CPU or memory usage directly indicates session table limits, but the trap here is that session table exhaustion is specifically confirmed by session fail rate and current session count, not by general resource utilization metrics.

Full explanation →

MCQeasy

A network administrator wants to block known malicious IP addresses using threat intelligence feeds on FortiGate. Which feature should they use?

A.FortiGuard Web Filtering

B.External Threat Intelligence

C.Application Control

D.IP Reputation

AnswerB

This feature enables importing third-party threat feeds and using them in firewall policies.

Why this answer

FortiGate's External Threat Intelligence feature allows administrators to import and consume threat intelligence feeds (e.g., STIX/TAXII, CSV, or custom URLs) to block known malicious IP addresses. This is the correct feature because it is specifically designed to ingest external threat data and apply it to firewall policies for dynamic blocking, unlike the other options which serve different purposes.

Exam trap

The trap here is that candidates often confuse IP Reputation (a built-in FortiGuard service) with External Threat Intelligence (a feature for importing custom feeds), leading them to select IP Reputation when the question explicitly mentions 'threat intelligence feeds' from external sources.

How to eliminate wrong answers

Option A is wrong because FortiGuard Web Filtering is used to control access to web categories and URLs based on FortiGuard's cloud database, not to block specific IP addresses from external threat feeds. Option C is wrong because Application Control identifies and controls application traffic (e.g., Facebook, Skype) based on signatures, not IP-based threat intelligence. Option D is wrong because IP Reputation is a built-in FortiGuard service that rates IP addresses based on FortiGuard's own threat data, not a feature to import custom external threat intelligence feeds.

Full explanation →

Multi-Selectmedium

An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails to establish phase 2. The phase 2 configuration shows 'set proposal aes128-sha256' on both sides. Which TWO configuration items should the administrator verify?

Select 2 answers

A.PFS (Perfect Forward Secrecy) settings

B.The local authentication method (certificate vs pre-shared key)

C.The encryption algorithm for phase 2

D.The local and remote subnets defined in phase 2 (proxy IDs)

E.The pre-shared key

AnswersA, D

If one side has PFS enabled and the other does not, or they use different DH groups, phase 2 will fail.

Why this answer

PFS ensures that if one session key is compromised, previous and future session keys remain secure by using a Diffie-Hellman exchange in phase 2. If PFS is enabled on one side but not the other, or if the DH groups do not match, phase 2 will fail even when the encryption and authentication proposals are identical. Since the phase 2 proposal 'aes128-sha256' matches on both sides, the mismatch likely lies in PFS settings.

Exam trap

The trap here is that candidates assume matching encryption and authentication proposals guarantee phase 2 success, overlooking PFS and proxy ID mismatches which are frequently tested in NSE7 troubleshooting scenarios.

Full explanation →

MCQhard

In an HA cluster, after a failover, some established sessions are not being synchronized to the new primary unit. Which setting must be enabled to ensure session synchronization?

A.set override enable

B.set sync-sessions enable

C.set priority <value>

D.set session-pickup enable

AnswerD

This enables session synchronization in HA.

Why this answer

Session-pickup is the FortiGate HA feature that synchronizes the state of established sessions from the primary unit to the backup unit. When a failover occurs, the new primary unit can continue forwarding traffic for those sessions without interruption only if session-pickup is enabled. Without it, all existing sessions are dropped and must be re-established by the clients.

Exam trap

The trap here is that candidates confuse 'session-pickup' with general HA synchronization or misremember the exact CLI command, often selecting 'set sync-sessions enable' which sounds plausible but does not exist in FortiGate's configuration.

How to eliminate wrong answers

Option A is wrong because 'set override enable' controls which unit becomes primary after a failover based on priority, not session synchronization. Option B is wrong because 'set sync-sessions enable' is not a valid FortiGate HA command; the correct command for session synchronization is 'set session-pickup enable'. Option C is wrong because 'set priority <value>' sets the device priority for HA role election, not session state synchronization.

Full explanation →

MCQhard

During a security audit, it is found that traffic between two VDOMs is allowed even though no inter-VDOM routing policy is configured. The VDOMs are connected via a VDOM link. What could explain this behavior?

A.The FortiGate is in NAT mode

B.The VDOMs are in the same administrative domain

C.The VDOM link is using the same interface IP

D.The VDOM link is operating in transparent mode

AnswerD

If the VDOM link is in transparent mode, it bridges traffic without routing, so inter-VDOM routing policies are not required.

Why this answer

When a VDOM link operates in transparent mode, it acts as a Layer 2 bridge between the connected VDOMs. In transparent mode, the VDOM link does not require an inter-VDOM routing policy because traffic is forwarded based on MAC addresses rather than IP routing, effectively allowing all traffic between the VDOMs unless explicitly filtered by firewall policies. This explains why traffic flows even without a configured inter-VDOM routing policy.

Exam trap

The trap here is that candidates often assume inter-VDOM traffic always requires a routing policy, forgetting that transparent mode bypasses Layer 3 routing entirely by operating at Layer 2.

How to eliminate wrong answers

Option A is wrong because NAT mode affects how the FortiGate translates IP addresses, not the inter-VDOM routing policy requirement; NAT mode does not bypass the need for an inter-VDOM routing policy when VDOMs are connected via a VDOM link. Option B is wrong because VDOMs are always in separate administrative domains by design; being in the same administrative domain is not a concept in FortiGate VDOMs, and even if they were, it would not override the need for a routing policy. Option C is wrong because using the same interface IP on a VDOM link is not possible—each VDOM link interface must have a unique IP address; even if they were the same, it would cause an IP conflict, not allow traffic without a routing policy.

Full explanation →

Multi-Selecteasy

A FortiGate administrator wants to monitor performance thresholds to be alerted when the firewall is under heavy load. Which THREE metrics can be monitored using the built-in performance monitoring features (e.g., 'diagnose sys top' or SNMP)?

Select 3 answers

A.CPU utilization percentage

B.Interface speed

C.Number of concurrent sessions

D.Disk space utilization

E.Memory utilization percentage

AnswersA, C, E

CPU usage is a critical performance indicator.

Why this answer

The built-in 'diagnose sys top' command and SNMP monitoring both provide real-time CPU utilization percentage, which is a key metric for detecting heavy load on a FortiGate firewall. High CPU usage can indicate resource contention, impacting packet processing and overall performance.

Exam trap

The trap here is that candidates confuse static interface properties (like speed) with dynamic performance metrics, or mistakenly think disk space is relevant to firewall load, when in fact only CPU, memory, and session counts are directly monitored for performance thresholds.

Full explanation →

Multi-Selecthard

An administrator is troubleshooting an IPsec VPN Phase 2 negotiation failure. The debug shows 'no matching phase 2 proposal' from the remote peer. Which TWO of the following are likely causes? (Choose two.)

Select 2 answers

A.The local and remote proxy IDs (subnets) are not matching

B.The pre-shared key is incorrect

C.The firewall policy does not allow UDP port 500

D.The encryption algorithm (e.g., AES256 vs AES128) does not match between peers

E.The IKE version (IKEv1 vs IKEv2) is different

AnswersA, D

Phase 2 requires matching proxy IDs to establish SAs.

Why this answer

IPsec Phase 2 negotiation requires the proxy IDs (local and remote subnets) to match exactly between peers. The 'no matching phase 2 proposal' debug message indicates the remote peer received a proposal with a subnet or traffic selector that does not match its configured proxy ID. This is a common misconfiguration when defining which traffic should be encrypted over the VPN tunnel.

Exam trap

The trap here is that candidates often confuse Phase 1 and Phase 2 parameters, incorrectly attributing a Phase 2 'no matching proposal' error to authentication or IKE version mismatches, which actually cause Phase 1 failures.

Full explanation →

MCQeasy

What is the purpose of BFD on a FortiGate?

A.To load balance traffic across multiple paths.

B.To provide fast detection of link failures.

C.To authenticate OSPF neighbors.

D.To encrypt traffic between two FortiGates.

AnswerB

BFD detects failures faster than routing protocol hello timers.

Why this answer

BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for routing protocols like OSPF and BGP, independent of the routing protocol's own hello timers. On a FortiGate, BFD is used to rapidly detect link or neighbor failures, enabling faster convergence in SD-WAN and dynamic routing scenarios.

Exam trap

The trap here is that candidates confuse BFD's fast failure detection with load balancing or authentication functions, but BFD is strictly a liveness detection mechanism with no role in traffic distribution or security.

How to eliminate wrong answers

Option A is wrong because BFD does not perform load balancing; load balancing is handled by ECMP (Equal-Cost Multi-Path) or SD-WAN rules, not BFD. Option C is wrong because OSPF neighbor authentication is performed using MD5 or SHA authentication keys, not BFD; BFD only monitors link liveliness. Option D is wrong because traffic encryption between FortiGates is achieved via IPsec VPN tunnels, not BFD, which is a lightweight hello-based protocol with no encryption capabilities.

Full explanation →

MCQeasy

An administrator needs to isolate customer traffic in a FortiGate deployed at a service provider. Each customer should have independent administrators and security policies. Which feature should be used?

A.VLAN interfaces

B.Policy packages

C.Administrative domains (ADOMs)

D.Virtual domains (VDOMs)

AnswerD

VDOMs provide complete separation of management and traffic.

Why this answer

Virtual domains (VDOMs) allow a single FortiGate to be partitioned into multiple independent virtual firewalls, each with its own administrators, security policies, routing tables, and interfaces. This is the correct feature for isolating customer traffic at a service provider because it provides complete administrative and policy separation per customer, which VLAN interfaces alone cannot achieve.

Exam trap

The trap here is confusing VLAN interfaces (Layer 2 segmentation) with VDOMs (full virtual firewall instances), leading candidates to choose VLANs when the question explicitly requires independent administrators and security policies.

How to eliminate wrong answers

Option A is wrong because VLAN interfaces only provide Layer 2 segmentation of traffic on a physical port; they do not create independent administrative domains or separate security policy contexts. Option B is wrong because policy packages are containers for firewall policies within a single VDOM or non-VDOM mode; they do not isolate administrators or provide independent routing and management. Option C is wrong because administrative domains (ADOMs) are a FortiManager concept for managing multiple FortiGate devices centrally, not a feature on the FortiGate itself for local isolation.

Full explanation →

MCQmedium

A FortiGate admin configures an automation stitch to send an email alert when a high-severity IPS event occurs. The trigger is 'IPS Event' and the action is 'Email'. After testing, no email is sent despite events being logged. What is the most likely cause?

A.The IPS event severity threshold is set too low

B.The automation stitch is disabled

C.No SMTP server is configured in the FortiGate

D.The IPS engine is in monitor mode

AnswerC

Email action requires an SMTP server to be configured under System > Settings.

Why this answer

The automation stitch requires a functional SMTP server configuration to send emails. Without an SMTP server defined under System > Settings > Email Service, the FortiGate cannot relay the alert email, even if the trigger and action are correctly configured and events are logged. This is the most common reason for email delivery failure in automation stitches.

Exam trap

The trap here is that candidates assume the automation stitch is misconfigured or the IPS engine is blocking the event, when the real issue is the underlying email infrastructure (SMTP) that the action depends on, which is a separate configuration from the stitch itself.

How to eliminate wrong answers

Option A is wrong because a low severity threshold would cause more events to match, not prevent email sending; the issue is delivery, not triggering. Option B is wrong because if the stitch were disabled, no events would be logged as triggered by the stitch, but the question states events are logged, implying the stitch is enabled and triggering. Option D is wrong because monitor mode affects IPS action (e.g., whether packets are blocked), not the generation of IPS events or the ability to send email alerts.

Full explanation →

MCQmedium

An administrator wants to configure FortiGate to use the machine learning engine for advanced antivirus detection. Which setting must be enabled in the antivirus profile?

A.Enable 'Machine Learning Engine' in the antivirus profile

B.Enable 'Detect All' in the antivirus profile

C.Set 'Scan Mode' to 'Quick' in the antivirus profile

D.Enable 'Use FortiSandbox' in the antivirus profile

AnswerA

The machine learning engine must be enabled in the antivirus profile to use AI-based detection.

Why this answer

The machine learning engine for advanced antivirus detection is a dedicated feature within the antivirus profile that must be explicitly enabled. This engine uses behavioral analysis and heuristics to detect unknown or zero-day malware without relying solely on signature-based detection. Enabling this setting allows FortiGate to leverage on-device ML models to identify malicious files based on patterns and anomalies.

Exam trap

The trap here is that candidates may confuse the machine learning engine with FortiSandbox integration, assuming that sandboxing is required for ML-based detection, when in fact the ML engine is a standalone on-device feature that must be enabled separately in the antivirus profile.

How to eliminate wrong answers

Option B is wrong because 'Detect All' is not a valid setting in the antivirus profile; it is a misconception that such a toggle exists for enabling ML-based detection. Option C is wrong because setting 'Scan Mode' to 'Quick' reduces scanning depth and may skip certain file types or archives, which would not enable the machine learning engine and could actually decrease detection accuracy. Option D is wrong because 'Use FortiSandbox' integrates with an external sandbox for file detonation and analysis, but it is a separate feature from the on-device machine learning engine and does not enable local ML-based detection.

Full explanation →

MCQhard

A FortiGate in a multi-VDOM environment has a management VDOM (mgmt-vdom) and a traffic VDOM (corp-vdom). The admin wants to access the FortiGate GUI using IP 10.0.1.1 assigned to port1 in mgmt-vdom. However, the GUI is unreachable. The admin can SSH into mgmt-vdom. What is the most likely cause?

A.The admin must enable 'set allowaccess https' under the interface configuration

B.The management VDOM has an implicit deny policy blocking inbound HTTPS

C.The FortiGate is in transparent mode and requires a management IP

D.The traffic VDOM's routing table is incorrect

AnswerB

Even in the management VDOM, a policy must explicitly allow HTTPS access. Without it, the GUI is blocked.

Why this answer

In a multi-VDOM FortiGate, each VDOM has its own independent firewall policies. Even if HTTPS access is enabled on the interface (set allowaccess https), the management VDOM (mgmt-vdom) still requires an explicit firewall policy to permit inbound HTTPS traffic from the source to the FortiGate's own IP. Without such a policy, the implicit deny rule at the end of the policy list blocks the GUI connection.

SSH works because it is typically allowed by a separate policy or by default administrative access rules, but HTTPS is not implicitly permitted.

Exam trap

The trap here is that candidates assume enabling 'allowaccess' on the interface alone is sufficient for GUI access, overlooking the fact that FortiGate's implicit deny in the VDOM's policy layer blocks all inbound traffic unless an explicit permit policy exists.

How to eliminate wrong answers

Option A is wrong because enabling 'set allowaccess https' on the interface is necessary but not sufficient; without a firewall policy in mgmt-vdom permitting inbound HTTPS, the traffic is still dropped by the implicit deny. Option C is wrong because transparent mode is irrelevant here; the FortiGate is in multi-VDOM mode, and the issue is policy-based, not mode-based. Option D is wrong because the traffic VDOM's routing table does not affect management access to the mgmt-vdom interface; management traffic is handled within the mgmt-vdom itself.

Full explanation →

Multi-Selectmedium

A network administrator is troubleshooting a split-brain scenario in an HA cluster. Which TWO conditions can cause split-brain? (Choose two.)

Select 2 answers

A.Loss of heartbeat link between HA members

B.One unit has a higher priority

C.Firmware version mismatch

D.Mismatched HA configuration (e.g., different HA mode)

E.Session pickup is disabled

AnswersA, D

Without heartbeat, each unit assumes the other is down and becomes primary.

Why this answer

Options A and D are correct. Loss of HA heartbeat communication (A) causes both units to think they are primary. Mismatched HA configuration (D) can also cause split-brain.

Option B causes failover but not split-brain. Option C is irrelevant.

Full explanation →

Multi-Selectmedium

A FortiGate administrator is configuring NAC (Network Access Control) integration with FortiNAC. The goal is to control access for wired clients based on device compliance. Which TWO configurations are required on the FortiGate to support this integration?

Select 2 answers

A.Configure a RADIUS server pointing to FortiNAC.

B.Create a security group tag (SGT) mapping.

C.Enable '802.1x' authentication on the interface.

D.Enable 'nac-policy' on the switch-facing interface.

E.Set the 'nac-mode' to 'global-vlan' under the interface.

AnswersA, D

Why this answer

To integrate FortiGate with FortiNAC, two configurations are needed: first, a RADIUS server pointing to FortiNAC (A) must be configured on the FortiGate so it can query device compliance status from FortiNAC. Second, the 'nac-policy' option must be enabled on the FortiGate interface that connects to the switch (D). This allows the FortiGate to apply NAC-based access policies to wired clients.

Options B (security group tag mapping) and C (802.1x on the interface) are not required on the FortiGate for this integration; 802.1x is typically handled by the switch. Option E (nac-mode to global-vlan) is not a standard setting for this scenario.

Full explanation →

MCQeasy

A FortiGate administrator is designing a VDOM configuration for a multi-tenant environment. Each tenant requires its own routing table and firewall policies. Which VDOM type should be used for each tenant?

A.TP mode VDOM

B.Router mode VDOM

C.Transparent mode VDOM

D.NAT mode VDOM

AnswerD

NAT mode VDOM provides independent routing and policies.

Why this answer

In a multi-tenant VDOM environment where each tenant requires its own routing table and firewall policies, NAT mode VDOM (option D) is the correct choice because it operates as a Layer 3 routing entity with its own independent routing table, interfaces, and firewall policies. This mode allows each tenant VDOM to perform NAT, route between subnets, and enforce security policies autonomously, which is essential for tenant isolation and policy control.

Exam trap

The trap here is that candidates often confuse 'Router mode' (a non-existent term) with NAT mode, or assume Transparent mode can provide Layer 3 routing isolation, but only NAT mode VDOMs support independent routing tables and firewall policies for multi-tenant environments.

How to eliminate wrong answers

Option A is wrong because TP mode VDOM (Transparent mode) does not maintain its own routing table; it forwards traffic at Layer 2 and relies on the root VDOM or external router for routing, making it unsuitable for tenants needing independent routing. Option B is wrong because 'Router mode VDOM' is not a standard FortiGate VDOM type; the correct term is NAT mode or Transparent mode, and Router mode is a misnomer that does not exist in FortiOS. Option C is wrong because Transparent mode VDOM operates at Layer 2 without its own routing table, so it cannot provide each tenant with an independent routing table, which is a core requirement for multi-tenant routing isolation.

Full explanation →

Drag & Dropmedium

Drag and drop the steps to configure a FortiGate to send logs to a FortiAnalyzer into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence to configure a FortiGate to send logs to FortiAnalyzer is: first add the FortiAnalyzer as a log device, then configure its IP address and shared key for authentication, then choose which log types (e.g., traffic, event, etc.) to forward, optionally apply filters to refine the logs, and finally test the connectivity to verify the configuration. This order ensures that each step builds upon the previous one, avoiding errors such as trying to configure a device that hasn't been added yet or testing before all settings are in place.

Full explanation →

100

Multi-Selecthard

A FortiGate administrator is troubleshooting a ZTNA problem where users are unable to connect to an internal application via FortiClient. FortiClient reports 'Connection refused'. The FortiGate ZTNA gateway is configured correctly. Which THREE steps should the administrator take to diagnose the issue?

Select 3 answers

A.Check the FortiGate's antivirus update status

B.Verify that FortiClient can reach the ZTNA gateway's IP and port

C.Examine the ZTNA access proxy rule to ensure the application mapping is correct

D.Reboot the FortiClient computer

E.Verify that the application server is reachable from the FortiGate (e.g., ping or telnet)

AnswersB, C, E

Network connectivity between FortiClient and the ZTNA gateway is fundamental.

Why this answer

To diagnose a ZTNA connection issue where FortiClient reports 'Connection refused' but the ZTNA gateway is correctly configured, the administrator should:

Verify that FortiClient can reach the ZTNA gateway's IP and port (option B): This ensures the client can establish a connection to the gateway itself. If the gateway is unreachable, the client cannot initiate the ZTNA tunnel.

Examine the ZTNA access proxy rule to ensure the application mapping is correct (option C): The access proxy rule defines which internal application the gateway forwards traffic to. Incorrect mapping (e.g., wrong IP, port, or protocol) would cause the gateway to reject or misroute the connection.

Verify that the application server is reachable from the FortiGate (option E): Even if the client can reach the gateway and the mapping is correct, the gateway must be able to reach the actual application server. Use ping or telnet from the FortiGate to confirm network connectivity to the server.

Options A (antivirus update status) and D (reboot FortiClient) are not directly relevant to this ZTNA connectivity issue. The FortiClient reports 'Connection refused', which typically points to network or configuration problems, not antivirus updates or client software state.

Full explanation →

101

MCQeasy

An administrator wants to load balance traffic across two WAN links by session count. Which SD-WAN load balancing algorithm should they use?

A.Sessions

B.Spillover

C.Lowest-cost

D.Volume

AnswerA

The sessions algorithm distributes sessions based on the number of active sessions per interface.

Why this answer

The Sessions algorithm distributes new sessions across WAN links based on the current session count, ensuring each link handles a roughly equal number of active sessions. This directly matches the administrator's requirement to load balance by session count, as it uses the session counter as the metric for link selection.

Exam trap

The trap here is that candidates often confuse 'session count' with 'volume' or 'spillover,' assuming that any load balancing algorithm that distributes traffic equally must use data volume or bandwidth thresholds, rather than recognizing that Sessions is the explicit algorithm for session-based distribution.

How to eliminate wrong answers

Option B is wrong because Spillover is not a load balancing algorithm; it is a traffic steering method that sends traffic to a primary link until its bandwidth threshold is exceeded, then spills over to backup links, which does not balance by session count. Option C is wrong because Lowest-cost selects the link with the lowest cost metric (e.g., latency, jitter, or loss) for each session, not based on session count. Option D is wrong because Volume balances traffic by the amount of data transferred (bytes) across links, not by the number of sessions.

Full explanation →

102

Multi-Selectmedium

An administrator is configuring a new VDOM on a FortiGate and needs to ensure that certain system resources are isolated for that VDOM. Which TWO settings must be configured to achieve resource isolation?

Select 2 answers

A.Set disk quota

B.Set memory quota

C.Set CPU quota

D.Set bandwidth limit

E.Set session limit

AnswersB, C

Memory quota limits the memory usage for the VDOM.

Why this answer

Setting a memory quota on a VDOM limits the amount of physical memory (RAM) the VDOM can consume, preventing it from starving other VDOMs or the root system. Option C is correct because setting a CPU quota caps the percentage of CPU time the VDOM can use, ensuring fair scheduling across VDOMs. Together, these two settings enforce resource isolation at the system level, which is required for multi-tenant or segmented environments.

Exam trap

The trap here is that candidates confuse 'resource isolation' with 'traffic control' or 'storage limits', leading them to select bandwidth limit or disk quota instead of the correct system-level quotas (memory and CPU).

Full explanation →

103

Multi-Selectmedium

An admin is troubleshooting an IPsec VPN tunnel that is failing phase 2. The IKE debug shows 'no matching proposal'. Which TWO settings should the admin verify on both sides? (Choose two.)

Select 2 answers

A.Dead Peer Detection interval

B.Encryption algorithm (e.g., AES128, AES256)

C.Diffie-Hellman group for PFS

D.Pre-shared key

E.Local and remote gateway IP addresses

AnswersB, C

Part of phase 2 proposal.

Why this answer

In IPsec phase 2, the IKE debug message 'no matching proposal' indicates a mismatch in the security association (SA) parameters used to establish the IPsec SA. The encryption algorithm (option B) is a core component of the IPsec proposal that must match exactly on both peers. Perfect Forward Secrecy (PFS) using a Diffie-Hellman group (option C) is also negotiated during phase 2; if one side requires PFS and the other does not, or if the DH groups differ, phase 2 will fail with this error.

Exam trap

The trap here is that candidates often confuse phase 1 and phase 2 parameters, incorrectly selecting pre-shared key (option D) or gateway IPs (option E) as causes for a phase 2 proposal mismatch, when in fact only the IPsec SA parameters (encryption, authentication, PFS) are negotiated in phase 2.

Full explanation →

104

MCQmedium

An administrator wants to ensure that traffic from a specific source IP uses a particular SD-WAN member regardless of performance SLA results. Which SD-WAN configuration element should be used?

A.SD-WAN rule with manual strategy

B.Route map

C.Policy-based routing on the firewall policy

D.Performance SLA

AnswerA

SD-WAN rules can use manual strategy to force traffic to a specific member.

Why this answer

A is correct because an SD-WAN rule with a manual strategy allows the administrator to explicitly pin traffic from a specific source IP to a particular SD-WAN member interface, overriding any performance SLA-based path selection. This is achieved by configuring the rule's 'strategy' as 'manual' and specifying the preferred member, which forces all matching traffic to use that interface regardless of SLA health.

Exam trap

The trap here is that candidates confuse Performance SLA as a steering mechanism rather than a monitoring tool, or mistakenly think policy-based routing can achieve the same result within an SD-WAN context, but Fortinet's SD-WAN architecture requires the rule's strategy to be set to 'manual' for explicit member pinning.

How to eliminate wrong answers

Option B is wrong because route maps are used for route redistribution, filtering, or modifying routing attributes (e.g., metric, next-hop) in routing protocols like BGP or OSPF; they do not provide per-source-IP traffic steering within an SD-WAN zone. Option C is wrong because policy-based routing (PBR) on a firewall policy can direct traffic based on source IP, but it operates at the routing level and does not integrate with SD-WAN member selection or SLA awareness; it would bypass the SD-WAN logic entirely. Option D is wrong because a Performance SLA is a monitoring mechanism that measures link quality (e.g., latency, jitter, packet loss) and is used by SD-WAN rules with 'best quality' or 'load balancing' strategies, but it cannot force traffic to a specific member; it only provides data for dynamic path decisions.

Full explanation →

105

Matchingmedium

Match each Fortinet component to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Next-generation firewall

Centralized management platform

Logging and reporting server

Advanced threat detection and analysis

Web application firewall

Why these pairings

FortiGate is the NGFW, FortiManager manages devices, FortiAnalyzer handles logging/analytics, and FortiClient is an endpoint agent. Common confusions involve swapping these roles.

Full explanation →

106

MCQmedium

A FortiGate is configured as a SAML service provider (SP) for user authentication. Users report they are redirected to the identity provider (IdP) for authentication, but after successful login, they are not allowed access to the requested resource. What is the MOST likely cause?

A.The FortiGate is configured as an IdP instead of SP

B.SAML single logout is enabled and causing session termination

C.The IdP certificate is not trusted by the FortiGate

D.The SAML user group is not configured with the correct IdP attribute mapping

AnswerD

Without proper group mapping, the FortiGate cannot assign the user to a group, and the firewall policy requiring that group will deny access.

Why this answer

After SAML authentication, the FortiGate must have a matching user group and firewall policy that allows traffic from authenticated users. If the IdP sends the correct attributes but the FortiGate does not have a group mapping or policy, access will be denied.

Full explanation →

107

MCQhard

A security engineer is troubleshooting a scenario where FortiGate is not blocking a known malicious URL categorized as 'Malware'. The web filtering profile is configured with 'monitor all' for the Malware category. What change should be made to block the URL?

A.Configure traffic shaping to rate limit the URL

B.Add a static URL filter with the exact URL and action 'block'

C.Enable DNS filter with botnet C2 domain blocking

D.Change the action for Malware category from 'monitor' to 'block' in the web filter profile

AnswerD

Setting the category action to 'block' will block all URLs in that category.

Why this answer

The web filtering profile currently has the Malware category set to 'monitor all', which logs but does not block traffic. To block the URL, the action must be changed from 'monitor' to 'block' within the same web filter profile. This directly enforces the blocking action for all URLs categorized as Malware, including the known malicious URL.

Exam trap

The trap here is that candidates may think a static URL filter is required for blocking, overlooking that category-based actions in the web filter profile can directly block all URLs in a category without needing individual entries.

How to eliminate wrong answers

Option A is wrong because traffic shaping only rate-limits bandwidth and does not block URLs; it cannot enforce a block on malicious content. Option B is wrong because adding a static URL filter is unnecessary and less efficient when the category-based action can be changed; it also requires manual entry of every specific URL, which is not scalable. Option C is wrong because DNS filter with botnet C2 domain blocking targets command-and-control domains at the DNS level, not HTTP/HTTPS URL categories like Malware; it addresses a different threat vector.

Full explanation →

108

MCQhard

A company has deployed two FortiGate-600Es in an active-passive HA cluster. The cluster is configured with three VDOMs: VDOM-A (corporate LAN), VDOM-B (guest Wi-Fi), and VDOM-C (DMZ). Each VDOM has its own set of interfaces and policies. The cluster is also configured to use FGCP with session pickup enabled. Recently, the network team noticed that after a failover event, some user sessions in VDOM-B are not being picked up, causing disruption for guest users. The session pickup feature is enabled globally. The administrator checks the configuration and finds the following settings on the primary FortiGate: - config system ha set session-pickup enable set session-pickup-connectionless enable end - config vdom edit VDOM-A config system ha set session-pickup enable end next edit VDOM-B config system ha set session-pickup disable end next edit VDOM-C config system ha set session-pickup enable end next Based on this configuration, what is the most likely reason that sessions in VDOM-B are not being picked up?

A.The HA priority of the cluster is set too low, causing session pickup to fail for VDOM-B.

B.Session pickup for connectionless protocols is not enabled, so UDP sessions in VDOM-B are not picked up.

C.Session pickup is disabled specifically for VDOM-B in the per-VDOM HA configuration.

D.The interfaces assigned to VDOM-B do not have session pickup enabled.

AnswerC

The per-VDOM setting overrides the global setting, so session pickup is disabled for VDOM-B.

Why this answer

The per-VDOM HA configuration for VDOM-B explicitly disables session pickup with 'set session-pickup disable'. Even though the global HA settings enable session pickup, the per-VDOM setting overrides the global setting for that VDOM. As a result, after a failover, sessions in VDOM-B are not synchronized to the standby FortiGate and are not picked up, causing disruption for guest users.

Exam trap

The trap here is that candidates assume global session pickup settings apply uniformly to all VDOMs, overlooking that per-VDOM HA settings override the global configuration, which is a common misconfiguration in multi-VDOM HA deployments.

How to eliminate wrong answers

Option A is wrong because HA priority affects which unit becomes primary, not whether session pickup functions per VDOM; session pickup is controlled by explicit enable/disable settings, not priority. Option B is wrong because 'session-pickup-connectionless' is enabled globally, which would allow UDP and other connectionless sessions to be picked up, but this global setting is overridden by the per-VDOM disable for VDOM-B. Option D is wrong because session pickup is configured at the VDOM level, not per interface; interfaces inherit the VDOM's session pickup setting, so disabling it on the VDOM prevents pickup regardless of interface configuration.

Full explanation →

109

MCQeasy

An administrator is reviewing the HA configuration shown in the exhibit. The primary unit has failed, and the secondary unit (with priority 100) has taken over. However, the administrator notices that the secondary unit has an IP address of 10.10.10.2 on port3, but cannot ping the management gateway 10.10.10.1. What is the most likely cause?

A.The HA management interface IP is not active on the secondary

B.The hbdev configuration is incorrect

C.The override setting is preventing the secondary from taking over management

D.session-pickup is not enabled

AnswerA

The management IP is active only on the primary unit; the secondary uses the same IP after failover, but the network may not have updated.

Why this answer

When the secondary unit takes over in an HA cluster, the HA management interface IP (configured under config system ha) is only active on the primary unit by default. Even after failover, the secondary unit does not automatically activate this IP unless the 'management-interface-ip' is explicitly configured to be active on the secondary. Since the secondary unit has IP 10.10.10.2 on port3 but cannot ping the management gateway 10.10.10.1, the most likely cause is that the HA management interface IP is not active on the secondary, meaning the secondary unit is using its own port3 IP (10.10.10.2) but the gateway expects the management IP to be reachable from that subnet, which it is not.

Exam trap

The trap here is that candidates often assume the secondary unit automatically inherits all IP addresses from the primary after failover, but FortiGate HA specifically requires explicit configuration for the management interface IP to be active on the secondary.

How to eliminate wrong answers

Option B is wrong because hbdev (heartbeat device) configuration affects HA heartbeat communication between units, not the activation of the management IP on the secondary after failover. Option C is wrong because the override setting controls whether a higher-priority unit can preempt the current primary after it recovers; it does not prevent the secondary from taking over management functions after the primary fails. Option D is wrong because session-pickup is a feature for synchronizing firewall sessions between HA members; it has no impact on whether the management interface IP is active on the secondary unit.

Full explanation →

110

MCQeasy

Which feature allows a FortiGate to maintain separate routing tables for different customers or departments on the same device?

A.Route maps

B.VDOM

C.VRF (Virtual Routing and Forwarding)

D.Policy-based routing

AnswerC

VRF allows multiple independent routing table instances on the same FortiGate.

Why this answer

VRF (Virtual Routing and Forwarding) allows a FortiGate to maintain separate, isolated routing tables and forwarding instances for different customers or departments on the same physical device. Each VRF has its own routing table, forwarding table, and interfaces, ensuring traffic from one VRF never crosses into another without explicit route leaking. This is the correct feature for multi-tenant or multi-department routing isolation.

Exam trap

The trap here is that candidates often confuse VDOMs with VRFs, thinking VDOMs provide routing isolation, but VDOMs primarily isolate administrative domains and firewall policies, while VRFs specifically provide separate routing tables and forwarding instances.

How to eliminate wrong answers

Option A is wrong because route maps are used for route filtering and policy-based manipulation (e.g., BGP attribute modification), not for maintaining separate routing tables. Option B is wrong because VDOMs (Virtual Domains) provide separate administrative domains and firewall policies, but they do not inherently create separate routing tables; VDOMs can use VRFs for routing isolation, but VDOM alone is not the feature for separate routing tables. Option D is wrong because policy-based routing (PBR) allows traffic to be forwarded based on policies (e.g., source/destination), but it does not create separate routing tables; it overrides the routing table for specific traffic, not isolate routing instances.

Full explanation →

111

Multi-Selecthard

A security analyst wants to use automation stitches on FortiGate to automatically block IP addresses that trigger an IPS signature for 'SSH Brute Force'. Which two components are required to create this automation stitch? (Choose two.)

Select 2 answers

A.Action: 'Add to Block List'

B.FortiAnalyzer log query

C.Action: 'Email Notification'

D.Trigger: 'IPS Event'

E.FortiGuard category

AnswersA, D

The action should block the source IP.

Why this answer

The 'Add to Block List' action is the specific automation stitch action that dynamically adds the offending IP address to the FortiGate's local block list, effectively blocking further SSH brute-force attempts. This action directly enforces the security policy by preventing the source IP from accessing the firewall until the block expires or is manually removed.

Exam trap

The trap here is that candidates often confuse optional actions like email notifications or external log queries as required components, when only the trigger and a blocking action are mandatory to create a functional automation stitch for IP blocking.

Full explanation →

112

MCQmedium

A FortiGate administrator is troubleshooting a VPN tunnel that connects to a remote site. The tunnel is up, but traffic is not passing. The administrator checks the Phase 2 settings and sees that the local and remote subnets are correctly defined. What is the next step to diagnose the issue?

A.Check the firewall policies that reference the VPN interface

B.Check the routing table for the remote subnet

C.Run 'diagnose vpn ike log' to check for Phase 1 errors

D.Restart the VPN tunnel

AnswerA

Even if the tunnel is up, traffic must be allowed by a firewall policy from the VPN interface to the destination zone.

Why this answer

When the VPN tunnel is up (Phase 1 and Phase 2 are established) but traffic is not passing, the most common cause is that a firewall policy referencing the VPN interface is either missing or misconfigured. Even with correct Phase 2 selectors and routing, the FortiGate will drop traffic if no policy explicitly permits it from the source to the destination over the VPN interface. Therefore, checking the firewall policies is the logical next step.

Exam trap

The trap here is that candidates assume a working Phase 2 (tunnel up) guarantees traffic flow, but FortiGate requires an explicit firewall policy to permit traffic through the VPN interface, unlike some other vendors where a route alone is sufficient.

How to eliminate wrong answers

Option B is wrong because if the tunnel is up and Phase 2 subnets are correctly defined, the routing table for the remote subnet is typically already present (either statically or via dynamic routing); a missing route would prevent the tunnel from coming up or cause Phase 2 to fail, not just block traffic. Option C is wrong because 'diagnose vpn ike log' is used to debug Phase 1 (IKE) issues, but the tunnel is already up, indicating Phase 1 completed successfully; this command would not reveal why traffic is not passing through an established tunnel. Option D is wrong because restarting the VPN tunnel is a brute-force approach that does not diagnose the root cause; if the tunnel is up and the configuration is correct, restarting it will not resolve a missing or misconfigured firewall policy.

Full explanation →

113

Multi-Selecthard

A FortiGate is deployed in multi-VDOM mode. The administrator wants to use FortiAnalyzer to centralize logging from all VDOMs. Which THREE steps must be performed? (Choose three.)

Select 3 answers

A.Enable log forwarding on the management VDOM only

B.Ensure that the FortiAnalyzer can reach the FortiGate's management IP

C.Add the FortiGate as a device in FortiAnalyzer

D.Configure FortiAnalyzer settings in each VDOM to point to the FortiAnalyzer IP

E.Enable 'log-all-vdoms' feature on the FortiGate

AnswersB, C, D

Correct.

Why this answer

The FortiAnalyzer must be able to reach the FortiGate's management IP to establish the logging connection. In multi-VDOM mode, the management VDOM handles all management traffic, including FortiAnalyzer communication, so reachability to that specific IP is essential for centralized logging.

Exam trap

The trap here is that candidates assume a single global setting like 'log-all-vdoms' exists, when in reality FortiOS requires per-VDOM configuration or the use of the 'central-log' feature to aggregate logs from all VDOMs.

Full explanation →

114

Multi-Selectmedium

A FortiGate administrator is configuring a hub-and-spoke ADVPN with BGP. The hub has multiple spokes. Which TWO configuration steps are REQUIRED on the hub FortiGate for shortcut tunnels to be established between spokes?

Select 2 answers

A.Configure BGP to redistribute connected or static routes to the spokes

B.Enable 'set auto-discovery-receiver' on the hub's phase1 interface

C.Enable 'set auto-discovery-sender' on the hub's phase1 interface

D.Disable DPD on the hub's phase1 interface

E.Set the IKE version to IKEv1 on the hub

AnswersA, C

Without route redistribution, spokes will not learn about other spoke subnets, so shortcut tunnels would have no traffic to trigger.

Why this answer

For ADVPN shortcut tunnels, the hub must enable auto-discovery sender and must also advertise the spoke routes to other spokes. Without route advertisement, spokes cannot know about each other's networks.

Full explanation →

115

Multi-Selectmedium

An organization wants to implement multiple layers of defense against advanced persistent threats. Which three Fortinet solutions would be most effective in an ATP strategy? (Choose three.)

Select 3 answers

A.FortiMail

B.FortiSandbox

C.FortiWeb

D.FortiEDR

E.FortiDeceptor

AnswersB, D, E

FortiSandbox detects unknown malware via behavioral analysis.

Why this answer

FortiSandbox is correct because it provides dynamic analysis of suspicious files and URLs in a controlled, isolated environment, detecting zero-day and advanced malware that signature-based solutions miss. It integrates with other Fortinet security products to share threat intelligence and automate blocking, forming a critical layer in an ATP strategy by catching threats that evade initial defenses.

Exam trap

The trap here is that candidates often confuse 'security products that are part of a layered defense' with 'core ATP solutions,' leading them to select FortiMail or FortiWeb because they are common perimeter tools, while the exam specifically targets solutions that provide advanced threat detection, analysis, and response across multiple attack vectors.

Full explanation →

116

MCQmedium

A network administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The remote gateway logs show a proposal mismatch. On FortiGate, the administrator runs 'diagnose vpn ike config' and sees 'proposal: aes128-sha1, aes256-sha256'. The remote side expects 'aes256-sha1'. What is the most likely cause?

A.The Phase 1 proposal list does not include the algorithm combination the remote gateway requires

B.The pre-shared key is incorrect

C.The Phase 2 selectors are misconfigured

D.The IKE version is set to 1 but remote uses 2

AnswerA

Correct. The local proposal list must contain at least one matching algorithm set that the remote gateway supports.

Why this answer

The 'diagnose vpn ike config' output shows the FortiGate's Phase 1 proposal list includes 'aes128-sha1' and 'aes256-sha256', but the remote gateway expects 'aes256-sha1'. Since neither of the local proposals matches the remote's required combination, the IKE negotiation fails with a 'proposal mismatch' error. The administrator must add 'aes256-sha1' to the Phase 1 proposal list on the FortiGate to align with the remote gateway's expectation.

Exam trap

The trap here is that candidates often confuse a proposal mismatch with a pre-shared key or IKE version issue, but the specific error message and the 'diagnose vpn ike config' output directly point to an algorithm mismatch in Phase 1, not authentication or version negotiation.

How to eliminate wrong answers

Option B is wrong because a pre-shared key mismatch typically results in an authentication failure, not a proposal mismatch; the logs would show 'authentication failed' or 'invalid cookie' rather than a proposal error. Option C is wrong because Phase 2 selectors (traffic selectors) are negotiated after Phase 1 is established, so a Phase 2 misconfiguration would cause the tunnel to fail later, not prevent Phase 1 from completing. Option D is wrong because an IKE version mismatch (v1 vs v2) would produce a different error, such as 'no acceptable proposal' or 'unsupported IKE version', not a proposal mismatch on algorithms; the proposal mismatch specifically refers to encryption/hash algorithms, not the IKE version.

Full explanation →

117

MCQhard

A FortiGate running FortiOS 7.2 has multiple VDOMs. The administrator notices that inter-VDOM routing between two VDOMs is not working. Configuration shows a firewall policy allowing the traffic, and the route table shows routes to the destination VDOM. What additional configuration is required?

A.Configure a static route with a gateway IP in the destination VDOM

B.Create a VDOM link interface pair and assign them to the respective VDOMs

C.Assign an IP address to the VLAN interface on the source VDOM

D.Enable 'inter-vdom' under config system global

AnswerB

Inter-VDOM routing requires a VDOM link (logical interface pair) connecting the VDOMs.

Why this answer

Inter-VDOM routing requires a VDOM link, which is a pair of logical interfaces (one in each VDOM) that are directly connected. Without this link, the VDOMs cannot exchange traffic even if firewall policies and routes exist, because they operate as separate virtual firewalls with isolated forwarding tables.

Exam trap

The trap here is that candidates assume a firewall policy and routes are sufficient for inter-VDOM traffic, overlooking the mandatory VDOM link interface pair that provides the actual Layer 3 adjacency between the VDOMs.

How to eliminate wrong answers

Option A is wrong because a static route with a gateway IP in the destination VDOM is not possible; the gateway must be reachable via an interface that belongs to the source VDOM, and inter-VDOM routing requires a direct link (VDOM link) rather than a next-hop in another VDOM. Option C is wrong because assigning an IP to a VLAN interface on the source VDOM does not create a path to the destination VDOM; VLAN interfaces are used for Layer 2 segmentation within a single VDOM, not for inter-VDOM connectivity. Option D is wrong because there is no 'inter-vdom' toggle under config system global; inter-VDOM routing is enabled by default when VDOMs are enabled, and the missing piece is the VDOM link interface pair, not a global setting.

Full explanation →

118

MCQeasy

An administrator wants to monitor the session count on a FortiGate in real time. Which CLI command provides this information?

A.diagnose sys top

B.get system performance status

C.diagnose sys session stat

D.diagnose debug enable

AnswerC

This command displays current session statistics including total session count.

Why this answer

'diagnose sys session stat' is the specific FortiGate CLI command that displays real-time session statistics, including the total number of sessions currently tracked by the firewall. This command provides a live count of active sessions, which is exactly what the administrator needs for real-time monitoring.

Exam trap

The trap here is confusing general performance monitoring commands (like 'get system performance status') with session-specific diagnostics, leading candidates to select options that show system health but not the exact session count required.

How to eliminate wrong answers

Option A is wrong because 'diagnose sys top' shows real-time CPU and memory usage per process, not session counts. Option B is wrong because 'get system performance status' displays overall system performance metrics like CPU load and memory usage, but does not include session count details. Option D is wrong because 'diagnose debug enable' is used to enable debug output for troubleshooting, not to display session statistics.

Full explanation →

119

MCQhard

A FortiGate administrator configures a VDOM with a limit on the number of firewall policies. The VDOM has 200 policies, and the limit is set to 250. The administrator attempts to add a new policy but receives an error indicating the limit has been reached. What is the MOST likely reason?

A.The administrator must reboot the FortiGate for the limit to take effect

B.The limit includes IPv4, IPv6, and other policy types

C.The VDOM has reached the maximum number of objects, not policies

D.The limit is per VDOM and cannot be changed

AnswerB

VDOM policy limits apply to the total number of policies across all types (IPv4, IPv6, etc.). If 200 IPv4 policies exist, plus IPv6 policies, the total may exceed 250.

Why this answer

The FortiGate VDOM policy limit includes all policy types—IPv4, IPv6, and others (e.g., local-in policies, authentication policies). Even if the administrator has only 200 IPv4 policies, the total count of all policy types combined may already reach the 250 limit, preventing the addition of a new policy. This is why the error occurs despite the VDOM appearing to have room under the configured limit.

Exam trap

The trap here is that candidates assume the limit applies only to IPv4 firewall policies, ignoring that FortiGate counts all policy types (IPv4, IPv6, local-in, etc.) against the same limit, leading them to choose an incorrect answer like C or D.

How to eliminate wrong answers

Option A is wrong because policy limits take effect immediately without requiring a reboot; FortiGate enforces the limit dynamically upon policy creation. Option C is wrong because the error specifically references the policy limit, not the object limit; FortiGate has separate limits for objects (e.g., addresses, services) and policies, and the error message would differ if it were an object limit issue. Option D is wrong because the limit can be changed per VDOM via the config vdom command (e.g., set firewall-policy-limit), and it is not immutable.

Full explanation →

120

MCQmedium

A FortiGate has multiple VRFs configured. An administrator wants to allow traffic from VRF 1 to reach a server in VRF 2. What configuration is required?

A.Use a single VDOM and enable inter-VDOM links.

B.Place both interfaces in the same VRF.

C.Create a static route from one VRF to another.

D.Configure a VRF leak policy using route maps or policy routes.

AnswerD

VRF leaking can be achieved by using route maps with the 'set vrf' command or by using policy routes to forward traffic between VRFs.

Why this answer

VRF leaking is the standard method to allow traffic between different VRFs on a FortiGate. This is achieved by configuring route maps or policy routes to selectively import/export routes between VRFs, enabling inter-VRF communication without merging the VRFs or using VDOMs.

Exam trap

The trap here is that candidates confuse VRF leaking with inter-VDOM routing or assume a simple static route can bridge VRFs, but FortiGate enforces strict VRF isolation unless an explicit leak policy is configured.

How to eliminate wrong answers

Option A is wrong because inter-VDOM links are used for communication between different VDOMs, not between VRFs within the same VDOM; VRFs are a routing table segmentation feature within a single VDOM. Option B is wrong because placing both interfaces in the same VRF would defeat the purpose of VRF segmentation, merging the routing tables and removing isolation. Option C is wrong because a static route alone cannot leak traffic between VRFs; FortiGate requires explicit VRF leak configuration (e.g., route maps or policy routes) to allow inter-VRF forwarding, as static routes are VRF-scoped by default.

Full explanation →

121

MCQhard

A FortiGate HA cluster is configured with two units in active-passive mode. The administrator needs to perform a firmware upgrade on the cluster with minimal downtime. The current firmware version is 7.2.5 and the target is 7.2.7. The cluster uses FGCP with session synchronization enabled. Which procedure should the administrator follow?

A.Upgrade only the primary unit and let the secondary synchronize automatically

B.Disable HA, upgrade both units, then re-enable HA

C.Upgrade both units at the same time by connecting to each via console

D.Upgrade the passive unit first, perform a graceful failover, then upgrade the new passive unit

AnswerD

This procedure ensures minimal downtime and maintains session synchronization.

Why this answer

It follows the recommended upgrade procedure for an active-passive FGCP cluster with session synchronization. By upgrading the passive unit first, then performing a graceful failover (which preserves existing sessions via FGCP session sync), and finally upgrading the new passive unit, the administrator ensures that the cluster remains operational throughout the process with minimal traffic disruption. This method avoids a full cluster outage and maintains session continuity.

Exam trap

The trap here is that candidates assume firmware synchronization works like configuration synchronization, leading them to choose Option A, but FGCP does not automatically replicate firmware images between cluster members.

How to eliminate wrong answers

Option A is wrong because upgrading only the primary unit does not cause the secondary to synchronize firmware; FGCP synchronizes configuration and session state, not firmware images, so the secondary would remain on the old version and the cluster would break. Option B is wrong because disabling HA removes redundancy and causes a full traffic outage during the upgrade, which contradicts the goal of minimal downtime. Option C is wrong because upgrading both units simultaneously via console without a failover sequence would likely cause a split-brain scenario or traffic loss, as both units would reboot at the same time, dropping all sessions.

Full explanation →

122

MCQeasy

An administrator applies the above policy but users from 10.0.1.0/24 cannot access web servers at 10.0.2.0/24. However, they can ping the servers. What is the most likely cause?

A.The service 'HTTP' does not include port 443 or the web application is using HTTPS.

B.The destination address is incorrect.

C.The schedule 'always' is not correctly configured.

D.The source interface is incorrect.

AnswerA

The service 'HTTP' only covers port 80; if the web server uses HTTPS (port 443), the policy won't match.

Why this answer

The policy allows HTTP traffic (port 80), but the web servers are likely using HTTPS (port 443). Since the service object 'HTTP' in FortiGate typically only includes TCP/80, HTTPS traffic is denied by default. The administrator can ping the servers because ICMP is permitted by an implicit or explicit policy, confirming that routing and connectivity are functional.

Exam trap

The trap here is that candidates assume 'HTTP' covers all web traffic, but FortiGate strictly matches the defined ports in the service object, so HTTPS (port 443) is blocked unless explicitly permitted.

How to eliminate wrong answers

Option B is wrong because the destination address 10.0.2.0/24 is correct for the web servers, and ping success confirms reachability. Option C is wrong because the schedule 'always' is a default, always-active schedule that cannot be misconfigured; if it were invalid, no traffic would pass. Option D is wrong because the source interface is correctly set to the interface connected to 10.0.1.0/24, as evidenced by successful ping traffic from that subnet.

Full explanation →

123

MCQeasy

A network administrator wants to logically separate two departments on a single FortiGate. Each department must have its own firewall policies, routing table, and administrators. Which feature should be used?

A.Virtual Domains (VDOMs)

B.Policy Packages

C.Administrative Domains (ADOMs)

D.VLANs

AnswerA

VDOMs create separate virtual firewalls within a single chassis.

Why this answer

Virtual Domains (VDOMs) allow a single FortiGate to be partitioned into multiple independent virtual firewalls, each with its own firewall policies, routing table, and administrative access. This meets the requirement for logical separation of departments with isolated policy and routing domains.

Exam trap

The trap here is confusing VLANs with VDOMs: VLANs segment Layer 2 traffic but do not provide independent routing tables or administrative domains, so candidates often pick VLANs when the question explicitly requires separate routing and administrators.

How to eliminate wrong answers

Option B is wrong because Policy Packages are used to group firewall policies within a VDOM or a non-VDOM FortiGate, but they do not provide separate routing tables or independent administrators. Option C is wrong because Administrative Domains (ADOMs) are a FortiManager concept for managing multiple FortiGates or VDOMs, not a feature on a single FortiGate for local separation. Option D is wrong because VLANs operate at Layer 2 to segment broadcast domains and require a Layer 3 interface or VDOM to enforce separate routing tables and firewall policies; they do not inherently provide independent routing or administrative isolation.

Full explanation →

124

MCQhard

An administrator is investigating a security incident and needs to view raw logs from a FortiAnalyzer for a specific time range. The administrator wants to ensure the logs are not aggregated or summarized. Which type of log view should be used?

A.Event Management

B.FortiView

C.Reports

D.Log View

AnswerD

Log View displays raw, unaggregated logs from the FortiAnalyzer, ideal for detailed incident investigation.

Why this answer

The Log View in FortiAnalyzer displays raw, unaggregated logs exactly as received from FortiGate devices, making it the correct choice for viewing logs without summarization. Unlike other views that pre-process or summarize data, Log View provides direct access to the original log entries for a specified time range, which is essential for detailed incident investigation.

Exam trap

The trap here is that candidates confuse FortiView's real-time graphical summaries with raw log access, assuming 'Log View' is just another dashboard, when in fact FortiView aggregates data and Log View shows the original unmodified logs.

How to eliminate wrong answers

Option A is wrong because Event Management aggregates and correlates logs into events, summarizing multiple log entries into a single event record, which does not show raw logs. Option B is wrong because FortiView provides pre-processed, summarized graphical views and dashboards that aggregate data for quick analysis, not raw logs. Option C is wrong because Reports generate summarized, formatted output based on templates and scheduled aggregation, not the original unaggregated log entries.

Full explanation →

125

MCQhard

A FortiGate VDOM is configured with a WAN interface (port1) and LAN interface (internal). The admin creates a policy allowing HTTP from internal to WAN with an antivirus profile applied. Users report that HTTP throughput is very slow. The admin checks the session table and sees many sessions with state 11 (TCP_CLOSE_WAIT). What is causing the performance issue?

A.The antivirus profile is performing file scanning, causing delays

B.The policy is missing a timeout setting for TCP half-close

C.The HTTP server is not properly closing connections, and the FortiGate is waiting for FIN from client

D.The FortiGate is using proxy-based inspection, which delays session closure

AnswerC

CLOSE_WAIT means the server has closed the connection (FIN received) but the client hasn't. The FortiGate waits for the client's FIN and holds the session.

Why this answer

State 11 (TCP_CLOSE_WAIT) indicates that the FortiGate has received a FIN from the server (WAN side) and is waiting for a FIN from the client (internal side) to complete the TCP connection closure. When the HTTP server does not properly close connections, the FortiGate holds these sessions open, consuming session table resources and causing performance degradation. The antivirus profile is not the direct cause; the issue is the accumulation of sessions stuck in CLOSE_WAIT due to incomplete TCP teardown.

Exam trap

The trap here is that candidates often attribute slow throughput to antivirus scanning (Option A) or proxy inspection (Option D), but the session state TCP_CLOSE_WAIT directly points to a TCP closure problem, not a content inspection issue.

How to eliminate wrong answers

Option A is wrong because antivirus file scanning can introduce latency but does not cause sessions to remain in TCP_CLOSE_WAIT state; that state is specific to TCP connection closure, not scanning delays. Option B is wrong because FortiGate does not have a configurable 'TCP half-close timeout' for policies; session timeouts are handled by the TCP session timeout settings (e.g., default-tcp-timeout), and the issue is not a missing timeout but the server not sending FIN. Option D is wrong because proxy-based inspection may affect session handling but does not cause sessions to stay in CLOSE_WAIT; CLOSE_WAIT is a standard TCP state indicating the device is waiting for the client to close, regardless of inspection mode.

Full explanation →

126

Multi-Selecthard

A FortiGate administrator is troubleshooting an IPsec VPN that uses IKEv2 with certificate authentication. The VPN fails to establish. The administrator runs 'diagnose vpn ike gateway list' and sees the gateway state is 'IKE_INIT'. Which three possible causes should the administrator investigate? (Choose three.)

Select 3 answers

A.The certificate of the remote peer is not trusted by the local FortiGate

B.The pre-shared key is incorrect

C.The phase 1 proposal (encryption, hash, DH group) does not match

D.The phase 2 proxy ID is incorrect

E.The remote peer's certificate has expired

AnswersA, C, E

Certificate validation failure would cause IKE to stay in INIT.

Why this answer

The IKE_INIT state indicates phase 1 has not completed. Possible causes include the remote peer's certificate not being trusted (A), phase 1 proposal mismatch (C), and the remote peer's certificate having expired (E). Note that with IKEv2 certificate authentication, a pre-shared key (B) is not used, and phase 2 proxy ID mismatch (D) would not cause phase 1 failure.

Full explanation →

127

MCQmedium

An administrator runs 'diagnose sys session filter dport 443' and sees: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is a multicast session with a duration of 3600 seconds.

B.The session is a TCP session in established state that has been up for 3600 seconds and will expire in 3599 seconds.

C.The session is in SYN_SENT state and has timed out after 3600 seconds.

D.The session is a UDP session that has been active for 3600 seconds.

AnswerB

proto=6 means TCP, proto_state=01 typically indicates established state. Duration is the time since session creation, expire is the remaining time before the session is removed if idle.

Why this answer

The output shows proto=6, which is TCP, and proto_state=01, which indicates the TCP session is in an established state (TCP_ESTABLISHED). The duration=3600 means the session has been active for 3600 seconds, and expire=3599 means it will expire in 3599 seconds (i.e., the idle timeout is counting down). This is a standard TCP session in the established state, not a multicast or UDP session.

Exam trap

The trap here is that candidates confuse proto_state=01 with a SYN_SENT or timed-out state, or misinterpret proto=6 as UDP, because they do not memorize the TCP state codes or protocol numbers used in FortiOS session diagnostics.

How to eliminate wrong answers

Option A is wrong because proto=6 is TCP, not multicast; multicast sessions use UDP (proto=17) and have different state codes. Option C is wrong because proto_state=01 represents TCP_ESTABLISHED, not SYN_SENT (which would be state 02); also, the session has not timed out—it is still active with an expiry counter. Option D is wrong because proto=6 is TCP, not UDP (UDP uses proto=17), and UDP sessions do not have a TCP state machine.

Full explanation →

128

MCQhard

An administrator configures a multi-VDOM FortiGate in transparent mode. The admin notices that the management IP is reachable from both interfaces, but traffic passing through the device is not being inspected. What is the likely issue?

A.Inter-VDOM routing is misconfigured

B.The VDOM is in transparent mode, but no firewall policy is applied to the traffic

C.The FortiGate needs a default route

D.The management IP is assigned to the wrong VDOM

AnswerB

In transparent mode, traffic is bridged by default; policies must be created to inspect traffic.

Why this answer

In transparent mode, a FortiGate acts as a Layer 2 bridge, and traffic passing through the device is controlled by firewall policies, not by routing. Even though the management IP is reachable (because it is a separate IP on the bridge interface), no traffic inspection occurs unless an explicit firewall policy is configured to allow and inspect the traffic between the bridge interfaces. Option B correctly identifies that the missing firewall policy is the root cause.

Exam trap

The trap here is that candidates assume transparent mode automatically inspects all traffic or that management IP reachability implies full functionality, but in reality, a firewall policy is mandatory for traffic inspection even in Layer 2 mode.

How to eliminate wrong answers

Option A is wrong because inter-VDOM routing is not relevant in a single-VDOM transparent mode setup; the issue is about intra-VDOM traffic passing through the bridge, not between VDOMs. Option C is wrong because a default route is used for management traffic originating from the FortiGate itself, not for transit traffic passing through the device in transparent mode; transit traffic is bridged and does not require a routing table. Option D is wrong because the management IP being reachable from both interfaces indicates it is correctly assigned to the VDOM; the problem is the lack of a firewall policy to inspect transit traffic, not a misassignment of the management IP.

Full explanation →

129

MCQhard

An administrator configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. The default route in VDOM-A points to a next-hop router, and VDOM-B has a static route to a subnet behind VDOM-A. Users in VDOM-B cannot reach that subnet. The administrator runs 'diagnose ip route list' in both VDOMs and sees the routes are present. What is the most likely cause?

A.The VDOM link MTU is too small for the traffic

B.The VDOM link interfaces are administratively down

C.Firewall policies are missing on the VDOMs to permit traffic between the VDOM link and the destination interfaces

D.The VDOMs are in different administrative domains (ADOMs) on FortiManager

AnswerC

Correct.

Why this answer

Even though the routes are present in both VDOMs, inter-VDOM routing via a VDOM link requires explicit firewall policies on each VDOM to permit traffic between the VDOM link interface and the destination interface. Without these policies, the FortiGate drops the traffic at the firewall layer, even though the routing table is correct. This is a common misconfiguration because VDOM links behave like physical interfaces and are subject to firewall policy enforcement.

Exam trap

The trap here is that candidates assume that because routes are present and the VDOM link is up, traffic should flow automatically, forgetting that FortiGate enforces firewall policies even for inter-VDOM traffic.

How to eliminate wrong answers

Option A is wrong because an MTU mismatch would cause fragmentation issues or packet drops, but the routes would still be present and the administrator would typically see ICMP fragmentation-needed messages or packet loss, not a complete inability to reach the subnet. Option B is wrong because if the VDOM link interfaces were administratively down, the routes would not appear in the routing table (the interface would be down, making the next-hop unreachable), and the administrator would see the interfaces in a 'down' state. Option D is wrong because ADOMs on FortiManager are a management-plane concept that controls visibility and administrative access, not data-plane forwarding; inter-VDOM routing is handled locally on the FortiGate and is unaffected by FortiManager ADOM configuration.

Full explanation →

130

MCQmedium

A FortiGate has multiple equal-cost routes to the same destination via two different interfaces. ECMP load balancing is enabled. What determines how traffic is distributed among the routes?

A.The interface speed

B.A hash of source and destination IP addresses

C.Round-robin per packet

D.The route metric

AnswerB

Default ECMP uses source-dest-ip hashing.

Why this answer

When ECMP load balancing is enabled on a FortiGate, traffic distribution among equal-cost routes is determined by a hash algorithm that uses source and destination IP addresses (and optionally ports) to select the egress interface. This ensures that all packets belonging to the same flow are consistently forwarded via the same path, preserving packet order and avoiding reordering issues.

Exam trap

The trap here is that candidates often assume ECMP uses round-robin or interface speed weighting, but FortiGate strictly uses a hash-based algorithm to maintain flow affinity and avoid packet reordering.

How to eliminate wrong answers

Option A is wrong because interface speed does not influence ECMP load balancing; FortiGate uses a hash-based selection, not a weighted distribution based on link speed. Option C is wrong because FortiGate does not use per-packet round-robin for ECMP; such a method would cause severe packet reordering and is not implemented in FortiGate's ECMP logic. Option D is wrong because the route metric is identical for all equal-cost routes by definition; ECMP only applies when metrics are equal, so metric does not determine distribution.

Full explanation →

131

MCQmedium

A network administrator configures an SD-WAN zone with two members (port1 and port2) and sets the load balancing algorithm to 'spillover'. The spillover threshold is set to 100 Mbps on port1. If traffic reaches 120 Mbps on port1, what happens to new sessions?

A.All traffic is dropped because the threshold exceeded

B.New sessions are sent to port2 until port1 drops below the threshold

C.Port1 continues to receive all new sessions but packets are queued

D.New sessions are distributed equally between port1 and port2

AnswerB

Correct spillover behavior.

Why this answer

When the spillover algorithm is configured with a threshold of 100 Mbps on port1 and traffic reaches 120 Mbps, port1 is considered saturated. The SD-WAN zone then directs all new sessions to port2 until the traffic on port1 drops below the threshold. This is the defined behavior of spillover load balancing in Fortinet SD-WAN, where traffic is shifted away from an overloaded member to maintain performance.

Exam trap

The trap here is that candidates often confuse spillover with load balancing algorithms like 'lowest latency' or 'round-robin', incorrectly assuming that traffic is dropped, queued, or evenly distributed when the threshold is exceeded, rather than understanding that spillover is a failover-like mechanism that shifts new sessions to the next available member.

How to eliminate wrong answers

Option A is wrong because spillover does not drop traffic; it redirects new sessions to another member when the threshold is exceeded. Option C is wrong because spillover does not queue packets on the overloaded port; it actively moves new sessions to an alternate member. Option D is wrong because spillover does not distribute sessions equally; it sends all new sessions to the underutilized member (port2) until the primary member's load drops below the threshold.

Full explanation →

132

Multi-Selecteasy

An administrator is troubleshooting why a FortiAnalyzer report is not showing expected data. Which TWO potential causes should the administrator investigate?

Select 2 answers

A.The log data is in a different datastore than the one configured for the report

B.The report schedule is not set

C.The FortiAnalyzer is in a different ADOM

D.The FortiGate is not configured to send logs to FortiAnalyzer

E.The FortiAnalyzer license has expired

AnswersA, D

Reports must point to the correct datastore containing the logs.

Why this answer

FortiAnalyzer organizes logs into datastores based on device groups or ADOMs. If the report is configured to query a datastore that does not contain the relevant logs, the report will not display the expected data, even if the logs exist elsewhere on the same FortiAnalyzer.

Exam trap

The trap here is that candidates often confuse ADOMs with datastores, assuming an ADOM mismatch would block data, when in fact ADOMs only affect administrative visibility, not the underlying log storage or report query scope.

Full explanation →

133

MCQeasy

A FortiGate is configured as a SAML service provider (SP) for SSO. Users authenticate via an external IdP. After successful authentication, the FortiGate should enforce a firewall policy based on the user's group membership. Which FortiGate setting must be enabled to receive group information from the IdP?

A.Enable 'Require IdP Certificate Validation'

B.Create a separate firewall policy for each user

C.Enable 'Auto-Provision Users' on FortiGate

D.Configure the 'user-group' attribute in the SAML SP settings

AnswerD

FortiGate allows mapping of group membership from a SAML attribute. The administrator must specify which attribute (e.g., group) carries the group information.

Why this answer

To receive group membership information from the IdP, the FortiGate SAML SP must be configured with the correct SAML attribute that carries the user group data. This is done by setting the 'user-group' attribute (or equivalent) in the SAML SP configuration. When the IdP sends a SAML assertion containing that attribute, FortiGate maps it to the user's group membership, enabling group-based firewall policies.

Option D is correct because it explicitly references configuring the 'user-group' attribute in the SAML SP settings.

Full explanation →

134

MCQmedium

An administrator configures a ZTNA proxy rule to allow access to an internal application. Users can connect to the FortiGate ZTNA gateway but receive a '403 Forbidden' error. Which step should the administrator take to resolve the issue?

A.Disable the 'require ZTNA tag' option on the proxy rule

B.Check that the ZTNA proxy rule's action is set to 'accept' and the correct tags are specified

C.Ensure the application is reachable from the FortiGate with a ping

D.Verify that the application's firewall policy has an SSL inspection profile applied

AnswerB

The proxy rule controls access based on tags. Missing tags cause forbidden errors.

Why this answer

A 403 error on ZTNA typically indicates that the user's device does not have the required ZTNA tags. The administrator must ensure the FortiClient has the correct tags assigned based on compliance.

Full explanation →

135

MCQhard

A FortiGate is configured with an antivirus profile that has the machine learning engine enabled. An administrator notices that some files are being detected by the ML engine but the verdict is 'probably clean'. What does this verdict indicate?

A.The file is clean and safe to pass.

B.The file is definitely malicious and should be blocked.

C.The ML engine has detected an outbreak but needs FortiGuard to confirm.

D.The ML engine has low confidence that the file is malicious; it may be a false positive.

AnswerD

'Probably clean' indicates low malicious confidence, often requiring further analysis.

Why this answer

The ML engine in FortiGate's antivirus profile assigns a verdict of 'probably clean' when its confidence level is low that the file is malicious. This indicates a potential false positive, meaning the file is likely benign but the engine cannot be certain. The correct action is to allow the file to pass while logging the event for further analysis, not to block it outright.

Exam trap

The trap here is that candidates confuse 'probably clean' with 'clean' or assume it requires external verification, when in fact it is a low-confidence verdict designed to avoid blocking potentially safe files.

How to eliminate wrong answers

Option A is wrong because 'probably clean' does not guarantee the file is clean; it indicates low confidence, so the file should not be unconditionally passed without scrutiny. Option B is wrong because the ML engine does not have high enough confidence to classify the file as definitely malicious; blocking it would be too aggressive and could cause false positives. Option C is wrong because the ML engine does not require FortiGuard confirmation for 'probably clean' verdicts; that mechanism is used for 'outbreak' verdicts where the engine suspects a new threat and queries FortiGuard for real-time reputation.

Full explanation →

136

MCQeasy

Which FortiGate feature allows an administrator to define a granular policy based on the security posture of the endpoint device, such as OS version, antivirus status, and disk encryption, before granting access to a protected application?

A.Web filtering profile

B.SSL VPN portal

C.IPsec phase 1 configuration

D.ZTNA access proxy

AnswerD

ZTNA access proxy enforces access based on device posture and user identity.

Why this answer

ZTNA (Zero Trust Network Access) uses device posture checks to evaluate endpoint security before granting access to applications.

Full explanation →

137

MCQhard

An administrator configures automation stitches on FortiManager to trigger a script when a specific event log is received. The script should block the source IP on the firewall. However, the script does not run when the event occurs. What is a likely cause?

A.The event handler filter does not match the log

B.The FortiGate is in transparent mode

C.The script is not compiled

D.The script is set to run on all managed devices

AnswerA

Correct.

Why this answer

Automation stitches on FortiManager rely on event handler filters to match specific log IDs or patterns. If the filter does not match the incoming event log (e.g., wrong log ID, incorrect field value, or mismatched severity), the trigger condition is never met, and the script will not execute. This is the most common misconfiguration when setting up event-driven automation.

Exam trap

The trap here is that candidates may assume the script itself has a syntax error or that transparent mode disables automation, but the real issue is almost always a filter mismatch in the event handler configuration.

How to eliminate wrong answers

Option B is wrong because FortiGate transparent mode does not prevent automation stitches from running; the script execution is independent of the firewall's operational mode. Option C is wrong because FortiManager scripts are interpreted, not compiled, so there is no compilation step required. Option D is wrong because setting the script to run on all managed devices would not prevent it from running; it would simply apply the script to every device, which could cause unintended behavior but does not block execution.

Full explanation →

138

Multi-Selecthard

A FortiGate is configured with multiple VRFs. An administrator notices that routes from VRF A are not being advertised to VRF B via BGP, even though the BGP configuration is correct. Which TWO actions could resolve this issue?

Select 2 answers

A.Enable 'route-flap damping' on the BGP session between VRFs

B.Configure a route leak from VRF A to VRF B under config router vrf

C.Disable 'bgp enforce-first-as' to allow cross-VRF advertisements

D.Configure 'set import-route' under the BGP VRF configuration

E.Use 'set next-hop-self' on the BGP neighbor in each VRF

AnswersB, E

Why this answer

Configuring a route leak from VRF A to VRF B under 'config router vrf' explicitly allows routes to be imported/exported between VRFs using route targets, which is required for cross-VRF BGP route advertisement. Option E is correct because 'set next-hop-self' on the BGP neighbor in each VRF ensures that the next hop is reachable from the receiving VRF, preventing next-hop unreachability issues that can block route advertisement.

Exam trap

The trap here is that candidates often confuse BGP session-level settings (like enforce-first-as or damping) with VRF route leaking mechanisms, assuming any BGP tweak can fix cross-VRF issues, when in fact explicit VRF export/import configuration is required.

Full explanation →

139

MCQhard

A network administrator is troubleshooting a FortiGate IPS sensor that is not generating alerts for a custom signature they created. The custom signature uses the pattern 'malicious. The signature is enabled and applied to a firewall policy. What is the MOST likely cause of the issue?

A.The signature severity is set to 'Low' and logging is disabled for low severity

B.The custom signature is missing the 'protocol' parameter

C.The IPS sensor is configured in 'Passive' mode

D.The firewall policy is using 'Flow-based' inspection

AnswerB

Custom signatures must specify a protocol decoder (e.g., HTTP, FTP) to be evaluated; without it, the signature is ignored.

Why this answer

The custom signature is missing the 'protocol' parameter, which is mandatory for FortiGate custom IPS signatures. Without specifying the protocol (e.g., TCP, UDP, HTTP), the IPS engine cannot match the pattern against any traffic flow, so no alerts are generated even if the signature is enabled and applied to a policy.

Exam trap

The trap here is that candidates assume a missing protocol parameter would cause a syntax error or prevent the signature from being saved, but FortiGate allows saving incomplete custom signatures that simply never match traffic.

How to eliminate wrong answers

Option A is wrong because even if severity is 'Low' and logging is disabled for low severity, the IPS sensor would still generate alerts (just not log them); the question states no alerts are generated, not just no logs. Option C is wrong because 'Passive' mode only prevents the IPS from dropping traffic but still allows alert generation and logging; it does not suppress alerts entirely. Option D is wrong because 'Flow-based' inspection supports custom signatures and can generate alerts; the issue is not the inspection mode but the missing protocol parameter in the signature definition.

Full explanation →

140

MCQeasy

A company wants to detect and block phishing emails that contain malicious links. Which FortiGate security profile should be used?

A.Antivirus profile

B.Web Filtering profile

C.Data Leak Prevention profile

D.Email Filtering profile

AnswerD

Email filtering can block phishing emails based on content and reputation.

Why this answer

FortiGate's Email Filtering profile is specifically designed to inspect SMTP, POP3, and IMAP traffic for phishing indicators, including malicious URLs in email bodies and attachments. It can block or quarantine emails based on URL reputation, sender authentication (SPF/DKIM/DMARC), and content analysis, directly addressing the requirement to detect and block phishing emails with malicious links.

Exam trap

The trap here is that candidates often confuse Web Filtering (which handles web traffic) with Email Filtering (which handles email protocols), assuming URL reputation checks in web filtering can block phishing links in emails, but FortiGate requires the Email Filtering profile to inspect SMTP/IMAP/POP3 traffic and apply email-specific actions like quarantine.

How to eliminate wrong answers

Option A is wrong because the Antivirus profile scans for malware signatures in file attachments and does not analyze URLs or email-specific phishing patterns; it would miss malicious links that do not contain executable payloads. Option B is wrong because the Web Filtering profile controls HTTP/HTTPS traffic based on URL categories and reputation, but it operates on web proxy traffic, not on email protocols like SMTP, and cannot inspect or block emails before they reach the user's inbox. Option C is wrong because the Data Leak Prevention profile monitors and prevents unauthorized data exfiltration (e.g., credit card numbers, SSNs) and has no capability to detect phishing links or email-based threats.

Full explanation →

141

MCQmedium

A FortiGate administrator notices that traffic classified as 'unknown' by the antivirus is being allowed. The administrator wants to ensure that such files are submitted to FortiSandbox for analysis and blocked until a verdict is received. Which configuration is required?

A.Create a custom IPS signature for unknown files

B.Enable FortiSandbox in the antivirus profile and set 'Action for unknown files' to 'Block'

C.Enable outbreak prevention in the antivirus profile

D.Enable FortiSandbox in the antivirus profile and set 'Action for known files' to 'Block'

AnswerB

This configuration submits unknown files to FortiSandbox and blocks them until a verdict is returned.

Why this answer

When FortiSandbox is enabled in the antivirus profile and 'Action for unknown files' is set to 'Block', the FortiGate will submit files that cannot be identified by the local antivirus engine to FortiSandbox for analysis. While the file is being analyzed, it is blocked from reaching the client, ensuring that no potentially malicious content is delivered until a verdict (clean or malicious) is received. This directly addresses the administrator's requirement to block unknown files pending sandbox analysis.

Exam trap

The trap here is that candidates often confuse 'Action for unknown files' with 'Action for known files' or mistakenly think that outbreak prevention (which uses FortiGuard outbreak signatures) is sufficient to block unknown files, when in fact only the sandbox integration with the 'Block' action provides the required submission and blocking behavior.

How to eliminate wrong answers

Option A is wrong because custom IPS signatures are designed to detect and block network-level attacks based on traffic patterns, not to handle unknown files identified by the antivirus engine; IPS does not integrate with FortiSandbox for file submission. Option C is wrong because outbreak prevention in the antivirus profile uses FortiGuard outbreak alerts to block files based on known outbreak signatures, but it does not submit unknown files to FortiSandbox or block them pending analysis; it relies on pre-existing outbreak intelligence. Option D is wrong because setting 'Action for known files' to 'Block' would block files that are already identified by the antivirus engine, which is the opposite of the requirement; the administrator needs to block unknown files, not known ones.

Full explanation →

142

MCQeasy

What does FortiGuard Outbreak Prevention use to protect against newly discovered malware outbreaks before traditional signatures are available?

A.Outbreak signatures and hash-based blocking

B.IP reputation and URL filtering

C.Heuristic analysis and emulation

D.Artificial intelligence and behavior analysis

AnswerA

Outbreak prevention uses hashes of malicious files identified during outbreaks.

Why this answer

FortiGuard Outbreak Prevention uses outbreak signatures and hash-based blocking to provide rapid protection against newly discovered malware outbreaks before traditional signatures are available. Outbreak signatures are lightweight, pattern-based detections that can be deployed quickly, while hash-based blocking allows immediate blocking of known malicious file hashes, even when full signature analysis is not yet complete.

Exam trap

The trap here is that candidates often confuse outbreak prevention with sandboxing or heuristic analysis, but FortiGuard Outbreak Prevention specifically relies on rapidly deployable outbreak signatures and hash-based blocking, not on behavioral or AI-based analysis.

How to eliminate wrong answers

Option B is wrong because IP reputation and URL filtering are network-layer controls that block known malicious hosts or URLs, but they do not directly detect or block malware files themselves, making them insufficient for outbreak prevention. Option C is wrong because heuristic analysis and emulation are proactive detection methods used in sandboxing or advanced threat protection, but they are not the primary mechanism for FortiGuard Outbreak Prevention, which relies on rapidly deployable signatures and hashes. Option D is wrong because artificial intelligence and behavior analysis are advanced techniques used in FortiSandbox or FortiAI, but they are not the core technology behind FortiGuard Outbreak Prevention, which focuses on immediate, signature-based blocking.

Full explanation →

143

MCQhard

An administrator is troubleshooting an HA cluster (active-passive) where both units show 'primary' in 'get system ha status'. The cluster is not synchronizing configurations. What is the MOST likely cause?

A.The HA password is incorrect

B.The HA heartbeat interface is disconnected or misconfigured

C.The HA group ID is mismatched

D.The HA priority values are equal for both units

AnswerB

If heartbeat communication fails, each unit assumes the other is down and transitions to primary, causing a split-brain.

Why this answer

In an active-passive HA cluster, both units showing 'primary' indicates a failure in heartbeat communication. The HA heartbeat interface is used to exchange cluster state and session information; if it is disconnected or misconfigured, each unit assumes the other is down and transitions to primary, leading to a split-brain scenario. This prevents configuration synchronization because the units cannot agree on a primary-secondary role.

Exam trap

The trap here is that candidates often assume an HA password mismatch or group ID mismatch causes role conflicts, but in reality, a heartbeat failure is the only scenario that makes both units independently declare themselves primary.

How to eliminate wrong answers

Option A is wrong because an incorrect HA password would cause authentication failures during heartbeat exchanges, but both units would still show their correct roles (primary/secondary) based on priority; they would not both become primary. Option C is wrong because a mismatched HA group ID would prevent the cluster from forming entirely, resulting in both units showing as standalone or 'standalone', not both as 'primary'. Option D is wrong because equal HA priority values do not cause both units to become primary; in an active-passive cluster, if priorities are equal, the unit with the higher serial number becomes primary, and the other becomes secondary, so both would not show 'primary'.

Full explanation →

144

Multi-Selectmedium

A company receives a threat intelligence feed that lists several IP addresses as malicious. The administrator wants to automatically block traffic from these IPs on FortiGate. Which TWO methods can achieve this? (Choose two.)

Select 2 answers

A.Enable FortiGuard Outbreak Prevention

B.Configure an external connector to a threat intelligence feed and map it to an address object

C.Use an automation stitch with a trigger that receives the feed and an action to update blocked IPs

D.Configure a firewall policy to deny all traffic from unknown sources

E.Create an address group and add the IPs manually

AnswersB, C

External connectors can pull threat feeds and update address objects automatically.

Why this answer

FortiGate's external connector can ingest a threat intelligence feed (e.g., STIX/TAXII or CSV) and dynamically map it to an address object. This allows the firewall to automatically update its policy enforcement based on the feed without manual intervention. Option C is correct because an automation stitch can use a trigger (e.g., receiving a feed via webhook or script) and an action to update blocked IPs via the FortiOS API or CLI, providing real-time blocking.

Exam trap

The trap here is that candidates often confuse FortiGuard Outbreak Prevention (a signature-based service) with the ability to ingest external threat feeds, or they think manual address groups are sufficient for automated threat blocking, missing the requirement for dynamic, feed-driven automation.

Full explanation →

145

MCQeasy

What is the purpose of header and footer policies in a FortiManager policy package?

A.They are used for VDOM-specific policies that cannot be modified

B.They provide a way to group policies for reporting purposes

C.They define policies that are placed at the top (header) and bottom (footer) of the policy list when applied to a FortiGate

D.They allow policy packages to be installed in a specific sequence

AnswerC

Header policies are evaluated first, footer policies last, regardless of other policies.

Why this answer

Header and footer policies in FortiManager policy packages allow administrators to define policies that are automatically placed at the very top (header) and very bottom (footer) of the policy list when the package is installed on a FortiGate. This ensures that critical policies, such as default deny rules or inter-VDOM links, remain in a fixed position regardless of other policy changes. This mechanism is essential for maintaining a consistent security posture across managed FortiGates.

Exam trap

The trap here is that candidates often confuse header/footer policies with VDOM-specific policies or policy grouping, when in fact they are specifically designed to enforce a fixed policy order at the top and bottom of the policy list.

How to eliminate wrong answers

Option A is wrong because header and footer policies are not VDOM-specific; they are part of the policy package and can be modified like any other policy. Option B is wrong because header and footer policies are not used for grouping policies for reporting; reporting groups are handled via policy tags or separate grouping features. Option D is wrong because header and footer policies do not control the installation sequence of policy packages; installation sequence is managed by the 'Installation Order' setting in FortiManager, not by header/footer policies.

Full explanation →

146

MCQmedium

An administrator wants to segment traffic between two departments (Engineering and Finance) using the same FortiGate. Each department must have its own routing table with overlapping IP addresses. Which feature should be enabled to achieve this without creating separate VDOMs?

A.VRF

B.Policy-based routing

C.Virtual IP (VIP)

D.Multiple VDOMs

AnswerA

VRF provides separate routing tables within a VDOM, allowing overlapping IP addresses.

Why this answer

VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, enabling overlapping IP address spaces for different departments without requiring separate VDOMs. Each VRF instance isolates routing decisions, forwarding tables, and interfaces, meeting the segmentation requirement while preserving a unified management plane.

Exam trap

The trap here is that candidates confuse VRF with VDOMs, assuming that only VDOMs can provide routing isolation, but VRF achieves the same within a single VDOM without the overhead of separate management domains.

How to eliminate wrong answers

Option B is wrong because policy-based routing (PBR) only influences traffic path selection based on policies (e.g., source/destination), but does not create separate routing tables or support overlapping IP addresses; all routes still reside in the global routing table. Option C is wrong because Virtual IP (VIP) is a destination NAT feature used to map public IPs to private IPs, not a mechanism for routing table isolation or overlapping address spaces. Option D is wrong because multiple VDOMs would achieve the goal but the question explicitly asks for a solution without creating separate VDOMs; VRF provides the same isolation within a single VDOM.

Full explanation →

147

MCQeasy

What is the primary purpose of an administrative VDOM on a FortiGate?

A.To enable transparent mode operation

B.To increase the maximum number of firewall policies

C.To provide independent management and administrative access for different tenants or departments

D.To route traffic between different VDOMs

AnswerC

Why this answer

An administrative VDOM on a FortiGate provides independent management and administrative access for different tenants or departments. Each administrative VDOM has its own administrator accounts, authentication settings, and management interfaces (HTTPS, SSH, SNMP), allowing multi-tenant isolation without requiring separate physical firewalls. This is distinct from traffic-forwarding VDOMs, which handle data plane operations.

Exam trap

The trap here is confusing the management-plane isolation of an administrative VDOM with data-plane functions like inter-VDOM routing or transparent mode, leading candidates to select options that describe traffic forwarding or operational modes instead of administrative separation.

How to eliminate wrong answers

Option A is wrong because transparent mode operation is a per-VDOM setting (config system vdom edit <vdom> set mode transparent), not a purpose of an administrative VDOM; administrative VDOMs can operate in either transparent or NAT mode. Option B is wrong because the maximum number of firewall policies is limited by the FortiGate model and total VDOM resources, not by the presence of an administrative VDOM; an administrative VDOM does not increase policy limits. Option D is wrong because routing traffic between different VDOMs is accomplished via inter-VDOM links (config system vdom-link) or VDOM peering, not by an administrative VDOM, which is solely for management plane separation.

Full explanation →

148

Multi-Selectmedium

A FortiGate administrator is troubleshooting a BGP session that fails to establish with a neighbor at 10.0.1.1. Running 'diagnose ip router bgp all' shows the neighbor state as 'Idle'. Which TWO commands should the administrator run NEXT to diagnose the issue?

Select 2 answers

A.show full-configuration router bgp

B.execute ping 10.0.1.1

C.diagnose ip router bgp all

D.diagnose sys session filter dport 179

E.get router info bgp summary

AnswersA, B

This displays the complete BGP configuration, including neighbor IP, remote AS, and update-source, helping identify misconfiguration.

Why this answer

'show full-configuration router bgp' displays the complete BGP configuration, including all neighbor settings, network statements, and route-maps. This allows the administrator to verify that the neighbor at 10.0.1.1 is correctly configured with the proper remote-as, update-source, and any optional parameters that might prevent the session from leaving the Idle state. Option B is correct because a BGP session stuck in Idle often indicates a Layer 3 connectivity issue; pinging the neighbor confirms whether the destination is reachable, which is a fundamental prerequisite for TCP port 179 to establish.

Exam trap

The trap here is that candidates assume 'diagnose ip router bgp all' or 'get router info bgp summary' will provide the root cause, but these commands only confirm the Idle state without revealing whether the issue is configuration or connectivity, leading them to skip the fundamental Layer 3 check and the full configuration review.

Full explanation →

149

MCQeasy

Which FortiAnalyzer feature allows administrators to create automated response actions triggered by specific log events, such as blocking an IP address when an intrusion is detected?

A.FortiView

B.Reports

C.Incidents

D.Playbooks

AnswerD

Playbooks automate response actions based on triggers.

Why this answer

Playbooks in FortiAnalyzer allow administrators to define automated response actions triggered by specific log events, such as blocking an IP address when an intrusion is detected. This feature uses a visual workflow editor to chain conditions and actions (e.g., executing CLI commands via FortiGate API or sending alerts) based on real-time log analysis, enabling automated threat mitigation without manual intervention.

Exam trap

The trap here is that candidates confuse Playbooks with Incidents, assuming Incidents include automation, but Incidents are purely for manual or semi-manual investigation workflows, while Playbooks are the only feature for fully automated, event-triggered responses.

How to eliminate wrong answers

Option A is wrong because FortiView is a real-time monitoring and visualization tool that displays traffic logs, sessions, and security events, but it does not provide automation or trigger-based response actions. Option B is wrong because Reports are scheduled or on-demand document generation tools for summarizing historical data, not for executing automated responses to live events. Option C is wrong because Incidents are a grouping mechanism for related alerts and logs to aid investigation, but they do not include automated action execution like blocking IPs.

Full explanation →

150

MCQeasy

What is the primary purpose of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus features?

A.To remove potentially malicious content from documents and rebuild them as safe files

B.To convert files into PDF format for safer viewing

C.To detect zero-day malware using sandboxing

D.To block all files containing macros

AnswerA

CDR strips active content and reconstructs files to eliminate threats.

Why this answer

Content Disarm and Reconstruction (CDR) is designed to remove active or potentially malicious content—such as macros, scripts, embedded objects, and OLE links—from documents (e.g., Office files, PDFs) and then reconstruct them as sanitized, safe versions. This approach prevents threats like macro-based malware or exploit-laden attachments from reaching users, even if the file contains previously unknown (zero-day) payloads, by stripping the dangerous components rather than relying solely on signature-based detection.

Exam trap

The trap here is that candidates often confuse CDR with sandboxing or macro blocking, but CDR is a static sanitization technique that removes active content from files without detonating them, whereas sandboxing involves dynamic analysis and macro blocking is a simpler, all-or-nothing approach that CDR avoids by allowing safe use of the document.

How to eliminate wrong answers

Option B is wrong because CDR does not convert files to PDF format; it sanitizes the original file format (e.g., DOCX, XLSX, PDF) and returns a cleaned version in the same format, not a different one. Option C is wrong because CDR is not a sandboxing or dynamic analysis feature; it statically disarms content by removing active elements, whereas sandboxing (e.g., FortiSandbox) detonates files in a virtual environment to detect zero-day malware. Option D is wrong because CDR does not block all files containing macros; it removes the macros and other active content from the file and then delivers the sanitized file, allowing the document to be used safely without the macro functionality.

Full explanation →

Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 76–150