Fortinet NSE 7 Advanced Security NSE7 NSE7 Questions 226–300 | Page 4/13

226

Multi-Selecthard

Which THREE actions can an administrator perform using FortiManager in a Security Fabric environment? (Choose three.)

Select 3 answers

A.Upgrade the firmware of multiple FortiGates at once

B.View logs from all managed FortiGates in a single dashboard

C.Terminate IPsec VPN tunnels on the FortiManager

D.Configure FortiGate to manage the FortiManager

E.Push firewall policies to multiple FortiGates simultaneously

AnswersA, B, E

Firmware upgrade can be done centrally.

Why this answer

FortiManager supports centralized firmware management, allowing administrators to upgrade the firmware of multiple FortiGates simultaneously via the 'Firmware Upgrade' wizard in the Device Manager. This leverages the FortiManager's role as a central management point, which can stage and push firmware images to managed devices in a Security Fabric, reducing downtime and ensuring consistency across the fabric.

Exam trap

The trap here is that candidates confuse FortiManager's ability to configure VPN settings with the ability to terminate active tunnels, or they mistakenly think the FortiGate can manage the FortiManager (reversing the management relationship), which is a common misconception in centralized management architectures.

Full explanation →

227

MCQeasy

A FortiGate administrator wants to ensure that files in email attachments are disarmed before delivery. Which security feature should be configured in the antivirus profile?

A.Content Disarm and Reconstruction (CDR)

B.FortiSandbox inline scanning

C.Machine Learning Engine

D.Outbreak Prevention

AnswerA

CDR strips active content and rebuilds files to a safe state.

Why this answer

Content Disarm and Reconstruction (CDR) is the correct answer because it is specifically designed to remove active content (e.g., macros, scripts, embedded objects) from email attachments and rebuild them into safe, sanitized versions before delivery. Unlike detection-based methods, CDR proactively disarms threats by stripping potentially malicious elements while preserving the file's usability, making it the ideal choice for disarming attachments in an antivirus profile.

Exam trap

The trap here is that candidates often confuse detection-based features like FortiSandbox or Machine Learning with proactive disarming, assuming that any advanced threat protection feature can 'disarm' files, whereas CDR is the only option that actively reconstructs attachments to remove active content.

How to eliminate wrong answers

Option B is wrong because FortiSandbox inline scanning is a behavioral analysis feature that detonates files in a sandbox to detect threats, but it does not actively strip or reconstruct file content; it relies on detection and blocking, not proactive disarming. Option C is wrong because the Machine Learning Engine uses statistical models to classify files as malicious or benign based on patterns, but it does not modify or reconstruct attachments to remove active content. Option D is wrong because Outbreak Prevention is a FortiGuard service that provides real-time signatures and intelligence for emerging threats, but it is a detection and prevention mechanism, not a file sanitization or reconstruction technology.

Full explanation →

228

MCQmedium

An administrator configures a performance SLA for SD-WAN health checks. The SLA uses a ping probe to 8.8.8.8 every 2 seconds with a latency threshold of 150 ms and jitter threshold of 20 ms. After some time, the SD-WAN rule still shows the member as 'dead'. Which command should the administrator use to verify the probe results?

A.show system sdwan health-check

B.diagnose sys sdwan health-check

C.diagnose sys session list

D.execute ping-options source 8.8.8.8

AnswerB

This command displays real-time health check statistics.

Why this answer

The 'diagnose sys sdwan health-check' command is the correct tool because it provides real-time, detailed probe results for each SD-WAN health-check member, including latency, jitter, packet loss, and SLA status. This allows the administrator to see exactly why the member is marked as 'dead', such as exceeding the 150 ms latency or 20 ms jitter thresholds. The 'show system sdwan health-check' command only displays configured parameters, not live probe data.

Exam trap

The trap here is that candidates confuse the configuration display command ('show system sdwan health-check') with the diagnostic command ('diagnose sys sdwan health-check'), assuming the former shows live results when it only shows static configuration.

How to eliminate wrong answers

Option A is wrong because 'show system sdwan health-check' displays only the configured SLA parameters (e.g., probe target, thresholds) and not the actual live probe results or current member status. Option C is wrong because 'diagnose sys session list' shows active session entries in the session table, which is unrelated to SD-WAN health-check probe results or SLA compliance. Option D is wrong because 'execute ping-options source 8.8.8.8' sets the source IP for ping commands but does not verify SD-WAN health-check probe results; it is a configuration command, not a diagnostic one.

Full explanation →

229

MCQhard

An administrator configures a session helper for FTP but notices that active FTP data connections are not being allowed through the firewall. The FTP control session establishes fine. What is the MOST likely cause?

A.The FTP server is using passive mode

B.The FTP session helper is not enabled on the firewall policy

C.The ALG is configured to use proxy-based inspection instead of flow-based

D.The firewall policy has NAT enabled

AnswerB

Without the session helper enabled, FortiGate will not inspect FTP control traffic and will not open pinholes for data connections.

Why this answer

The session helper for FTP is a feature that must be explicitly enabled on the firewall policy to inspect and dynamically create pinholes for active FTP data connections. If the session helper is not enabled on the policy, the firewall will only allow the control session (port 21) but will not open the necessary high ports for the data channel, causing active FTP to fail while passive mode (which uses the control session for data negotiation) may still work.

Exam trap

The trap here is that candidates often assume the FTP session helper is automatically enabled when FTP traffic is allowed, but in FortiGate it must be explicitly configured on the policy, and they may confuse passive mode (which works without helpers) with active mode requirements.

How to eliminate wrong answers

Option A is wrong because passive mode FTP does not require the firewall to open dynamic data ports; instead, the client initiates the data connection, so it would not cause active FTP data connections to be blocked. Option C is wrong because the ALG (Application Layer Gateway) configuration for proxy-based vs flow-based inspection affects how traffic is processed, but the core issue is that the session helper itself is not enabled on the policy, not the inspection mode. Option D is wrong because NAT on the firewall policy does not inherently block active FTP data connections; NAT can be used with FTP helpers and ALGs to handle address translation, but the absence of the session helper is the direct cause of the failure.

Full explanation →

230

Multi-Selectmedium

An organization wants to implement email authentication to prevent spoofing and phishing attacks. They use FortiMail as their email security gateway. Which THREE mechanisms should they configure to achieve comprehensive email authentication?

Select 3 answers

A.Transport Layer Security (TLS) for SMTP

B.FortiGuard Antispam

C.Sender Policy Framework (SPF)

D.Domain-based Message Authentication, Reporting and Conformance (DMARC)

E.DomainKeys Identified Mail (DKIM)

AnswersC, D, E

SPF verifies that the sending server is authorized by the domain owner.

Why this answer

Sender Policy Framework (SPF) is correct because it allows the domain owner to publish a DNS TXT record listing authorized sending IP addresses, enabling receiving mail servers (like FortiMail) to verify that the email originated from an approved source. This directly prevents spoofing by rejecting messages from unauthorized IPs claiming to be from the domain.

Exam trap

The trap here is that candidates confuse encryption (TLS) or antispam filtering with authentication mechanisms, failing to recognize that SPF, DKIM, and DMARC are the three complementary protocols specifically designed for email authentication and spoofing prevention as defined in RFC 7208, RFC 6376, and RFC 7489.

Full explanation →

231

MCQhard

An administrator configures FortiSandbox to quarantine files that are rated 'malicious'. They notice that some files are being quarantined even though the verdict is 'clean'. What could explain this?

A.The quarantine action is set to apply to files with a risk level above a certain threshold, and clean files have been incorrectly rated

B.FortiSandbox uses a whitelist that includes those files

C.The files were submitted by a different FortiGate with different settings

D.The administrator has enabled 'aggressive mode' which quarantines all files

AnswerA

Risk level thresholds can cause false positives if set too aggressively.

Why this answer

FortiSandbox's quarantine action can be configured based on a risk score threshold, not solely on the verdict. If the risk score for a file rated 'clean' exceeds the configured threshold, the file may still be quarantined. This occurs because the verdict and risk score are separate attributes; a 'clean' verdict indicates no known malware, but the file's behavior or heuristics may still generate a high risk score that triggers quarantine.

Exam trap

The trap here is that candidates assume quarantine is strictly tied to the verdict, overlooking that FortiSandbox's quarantine action can be independently triggered by a risk score threshold, leading to quarantine of 'clean' files with high risk scores.

How to eliminate wrong answers

Option B is wrong because a whitelist would prevent quarantine, not cause it; whitelisted files are explicitly allowed and bypass scanning. Option C is wrong because files submitted by different FortiGate devices are evaluated independently by FortiSandbox based on its own analysis, not on the submitting device's settings; the quarantine decision is local to the FortiSandbox configuration. Option D is wrong because 'aggressive mode' in FortiSandbox does not exist; FortiSandbox uses configurable risk thresholds and verdicts, not an all-or-nothing aggressive mode.

Full explanation →

232

Multi-Selectmedium

A network engineer needs to collect logs from multiple FortiGates and generate compliance reports. Which TWO FortiAnalyzer features should be used?

Select 2 answers

A.ADOM configuration

B.Log analytics

C.Reports

D.Automation stitches

E.Policy packages

AnswersB, C

Why this answer

Log analytics (option B) is correct because it provides the ability to search, filter, and visualize logs from multiple FortiGates, enabling the identification of trends and anomalies necessary for compliance reporting. Reports (option C) is correct because FortiAnalyzer includes a dedicated reporting engine that can generate scheduled or on-demand compliance reports based on collected logs, with pre-defined templates for standards like PCI DSS, HIPAA, and SOX.

Exam trap

The trap here is that candidates confuse FortiAnalyzer's ADOM feature (which is for administrative separation) with log collection or reporting, or they mistakenly associate automation stitches or policy packages with compliance reporting, which are actually features of FortiGate or FortiManager, not FortiAnalyzer.

Full explanation →

233

Multi-Selecteasy

Which TWO of the following can be used to authenticate users in a ZTNA connection? (Select two.)

Select 2 answers

A.LDAP authentication

B.FortiToken

C.IPsec authentication

D.SAML authentication

E.Certificate authentication

AnswersD, E

SAML is supported for SSO.

Why this answer

In a ZTNA connection, authentication can be performed using SAML (Security Assertion Markup Language) because it enables federated identity management and single sign-on (SSO), allowing the FortiGate to verify user identity via an external identity provider (IdP) without direct password handling. Certificate authentication is also valid because ZTNA leverages client certificates (X.509) to establish mutual TLS (mTLS) between the user device and the FortiGate, ensuring device identity and trust before granting access.

Exam trap

The trap here is that candidates often confuse authentication methods used in traditional VPNs (like LDAP or FortiToken) with the identity-centric methods required for ZTNA, forgetting that ZTNA mandates integration with an IdP or certificate-based trust rather than direct password or token verification.

Full explanation →

234

MCQeasy

What is the purpose of a route map when used with route redistribution on a FortiGate?

A.To create a prefix list for BGP

B.To define the administrative distance of redistributed routes

C.To enable the redistribution process

D.To filter or modify route attributes during redistribution

AnswerD

Route maps allow granular control over which routes are redistributed and how.

Why this answer

Route maps are used with route redistribution to filter which routes are redistributed and to modify route attributes (such as metric, tag, or next-hop) as they are injected from one routing protocol into another. Option D is correct because route maps provide granular control over the redistribution process, allowing administrators to match specific routes using prefix lists or ACLs and then set attributes like metric or tag before the routes are redistributed.

Exam trap

The trap here is that candidates often confuse the route map's role as a filter or modifier with the enabling of redistribution itself, thinking the route map is required to start redistribution, when in fact redistribution is enabled by the 'redistribute' command and the route map is an optional parameter.

How to eliminate wrong answers

Option A is wrong because a prefix list is a separate tool used to match IP prefixes, not a route map; route maps can reference prefix lists, but the route map itself is not a prefix list. Option B is wrong because administrative distance is a property of the routing protocol or static route, not something set by a route map during redistribution; route maps can set metric, tag, or next-hop, but not administrative distance. Option C is wrong because the redistribution process is enabled by the 'redistribute' command under the routing protocol configuration, not by a route map; the route map is an optional filter applied to that redistribution.

Full explanation →

235

MCQmedium

A FortiManager administrator creates an ADOM for the root VDOM and regular VDOMs. The administrator wants to manage only the regular VDOMs from FortiManager. Which ADOM type should be used?

A.Regular ADOM (non-root)

B.Management VDOM ADOM

C.Root ADOM

D.Global ADOM

AnswerA

Regular ADOM can be assigned to specific VDOMs, excluding the root if not needed.

Why this answer

A Regular ADOM (non-root) is the correct choice because it allows the administrator to manage only the regular VDOMs (non-root VDOMs) on a FortiGate, excluding the root VDOM. This ADOM type is designed for managing individual VDOMs as separate entities, providing granular control without affecting the root VDOM's global settings or other VDOMs.

Exam trap

The trap here is that candidates often confuse the 'Root ADOM' with managing only the root VDOM, but it actually manages all VDOMs (root and regular) together, which is not suitable when only regular VDOMs need to be managed.

How to eliminate wrong answers

Option B (Management VDOM ADOM) is wrong because it is not a standard ADOM type in FortiManager; the correct term is 'Management VDOM' for a VDOM that handles management traffic, but it does not define an ADOM type for managing regular VDOMs. Option C (Root ADOM) is wrong because it manages the root VDOM and all regular VDOMs together, which contradicts the requirement to manage only regular VDOMs. Option D (Global ADOM) is wrong because it is used for global policy objects and settings that apply across all ADOMs, not for managing individual VDOMs.

Full explanation →

236

MCQmedium

A healthcare provider is deploying ZTNA to secure access to an internal electronic health records (EHR) system. The EHR system is composed of multiple web services running on different ports behind a load balancer with IP 10.0.10.100. The load balancer listens on ports 443, 8443, and 9090. The administrator configures a single ZTNA rule with proxy destination 10.0.10.100:443, expecting that the other ports will be accessed via the same rule. However, users report that they can only access the service on port 443; connections to ports 8443 and 9090 fail. The FortiGate logs show that requests to other ports are being dropped. What should the administrator do to resolve this?

A.Configure the load balancer to redirect all traffic to port 443.

B.Configure the ZTNA gateway to allow all ports to the load balancer.

C.Create separate ZTNA rules for each port (8443 and 9090).

D.Ask users to change the port in their browser to 443.

AnswerC

ZTNA rules are port-specific.

Why this answer

Each ZTNA rule maps to a single proxy destination port. The rule configured with proxy destination 10.0.10.100:443 only forwards traffic for that specific port. To access services on ports 8443 and 9090, separate ZTNA rules must be created for each port, each with its own proxy destination and access proxy configuration.

Exam trap

The trap here is that candidates assume a single ZTNA rule with a destination IP will automatically forward traffic to all ports on that IP, overlooking that ZTNA rules are port-specific and require separate rules for each service port.

How to eliminate wrong answers

Option A is wrong because redirecting all traffic to port 443 would break the intended functionality of the separate web services running on ports 8443 and 9090, and the load balancer is not designed to redirect traffic arbitrarily. Option B is wrong because the ZTNA gateway does not support a wildcard 'allow all ports' configuration; ZTNA rules require explicit proxy destination IP and port pairs. Option D is wrong because asking users to change the port in their browser does not address the underlying ZTNA rule limitation; the gateway would still drop connections to ports not defined in the rule.

Full explanation →

237

MCQeasy

In a Fortinet ZTNA deployment, which component is responsible for forwarding decrypted traffic to the internal application server after the FortiGate proxy has performed SSL inspection?

A.FortiClient EMS

B.ZTNA proxy on FortiGate

C.IPsec VPN tunnel

D.FortiNAC

AnswerB

The ZTNA proxy terminates the client connection and creates a new connection to the server.

Why this answer

ZTNA proxy receives client requests, performs SSL inspection, and forwards the decrypted traffic to the internal server.

Full explanation →

238

MCQmedium

A network administrator is troubleshooting an ADVPN deployment. Spoke FortiGates can communicate with the hub, but shortcut tunnels between spokes are not being established. The administrator verifies that IKE and IPsec settings are correct on all devices. What is the MOST likely cause?

A.Dead Peer Detection (DPD) is disabled on the hub

B.The hub's phase2 configuration has 'auto-negotiate' disabled

C.The hub's phase1 configuration has 'auto-negotiate' disabled

D.The spokes have different IKE versions configured

AnswerB

Without auto-negotiate, the hub will not propose shortcut tunnels to spokes.

Why this answer

In ADVPN, shortcut tunnels require IKEv2 with the 'add-route' option and auto-negotiate. If the hub's phase2 configuration does not have 'auto-negotiate' enabled, it will not initiate shortcut tunnels.

Full explanation →

239

Drag & Dropmedium

Drag and drop the steps to configure a site-to-site IPsec VPN on a FortiGate firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Phase 1 establishes the IKE SA, Phase 2 creates the IPsec SA, then routing and policies are applied to allow traffic through the tunnel.

Full explanation →

240

MCQmedium

A network administrator is configuring SD-WAN on a FortiGate. They have multiple WAN links and want to ensure that traffic for a critical application uses the link with the lowest latency. Which SD-WAN configuration component should be used to achieve this?

A.Performance SLA with latency threshold and SD-WAN rule using best-quality strategy

B.SD-WAN rule with spillover load balancing

C.SD-WAN members with static priority

D.Load balancing algorithm set to lowest-cost (SLA)

AnswerA

Performance SLA measures latency, and a best-quality rule selects the link with lowest latency within the threshold.

Why this answer

The Performance SLA monitors latency (and other metrics) against a configured threshold, and the SD-WAN rule with the 'best-quality' strategy dynamically selects the WAN link that currently has the lowest latency. This ensures the critical application traffic is steered to the optimal link based on real-time performance measurements.

Exam trap

The trap here is that candidates confuse 'static priority' (which is a fixed preference) with dynamic SLA-based selection, or they incorrectly assume 'spillover' or 'lowest-cost' algorithms can react to latency changes in real time.

How to eliminate wrong answers

Option B is wrong because spillover load balancing uses bandwidth utilization thresholds to shift traffic, not latency, so it cannot ensure the lowest-latency link is selected. Option C is wrong because static priority assigns fixed preference to links regardless of current performance; if the highest-priority link has high latency, traffic will still use it. Option D is wrong because 'lowest-cost (SLA)' is not a valid load balancing algorithm in FortiOS; the correct term for SLA-based selection is 'best-quality' or 'SLA' strategy, and 'lowest-cost' typically refers to routing protocol metrics, not SD-WAN link quality.

Full explanation →

241

MCQeasy

A company wants to protect its internal users from malicious files attached to emails. Which FortiGate feature should be configured to inspect SMTP traffic for malware?

A.Antivirus

B.Email Filter

C.Web Filter

D.IPS

AnswerA

Antivirus profiles can scan SMTP, POP3, and IMAP traffic for malware.

Why this answer

FortiGate's Antivirus feature is designed to scan SMTP traffic for malware by inspecting email attachments and body content against virus signatures. When configured in a security policy, it intercepts SMTP sessions, buffers the email data, and performs real-time scanning to block or quarantine malicious files before delivery to internal users.

Exam trap

The trap here is that candidates confuse 'Email Filter' (which handles spam and content filtering) with antivirus scanning, assuming email security is solely about filtering, when in fact malware detection requires the dedicated Antivirus feature to inspect SMTP payloads at the file level.

How to eliminate wrong answers

Option B (Email Filter) is wrong because it focuses on spam filtering, content blocking, and email address/domain blacklisting, not on malware detection in attachments. Option C (Web Filter) is wrong because it controls HTTP/HTTPS traffic to block malicious URLs and web content, not SMTP email traffic. Option D (IPS) is wrong because it detects and prevents network-level attacks (e.g., exploits, buffer overflows) based on signatures, but it does not perform file-level malware scanning on email attachments.

Full explanation →

242

MCQhard

You are troubleshooting a VPN phase 2 negotiation failure. The logs show 'no proposal chosen'. What is the MOST likely cause?

A.The remote gateway IP is incorrect

B.The pre-shared key mismatch

C.The IKE version mismatch

D.The phase 2 proposal settings differ between the peers

AnswerD

Mismatched algorithms cause 'no proposal chosen'.

Why this answer

The 'no proposal chosen' error in VPN phase 2 indicates that the IPsec peers could not agree on a common set of phase 2 parameters (such as encryption algorithm, authentication algorithm, or PFS group). Since phase 2 negotiation occurs after IKE phase 1 has successfully completed, the issue is specifically with the IPsec SA proposal settings, not with pre-shared keys or IKE version. Therefore, differing phase 2 proposals between the peers are the most likely cause.

Exam trap

The trap here is that candidates often confuse phase 1 and phase 2 errors, assuming any 'no proposal chosen' relates to IKE proposals, when in fact the error message is specific to the IPsec SA negotiation in phase 2.

How to eliminate wrong answers

Option A is wrong because an incorrect remote gateway IP would prevent phase 1 (IKE) from establishing, not cause a phase 2 'no proposal chosen' error. Option B is wrong because a pre-shared key mismatch would cause an IKE authentication failure during phase 1, not a phase 2 proposal mismatch. Option C is wrong because an IKE version mismatch would prevent phase 1 negotiation entirely, resulting in a different error (e.g., 'no acceptable proposal' during phase 1), not a phase 2-specific 'no proposal chosen'.

Full explanation →

243

MCQmedium

A FortiGate administrator wants to use FortiAnalyzer to generate a report on top talkers in the network. Which FortiView feature should be used?

A.Log Analytics

B.FortiView

C.Playbooks

D.Incidents

AnswerB

FortiView provides traffic analytics including top talkers.

Why this answer

FortiView is the correct feature because it provides real-time and historical traffic visibility, including top talkers, directly from the FortiGate's session table and logs. FortiView's 'Top Talkers' widget aggregates traffic by source IP, destination IP, or application, allowing the administrator to generate reports on the highest bandwidth consumers without needing to run complex queries in Log Analytics.

Exam trap

The trap here is that candidates confuse FortiView with Log Analytics, assuming that any log-based reporting must go through Log Analytics, but FortiView provides the pre-built, aggregated top talkers view without requiring SQL-like queries.

How to eliminate wrong answers

Option A is wrong because Log Analytics is a FortiAnalyzer feature for running SQL-like queries against indexed logs, not a dedicated FortiView feature for visualizing top talkers; it requires manual query construction and lacks the pre-built, real-time top talker widgets. Option C is wrong because Playbooks are automation workflows in FortiSOAR or FortiAnalyzer for incident response, not a reporting or traffic visibility feature. Option D is wrong because Incidents are security event aggregations in FortiAnalyzer's Incident Management module, used for threat investigation and response, not for generating top talker reports.

Full explanation →

244

MCQeasy

A FortiGate is configured with ECMP load balancing. What is the default behavior when multiple routes have equal cost?

A.The route with the lowest metric is always preferred

B.The administrator must enable per-packet load balancing

C.Traffic is load balanced across the routes using a hash algorithm

D.All traffic is sent over the first route until it fails

AnswerC

ECMP uses source-destination hashing to distribute sessions.

Why this answer

When ECMP load balancing is configured on a FortiGate, the default behavior is to distribute traffic across multiple equal-cost routes using a hash algorithm. This hash algorithm considers fields such as source/destination IP, protocol, and ports to ensure session consistency, meaning all packets belonging to the same session follow the same path. This is the standard ECMP behavior in FortiOS, as documented in the FortiGate Administration Guide.

Exam trap

The trap here is that candidates often confuse ECMP with per-packet load balancing or assume that FortiGate defaults to a failover model, but the NSE7 exam expects you to know that ECMP uses a hash algorithm for per-session load balancing by default, not per-packet or primary-backup.

How to eliminate wrong answers

Option A is wrong because in ECMP, all routes have equal cost (metric), so no single route is preferred based on metric; the FortiGate uses a hash algorithm instead. Option B is wrong because per-packet load balancing is not the default and must be explicitly enabled via CLI (e.g., 'set load-balance-mode per-packet'), and even then it is rarely used due to packet reordering issues; the default is per-session load balancing using a hash. Option D is wrong because that describes a failover or primary/backup routing behavior, not ECMP; FortiGate does not send all traffic over the first route until failure unless 'set priority' or 'set weight' is used to create unequal costs.

Full explanation →

245

MCQmedium

During a failover test in an active-passive HA cluster, the administrator notices that the secondary unit does not take over the primary role after a link failure on the primary. The 'get system ha status' shows both units in 'standalone' mode. What is the MOST likely cause?

A.The session pickup feature is disabled

B.The HA heartbeat interface is down or misconfigured on one unit

C.The cluster is running in active-active mode

D.The HA override feature is disabled

AnswerB

Heartbeat failure causes units to operate independently as standalone.

Why this answer

When both units show 'standalone' mode in 'get system ha status', it indicates that the HA cluster has lost communication between the primary and secondary units, causing them to operate independently. The most common cause is a failure or misconfiguration of the HA heartbeat interface, which is the dedicated link used for cluster synchronization and health monitoring. Without a functional heartbeat, the secondary cannot detect the primary's link failure and will not initiate a failover.

Exam trap

The trap here is that candidates often confuse session pickup or override features with the fundamental requirement of a working heartbeat interface, assuming that failover is triggered by link failure detection on data ports rather than requiring a separate, dedicated heartbeat link.

How to eliminate wrong answers

Option A is wrong because session pickup is a feature for synchronizing existing sessions during a failover, not for detecting link failures or triggering role changes; disabling it does not prevent the secondary from taking over the primary role. Option C is wrong because if the cluster were running in active-active mode, both units would show as 'active' in HA status, not 'standalone', and the question specifies an active-passive cluster. Option D is wrong because the HA override feature controls whether a primary unit can preempt a secondary after recovery, not the ability to detect link failures or perform failover; disabling it does not cause standalone mode.

Full explanation →

246

Multi-Selectmedium

An administrator is troubleshooting an IPsec VPN where phase 1 is up but phase 2 fails. Which two debug commands would be MOST helpful in diagnosing the phase 2 issue? (Choose TWO.)

Select 2 answers

A.diagnose sys session list

B.diagnose debug application ipsec -1

C.diagnose vpn ipsec phase2-config

D.get vpn ipsec tunnel details

E.diagnose debug application ike -1

AnswersC, E

This shows the configured phase 2 parameters, helpful for mismatch detection.

Why this answer

'diagnose vpn ipsec phase2-config' displays the phase 2 configuration parameters (e.g., proxy IDs, encryption/authentication algorithms, and SA lifetimes) that must match between peers. Option E is correct because 'diagnose debug application ike -1' enables real-time IKEv1/IKEv2 debugging, which shows the exact phase 2 negotiation messages (e.g., Quick Mode exchanges) and any error codes or mismatches. Together, they allow you to identify configuration mismatches or negotiation failures that prevent phase 2 from establishing.

Exam trap

The trap here is that candidates confuse 'diagnose debug application ipsec' (which debugs kernel IPsec operations) with 'diagnose debug application ike' (which debugs the IKE negotiation protocol), leading them to select the wrong debug command for phase 2 issues.

Full explanation →

247

MCQmedium

An administrator configures an automation stitch on FortiManager to trigger a script when a specific log message is received. After saving, the stitch does not execute. What is a likely cause?

A.The FortiGate is not in the same ADOM

B.The log message is not being sent to FortiManager

C.The script is not uploaded to the FortiGate

D.The automation stitch is not enabled

AnswerD

Automation stitches must be enabled to run.

Why this answer

Automation stitches on FortiManager are disabled by default after creation. The administrator must explicitly enable the stitch before it will trigger on incoming log events. Without enabling, the stitch remains inactive regardless of other configurations.

Exam trap

The trap here is that candidates assume saving a configuration automatically activates it, but FortiManager requires an explicit enable step for automation stitches, unlike some other FortiManager objects that are active by default.

How to eliminate wrong answers

Option A is wrong because the FortiGate does not need to be in the same ADOM for the automation stitch to execute; FortiManager can manage devices across ADOMs as long as the device is properly assigned. Option B is wrong because the question states the stitch does not execute after saving, implying the log message is expected to be received; if logs were not sent, the issue would be a missing log forwarding configuration, not a disabled stitch. Option C is wrong because the script is executed from FortiManager, not uploaded to the FortiGate; automation stitches on FortiManager run scripts stored locally on the FortiManager, not on the managed device.

Full explanation →

248

MCQmedium

An organization wants to deploy a web application firewall (WAF) to protect a public-facing web application. They are evaluating FortiGate versus FortiWeb. Which of the following is a key advantage of using FortiWeb over FortiGate for WAF functionality?

A.FortiWeb offers advanced bot detection and positive security model

B.FortiGate can perform SSL deep inspection without performance impact

C.FortiGate supports a larger number of web servers behind a single policy

D.FortiGate can automatically patch web application vulnerabilities

AnswerA

FortiWeb includes machine learning bot detection and positive security model (whitelisting), which FortiGate lacks.

Why this answer

FortiWeb is a dedicated web application firewall that provides advanced bot detection and a positive security model, which allows only explicitly allowed traffic based on a whitelist of known good patterns. This is a key advantage over FortiGate, which primarily uses a negative security model (signature-based) and lacks the same depth of bot mitigation and positive enforcement for web-specific threats.

Exam trap

The trap here is that candidates assume FortiGate's integrated WAF features are equivalent to a dedicated WAF, but FortiWeb's positive security model and advanced bot detection are unique differentiators that FortiGate lacks.

How to eliminate wrong answers

Option B is wrong because FortiGate, like any device performing SSL deep inspection, incurs performance overhead due to decryption/re-encryption, and FortiGate does not claim zero performance impact. Option C is wrong because FortiGate does not inherently support a larger number of web servers behind a single policy; both platforms can scale, but FortiWeb is specifically optimized for high-volume web server pools with granular per-server policies. Option D is wrong because neither FortiGate nor FortiWeb automatically patches web application vulnerabilities; they detect and block exploit attempts but do not modify application code.

Full explanation →

249

MCQmedium

A FortiGate administrator configures an antivirus profile with the machine learning engine enabled and applies it to a policy inspecting HTTP traffic. After deployment, the admin notices that some files are being allowed that should have been detected. What is the MOST likely cause?

A.The ML engine is in monitor-only mode

B.FortiGuard outbreak prevention is disabled

C.The antivirus profile is using flow-based inspection instead of proxy-based

D.The file size exceeds the maximum scanning limit

AnswerA

Monitor mode logs detections but does not block. To block, the engine must be in protect mode.

Why this answer

The most likely cause is that the machine learning engine is configured in monitor-only mode. In this mode, the ML engine will log detections and generate alerts but will not take any action to block the file, allowing it to pass through the policy. This is a common initial deployment strategy to assess the ML engine's impact before enabling active blocking.

Exam trap

The trap here is that candidates often assume the ML engine always blocks threats by default, overlooking the distinct monitor-only mode that logs detections without enforcement.

How to eliminate wrong answers

Option B is wrong because FortiGuard outbreak prevention is a separate feature that provides real-time updates for zero-day threats; disabling it would not cause the ML engine to allow files it should detect, as the ML engine operates independently of FortiGuard updates. Option C is wrong because flow-based inspection supports the ML engine and can perform detection; the issue is not the inspection mode but the action configured for the ML engine. Option D is wrong because if the file size exceeded the maximum scanning limit, the file would typically be skipped entirely or passed without any scanning, not allowed after being evaluated by the ML engine.

Full explanation →

250

Multi-Selecthard

A company is deploying ZTNA to protect an internal application. They want to ensure that only users with devices that have disk encryption enabled and the latest OS patches can access the application. Which THREE components must be configured to achieve this?

Select 3 answers

A.FortiNAC for network admission control

B.IPsec VPN to encrypt traffic between client and FortiGate

C.FortiClient on the endpoint device

D.FortiGate ZTNA access proxy with tag-based rules

E.FortiClient EMS to define compliance policies and assign tags

AnswersC, D, E

FortiClient collects device posture information such as disk encryption status and OS patch level.

Why this answer

To enforce device posture requirements like disk encryption and OS patch level, you need FortiClient on the device to report posture, FortiClient EMS to define compliance policies and generate tags, and FortiGate ZTNA proxy to check those tags before granting access.

Full explanation →

251

MCQmedium

A company wants to receive threat intelligence feeds from external sources to enhance their FortiGate's protection. Which method should be used to integrate external threat feeds into FortiGate?

A.Use FortiGuard Threat Intelligence Service which automatically pulls feeds.

B.Manually add IP addresses to local address objects.

C.Configure an external threat feed connector in FortiGate, such as using a URL to a STIX/TAXII feed.

D.Use FortiAnalyzer to push feeds to FortiGate.

AnswerC

FortiGate supports external threat feeds via indicators of compromise (IOC) using STIX/TAXII or via the 'config system external-resource' command.

Why this answer

FortiGate supports integration with external threat intelligence feeds via the External Threat Feed connector, which can consume STIX/TAXII feeds from a URL. This allows the FortiGate to dynamically update its threat database with indicators from third-party sources, enhancing its protection without relying solely on FortiGuard services.

Exam trap

The trap here is that candidates may confuse FortiGuard's built-in threat intelligence service with the ability to integrate external feeds, assuming FortiGuard can be customized to pull from third-party sources, when in fact the External Threat Feed connector is the dedicated feature for that purpose.

How to eliminate wrong answers

Option A is wrong because FortiGuard Threat Intelligence Service is a built-in Fortinet service that provides curated feeds, not a method to integrate external third-party feeds; it cannot be configured to pull from arbitrary external sources. Option B is wrong because manually adding IP addresses to local address objects is a static, labor-intensive approach that does not support automated, dynamic updates from external threat feeds, defeating the purpose of real-time intelligence integration. Option D is wrong because FortiAnalyzer is a log management and analytics platform, not a mechanism to push threat feeds to FortiGate; it can forward logs or events but does not handle external feed ingestion for threat intelligence updates.

Full explanation →

252

Multi-Selectmedium

An administrator is configuring SD-WAN rules to steer traffic based on application performance. The requirement is to use VoIP traffic over the WAN link that has the lowest latency, but if latency exceeds 100ms, fail over to a backup link. The administrator has already created performance SLAs for both links. Which THREE configuration steps are required?

Select 3 answers

A.Set the 'failover-threshold' on each SD-WAN member to 100

B.Configure the SLA metric to 'latency' in the performance SLA

C.Create an SD-WAN rule for VoIP traffic and set the load balancing method to 'best quality'

D.Add both WAN interfaces to the rule as members and set weight based on latency

E.In the SD-WAN rule, set the 'sla-constraint' to 'sla' and define the latency threshold of 100ms

AnswersB, C, E

Why this answer

The performance SLA must be configured to monitor latency as the metric to measure link quality. Without setting the SLA metric to 'latency', the SD-WAN rule cannot evaluate which link has the lowest latency for VoIP traffic, which is the core requirement.

Exam trap

The trap here is confusing the 'failover-threshold' parameter on SD-WAN members with the SLA constraint in the SD-WAN rule, where the actual latency threshold for failover is defined.

Full explanation →

253

MCQmedium

An organization deploys FortiEDR to protect endpoints. Which component is responsible for collecting and sending telemetry data to the FortiEDR management console?

A.FortiGate firewall

B.FortiEDR Sensor (Agent)

C.FortiAnalyzer

D.FortiClient EMS

AnswerB

The sensor is installed on endpoints to gather data.

Why this answer

The FortiEDR Sensor (Agent) is the endpoint-resident component that collects telemetry data—such as process creation, network connections, file system changes, and registry modifications—and securely transmits it to the FortiEDR management console (Controller) for analysis and threat detection. Without the sensor, the management console has no visibility into endpoint activity.

Exam trap

The trap here is that candidates often confuse FortiClient EMS (which manages endpoint policies) with the FortiEDR Sensor, assuming that EMS handles telemetry collection, when in fact the sensor is a separate, dedicated agent for endpoint detection and response.

How to eliminate wrong answers

Option A is wrong because FortiGate is a next-generation firewall that provides network security and can integrate with FortiEDR via API or syslog, but it does not collect or send endpoint telemetry data to the FortiEDR management console. Option C is wrong because FortiAnalyzer is a centralized logging and reporting appliance that aggregates logs from Fortinet devices (e.g., FortiGate, FortiMail) but does not act as the telemetry collection agent for FortiEDR endpoints. Option D is wrong because FortiClient EMS manages endpoint compliance, VPN, and web filtering policies, and while it can integrate with FortiEDR, it is not the component that collects and sends endpoint telemetry to the FortiEDR console.

Full explanation →

254

Multi-Selectmedium

A network admin is troubleshooting an SD-WAN rule that should steer VoIP traffic to a low-latency link. The rule matches traffic from the VoIP subnet to any destination and uses the 'best-quality' strategy with SLA monitoring. However, traffic is still using the other link. Which TWO checks should the admin perform? (Choose two.)

Select 2 answers

A.Ensure that the FortiGate has a default route via each SD-WAN member.

B.Check that the SD-WAN rule has a higher priority than other rules that might match the traffic.

C.Disable the other SD-WAN members temporarily to force traffic to the desired link.

D.Confirm that the VoIP subnet is included in the SD-WAN zone.

E.Verify that the performance SLA is correctly configured and the VoIP traffic matches the SLA's server.

AnswersB, E

SD-WAN rules are evaluated in order; a rule with higher priority (lower number) takes precedence.

Full explanation →

255

Matchingmedium

Match each FortiGate routing concept to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Manually configured route

Link-state dynamic routing protocol

Path-vector dynamic routing protocol

Routes traffic based on policy criteria

Load balancing across multiple paths

Why these pairings

Correct matches: PBR, Route redistribution, Administrative distance, and Static route are correctly paired. ECMP and Metric are swapped; ECMP distributes traffic across equal-cost paths, while Metric compares routes within a protocol.

Full explanation →

256

Multi-Selectmedium

A FortiGate administrator is troubleshooting slow network performance. The administrator runs the command 'diagnose sys session filter dst 10.0.0.1' and sees many sessions in a 'proto_state=0a' state. What does this state indicate?

Select 1 answer

A.The session has been reset

B.The session is in FIN_WAIT_2 state

C.The session is in TIME_WAIT state

D.The session is actively transferring data

E.The session is in SYN_RECEIVED state

AnswersB

Correct. proto_state=0x0a (decimal 10) maps to TCP FIN_WAIT_2 state, a normal part of TCP teardown.

Why this answer

In FortiOS session diagnostics, the 'proto_state' field displays a hexadecimal value representing the TCP state. The value 0x0a (decimal 10) corresponds to the TCP FIN_WAIT_2 state. TIME_WAIT corresponds to 0x0b, not 0x0a.

Therefore, the session is in FIN_WAIT_2 state. An excessive number of sessions in FIN_WAIT_2 may indicate that remote peers are not properly closing connections.

Exam trap

Candidates may assume that the hex value 0x0a corresponds to TIME_WAIT or other states, but it specifically indicates FIN_WAIT_2. Confusing the hexadecimal value with decimal or misremembering the state mapping is a common pitfall.

Full explanation →

257

MCQmedium

A FortiGate administrator needs to configure a policy that allows traffic from VDOM A to VDOM B using inter-VDOM routing. Which configuration is required?

A.A single policy in VDOM A with destination VDOM B

B.A static route in VDOM A pointing to VDOM B

C.Policies in both VDOMs allowing traffic to and from the inter-VDOM link

D.Disable VDOM security features

AnswerC

Correct: policies in both VDOMs are required to allow bidirectional traffic.

Why this answer

Inter-VDOM routing requires explicit policy enforcement on both sides of the inter-VDOM link. A single policy in VDOM A cannot control return traffic from VDOM B, and FortiGate does not implicitly allow traffic between VDOMs. Therefore, policies must be configured in both VDOMs to permit traffic in both directions, ensuring stateful inspection and security controls are applied consistently.

Exam trap

The trap here is that candidates assume a single policy in the source VDOM is sufficient, forgetting that FortiGate treats each VDOM as a separate virtual firewall requiring its own policy for return traffic.

How to eliminate wrong answers

Option A is wrong because a single policy in VDOM A only controls outbound traffic from VDOM A; return traffic from VDOM B would be dropped without a corresponding policy in VDOM B. Option B is wrong because static routes direct traffic but do not provide firewall policy enforcement; inter-VDOM traffic still requires explicit allow policies in both VDOMs. Option D is wrong because disabling VDOM security features would bypass all security controls, which is not a valid or secure configuration for inter-VDOM routing.

Full explanation →

258

MCQeasy

An administrator wants to limit the number of VDOMs that can be created on a FortiGate. What should the administrator configure?

A.Use the 'config vdom' command to delete unused VDOMs

B.Set the 'max-vdom' option under 'config system global'

C.Configure the VDOM license on FortiManager

D.Set the 'vdom-admin' option to 'enable'

AnswerB

The 'max-vdom' parameter in system global sets the maximum number of VDOMs.

Why this answer

The 'max-vdom' option under 'config system global' directly limits the number of VDOMs that can be created on a FortiGate. This setting enforces a hard cap on the total VDOM count, regardless of licensing or administrative roles. By default, the value is set to 10 on most models, but it can be increased up to the maximum supported by the platform or license.

Exam trap

The trap here is that candidates often confuse the FortiGate's local 'max-vdom' limit with FortiManager licensing or the 'vdom-admin' toggle, mistakenly thinking those options control the creation cap when they actually address management scope or administrative access.

How to eliminate wrong answers

Option A is wrong because deleting unused VDOMs reduces the current count but does not prevent future creation of additional VDOMs; it is a reactive action, not a proactive limit. Option C is wrong because the VDOM license on FortiManager controls the number of VDOMs that can be managed centrally, but it does not enforce a creation limit on the FortiGate itself; the FortiGate's local 'max-vdom' setting is independent of FortiManager licensing. Option D is wrong because the 'vdom-admin' option enables or disables VDOM administration mode (allowing VDOM configuration), but it does not impose any numerical limit on how many VDOMs can be created.

Full explanation →

259

Multi-Selectmedium

A FortiGate is acting as an ABR between OSPF area 0 and area 1. The administrator needs to redistribute a static route into OSPF so that it appears as an inter-area route (Type 3 LSA). Which three steps are required? (Choose THREE.)

Select 3 answers

A.Disable route summarization on the ABR

B.Configure a route map to set the metric type to Type 1

C.Verify the OSPF process has network statements covering all interfaces

D.Configure 'redistribute static' under OSPF on the ABR

E.Ensure the static route is present in the routing table

AnswersC, D, E

Necessary for OSPF adjacency and LSA propagation.

Why this answer

For OSPF to generate Type 3 LSAs from redistributed routes, the ABR must have OSPF enabled on its interfaces via network statements. Without these statements, the ABR cannot form adjacencies or propagate LSAs between areas, which is essential for inter-area route advertisement.

Exam trap

The trap here is that candidates often think a route map or metric type change is needed to produce Type 3 LSAs, but in reality, Type 3 LSAs are generated automatically by the ABR from redistributed routes when OSPF is properly enabled on interfaces, not from external route manipulation.

Full explanation →

260

MCQhard

An administrator configures email authentication (SPF, DKIM, DMARC) on FortiMail. They find that legitimate emails are being marked as spam by FortiMail. The SPF check passes but DKIM fails. What could be the issue?

A.The SPF record is too strict

B.The email was forwarded by an intermediary that strips the DKIM signature

C.FortiMail has a bug in the DKIM verification module

D.The DMARC policy is set to reject

AnswerB

Forwarding often breaks DKIM, causing it to fail.

Why this answer

When an email is forwarded by an intermediary (e.g., a mailing list or forwarding service), the intermediary often modifies the message headers or body, which invalidates the DKIM signature. Since DKIM relies on a cryptographic hash of the original message content and selected headers, any alteration—even by a legitimate forwarder—causes the signature verification to fail. The SPF check passes because the forwarding server may be authorized in the SPF record, but DKIM failure triggers spam classification if the DMARC policy is not aligned.

Exam trap

The trap here is that candidates assume DKIM failure is always due to a misconfiguration on the sending side, rather than recognizing that forwarding or intermediary modification is a common and legitimate cause of DKIM breakage.

How to eliminate wrong answers

Option A is wrong because a strict SPF record (e.g., -all) would cause SPF to fail, not pass; the question states SPF passes, so this is irrelevant. Option C is wrong because FortiMail's DKIM verification module is RFC 6376 compliant and does not have a known bug that would cause legitimate DKIM signatures to fail; this is a red herring. Option D is wrong because DMARC policy (p=reject) only dictates how receivers handle messages that fail both SPF and DKIM alignment; it does not cause DKIM to fail—it is an action based on the result, not the cause of the failure.

Full explanation →

261

Multi-Selecthard

An organization is deploying FortiEDR to enhance endpoint protection. Which THREE capabilities does FortiEDR provide? (Choose three.)

Select 3 answers

A.Forensic investigation and root cause analysis

B.Decoy deployment to lure attackers

C.Real-time threat detection using behavioral analysis

D.Automated response to isolate compromised endpoints

E.Email security filtering

AnswersA, C, D

FortiEDR provides detailed forensic data for investigation.

Why this answer

FortiEDR provides forensic investigation and root cause analysis by recording detailed endpoint telemetry, including process creation, network connections, and file system changes. This allows security teams to reconstruct the full attack chain after an incident, identifying the initial infection vector and all subsequent malicious activities. The platform correlates these events across multiple endpoints to provide a comprehensive timeline for investigation.

Exam trap

The trap here is that candidates may confuse FortiEDR's capabilities with those of other Fortinet products, such as assuming decoy deployment (FortiDeceptor) or email filtering (FortiMail) are part of FortiEDR's endpoint protection suite.

Full explanation →

262

Multi-Selectmedium

A FortiGate administrator is troubleshooting a scenario where remote users can connect to the VPN but cannot access internal resources. The VPN policy is configured correctly. Which TWO steps should the administrator take to diagnose the issue?

Select 2 answers

A.Verify that the routing table on the FortiGate includes the remote networks

B.Check the firewall policy to ensure it allows traffic from the VPN to internal networks

C.Restart the IKE daemon on the FortiGate

D.Disable NAT on the VPN policy

E.Increase the DPD retry count

AnswersA, B

Without routes to the remote networks, traffic will not be forwarded through the tunnel.

Why this answer

Check routing and firewall policies. If the tunnel is up but traffic is not forwarded, routing may be missing or firewall policies may be blocking or not matching.

Full explanation →

263

MCQhard

Refer to the exhibit. A tunnel interface is configured with IP 10.0.1.1/30 and remote-ip 10.0.1.2/30. The phase2 defines src-subnet as 10.0.1.0/30 and dst-subnet as 10.0.2.0/30. What is the most likely problem with this configuration?

A.The phase2 src-subnet includes the tunnel interface IP

B.The remote gateway is set to a static IP but the peer might be dynamic

C.The tunnel interface is missing the 'ip' command

D.The phase2 dst-subnet overlaps with the remote gateway

AnswerA

The tunnel interface IP (10.0.1.1) is inside the src-subnet (10.0.1.0/30), which is incorrect. The src-subnet should be the local LAN subnet, not the tunnel subnet.

Why this answer

The phase2 src-subnet is set to 10.0.1.0/30, which includes the tunnel interface IP 10.0.1.1/30. In IPsec VPN configurations, the phase2 selector must not include the tunnel interface IP itself because the tunnel interface is used for routing encapsulated traffic; including it can cause routing loops or prevent the tunnel from establishing correctly. The correct src-subnet should be the protected internal network behind the FortiGate, not the tunnel subnet.

Exam trap

The trap here is that candidates often confuse the tunnel interface subnet with the protected local subnet, assuming the phase2 selectors should match the tunnel IPs, when in fact they must specify the actual internal networks behind the VPN gateways.

How to eliminate wrong answers

Option B is wrong because the question does not provide any information about the peer being dynamic; the remote-ip is statically configured, and a static peer is valid. Option C is wrong because the tunnel interface is configured with an IP address (10.0.1.1/30), which implies the 'ip' command is present; the issue is not a missing command. Option D is wrong because the phase2 dst-subnet (10.0.2.0/30) does not overlap with the remote gateway (10.0.1.2/30); they are on different subnets, so no overlap exists.

Full explanation →

264

MCQmedium

A FortiGate admin configures a policy package with header and footer policies in FortiManager. What is the purpose of header policies?

A.They are used for NAT policies only

B.They provide default logging for all traffic

C.They apply only to the root VDOM

D.They are evaluated before other policies in the same policy package

AnswerD

Header policies have higher priority and are evaluated first.

Why this answer

Header policies in FortiManager are evaluated before any other policies in the same policy package. This allows administrators to enforce mandatory rules—such as blocking specific traffic or applying global inspection—that must be processed first, ensuring they are not bypassed by more specific policies later in the sequence.

Exam trap

The trap here is that candidates often confuse header policies with global policies or default settings, assuming they apply only to NAT or root VDOMs, when in fact they are simply policies that are evaluated first within a specific policy package.

How to eliminate wrong answers

Option A is wrong because header policies are not limited to NAT policies; they can include any firewall policy type, including security, authentication, or traffic shaping. Option B is wrong because header policies do not automatically provide default logging; logging must be explicitly configured within each policy. Option C is wrong because header policies apply to the entire policy package, not just the root VDOM; they affect all VDOMs that use that package.

Full explanation →

265

MCQmedium

An administrator configured a new policy package in FortiManager and assigned it to a FortiGate. After installing the policy package, the FortiGate shows the new policies, but traffic is not matching them. What could be the reason?

A.The policy package is installed to the root VDOM instead of the target VDOM

B.The policy package has not been committed

C.The FortiGate has not been added to the ADOM

D.The FortiGate is in transparent mode

AnswerA

Policy packages are installed per VDOM; if the wrong VDOM is selected, policies won't affect the correct traffic.

Why this answer

When a policy package is installed to a FortiGate via FortiManager, the installation target must match the VDOM context of the FortiGate. If the administrator assigns the policy package to the root VDOM (or a different VDOM) instead of the specific VDOM where traffic is being processed, the policies will appear in the FortiGate's configuration but will not be applied to the correct VDOM's traffic. FortiManager installs policies per VDOM, and mismatched VDOM assignment causes the policies to be ignored by the traffic path.

Exam trap

The trap here is that candidates assume policy installation always applies globally, but FortiManager enforces VDOM-specific policy assignment, and failing to match the VDOM causes the policies to be present but inactive for the target traffic.

How to eliminate wrong answers

Option B is wrong because FortiManager does not use a 'commit' operation for policy packages; installation is immediate upon selecting 'Install' and does not require a separate commit step. Option C is wrong because the FortiGate must be added to an ADOM to be managed, but the question states the policy package was assigned and installed, implying the FortiGate is already in the ADOM. Option D is wrong because transparent mode does not prevent policy matching; FortiGate in transparent mode still processes firewall policies, and the issue is VDOM misassignment, not the operational mode.

Full explanation →

266

MCQeasy

What is the purpose of a management VDOM in a multi-VDOM FortiGate?

A.To apply security profiles for all VDOMs

B.To route all inter-VDOM traffic

C.To provide a dedicated VDOM for system administration and management traffic

D.To host customer-facing services

AnswerC

The management VDOM handles GUI/CLI access, SNMP, etc.

Why this answer

A management VDOM is a dedicated administrative VDOM that isolates system management traffic (e.g., SSH, HTTPS, SNMP, syslog) from data-plane VDOMs. This ensures that administrative access and logging remain available even if a data VDOM fails or is misconfigured, and it prevents management traffic from competing with production traffic for resources.

Exam trap

The trap here is that candidates often confuse the management VDOM with a 'super-VDOM' that controls all others, but in reality it only handles administrative traffic and has no data-plane forwarding role.

How to eliminate wrong answers

Option A is wrong because security profiles (e.g., antivirus, web filtering) are applied per VDOM or per policy, not centrally by a management VDOM; each VDOM has its own independent security policy engine. Option B is wrong because inter-VDOM traffic is routed by the VDOM link or inter-VDOM link feature, not by the management VDOM; the management VDOM does not participate in data-plane forwarding. Option D is wrong because customer-facing services (e.g., web servers, application hosting) are typically placed in a separate data VDOM, not the management VDOM, which is reserved strictly for administrative access and monitoring.

Full explanation →

267

Multi-Selectmedium

A FortiGate is configured as a ZTNA proxy for an internal application. Users authenticate via SAML with FortiGate as the IdP. The administrator wants to enforce that only devices with a valid ZTNA tag can access the application. Which TWO configurations are required?

Select 2 answers

A.Install a client certificate on each device for authentication.

B.Configure FortiClient EMS to push compliance tags to FortiGate.

C.Set the ZTNA proxy to require FortiClient on the client device.

D.Create a ZTNA rule with tag conditions.

E.Enable ZTNA tags on the firewall policy that permits access to the application.

AnswersD, E

Correct. A ZTNA rule with tag conditions is required to specify which ZTNA tags are permitted for access to the application.

Why this answer

To enforce that only devices with a valid ZTNA tag can access the application, two configurations are required: creating a ZTNA rule with tag conditions (D) and enabling ZTNA tags on the firewall policy that permits access (E). The ZTNA rule defines which tags are allowed, and the firewall policy must have ZTNA tags enabled to apply the rule. Option B (configuring EMS to push tags) is a prerequisite but not an enforcement configuration; options A and C are not required since SAML handles authentication and FortiClient is not mandatory on the proxy itself.

Full explanation →

268

Matchingmedium

Match each Fortinet security feature to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Detects and prevents network attacks

Identifies and controls application traffic

Blocks access to malicious or unwanted websites

Scans and removes malware from traffic

Prevents sensitive data from leaving the network

Why these pairings

Fortinet security features have distinct functions: IPS inspects network traffic for exploits, Application Control identifies applications, Web Filtering controls web access, and Antivirus scans for malware. Common confusions involve swapping these roles.

Full explanation →

269

Multi-Selecthard

A FortiGate HA cluster is configured in active-passive mode with VDOMs. The administrator wants to ensure that a specific VDOM (VDOM1) always runs on the primary unit unless that unit fails. Additionally, the administrator wants to minimize disruption during a failover. Which THREE configuration steps should be taken?

Select 3 answers

A.Set the HA priority of the primary unit to a higher value (e.g., 200) than the secondary unit

B.Disable session pickup to speed up failover

C.Configure VDOM load balance with 'prefer' setting for VDOM1 on the primary unit

D.Enable session pickup and ensure session synchronization is configured

E.Enable active-active HA mode

AnswersA, C, D

Higher priority makes the unit preferred to be primary.

Why this answer

In an active-passive HA cluster, setting a higher HA priority (e.g., 200) on the primary unit ensures it is elected as the active unit. This guarantees that VDOM1, which is not load-balanced, will run on the primary unit under normal conditions, as the higher priority value makes the primary unit preferred during the election process.

Exam trap

The trap here is that candidates often confuse active-passive with active-active HA mode, incorrectly assuming that active-active is required for VDOM-specific control, when in fact the 'prefer' setting within active-passive mode achieves the desired behavior without allowing VDOMs to run on both units simultaneously.

Full explanation →

270

MCQeasy

A FortiGate administrator wants to see the current number of active sessions. Which command provides this information?

A.show system session-info

B.diagnose sys session stat

C.diagnose sys session list

D.get system performance status

AnswerB

This command shows session count and other statistics.

Why this answer

The 'diagnose sys session stat' command displays a summary of the current session table, including the total number of active sessions, which is exactly what the administrator needs. This command is part of FortiGate's diagnostic tools and provides a quick statistical overview without listing individual session details.

Exam trap

The trap here is that candidates confuse 'diagnose sys session stat' with 'diagnose sys session list' or 'show system session-info', assuming any command with 'session' in it will show the session count, but only 'stat' provides the aggregated summary without listing every session.

How to eliminate wrong answers

Option A is wrong because 'show system session-info' is not a valid FortiGate CLI command; the correct command for viewing session information is 'diagnose sys session stat' or 'get system session-info' (which shows session-related configuration, not active session counts). Option C is wrong because 'diagnose sys session list' dumps all individual session entries, which is useful for deep inspection but does not provide a simple count of active sessions and can overwhelm the output. Option D is wrong because 'get system performance status' shows overall system performance metrics like CPU and memory usage, not the number of active sessions.

Full explanation →

271

Multi-Selecteasy

A company is deploying ZTNA to replace their legacy VPN. They want to ensure that only users with a valid certificate and compliant antivirus can access the internal application. Which TWO components are required on the FortiGate for this deployment?

Select 2 answers

A.ZTNA proxy rule with access proxy

B.Dynamic routing protocol (BGP)

C.Firewall policy with ZTNA tags matching

D.SSL-VPN portal

E.IPsec phase1 with certificate authentication

AnswersA, C

Why this answer

ZTNA uses a proxy rule (access proxy) to publish the application, and a firewall policy that references ZTNA tags and the access proxy to enforce access based on identity and posture.

Full explanation →

272

MCQhard

A network engineer is troubleshooting an SD-WAN setup where traffic from a specific subnet is not being load-balanced as expected. The SD-WAN rule uses 'source IP' hashing. The engineer notices that the traffic originates from multiple hosts in the same /24 subnet. What is the most likely cause of poor load distribution?

A.The SD-WAN rule is not matching the traffic.

B.The SD-WAN members have different bandwidths.

C.Traffic is using a single destination IP and port.

D.The source IP hashing algorithm causes multiple hosts in the same subnet to map to the same member.

AnswerD

Source IP hashing can lead to poor distribution for similar IPs.

Why this answer

Source IP hashing in SD-WAN uses a hash of the source IP address to select a member for each flow. When multiple hosts reside in the same /24 subnet, their source IPs share the same first 24 bits, which can cause the hash algorithm to map them to the same SD-WAN member if the hash function is not sufficiently granular or if the number of members is small. This results in poor load distribution despite multiple sources.

Exam trap

The trap here is that candidates assume multiple hosts in the same subnet automatically distribute traffic evenly, forgetting that source IP hashing can produce identical hash values for IPs sharing the same network prefix, leading to poor load balancing.

How to eliminate wrong answers

Option A is wrong because if the SD-WAN rule were not matching the traffic, no load balancing would occur at all, not just poor distribution. Option B is wrong because different bandwidths among members affect capacity but do not cause the hash algorithm to map multiple hosts in the same subnet to the same member; bandwidth differences are handled by weighted load balancing, not source IP hashing. Option C is wrong because using a single destination IP and port would affect per-flow load balancing (e.g., session-based hashing), but source IP hashing is independent of destination; the issue here is specifically about source IPs in the same subnet mapping identically.

Full explanation →

273

Multi-Selectmedium

An administrator is using FortiAnalyzer to generate a compliance report. The report should include logs from multiple FortiGates in different ADOMs. Which three actions must the administrator take? (Choose three.)

Select 3 answers

A.Configure a meta field to tag the devices for report filtering

B.Ensure the FortiGates are logging to the same ADOM or multiple ADOMs

C.Create a new ADOM that spans all the FortiGates

D.Use the 'device groups' feature in FortiAnalyzer to aggregate logs

E.Select the appropriate ADOM scope when configuring the report

AnswersA, B, E

Meta fields allow grouping of devices across ADOMs for reporting.

Why this answer

Meta fields in FortiAnalyzer allow you to tag devices with custom attributes, which can then be used as filters when generating compliance reports. This enables the report to include logs from multiple FortiGates across different ADOMs by filtering based on the meta field value, rather than being restricted to a single ADOM's scope.

Exam trap

The trap here is that candidates often assume that logs from different ADOMs must be aggregated into a single ADOM or use device groups, but FortiAnalyzer's meta fields and ADOM scope selection provide a more flexible and secure method for cross-ADOM reporting without compromising ADOM boundaries.

Full explanation →

274

Matchingmedium

Match each IPsec VPN term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Internet Key Exchange version 1

Internet Key Exchange version 2

Encapsulating Security Payload

Authentication Header

Perfect Forward Secrecy

Why these pairings

Correct matches: IKE establishes SAs and authenticates peers; SPI is an index to identify SAs; ESP provides confidentiality, authentication, and integrity. Common confusions include swapping IKE and SA definitions.

Full explanation →

275

MCQhard

An administrator configures VDOMs on a FortiGate and assigns port1 to VDOM-A and port2 to VDOM-B. The administrator then creates a firewall policy in VDOM-A to allow traffic from port1 to the VDOM link. Traffic from VDOM-A to VDOM-B is still failing. What is the most likely missing configuration?

A.An inter-VDOM routing policy under system settings

B.A policy in VDOM-B allowing traffic from the VDOM link to port2

C.A static route in VDOM-A pointing to VDOM-B's subnet

D.A VDOM link connecting VDOM-A and VDOM-B

AnswerD

The VDOM link is required for inter-VDOM communication.

Why this answer

The most likely missing configuration is a VDOM link, which is the logical interconnecting interface required to route traffic between VDOMs. Without a VDOM link, VDOM-A and VDOM-B are isolated from each other, and no firewall policy or route can forward traffic between them. The administrator must create a VDOM link (e.g., using the 'config system vdom-link' command) to establish the Layer 3 adjacency needed for inter-VDOM communication.

Exam trap

The trap here is that candidates often assume a firewall policy alone is sufficient for inter-VDOM traffic, overlooking the mandatory requirement of a VDOM link to create the logical path between VDOMs before any policy or route can be applied.

How to eliminate wrong answers

Option A is wrong because an inter-VDOM routing policy is not a valid configuration object under system settings; inter-VDOM routing is achieved via VDOM links and policies, not a separate routing policy. Option B is wrong because while a policy in VDOM-B is eventually required to permit traffic from the VDOM link to port2, the immediate missing element is the VDOM link itself—without it, no traffic can reach VDOM-B to even be evaluated by a policy. Option C is wrong because a static route in VDOM-A pointing to VDOM-B's subnet is unnecessary until the VDOM link is created and the next-hop interface (the VDOM link) is defined; the route cannot function without the link.

Full explanation →

276

MCQmedium

In FortiManager, an administrator wants to apply a set of firewall policies to multiple FortiGates in different ADOMs. The policies must be centrally managed. What is the best approach?

A.Use the Global ADOM to define global policies that apply to all ADOMs

B.Create a policy package in each ADOM and use the same policies

C.Configure the policies directly on each FortiGate

D.Use automation stitches to copy policies between ADOMs

AnswerA

Global ADOM policies are inherited by all ADOMs, providing central management.

Why this answer

The Global ADOM in FortiManager allows administrators to define firewall policies that are automatically inherited by all ADOMs, ensuring consistent, centrally managed policy enforcement across multiple FortiGates without manual duplication. This approach leverages FortiManager's hierarchical policy model, where global policies are pushed to each ADOM's policy packages and take precedence over local policies unless overridden.

Exam trap

The trap here is that candidates often confuse the Global ADOM with a simple 'global policy' feature, not realizing it is a dedicated administrative domain with its own policy database and inheritance rules, leading them to choose option B (manual duplication) or D (automation stitches) as workarounds.

How to eliminate wrong answers

Option B is wrong because creating a policy package in each ADOM with the same policies duplicates configuration effort and defeats centralized management, as each ADOM's policies must be individually maintained and pushed. Option C is wrong because configuring policies directly on each FortiGate bypasses FortiManager's centralized control, leading to configuration drift and no single source of truth. Option D is wrong because automation stitches are designed for event-triggered actions (e.g., dynamic responses), not for replicating static policy sets between ADOMs, and they lack the inheritance and revision control of Global ADOM policies.

Full explanation →

277

MCQmedium

An administrator notices that when a BGP session goes down, failover to the backup path takes about 30 seconds. The admin wants to reduce the failover time to less than 1 second. Which technology should the administrator implement?

A.Configure BGP fast external failover

B.Increase the BGP keepalive timer to 1 second

C.Use policy-based routing with SLA monitoring

D.Enable BFD on the BGP neighbor and the associated interface

AnswerD

BFD provides fast failure detection (milliseconds) for routing protocols.

Why this answer

BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for BGP sessions by sending rapid hello packets independently of the BGP keepalive mechanism. By enabling BFD on both the BGP neighbor and the associated interface, the router can detect a link or neighbor failure in milliseconds (e.g., 50-300 ms), allowing BGP to converge and switch to the backup path in under 1 second, far faster than the default 30-second hold timer.

Exam trap

The trap here is that candidates often confuse BGP fast external failover (which only helps for directly connected interface flaps) with BFD (which provides sub-second detection for any failure along the path), leading them to select option A instead of D.

How to eliminate wrong answers

Option A is wrong because BGP fast external failover only triggers an immediate session reset when the directly connected interface goes down, but it does not provide sub-second detection for failures beyond the immediate link (e.g., a remote neighbor failure or intermediate switch failure). Option B is wrong because increasing the BGP keepalive timer to 1 second would actually require reducing the hold timer proportionally (e.g., to 3 seconds), which still results in detection times of several seconds and increases CPU/bandwidth overhead without achieving sub-second failover. Option C is wrong because policy-based routing with SLA monitoring can detect path failures using ICMP probes, but SLA polling intervals are typically 1-5 seconds, and the convergence process involves route removal and re-insertion, which cannot guarantee failover in under 1 second.

Full explanation →

278

Multi-Selectmedium

An administrator is planning a FortiManager deployment to manage multiple FortiGates with multiple VDOMs. The administrator wants to use ADOMs to separate configurations. Which TWO statements about ADOMs are correct? (Choose two.)

Select 2 answers

A.ADOMs support revision history for tracking configuration changes

B.Regular ADOMs can only contain devices with a single VDOM

C.A Global ADOM can manage all VDOMs on a managed FortiGate

D.Policy packages in an ADOM can be shared across different ADOMs

E.ADOMs cannot be renamed after creation

AnswersA, C

Each ADOM maintains its own revision history for managed devices/VDOMs.

Why this answer

ADOMs in FortiManager maintain a revision history for each managed device or VDOM, allowing administrators to track configuration changes over time, compare revisions, and roll back to previous states if needed. This revision control is essential for auditing and troubleshooting in multi-VDOM environments.

Exam trap

The trap here is that candidates often assume regular ADOMs can only contain single-VDOM devices (Option B) because of the word 'regular,' but FortiManager allows multi-VDOM devices to be split across ADOMs or grouped together, and the Global ADOM is specifically designed for cross-VDOM management.

Full explanation →

279

Multi-Selecthard

An administrator wants to ensure that traffic between two VDOMs on the same FortiGate is properly inspected. Which THREE configurations must be in place?

Select 3 answers

A.Inspection profiles applied to the policies

B.Enable SSL inspection on the inter-VDOM link interface

C.A firewall policy in each VDOM permitting traffic across the link

D.An inter-VDOM link between the VDOMs

E.Static routes on both VDOMs pointing to the inter-VDOM link

AnswersA, C, D

Why this answer

Inspection profiles (such as antivirus, web filtering, and IPS) must be explicitly applied to the firewall policies that govern traffic traversing the inter-VDOM link. Without these profiles, the FortiGate will forward traffic between VDOMs based solely on the policy action (accept/deny) without performing any deep packet inspection, leaving the traffic unexamined for threats. This is a fundamental requirement for UTM inspection in a multi-VDOM architecture.

Exam trap

The trap here is that candidates often assume SSL inspection must be enabled on the inter-VDOM link interface itself, but FortiGate requires SSL inspection to be configured as part of the inspection profile applied to the firewall policy, not on the interface.

Full explanation →

280

MCQmedium

An organization uses FortiGate's WAF feature (not FortiWeb) to protect a web server. The admin configures an inline WAF profile but notices that the WAF is not inspecting traffic. What is the most likely cause?

A.The WAF profile is not applied to a firewall policy

B.SSL Inspection is not enabled on the firewall policy

C.The firewall policy uses flow-based inspection

D.The WAF profile is configured in monitor mode

AnswerB

Without decryption, FortiGate cannot inspect encrypted traffic for WAF rules.

Why this answer

FortiGate's WAF feature operates at the application layer and requires SSL Inspection to decrypt HTTPS traffic before the WAF engine can analyze the payload. Without SSL Inspection enabled on the firewall policy, the WAF profile sees only encrypted traffic and cannot inspect HTTP/HTTPS content, effectively rendering the WAF non-functional for encrypted sessions.

Exam trap

The trap here is that candidates assume applying a WAF profile to a policy is enough, overlooking that FortiGate requires explicit SSL Inspection decryption to inspect HTTPS traffic, which is the most common oversight in WAF deployments.

How to eliminate wrong answers

Option A is wrong because applying a WAF profile to a firewall policy is necessary but not sufficient; the WAF will still fail to inspect traffic if SSL Inspection is missing. Option C is wrong because flow-based inspection does not inherently block WAF functionality; the WAF can work with both flow-based and proxy-based inspection modes, though proxy-based is recommended for deeper inspection. Option D is wrong because monitor mode only logs violations without blocking, but it still inspects traffic; the issue here is that no inspection occurs at all, which points to a missing decryption step, not a monitoring configuration.

Full explanation →

281

MCQhard

An organization uses FortiManager to manage multiple FortiGate devices in a Security Fabric. The administrator wants to push a new firewall policy that includes an FQDN address object. Which statement is true regarding FQDN objects in FortiManager policies?

A.FQDN objects must be defined on each managed FortiGate individually

B.The FQDN resolution is done automatically every 60 seconds by FortiManager

C.FortiManager resolves the FQDN to IP addresses at installation time and updates the policy accordingly

D.FQDN objects cannot be used in policies pushed from FortiManager

AnswerC

This ensures the FortiGate has the resolved IPs.

Why this answer

When an administrator pushes a policy containing an FQDN address object from FortiManager, FortiManager resolves the FQDN to its current IP addresses at installation time. The resolved IPs are then written into the policy on the managed FortiGate, ensuring the policy is immediately effective without requiring the FortiGate to perform DNS resolution. This behavior is specific to FortiManager-managed policies and differs from locally configured FQDN objects on FortiGate.

Exam trap

The trap here is that candidates confuse FortiManager's installation-time resolution with FortiGate's built-in FQDN caching and periodic re-resolution (default 60 seconds), leading them to incorrectly select Option B.

How to eliminate wrong answers

Option A is wrong because FQDN objects can be defined centrally in FortiManager and pushed to multiple FortiGates, eliminating the need for individual definition on each device. Option B is wrong because FortiManager does not perform automatic FQDN resolution every 60 seconds; resolution occurs only at installation time, and subsequent updates require a re-install or a scheduled policy push. Option D is wrong because FQDN objects are fully supported in policies pushed from FortiManager, with the resolution handled during installation as described.

Full explanation →

282

MCQeasy

An administrator wants to ensure that all traffic from VDOM 'Guest' is logged to a FortiAnalyzer that is managed by FortiManager. What must be configured in FortiManager to achieve this?

A.Enable FortiView on the FortiGate

B.Configure a log forwarding policy in the Global ADOM

C.Create an automation stitch to forward logs

D.Configure the VDOM's log settings and assign the device to an ADOM with log forwarding enabled

AnswerD

Proper log settings on the VDOM and correct ADOM configuration ensure logs are sent to FortiAnalyzer.

Why this answer

FortiManager manages log forwarding at the ADOM level. To forward logs from a specific VDOM (Guest) to FortiAnalyzer, the administrator must configure the VDOM's log settings to send logs to FortiAnalyzer and assign the FortiGate to an ADOM that has log forwarding enabled. This ensures that logs from the Guest VDOM are properly forwarded to the FortiAnalyzer managed by FortiManager.

Exam trap

The trap here is that candidates often confuse log forwarding with automation stitches or global policies, thinking that a global setting or event-triggered action can replace the need for per-VDOM log configuration within an ADOM.

How to eliminate wrong answers

Option A is wrong because enabling FortiView on the FortiGate only provides local traffic visualization and does not forward logs to FortiAnalyzer; FortiView is a monitoring tool, not a log forwarding mechanism. Option B is wrong because a log forwarding policy in the Global ADOM applies to all VDOMs globally, not specifically to the Guest VDOM, and it does not handle per-VDOM log forwarding granularity. Option C is wrong because an automation stitch is used for automated responses to events (e.g., triggering scripts or sending alerts), not for forwarding logs to FortiAnalyzer; log forwarding is configured via log settings and ADOM policies.

Full explanation →

283

MCQhard

A FortiGate has VDOMs enabled. An administrator runs 'get system status' and sees only one VDOM listed. However, the administrator configured two VDOMs earlier. What is the most likely cause?

A.The second VDOM was deleted by another administrator

B.VDOM mode is not enabled globally

C.The second VDOM has a different name and is hidden due to a bug

D.The command only shows the management VDOM; use 'config vdom' to see all

AnswerD

'get system status' displays only the current VDOM (usually management). To list all VDOMs, use 'show vdom' or 'config vdom'.

Why this answer

When VDOMs are enabled, the 'get system status' command displays only the management VDOM (the VDOM from which the administrator is currently logged in). To see all configured VDOMs, the administrator must use the 'config vdom' command followed by 'show' or 'get system status' within the global context. Option D correctly identifies this behavior, as the second VDOM is not deleted or hidden by a bug; it simply is not shown by that command.

Exam trap

The trap here is that candidates assume 'get system status' shows all configured VDOMs, when in fact it only displays the current management VDOM, leading them to incorrectly suspect deletion, misconfiguration, or a bug.

How to eliminate wrong answers

Option A is wrong because if the second VDOM had been deleted by another administrator, the 'config vdom' command would also show only one VDOM, but the question states the administrator configured two VDOMs earlier, and the issue is specifically with the output of 'get system status', not with the actual existence of the VDOM. Option B is wrong because if VDOM mode were not enabled globally, the 'get system status' command would not show any VDOM at all, and the administrator would not be able to configure VDOMs; the fact that one VDOM is listed indicates VDOM mode is enabled. Option C is wrong because there is no known bug in FortiOS that hides a VDOM due to its name; the 'get system status' command consistently shows only the current management VDOM, regardless of naming.

Full explanation →

284

MCQmedium

A site-to-site IPsec VPN tunnel is failing. The administrator runs 'diagnose vpn ike config' and sees that phase 1 parameters are correct. However, phase 2 negotiation fails with 'no proposal chosen'. What is the MOST likely cause?

A.The pre-shared key is incorrect

B.The phase 2 encryption/authentication algorithms do not match between peers

C.The firewall policy allowing IKE traffic is missing

D.The remote gateway IP address is wrong

AnswerB

Phase 2 negotiation fails when proposals do not match.

Why this answer

The 'no proposal chosen' error in phase 2 indicates that the IPsec security association (SA) parameters—specifically the encryption algorithm, authentication algorithm, or Diffie-Hellman group—do not match between the two peers. Since the administrator confirmed phase 1 is correct via 'diagnose vpn ike config', the issue is isolated to phase 2 proposal mismatch, making option B the most likely cause.

Exam trap

The trap here is that candidates often confuse phase 1 and phase 2 failures, assuming any 'no proposal chosen' error relates to IKE phase 1, when in fact the error message specifically indicates a phase 2 proposal mismatch after phase 1 has successfully completed.

How to eliminate wrong answers

Option A is wrong because an incorrect pre-shared key would cause phase 1 (IKE) negotiation to fail, not phase 2; the administrator already verified phase 1 parameters are correct. Option C is wrong because a missing firewall policy for IKE traffic would prevent UDP port 500 or 4500 packets from reaching the FortiGate, blocking phase 1 entirely, not just phase 2. Option D is wrong because an incorrect remote gateway IP address would prevent any IKE communication, leading to a phase 1 failure, not a phase 2 'no proposal chosen' error.

Full explanation →

285

Drag & Dropmedium

Drag and drop the steps to configure OSPF on a FortiGate firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Create virtual router, define areas and networks, set router ID, enable on interfaces, then verify.

Full explanation →

286

MCQhard

An administrator configures FortiAnalyzer to receive logs from multiple FortiGates. They want to create a report that shows only incidents involving 'critical' severity and specific attack types. Which FortiAnalyzer feature allows the administrator to define such a custom report?

A.Incident management

B.Playbooks

C.FortiView dashboards

D.Report datasets and charts

AnswerD

Datasets define the data source and filters; charts visualize it.

Why this answer

FortiAnalyzer reports use SQL-like queries and dataset definitions to filter and aggregate log data based on severity, attack type, etc.

Full explanation →

287

MCQhard

A FortiGate administrator runs 'diagnose sys session list' and sees a session for which the destination interface is 'sdwan'. The session is marked with 'state=01000048'. What does this state indicate about the session?

A.The session is being held until the SD-WAN load balancing decision is made

B.The session is bypassing SD-WAN load balancing and using policy-based routing

C.The session has completed load balancing and is being forwarded out the sdwan interface

D.The session has been dropped because the selected SD-WAN member is down

AnswerA

Why this answer

The session state value 0x01000048 corresponds to the flag 'SES_STATE_SD_WAN_HOLD' in FortiOS. This flag indicates that the session is temporarily held in a pending state while the SD-WAN load balancing decision is being made. The session will not be forwarded until the SD-WAN rule selects the appropriate member interface, preventing premature routing before the load balancing logic completes.

Exam trap

The trap here is that candidates often misinterpret the 'sdwan' interface as a physical interface that forwards traffic directly, when in fact it is a logical placeholder that triggers a hold state until the SD-WAN rule selects a specific member interface.

How to eliminate wrong answers

Option B is wrong because the session is explicitly held for SD-WAN load balancing, not bypassing it; policy-based routing is a separate mechanism that would not use the 'sdwan' interface or this hold flag. Option C is wrong because a session that has completed load balancing would show a specific member interface (e.g., 'port1') as the destination, not 'sdwan', and the state would not include the hold flag. Option D is wrong because a dropped session due to a down member would not be listed in the session table; the session would be terminated or fail to establish, not held with state 0x01000048.

Full explanation →

288

MCQmedium

An administrator wants to troubleshoot why specific traffic is not matching a configured firewall policy. Which debug command should be used?

A.diagnose sys session list

B.get firewall policy <id>

C.diagnose netlink interface list

D.diagnose debug flow

AnswerD

This traces packet flow and shows policy matching.

Why this answer

The 'diagnose debug flow' command is the correct tool for tracing traffic through the firewall policy engine in FortiOS. It captures the packet flow in real time, showing which policy is evaluated, why a match or no-match occurs, and any drop reasons. This directly addresses the administrator's need to troubleshoot why specific traffic is not matching a configured firewall policy.

Exam trap

The trap here is that candidates often confuse session listing commands with flow debugging, assuming that viewing existing sessions ('diagnose sys session list') will reveal why new traffic fails to match a policy, when in fact it only shows already-established sessions and not the real-time policy evaluation path.

How to eliminate wrong answers

Option A is wrong because 'diagnose sys session list' displays existing session entries in the session table, not the policy matching process for new traffic; it shows what has already been matched, not why a match failed. Option B is wrong because 'get firewall policy <id>' only displays the configuration of a specific policy, not the real-time debugging of traffic flow or policy matching decisions. Option C is wrong because 'diagnose netlink interface list' shows interface information and netlink kernel state, which is unrelated to firewall policy matching or traffic debugging.

Full explanation →

289

MCQeasy

A FortiGate administrator wants to use Fortinac for network access control. Which of the following is the PRIMARY function of Fortinac in a network?

A.Perform deep packet inspection on all traffic

B.Act as a VPN concentrator for remote access

C.Provide network access control by enforcing policies based on device identity and posture

D.Provide a cloud-based sandbox for malware analysis

AnswerC

FortiNAC's core function is NAC: controlling network access based on device identity, compliance, and user role.

Why this answer

FortiNAC is Fortinet's Network Access Control (NAC) solution. Its primary function is to provide visibility, control, and automated response for endpoints based on identity and posture, enabling policy enforcement for network access. Option C correctly describes this.

Full explanation →

290

MCQeasy

A company is deploying FortiGate with Advanced Threat Protection (ATP) and wants to block advanced malware that uses encrypted C2 communications. Which security profile should be configured to perform SSL inspection and detect malicious traffic?

A.Data Leak Prevention profile

B.Antivirus profile with SSL inspection

C.Web Filtering profile

D.Intrusion Prevention profile

AnswerB

Antivirus profiles can be configured with SSL inspection to detect malware in encrypted C2 traffic.

Why this answer

An Antivirus profile with SSL inspection enabled is required to decrypt encrypted C2 (command-and-control) traffic so that FortiGate can inspect the payload for malware signatures, heuristics, and behavioral patterns. Without SSL inspection, the ATP engine cannot see inside the encrypted tunnel, rendering the antivirus and other security profiles ineffective against encrypted C2 communications.

Exam trap

The trap here is that candidates often assume IPS or Web Filtering alone can block encrypted C2 traffic, but without SSL inspection, these profiles cannot see inside the encrypted tunnel, making the Antivirus profile with SSL inspection the only correct choice for detecting malware in encrypted communications.

How to eliminate wrong answers

Option A is wrong because a Data Leak Prevention (DLP) profile focuses on detecting and preventing unauthorized transmission of sensitive data (e.g., credit card numbers, PII) and does not perform SSL inspection or detect advanced malware C2 traffic. Option C is wrong because a Web Filtering profile controls access to URLs and categories (e.g., blocking malicious sites) but does not decrypt or inspect the content of encrypted sessions for malware payloads. Option D is wrong because an Intrusion Prevention profile (IPS) detects and blocks network-level exploits and vulnerabilities, but without SSL inspection, it cannot analyze encrypted C2 traffic; IPS relies on decrypted traffic to match signatures.

Full explanation →

291

MCQmedium

A FortiGate administrator is using FortiNAC to enforce network access control for wired endpoints. The administrator wants to quarantine any endpoint that fails antivirus compliance. Which action should be configured in the FortiNAC policy to achieve this?

A.Disable the switch port

B.Send a SNMP trap to the admin

C.Assign the endpoint to a quarantine VLAN

D.Block the MAC address at the switch port

AnswerC

This is the standard method to isolate non-compliant endpoints while allowing limited remediation access.

Why this answer

FortiNAC policies can enforce compliance by moving endpoints to a quarantine VLAN or applying a quarantine ACL. The typical action is to place the endpoint in a quarantine VLAN where access is restricted.

Full explanation →

292

MCQmedium

An administrator is troubleshooting a scenario where FortiAnalyzer is not receiving logs from a FortiGate. The FortiGate shows 'log-fortianalyzer setting status: disconnected'. Which step should be taken first to resolve this?

A.Check the FortiGate's DNS resolution for the FortiAnalyzer hostname

B.Verify that the FortiGate can reach the FortiAnalyzer IP address and that the FortiAnalyzer service is running

C.Restart the FortiGate's logging service

D.Disable and re-enable logging to FortiAnalyzer

AnswerB

Connectivity is the most basic check; ping and service status should be verified first.

Why this answer

The 'disconnected' status indicates that the FortiGate cannot establish a TCP connection to the FortiAnalyzer. The first step is to verify basic Layer 3 reachability (ping) and that the FortiAnalyzer service is listening on the default port (TCP 514 or 3000 for encrypted). Without confirming these, further troubleshooting is premature.

Exam trap

The trap here is that candidates often jump to reconfiguring logging or restarting services (options C or D) without first verifying the most fundamental Layer 3 connectivity and service availability, which is the logical starting point for any 'disconnected' status.

How to eliminate wrong answers

Option A is wrong because DNS resolution is only relevant if the FortiGate is configured to use a hostname instead of an IP address; the status 'disconnected' points to a connectivity or service issue, not name resolution. Option C is wrong because restarting the FortiGate's logging service does not address underlying network or server-side problems; it only restarts the local logging daemon. Option D is wrong because disabling and re-enabling logging to FortiAnalyzer merely toggles the configuration without fixing the root cause of the disconnection; it is a reactive step that should be taken only after connectivity and service status are confirmed.

Full explanation →

293

MCQhard

An enterprise uses FortiGate as an SD-WAN edge device with three WAN links: Link A (MPLS), Link B (broadband), and Link C (LTE). The SD-WAN rule for VoIP traffic uses the 'best quality' strategy with link-quality-measurement enabled. The VoIP traffic is routed via Link A. During peak hours, users report poor voice quality. The administrator checks the SD-WAN performance SLA logs and sees that Link A's jitter and latency are within acceptable thresholds, but packet loss is slightly elevated. Which action would most likely improve VoIP quality without manual intervention?

A.Increase the priority of Link A to ensure it remains the preferred link.

B.Configure a performance SLA for VoIP traffic with jitter < 10ms, latency < 100ms, and packet-loss < 0.5% and apply it to the SD-WAN rule.

C.Disable link-quality-measurement to reduce overhead on Link A.

D.Add a new SD-WAN rule with 'lowest cost' strategy for VoIP traffic.

AnswerB

Applying a performance SLA with strict thresholds will cause the SD-WAN rule to select a link that meets the criteria, switching away from Link A if it fails the SLA.

Why this answer

Configuring a performance SLA with specific thresholds for jitter, latency, and packet loss allows FortiGate to dynamically failover VoIP traffic to another WAN link when Link A's packet loss exceeds the defined threshold (e.g., 0.5%). Since the 'best quality' strategy uses link-quality-measurement to select the link with the best SLA compliance, applying a performance SLA with a packet-loss threshold ensures that even if jitter and latency are acceptable, elevated packet loss triggers a switch to a healthier link, improving voice quality without manual intervention.

Exam trap

The trap here is that candidates assume 'best quality' automatically handles all quality metrics, but without a performance SLA with explicit thresholds, FortiGate only uses link-quality-measurement for ordering and does not failover based on packet loss alone.

How to eliminate wrong answers

Option A is wrong because increasing the priority of Link A would force it to remain the preferred link, preventing failover to a better-performing link when packet loss is elevated, which would not resolve the poor voice quality. Option C is wrong because disabling link-quality-measurement would stop FortiGate from monitoring link quality altogether, removing the ability to detect packet loss and make dynamic routing decisions, likely worsening VoIP quality. Option D is wrong because using the 'lowest cost' strategy for VoIP traffic would select links based on cost rather than quality, which could route traffic over a cheaper but lower-quality link, failing to address the packet loss issue on Link A.

Full explanation →

294

MCQeasy

Which routing technique allows a FortiGate to forward packets based on source IP address, destination IP address, or other criteria, in addition to the destination IP alone?

A.Policy-Based Routing (PBR)

B.RIP

C.OSPF route redistribution

D.ECMP

AnswerA

PBR uses policies to route traffic based on various attributes.

Why this answer

Policy-Based Routing (PBR) allows a FortiGate to forward packets based on criteria beyond the destination IP address, such as source IP, destination port, protocol, or application. This is achieved by configuring policy routes that override the default routing table lookup, enabling granular traffic steering for advanced networking scenarios like SD-WAN.

Exam trap

The trap here is that candidates often confuse Policy-Based Routing with ECMP, assuming ECMP can also use source IP for path selection, but ECMP only balances traffic based on destination IP and does not support criteria like source IP or application without additional configuration like PBR or SD-WAN rules.

How to eliminate wrong answers

Option B (RIP) is wrong because RIP is a dynamic routing protocol that exchanges routes based solely on destination network prefixes, not on source IP or other packet attributes. Option C (OSPF route redistribution) is wrong because redistribution is a mechanism to import routes from one routing protocol into another, not a technique for forwarding packets based on multiple criteria. Option D (ECMP) is wrong because ECMP (Equal-Cost Multi-Path) distributes traffic across multiple paths with the same destination prefix cost, but it does not consider source IP or other packet-level criteria for forwarding decisions.

Full explanation →

295

MCQmedium

A FortiGate administrator configures SAML SSO with FortiGate as the Service Provider (SP) and an external IdP. Users report that they are prompted for credentials repeatedly without successful authentication. What is the most likely cause?

A.The SAML attribute mapping is incorrect

B.The FortiGate's clock is synchronized via NTP

C.The firewall policy does not allow SAML traffic

D.The IdP certificate is not imported or trusted on the FortiGate

AnswerD

FortiGate must trust the IdP's signing certificate to validate SAML responses; otherwise, authentication fails.

Why this answer

SAML SSO requires certificate trust. If the IdP certificate is not trusted by the FortiGate, the SAML assertion will not be validated, causing authentication failures. The clock skew is another common issue.

Full explanation →

296

Multi-Selectmedium

A FortiGate is configured with OSPF and BGP. The administrator wants to redistribute OSPF routes into BGP. Which TWO steps are required?

Select 2 answers

A.Configure a route map to filter the routes being redistributed

B.Set the BGP table version to 2

C.Use the 'redistribute ospf' command under the BGP configuration

D.Ensure the OSPF routes are present in the routing table

E.Disable OSPF on the interface

AnswersC, D

This enables redistribution of OSPF routes into BGP.

Why this answer

The 'redistribute ospf' command under BGP configuration is the explicit method to inject OSPF-learned routes into the BGP table. This command triggers the redistribution process, allowing OSPF routes to be advertised to BGP peers.

Exam trap

The trap here is that candidates often assume a route map is mandatory for redistribution, but the exam tests the knowledge that only the redistribution command and the presence of routes in the routing table are strictly required.

Full explanation →

297

MCQmedium

An administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees that both phase 1 and phase 2 are up. The policy allows traffic from both sides. What should the administrator check next?

A.Check the routing table for routes to the remote subnet

B.Increase the phase 2 keylife

C.Check the FortiGate's NTP status

D.Disable DPD

AnswerA

Routes are needed to send traffic into the tunnel.

Why this answer

Since both phases are up and policies are correct, the issue is likely routing. The administrator should verify that the correct routes are pointing to the VPN interface (tunnel interface) on both sides. Without proper routes, traffic will not be forwarded into the tunnel.

Full explanation →

298

MCQhard

An administrator has configured an OSPF overlay over an IPsec VPN between two FortiGates. The OSPF neighbors are established, but routes from one side are not being installed in the routing table on the other side. 'get router info ospf neighbor' shows FULL state. What is the most likely cause?

A.The IPsec tunnel is using transport mode instead of tunnel mode

B.The route's OSPF cost is higher than an existing route with a lower administrative distance

C.OSPF authentication is mismatched

D.The OSPF network type is not set to point-to-point

AnswerB

OSPF routes have an AD of 110. If a static route (AD 10) or other protocol has a lower AD, the OSPF route may not be installed.

Why this answer

Even though OSPF neighbors are FULL, routes may not be installed if they are not selected as best paths. One common reason is that the OSPF cost is higher than a static route or another routing protocol's metric. The other options would prevent neighbor from reaching FULL state.

Full explanation →

299

MCQhard

An organization is deploying multiple FortiGate devices across different geographic locations. The central IT team manages all devices from a single FortiManager. The remote FortiGates connect to FortiManager over a WAN link. Which feature should be enabled on FortiManager to ensure that configuration changes are applied consistently and without interruption to the remote FortiGates?

A.Enable auto-link configuration on the FortiManager

B.Use the 'Install on Next Reboot' option in the install wizard

C.Use 'Install Wizard' with 'Immediate Install' option

D.Enable 'Configuration Override' on the managed FortiGates

AnswerB

This ensures changes are applied after reboot, avoiding disruption.

Why this answer

The 'Install on Next Reboot' option ensures that configuration changes are staged on the remote FortiGate and applied atomically when the device reboots. This prevents partial or inconsistent application over an unreliable WAN link, as the FortiManager pushes the full configuration revision to the device, which then applies it during the boot process without requiring a persistent management session.

Exam trap

The trap here is that candidates often choose 'Immediate Install' (Option C) thinking it is the fastest method, but they overlook the risk of configuration corruption or incomplete application over an unreliable WAN link, which 'Install on Next Reboot' specifically avoids.

How to eliminate wrong answers

Option A is wrong because 'auto-link configuration' is not a standard FortiManager feature; the correct term is 'auto-link' for FortiGate interfaces, not for configuration deployment. Option C is wrong because 'Immediate Install' attempts to apply changes in real time over the WAN, which can cause interruptions or partial updates if the link is unstable or the device reboots mid-install. Option D is wrong because 'Configuration Override' allows a managed FortiGate to reject or overwrite FortiManager policies, which would defeat the purpose of consistent centralized management.

Full explanation →

300

MCQmedium

An administrator sees the following output from 'diagnose sys session list' for a particular session: proto=6 proto_state=01 duration=3600 expire=3599. What does this indicate about the session?

A.The session is an ICMP session

B.The session is a TCP session that is still open and will expire in 3599 seconds

C.The session is a TCP session in TIME_WAIT state

D.The session is for UDP traffic and has been up for 3600 seconds

AnswerB

proto=6 is TCP, duration=3600 seconds, expire=3599 seconds remaining.

Why this answer

The output shows proto=6, which is the protocol number for TCP. proto_state=01 indicates the TCP session is in the SYN_SENT state, meaning the session has been created but the TCP three-way handshake is not yet complete. The duration=3600 means the session has existed for 3600 seconds, and expire=3599 means it will expire in 3599 seconds if no further traffic is seen. Therefore, the session is a TCP session that is still open and will expire in 3599 seconds, making option B correct.

Exam trap

The trap is that candidates may mistake proto_state=01 for SYN_SENT, but it actually means the TCP session is ESTABLISHED. Also, the expire value does not indicate TIME_WAIT; TIME_WAIT would have a different state value.

How to eliminate wrong answers

Option A is wrong because ICMP uses protocol number 1, not 6, and would not show a TCP state field. Option C is wrong because a TCP TIME_WAIT state is represented by a different proto_state value (typically 0x1e or similar), not 01, and would have a much shorter expire time. Option D is wrong because UDP uses protocol number 17, not 6, and does not have a proto_state field for connection state tracking.

Full explanation →

Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 226–300