Fortinet NSE 7 Advanced Security NSE7 NSE7 Questions 376–450 | Page 6/13

376

Multi-Selecthard

An admin needs to verify that a new firewall policy is performing SSL inspection. Which THREE CLI commands or steps should the admin use to confirm? (Choose three.)

Select 3 answers

A.Use 'diagnose wad filter' to check if traffic is being processed by the web proxy for SSL inspection

B.Run 'diagnose debug flow' to check if traffic is hitting the policy

C.Filter sessions with 'diagnose sys session filter dport 443' and list sessions to see if they are decrypted

D.Run 'get system performance status' to see SSL inspection statistics

E.Check the policy configuration with 'show firewall policy <id>' and look for 'ssl-ssh-profile'

AnswersA, C, E

SSL inspection in proxy mode goes through the WAD daemon; checking WAD confirms inspection.

Why this answer

'diagnose wad filter' is used to verify that traffic is being processed by the web proxy (WAD) for SSL inspection. When SSL inspection is enabled, traffic on port 443 is intercepted by the FortiGate's proxy, and this command filters and displays relevant proxy sessions, confirming that decryption is occurring.

Exam trap

The trap here is that candidates often confuse 'diagnose debug flow' with confirming SSL inspection, but it only verifies policy matching, not the actual decryption process handled by the proxy.

Full explanation →

377

Multi-Selectmedium

An administrator is troubleshooting a scenario where traffic from VLAN 100 to a server at 10.1.2.100 is being blocked. The FortiGate has an active security policy allowing the traffic and the routing table shows a correct route. Which TWO diagnostic commands should the administrator run to identify the cause of the blockage?

Select 2 answers

A.diagnose sniffer packet any 'host 10.1.2.100' 4

B.get system performance status

C.diagnose ip arp list

D.diagnose sys session list

E.diagnose debug flow

AnswersA, E

Captures packets to verify traffic reaches the FortiGate.

Why this answer

'diagnose sniffer packet any host 10.1.2.100 4' captures packets to/from the server at the interface level, allowing the administrator to see if traffic from VLAN 100 is actually arriving at the FortiGate and whether it is being dropped or forwarded. This command helps identify if the issue is at Layer 2 (e.g., VLAN misconfiguration) or Layer 3 (e.g., routing or firewall drops).

Exam trap

The trap here is that candidates often choose 'diagnose sys session list' thinking it shows blocked traffic, but it only lists established sessions, not dropped packets or failed session creation attempts.

Full explanation →

378

MCQhard

Refer to the exhibit. A FortiGate is connected to the Security Fabric and registered with FortiManager. However, the administrator notices that the FortiGate is not receiving policy updates from FortiManager. What is the most likely cause?

A.The Fabric Root serial number is incorrect

B.The FortiGate is not registered with FortiManager

C.The policy package on FortiManager is not assigned to the correct device group or policy target

D.The Security Fabric is not fully connected

AnswerC

The device is in a fabric group, but policy must be assigned to that group.

Why this answer

FortiManager uses policy packages that must be explicitly assigned to a device group or specific FortiGate. Even if the FortiGate is registered and part of the Security Fabric, if the policy package is not assigned to the correct device group or policy target, the FortiGate will not receive policy updates. This is a common misconfiguration where the policy package exists but is not linked to the device.

Exam trap

The trap here is that candidates assume registration and Fabric connectivity guarantee policy updates, but FortiManager requires explicit policy package assignment to the device group or policy target, which is a separate configuration step.

How to eliminate wrong answers

Option A is wrong because the Fabric Root serial number is used for Security Fabric topology discovery and does not affect FortiManager policy push; a mismatch would break Fabric connectivity, not policy updates. Option B is wrong because the scenario explicitly states the FortiGate is registered with FortiManager, so this option contradicts the given information. Option D is wrong because the Security Fabric being not fully connected would impact Fabric services like topology sharing, but FortiManager policy updates use a direct management tunnel (port 541/TCP) independent of Fabric connectivity.

Full explanation →

379

MCQmedium

An administrator deploys a FortiGate in transparent mode within a Layer 2 network. They apply a firewall policy with an antivirus profile to inspect traffic between two VLANs. What is a key characteristic of transparent mode that affects policy application?

A.NAT is automatically applied to all traffic to preserve private IP addresses

B.Firewall policies are applied only to traffic entering the management interface

C.Each VDOM in transparent mode requires a unique IP address for management

D.Traffic is forwarded based on MAC addresses, and policies are applied transparently without changing the IP path

AnswerD

Transparent mode operates at Layer 2, so IP routing is not used.

Why this answer

In transparent mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. This allows firewall policies, including antivirus inspection, to be applied to traffic between VLANs without modifying the IP path or requiring NAT, ensuring seamless integration into existing Layer 2 networks.

Exam trap

The trap here is that candidates often assume transparent mode requires NAT or IP-based routing changes, but the key is that it operates purely at Layer 2, forwarding based on MAC addresses and applying policies without altering the IP path.

How to eliminate wrong answers

Option A is wrong because NAT is not automatically applied in transparent mode; NAT is a Layer 3 function and transparent mode operates at Layer 2, preserving the original IP addresses. Option B is wrong because firewall policies in transparent mode are applied to traffic passing through the FortiGate interfaces, not just the management interface; the management interface is used for administrative access only. Option C is wrong because VDOMs in transparent mode do not require a unique IP address for management; each VDOM can share the management IP or use a dedicated IP, but it is not a mandatory characteristic that affects policy application.

Full explanation →

380

MCQeasy

A FortiGate administrator enables Dead Peer Detection (DPD) on an IPsec VPN tunnel. What is the primary purpose of DPD?

A.To dynamically adjust the tunnel MTU

B.To encrypt the IKE negotiation traffic

C.To automatically renegotiate the IKE SA before it expires

D.To detect when the remote peer is no longer reachable

AnswerD

DPD sends periodic messages to verify the peer is alive.

Why this answer

DPD is used to monitor the liveness of the remote peer. If the peer becomes unreachable, DPD detects it and can trigger a failover or tunnel teardown, ensuring traffic does not blackhole.

Full explanation →

381

MCQhard

An administrator runs 'get router info bgp summary' and sees that the BGP session to a neighbor is in the 'Idle' state. The neighbor IP is reachable via ping. The BGP configuration uses loopback interfaces with 'update-source loopback1'. What is the MOST likely reason for the Idle state?

A.There is no route on the neighbor back to the FortiGate's loopback IP

B.The loopback interface is down or has no IP address assigned

C.The BGP neighbor's remote-as is misconfigured

D.The BGP timer values (keepalive/hold) are mismatched

AnswerA

BGP uses TCP; if the neighbor cannot reach the update-source IP, the TCP handshake fails, keeping the session in Idle.

Why this answer

The 'Idle' state in BGP indicates that the session cannot start, often due to a missing route to the neighbor's update-source IP. Since the neighbor IP is reachable via ping but the session uses loopback interfaces with 'update-source loopback1', the FortiGate's BGP packets will source from its loopback1 IP. If the neighbor does not have a route back to that loopback IP, it cannot respond to the TCP handshake, leaving the session stuck in Idle.

This is a classic BGP loopback peering issue where reachability of the source IP is required, not just the physical interface IP.

Exam trap

The trap here is that candidates assume ping reachability to the neighbor IP guarantees BGP session establishment, but they overlook that BGP packets are sourced from the loopback interface, requiring the neighbor to have a return route to that specific source IP.

How to eliminate wrong answers

Option B is wrong because if the loopback interface were down or had no IP, the 'update-source loopback1' command would fail to source packets, but the question states the neighbor IP is reachable via ping, implying the loopback is operational. Option C is wrong because a misconfigured remote-as would typically cause the session to transition to 'Active' or 'Connect' states, not remain in 'Idle', as BGP first attempts a TCP connection before checking AS numbers. Option D is wrong because mismatched keepalive/hold timers do not prevent the session from leaving Idle; they are negotiated during the Open message exchange after the TCP connection is established, so the session would reach 'Active' or 'Connect' first.

Full explanation →

382

Multi-Selecteasy

An administrator wants to use FortiAnalyzer to generate reports for compliance. Which two data sources can be included in a FortiAnalyzer report? (Choose two.)

Select 2 answers

A.Log data from FortiGate

B.Traffic statistics from FortiView

C.Routing table information from routers

D.Configuration backups from FortiManager

E.User authentication logs from LDAP servers

AnswersA, B

Log data is the primary source for reports.

Why this answer

FortiAnalyzer reports are built from log data collected from FortiGate devices, which includes traffic logs, event logs, and security logs. This log data is the primary source for compliance reporting because it provides detailed records of network activity. FortiView traffic statistics are also a valid data source, as they aggregate real-time and historical traffic data from FortiGate logs, allowing reports to include graphical summaries and top-talker information.

Exam trap

The trap here is that candidates assume FortiAnalyzer can directly ingest data from any network source (like routers or LDAP servers), but it only processes logs forwarded from FortiGate devices or other Fortinet products that support log forwarding, not arbitrary external systems.

Full explanation →

383

MCQeasy

What is the function of a VRF (Virtual Routing and Forwarding) on a FortiGate?

A.To provide redundancy for routing protocols

B.To aggregate multiple physical interfaces into one logical interface

C.To create multiple independent routing tables

D.To encrypt traffic between different virtual domains

AnswerC

VRF maintains separate routing tables, providing path isolation.

Why this answer

VRF (Virtual Routing and Forwarding) on a FortiGate allows the creation of multiple independent routing tables within a single physical device. This enables network segmentation and traffic isolation at Layer 3, where each VRF maintains its own routing table, forwarding decisions, and interface associations, preventing routes from leaking between VRFs unless explicitly configured with route leaking.

Exam trap

The trap here is that candidates confuse VRF with VDOM (Virtual Domain), but VRF is a Layer 3 routing isolation mechanism within a single VDOM, whereas VDOM provides full administrative and security separation at the device level.

How to eliminate wrong answers

Option A is wrong because VRF does not provide redundancy for routing protocols; redundancy is achieved through protocols like VRRP, FGCP (FortiGate Cluster Protocol), or routing protocol features like BGP multipath. Option B is wrong because aggregating multiple physical interfaces into one logical interface is the function of link aggregation (LAG) or interface bonding, not VRF. Option D is wrong because encrypting traffic between different virtual domains is the role of IPsec VPNs or VDOM inter-VDOM links with encryption, not VRF; VRF focuses on routing table separation, not encryption.

Full explanation →

384

MCQhard

A FortiGate has multiple IPsec VPNs to different branch offices. The administrator notices that one VPN tunnel is flapping (going up and down repeatedly). From the CLI, 'diagnose vpn ike gateway list' shows the gateway state as 'up' but then quickly goes to 'down'. What is the MOST likely cause?

A.The remote gateway's certificate is expired

B.The phase2 proposal is mismatched

C.Dead Peer Detection (DPD) retry interval is too short

D.The pre-shared key is incorrect

AnswerC

Aggressive DPD can cause false timeouts and tunnel flapping.

Why this answer

Tunnel flapping with IKEv2 is often due to DPD mismatches or aggressive DPD retry intervals. If DPD is configured with very short intervals, the tunnel may drop due to transient delays.

Full explanation →

385

MCQmedium

An administrator configures two FortiGate units in an active-passive HA cluster. During a failover test, the administrator notices that the secondary unit becomes primary but the session table is empty, causing all existing connections to drop. Which configuration change should be made to preserve session information during failover?

A.Enable FGCP configuration synchronization

B.Configure dead gateway detection on the FortiGate units

C.Enable link-failover on the monitored interfaces

D.Enable session pickup and configure HA session synchronization

AnswerD

Session pickup synchronizes session tables between cluster members.

Why this answer

Session pickup and HA session synchronization are specifically designed to replicate the session table from the primary FortiGate to the secondary unit in an active-passive cluster. Without this feature, the secondary unit becomes primary but has no knowledge of existing sessions, causing all active connections to drop. Enabling session synchronization ensures that session state information is continuously mirrored to the standby unit, allowing seamless failover without disrupting established flows.

Exam trap

The trap here is that candidates often confuse configuration synchronization (which is automatic and covers settings) with session synchronization (which must be explicitly enabled), leading them to incorrectly select option A thinking it preserves sessions.

How to eliminate wrong answers

Option A is wrong because FGCP configuration synchronization (enabled by default in HA clusters) only synchronizes configuration changes, not the dynamic session table; it does not preserve active sessions during failover. Option B is wrong because dead gateway detection is a network monitoring feature used to detect upstream gateway failures and trigger route changes, not a mechanism for replicating session state between HA units. Option C is wrong because link-failover on monitored interfaces triggers a failover when a monitored interface goes down, but it does not address the preservation of session information; the session table remains empty on the standby unit unless session synchronization is enabled.

Full explanation →

386

Multi-Selectmedium

A company wants to provide external contractors with access to a specific internal web application without granting full network access. The solution must authenticate the user, verify device compliance, and log all access. Which three Fortinet features should be combined to meet these requirements? (Choose THREE)

Select 3 answers

A.FortiNAC

B.SSL deep inspection

C.ZTNA proxy

D.FortiClient EMS with compliance enforcement

E.IPsec VPN with XAuth

AnswersB, C, D

Deep inspection decrypts HTTPS traffic for logging and security scanning.

Why this answer

ZTNA provides application-specific access with authentication and logging. FortiClient EMS enforces device compliance (posture). SSL deep inspection is required for decryption to log content.

This combination meets all requirements.

Full explanation →

387

MCQhard

A company uses SSL VPN with FortiGate for remote access. Users report that after connecting, they can access internal web servers but cannot ping them. Which configuration is most likely missing?

A.Split tunneling settings

B.SSL VPN web portal settings

C.Firewall policy allowing ICMP

D.DNS server configuration

AnswerC

The firewall policy for SSL VPN traffic must permit ICMP protocol in addition to TCP/80 and TCP/443.

Why this answer

SSL VPN tunnels typically allow TCP-based traffic like HTTP/HTTPS to internal web servers, but ICMP (ping) is a separate protocol that requires explicit permission in the firewall policy. Without a firewall policy rule permitting ICMP from the SSL VPN interface to the internal network, the FortiGate will drop the ping requests, even though the tunnel is established and other traffic flows.

Exam trap

The trap here is that candidates assume split tunneling or DNS is the cause, but the real issue is that ICMP is a separate protocol that must be explicitly permitted in the firewall policy, unlike TCP-based web traffic.

How to eliminate wrong answers

Option A is wrong because split tunneling controls whether traffic to the internet goes through the VPN tunnel or directly, not the ability to ping internal servers; it does not affect ICMP traffic to internal resources. Option B is wrong because the SSL VPN web portal settings define the web-based interface and bookmarks for users, not the underlying firewall rules that govern ICMP or other protocols. Option D is wrong because DNS server configuration resolves hostnames to IP addresses, but the issue is that ping fails even when using the IP address, indicating a lack of ICMP permission rather than name resolution.

Full explanation →

388

MCQmedium

A network admin runs 'diagnose sys session filter dport 443' and sees the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?

A.The session was established 1 hour ago and will expire in about 1 hour

B.The session is using UDP port 443

C.The session is for HTTP traffic and has 3599 seconds left

D.The session is for HTTPS traffic and is halfway through its expected lifetime

AnswerA

Duration=3600 seconds (1 hour), expire=3599 seconds (almost 1 hour remaining). Total session lifetime is about 2 hours.

Why this answer

The output shows `duration=3600`, meaning the session has been active for 3600 seconds (1 hour), and `expire=3599`, meaning the session will expire in 3599 seconds (approximately 1 hour). The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to TCP state ESTABLISHED. Therefore, the session was established 1 hour ago and will expire in about 1 hour, making option A correct.

Exam trap

The trap here is that candidates often misinterpret `expire=3599` as the total session lifetime rather than the remaining time until expiry, leading them to incorrectly calculate the session's age or remaining duration.

How to eliminate wrong answers

Option B is wrong because `proto=6` indicates TCP, not UDP (which is protocol 17). Option C is wrong because `proto=6` and `dport 443` indicate HTTPS (TCP/443), not HTTP (which typically uses port 80), and the session has 3599 seconds left, not 3599 seconds total lifetime. Option D is wrong because while the session is for HTTPS traffic (TCP/443), the duration and expire values show it is at the beginning of its lifetime (3600 seconds elapsed, 3599 seconds remaining), not halfway through.

Full explanation →

389

MCQhard

A FortiGate administrator receives an error when trying to create a new VDOM: 'Maximum number of VDOMs reached.' However, the FortiGate model supports more VDOMs. What could be the issue?

A.The VDOM license is not installed or is expired

B.The administrator is in the wrong VDOM context

C.The FortiGate is in transparent mode

D.The FortiGate needs a firmware upgrade

AnswerA

VDOM licenses are required to create additional VDOMs beyond the base limit.

Why this answer

The error 'Maximum number of VDOMs reached' occurs when the FortiGate attempts to exceed the licensed VDOM count, even if the hardware model supports more. FortiGate VDOM licensing is enforced via a separate license file; without a valid, non-expired license, the device restricts VDOM creation to the default (often 1 or 2) or previously licensed limit. This is a common issue when a license has expired or was never installed.

Exam trap

The trap here is that candidates assume the error is due to a hardware limitation or configuration mode, but Fortinet specifically tests the distinction between hardware capability and software licensing enforcement.

How to eliminate wrong answers

Option B is wrong because being in the wrong VDOM context would not generate a 'Maximum number of VDOMs reached' error; it would instead cause a permission or scope issue when trying to create a VDOM from a non-root or non-admin VDOM. Option C is wrong because transparent mode does not limit the maximum number of VDOMs; VDOMs can be created in both transparent and NAT modes, and the error is unrelated to the operational mode. Option D is wrong because a firmware upgrade does not increase the licensed VDOM limit; the limit is enforced by the license, not the firmware version, though a firmware upgrade might be needed to support newer license formats, but the error message specifically points to a licensing issue.

Full explanation →

390

MCQeasy

What is the primary difference between using a Web Application Firewall (WAF) on FortiGate versus using FortiWeb?

A.There is no difference; they are the same.

B.FortiGate WAF is cloud-based, while FortiWeb is on-premises.

C.FortiWeb provides dedicated, advanced WAF features and higher performance for web traffic, while FortiGate WAF is a basic protection feature.

D.FortiGate WAF can protect multiple web servers simultaneously, while FortiWeb protects only one.

AnswerC

FortiWeb is a dedicated WAF appliance with more advanced capabilities; FortiGate includes a basic WAF profile.

Why this answer

FortiWeb is a dedicated web application firewall appliance that provides advanced, specialized WAF features such as machine learning-based bot detection, API discovery, and granular signature tuning, along with higher throughput for web traffic. In contrast, the WAF feature on FortiGate is a basic, integrated protection module that offers essential HTTP/HTTPS inspection and signature-based filtering, but lacks the depth and performance optimization of FortiWeb.

Exam trap

The trap here is that candidates assume all WAF implementations are functionally identical, overlooking the architectural and performance differences between an integrated feature and a dedicated appliance.

How to eliminate wrong answers

Option A is wrong because FortiGate WAF and FortiWeb are fundamentally different products; FortiGate integrates a basic WAF as a feature within its NGFW, while FortiWeb is a dedicated appliance with advanced web security capabilities. Option B is wrong because FortiGate WAF is not cloud-based; it runs on-premises as part of the FortiGate hardware or VM, and FortiWeb can be deployed both on-premises and as a cloud service (e.g., FortiWeb Cloud). Option D is wrong because both FortiGate WAF and FortiWeb can protect multiple web servers simultaneously; FortiWeb supports multi-server load balancing and virtual server configurations, while FortiGate WAF can apply policies to multiple web servers behind the firewall.

Full explanation →

391

MCQmedium

Refer to the exhibit. Users report that they cannot log in to the SSL VPN portal. The stats show 15 login failures with reason 'auth_fail'. What is the most likely cause?

A.The user 'user1' does not exist

B.The login-attempt-limit is too low

C.The encryption algorithm is set to low

D.The SSL VPN settings do not reference the user group

AnswerD

The configuration is missing 'set user-group' under config vpn ssl settings; thus no group is authorized for login, causing authentication failure.

Why this answer

The 'auth_fail' reason indicates that the authentication request was processed but rejected, typically because the SSL VPN portal is not configured to reference the user group that 'user1' belongs to. Without a group filter or group mapping in the SSL VPN settings, the FortiGate cannot match the user to any allowed group, causing the authentication to fail even if the user credentials are valid.

Exam trap

The trap here is that candidates often assume 'auth_fail' always means a wrong password or missing user, but Fortinet specifically uses 'auth_fail' to indicate a group mismatch when the user exists and the password is correct, testing your understanding of SSL VPN portal-to-group binding.

How to eliminate wrong answers

Option A is wrong because if 'user1' did not exist, the FortiGate would log a 'user not found' error, not 'auth_fail'; 'auth_fail' specifically indicates the user exists but the authentication was denied. Option B is wrong because a low login-attempt-limit would cause 'login-locked' or 'blocked' messages after exceeding attempts, not 'auth_fail' on each failure. Option C is wrong because the encryption algorithm setting (e.g., low, medium, high) affects the SSL cipher strength negotiated during the handshake, not the authentication phase; a mismatch would cause a connection failure, not an 'auth_fail' log.

Full explanation →

392

Multi-Selecteasy

An administrator needs to troubleshoot an HA synchronization issue. Which TWO commands provide information about the HA synchronization status?

Select 2 answers

A.diagnose hardware sysinfo

B.show system ha

C.diagnose ha dump

D.get system ha status

E.diagnose sys session stat

AnswersC, D

Dumps detailed HA synchronization data.

Why this answer

The 'diagnose ha dump' command (C) provides detailed internal HA state information, including synchronization status, heartbeat details, and failover counters, which is essential for deep troubleshooting. The 'get system ha status' command (D) displays the current HA operational status, including synchronization state (e.g., 'synchronized' or 'out of sync'), making it a direct tool for checking sync health.

Exam trap

The trap here is that candidates confuse 'show system ha' (which only shows configuration) with 'get system ha status' (which shows operational synchronization state), or they overlook 'diagnose ha dump' because it sounds too low-level, even though it provides the most granular sync diagnostics.

Full explanation →

393

MCQmedium

A FortiGate admin runs 'diagnose debug application sslvpn -1' and sees repeated messages: 'SSL VPN tunnel establishment failed: no response from client.' The remote user reports that the FortiClient VPN connects but no traffic passes. What is the MOST likely cause?

A.The SSL VPN realm is misconfigured

B.The SSL VPN certificate has expired

C.The remote user's FortiClient version is incompatible

D.A firewall on the remote user's network is blocking UDP port 4500 or TCP port 443

AnswerD

SSL VPN tunnel establishment requires UDP 4500 (for NAT traversal) or TCP 443 for initial handshake. If blocked, the client cannot respond, leading to the 'no response from client' message.

Why this answer

The 'no response from client' message indicates the FortiGate is not receiving the expected reply from the client during SSL VPN tunnel establishment. This typically occurs when a firewall on the remote user's network blocks UDP port 4500 (IPsec NAT traversal) or TCP port 443 (HTTPS control channel), preventing the FortiClient from completing the tunnel negotiation. The fact that the client 'connects' but no traffic passes suggests the initial SSL handshake succeeds, but the subsequent tunnel setup fails due to packet loss or filtering.

Exam trap

The trap here is that candidates assume 'connects' means the entire VPN is working, when in reality FortiClient can show a connected status after the HTTPS phase completes even if the IPsec data tunnel fails due to UDP port blocking.

How to eliminate wrong answers

Option A is wrong because a misconfigured SSL VPN realm would cause authentication or portal access failures, not a 'no response from client' error during tunnel establishment. Option B is wrong because an expired SSL VPN certificate would produce certificate validation errors in the debug output, not a timeout waiting for client response. Option C is wrong because an incompatible FortiClient version typically causes version mismatch errors or connection refusal, not a silent failure where the client appears to connect but no traffic passes.

Full explanation →

394

MCQeasy

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration uses certificates for authentication. The admin sees the following log message: 'Certificate validation failed: unable to get local issuer certificate.' What is the most likely cause?

A.The peer's certificate has expired

B.The CA certificate that signed the peer's certificate is not imported on the FortiGate

C.The certificate revocation list (CRL) is not configured

D.The local certificate does not match the peer's expected CN

AnswerB

The error 'unable to get local issuer certificate' means the issuing CA is missing.

Why this answer

The error indicates that the FortiGate cannot find the CA certificate that issued the peer's certificate. The CA certificate must be imported and trusted on the FortiGate.

Full explanation →

395

MCQmedium

An organization uses FortiManager to manage multiple FortiGates. A junior admin accidentally deleted a critical firewall policy on one device and the change was auto-installed. How can the senior admin revert the device to the previous configuration?

A.Delete the ADOM and recreate it

B.Go to Device Manager -> Revision History and restore the previous revision

C.Use the 'restore' command on FortiManager

D.Manually recreate the policy on the FortiGate

AnswerB

Revision history stores configuration snapshots that can be restored.

Why this answer

FortiManager automatically stores configuration revisions for managed FortiGates. By navigating to Device Manager -> Revision History, the admin can select the previous revision and restore it, which reverts the device to its state before the accidental deletion. This process ensures the change is undone without manual intervention or affecting other devices.

Exam trap

The trap here is that candidates may think the only way to revert a change is to manually recreate the policy (Option D) or use a generic command (Option C), overlooking FortiManager's built-in revision history feature which is specifically designed for this purpose.

How to eliminate wrong answers

Option A is wrong because deleting the ADOM would remove all configurations for all devices in that ADOM, not just revert a single policy change, and would require recreating the entire ADOM from scratch, which is excessive and disruptive. Option C is wrong because there is no generic 'restore' command on FortiManager; the correct method is through the GUI or CLI using the 'execute restore' command with a specific revision, but the question implies a GUI-based approach, and the 'restore' command alone is ambiguous. Option D is wrong because manually recreating the policy on the FortiGate is error-prone, does not leverage FortiManager's revision history, and may not match the exact previous configuration, especially if other changes occurred.

Full explanation →

396

MCQmedium

An administrator configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. After configuration, traffic from VDOM-A cannot reach VDOM-B. Which configuration step is MOST likely missing?

A.Create a firewall policy on VDOM-A and VDOM-B allowing traffic over the VDOM link interface

B.Enable 'inter-vdom-routing' under system settings

C.Configure a static route on VDOM-A pointing to VDOM-B's subnet via the VDOM link

D.Assign both VDOM link interfaces to the same VDOM

AnswerA

Each VDOM must have a policy allowing traffic to/from the VDOM link interface, similar to any other interface.

Why this answer

VDOM links are special inter-VDOM interfaces that require firewall policies on both VDOMs to permit traffic. Without a policy on VDOM-A and VDOM-B that allows traffic over the VDOM link interface, packets will be dropped by the implicit deny rule. This is the most common missing step when inter-VDOM routing fails.

Exam trap

The trap here is that candidates often assume static routes or a global inter-VDOM routing toggle are required, overlooking that VDOM links function like physical interfaces and need firewall policies to permit traffic.

How to eliminate wrong answers

Option B is wrong because 'inter-vdom-routing' is not a configurable setting under system settings; inter-VDOM routing is inherently enabled when VDOMs are enabled and a VDOM link is created. Option C is wrong because static routes are not strictly required if the VDOM link is used as a transit link and the destination subnet is directly connected; the missing firewall policy is the primary issue. Option D is wrong because assigning both VDOM link interfaces to the same VDOM would defeat the purpose of inter-VDOM routing, as the link is designed to connect two different VDOMs.

Full explanation →

397

Multi-Selectmedium

Which TWO features are part of FortiGate's Advanced Threat Protection (ATP) suite?

Select 2 answers

A.Data Leak Prevention (DLP)

B.SSL Inspection

C.FortiGuard Antivirus

D.FortiSandbox

E.Intrusion Prevention System (IPS)

AnswersC, D

Part of ATP for malware detection.

Why this answer

FortiGate's Advanced Threat Protection (ATP) suite is designed to detect and block advanced, unknown, and zero-day threats. FortiGuard Antivirus (C) is a core ATP component that uses signature-based and heuristics-based scanning to detect known malware at the gateway. FortiSandbox (D) extends this by detonating suspicious files in a virtual environment to identify unknown threats, making both integral to the ATP suite.

Exam trap

The trap here is that candidates often confuse core security functions (like IPS or DLP) with the specific ATP suite components, which are explicitly defined by Fortinet as FortiGuard Antivirus and FortiSandbox for advanced threat detection.

Full explanation →

398

MCQeasy

What is the maximum number of VDOMs supported on a FortiGate 600F (assuming license)?

A.10

B.50

C.500

D.100

AnswerC

FortiGate 600F supports up to 500 VDOMs with license.

Why this answer

The FortiGate 600F, when properly licensed, supports up to 500 VDOMs. This is because the 600F is a mid-range enterprise appliance designed for large-scale multi-tenant environments, and its hardware resources (CPU, memory, and NP7 processors) are provisioned to handle the control-plane and data-plane overhead of up to 500 virtual domains. The license unlocks the VDOM feature, but the maximum count is a hardware-imposed limit, not a software cap.

Exam trap

The trap here is that candidates often confuse the default unlicensed limit (10 VDOMs) with the licensed maximum, or they assume the 600F shares the same VDOM limit as the 400F (100 VDOMs), failing to recognize that the 600F is a higher-spec model with a 500-VDOM ceiling.

How to eliminate wrong answers

Option A (10) is wrong because 10 VDOMs is the default unlicensed limit on many FortiGate models, but the 600F with a license supports far more. Option B (50) is wrong because 50 VDOMs is the maximum for lower-end models like the FortiGate 100F/200F, not the 600F. Option D (100) is wrong because 100 VDOMs is the limit for some mid-range models (e.g., FortiGate 400F), but the 600F is a higher-tier platform with a maximum of 500 VDOMs.

Full explanation →

399

MCQhard

You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?

A.The session is in SYN_SENT state and cannot be established

B.The session is an established TCP session with about one hour remaining before timeout

C.The session is a UDP session using port 443

D.The session has a duration of 3600 seconds and will expire immediately

AnswerB

Established TCP session (state 01), duration 3600s, expire 3599s (about 1 hour).

Why this answer

The output shows a TCP session (proto=6) with state 01, which in Fortinet's session table indicates an established TCP connection. The duration of 3600 seconds and expire value of 3599 seconds mean the session has been active for about one hour and has approximately one hour remaining before the idle timeout expires. This matches option B.

Exam trap

The trap here is that candidates often confuse the proto_state value 01 with SYN_SENT (which is 02) or assume the expire field indicates total session lifetime rather than remaining idle timeout.

How to eliminate wrong answers

Option A is wrong because proto_state=01 indicates an established TCP session, not SYN_SENT; SYN_SENT would be state 02. Option C is wrong because proto=6 is TCP, not UDP (UDP uses proto=17). Option D is wrong because expire=3599 means the session will expire in about 3599 seconds, not immediately; immediate expiry would show expire=0 or a very small value.

Full explanation →

400

Multi-Selecteasy

An administrator is troubleshooting a VPN tunnel that fails to establish. The administrator has verified that pre-shared keys match and phase 1 parameters are correct. Which TWO additional items should be checked?

Select 2 answers

A.NAT traversal configuration

B.Firewall policies allowing UDP 500 and 4500

C.The phase 2 proposal

D.The NTP server configuration

E.The FortiGate's hostname

AnswersA, B

Why this answer

NAT traversal (NAT-T) is required when a VPN tunnel passes through a device performing Network Address Translation (NAT). NAT-T encapsulates ESP packets inside UDP 4500 to avoid issues with NAT modifying IP headers. Even if phase 1 parameters match, without NAT-T enabled on both peers, the tunnel may fail to establish if a NAT device is detected between them.

Exam trap

The trap here is that candidates often assume phase 2 parameters must be checked first, but the question specifies the tunnel fails to establish, meaning phase 1 has not completed, so phase 2 is irrelevant at this stage.

Full explanation →

401

MCQmedium

An administrator connects a FortiExtender to the FortiGate's USB port. The FortiGate detects the FortiExtender and creates a virtual interface 'wwan1'. However, the link status shows 'down'. The SIM card is inserted and the cellular plan is active. What should the administrator check?

A.The APN settings are not configured under the FortiExtender interface

B.The FortiGate needs a security policy allowing traffic from wwan1

C.The FortiExtender firmware is not compatible with the FortiGate

D.The FortiExtender is not powered on

AnswerA

APN is required for cellular connectivity; without it, the link stays down.

Why this answer

The link status of the wwan1 interface remains 'down' because the FortiExtender requires the Access Point Name (APN) to be configured to establish a cellular data connection. Without the correct APN, the modem cannot attach to the mobile network, even with an active SIM card and power. The APN is configured under the FortiExtender interface settings on the FortiGate, not on the FortiExtender itself.

Exam trap

The trap here is that candidates often assume a detected device with an active SIM and power should automatically show a link-up status, overlooking the mandatory APN configuration required for cellular network attachment.

How to eliminate wrong answers

Option B is wrong because a security policy is only required for traffic forwarding, not for bringing the wwan1 link up; the link status is independent of firewall rules. Option C is wrong because firmware incompatibility would typically prevent detection or cause errors, but the FortiGate has already detected the FortiExtender and created the wwan1 interface, indicating basic compatibility. Option D is wrong because the FortiExtender is powered via the USB port from the FortiGate, and if it were not powered on, the FortiGate would not detect it or create the wwan1 interface.

Full explanation →

402

MCQmedium

An organization wants to prevent zero-day attacks by using Content Disarm and Reconstruction (CDR) on email attachments. Which Fortinet product provides this capability?

A.FortiWeb

B.FortiGate

C.FortiMail

D.FortiSandbox

AnswerC

FortiMail provides email security including CDR.

Why this answer

FortiMail is the correct answer because it natively integrates Content Disarm and Reconstruction (CDR) to sanitize email attachments by removing active content (e.g., macros, scripts, embedded objects) and rebuilding the file in a safe format. This prevents zero-day exploits that bypass signature-based detection, as CDR does not rely on threat intelligence but instead strips potentially malicious elements before delivery.

Exam trap

The trap here is that candidates often confuse FortiSandbox's dynamic analysis with CDR, assuming both provide proactive protection against zero-days, but FortiSandbox requires execution and detection, whereas CDR prevents exploitation by removing the attack surface entirely without relying on signatures or behavioral analysis.

How to eliminate wrong answers

Option A is wrong because FortiWeb is a web application firewall (WAF) that protects web servers from HTTP/HTTPS attacks (e.g., SQL injection, XSS) and does not process email attachments or provide CDR functionality. Option B is wrong because FortiGate is a next-generation firewall (NGFW) that can perform antivirus and sandboxing for traffic passing through it, but it does not include native CDR for email attachments; CDR is a feature specific to FortiMail's email security pipeline. Option D is wrong because FortiSandbox is a separate advanced threat detection appliance that uses dynamic analysis (e.g., detonating files in a sandbox) to identify unknown malware, but it does not perform CDR; CDR proactively disarms attachments without execution, whereas FortiSandbox relies on behavioral analysis after execution.

Full explanation →

403

MCQmedium

An administrator is configuring SD-WAN on a FortiGate. They want traffic from the internal network to a specific SaaS application to use the MPLS link unless the latency exceeds 50 ms, in which case traffic should failover to the broadband link. Which configuration elements are required?

A.Configure policy-based routing to direct SaaS traffic to the MPLS link and rely on default routing for failover.

B.Add a static route for the SaaS IP with the MPLS interface as the gateway and a higher distance than the default route via broadband.

C.Create an SD-WAN member for each link, configure a performance SLA with jitter threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic using the 'best-quality' strategy with the MPLS member.

D.Create an SD-WAN member for each link, configure a performance SLA with latency threshold 50 ms, and add an SD-WAN rule matching the SaaS traffic with the MPLS member as preferred and enable 'set failover enable'.

AnswerD

This correctly defines members, an SLA to measure latency, and a rule that uses the MPLS link with failover to the broadband when the SLA is not met.

Why this answer

It uses SD-WAN members for each link, a performance SLA with a latency threshold of 50 ms to monitor link quality, and an SD-WAN rule that matches SaaS traffic with the MPLS member as preferred and failover enabled. This configuration ensures that traffic uses the MPLS link as long as latency stays below 50 ms, and automatically fails over to the broadband link when the SLA is violated.

Exam trap

The trap here is that candidates often confuse jitter and latency thresholds or think that a static route with a higher distance can provide dynamic failover, but FortiGate SD-WAN requires explicit SLA monitoring and failover enablement to react to latency degradation.

How to eliminate wrong answers

Option A is wrong because policy-based routing does not support dynamic failover based on real-time latency; it is static and cannot react to SLA violations. Option B is wrong because using a static route with a higher distance for the MPLS link would make the broadband link the primary path (lower distance), contradicting the requirement to prefer MPLS; also, static routes cannot trigger failover based on latency thresholds. Option C is wrong because it specifies a jitter threshold of 50 ms, but the requirement is to failover based on latency exceeding 50 ms, not jitter; the 'best-quality' strategy selects the best link based on multiple metrics but does not enforce a preferred link with failover behavior.

Full explanation →

404

MCQmedium

A network administrator runs the command 'diagnose debug application ssl -1' and sees the following output: 'ssl_generate_proxy_cert: cannot find CA certificate for issuer CN=www.example.com'. What is the MOST likely cause?

A.The FortiGate does not have an internet connection to reach the CA certificate authority

B.The firewall policy does not have SSL inspection enabled

C.The web server's certificate has expired

D.The SSL/SSH inspection profile is configured with an incorrect CA certificate

AnswerD

If the CA certificate used to sign proxy certificates is missing or invalid, FortiGate cannot generate a new certificate for the inspected site.

Why this answer

The error 'cannot find CA certificate for issuer CN=www.example.com' indicates that the FortiGate's SSL/SSH inspection profile is configured to use a specific CA certificate to re-sign the web server's certificate, but that CA certificate is not present in the FortiGate's certificate store. This occurs when the inspection profile references a CA certificate that has been deleted, not imported, or misconfigured, preventing the generation of a proxy certificate for SSL inspection.

Exam trap

Fortinet often tests the misconception that SSL inspection errors are caused by network connectivity issues or certificate expiry, but the specific error about a missing CA certificate points directly to a misconfiguration in the inspection profile's certificate settings.

How to eliminate wrong answers

Option A is wrong because the FortiGate does not need an internet connection to reach a CA certificate authority; the CA certificate used for SSL inspection is locally stored on the FortiGate, not fetched from an external CA. Option B is wrong because if the firewall policy did not have SSL inspection enabled, the debug output would not show an attempt to generate a proxy certificate; the error specifically arises during the SSL inspection process, which requires the feature to be enabled. Option C is wrong because an expired web server certificate would cause a different error, such as 'certificate has expired' or a TLS handshake failure, not a missing CA certificate for re-signing.

Full explanation →

405

MCQmedium

An administrator notices that after making changes to a policy package in FortiManager, the 'Install Preview' shows that the changes will modify policies on a FortiGate. However, the admin wants to verify what the exact changes will be before installing. What should the admin do?

A.Check the 'Audit Log' for recent changes

B.Run 'diagnose dvm device list' on FortiManager

C.Use the 'Revision History' to compare the current configuration with the previous version

D.Use the 'Install Preview' and then click 'View Details' on each device

AnswerC

Revision history allows comparing configurations to see exact changes.

Why this answer

The Revision History feature in FortiManager allows an administrator to compare the current configuration of a policy package with a previous version, showing a detailed diff of exactly which policies will be added, removed, or modified. This provides a precise verification of changes before installation, unlike the Install Preview which only indicates that changes exist without showing the specific modifications.

Exam trap

The trap here is that candidates confuse the Install Preview's summary of changes (which only indicates that modifications exist) with the detailed comparison provided by Revision History, leading them to select Option D without realizing it lacks the granular diff needed to verify exact policy changes.

How to eliminate wrong answers

Option A is wrong because the Audit Log records administrative actions (e.g., who made changes and when) but does not show a side-by-side comparison of policy configurations or the exact modifications to individual policies. Option B is wrong because 'diagnose dvm device list' is a diagnostic command used to display the list of managed devices and their synchronization status, not to compare policy changes. Option D is wrong because the Install Preview's 'View Details' option only shows a summary of which objects will be installed (e.g., policy count changes) but does not provide a granular diff of the actual policy lines or attributes that will be modified.

Full explanation →

406

MCQmedium

An administrator has configured a FortiGate HA cluster with two units. The cluster uses a virtual cluster for load balancing in active-active mode. The administrator notices that traffic from one VDOM is not being load-balanced and is only handled by one unit. What is the most likely cause?

A.Session pickup is disabled

B.The HA priority is set to 0 on the secondary unit

C.The VDOM is not assigned to any virtual cluster

D.The management interface is not configured on the VDOM

AnswerC

VDOMs must be assigned to a virtual cluster for load balancing.

Why this answer

In an active-active HA cluster with virtual clusters, each VDOM must be explicitly assigned to a virtual cluster to participate in load balancing. If a VDOM is not assigned to any virtual cluster, it defaults to being handled only by the primary unit, regardless of the cluster mode. This explains why traffic from that VDOM is not load-balanced.

Exam trap

The trap here is that candidates often assume active-active mode automatically load-balances all traffic across both units, overlooking the requirement that each VDOM must be explicitly assigned to a virtual cluster to enable load balancing for that VDOM.

How to eliminate wrong answers

Option A is wrong because session pickup is a feature for synchronizing existing sessions after failover, not a prerequisite for load balancing traffic across units in active-active mode. Option B is wrong because setting HA priority to 0 on the secondary unit would make it a standby unit, but the question states the cluster is in active-active mode, where both units should actively forward traffic; priority 0 would prevent load balancing entirely, not just for one VDOM. Option D is wrong because the management interface configuration is unrelated to VDOM traffic forwarding or load balancing; it only affects administrative access to the VDOM.

Full explanation →

407

MCQeasy

Which FortiManager feature allows an administrator to roll back a policy package to a previous version?

A.Install preview

B.Revision history

C.Device manager

D.Automation stitch

AnswerB

Revision history allows an administrator to view and restore previous versions of policy packages or device configurations.

Why this answer

Revision history stores previous versions of policy packages, allowing an administrator to roll back to a previous version. Install preview (A) shows pending changes but does not provide rollback capability. Device manager (C) manages devices, not policy versioning.

Automation stitch (D) automates tasks but does not handle policy rollback.

Full explanation →

408

MCQmedium

A company with a hub-and-spoke SD-WAN topology uses FortiGates at each site. The hub has two WAN links: MPLS (10 Mbps) and broadband (100 Mbps). The spokes connect only via MPLS. The company deploys a new real-time application that requires low latency and low jitter. The network administrator creates an SD-WAN rule for this application with 'best quality' strategy and both MPLS and broadband as members. The SLA for MPLS is configured with latency < 10 ms and jitter < 5 ms. The SLA for broadband is configured with latency < 50 ms and jitter < 20 ms. The actual measured latency on MPLS is 12 ms, and jitter is 4 ms. The broadband latency is 25 ms, jitter 10 ms. Which path will the application traffic take?

A.The traffic will use the broadband link because MPLS SLA fails and broadband SLA is met.

B.The traffic will be load-balanced between MPLS and broadband.

C.The traffic will use the MPLS link because it is the preferred member.

D.The traffic will be dropped because no link meets the SLA.

AnswerA

SD-WAN failover to broadband.

Why this answer

The SD-WAN rule uses the 'best quality' strategy, which selects the member with the best SLA performance. The MPLS link fails its SLA because its measured latency of 12 ms exceeds the configured threshold of 10 ms, even though jitter is within limits. The broadband link meets both its latency (25 ms < 50 ms) and jitter (10 ms < 20 ms) thresholds, so it becomes the active path for the application traffic.

Exam trap

The trap here is that candidates assume MPLS is always preferred due to its lower latency profile, but the 'best quality' strategy strictly enforces SLA thresholds, and a link that fails its SLA is excluded from selection regardless of its absolute performance.

How to eliminate wrong answers

Option B is wrong because 'best quality' strategy does not perform load-balancing; it selects a single best path based on SLA compliance and performance metrics. Option C is wrong because MPLS is not inherently preferred; the rule treats both members equally, and MPLS is disqualified due to SLA failure. Option D is wrong because the broadband link meets its SLA thresholds, so traffic is not dropped.

Full explanation →

409

MCQeasy

An administrator wants to enforce that only devices with antivirus software installed and running can access a sensitive application via ZTNA. Which ZTNA feature should be used to verify this requirement?

A.ZTNA inline CASB

B.NAC with FortiNAC

C.ZTNA tags with device posture checks

D.IPsec VPN with DPD

AnswerC

ZTNA tags can contain posture attributes like antivirus status. The FortiGate can check these tags in the access proxy rule to grant or deny access.

Why this answer

ZTNA uses tags to indicate device posture. The FortiGate or FortiClient EMS can check for antivirus status and include that information in the device's posture tag. The ZTNA access proxy rule can then require that tag for access.

Full explanation →

410

MCQhard

A FortiGate is configured with an IPS sensor that has protocol anomaly detection enabled. The admin notices that legitimate VoIP traffic (SIP) is being blocked. Which action should the admin take to reduce false positives?

A.Change the IPS action from block to monitor

B.Add the VoIP servers to an IP exemption list in the IPS sensor

C.Disable protocol anomaly detection entirely

D.Tune the protocol anomaly thresholds to be more lenient for SIP

AnswerD

Tuning thresholds reduces false positives while maintaining security.

Why this answer

Protocol anomaly detection in IPS sensors uses predefined thresholds to identify abnormal traffic patterns. When legitimate SIP traffic is being blocked, tuning the protocol anomaly thresholds to be more lenient for SIP allows the sensor to accommodate normal variations in SIP behavior without triggering false positives, while still maintaining protection against actual anomalies.

Exam trap

The trap here is that candidates may think disabling or bypassing detection (options A, B, or C) is the simplest fix, but the exam tests the understanding that protocol anomaly detection should be tuned rather than disabled to preserve security while reducing false positives.

How to eliminate wrong answers

Option A is wrong because changing the IPS action from block to monitor would stop blocking but also disable protection, which is not a targeted fix for false positives and leaves the network vulnerable to real threats. Option B is wrong because adding VoIP servers to an IP exemption list would bypass all IPS inspection for those IPs, which is overly broad and could allow actual attacks to go undetected. Option C is wrong because disabling protocol anomaly detection entirely removes a valuable security layer and is an extreme measure that does not address the root cause of false positives.

Full explanation →

411

Multi-Selectmedium

A company uses FortiManager to manage multiple FortiGates. The admin wants to use a global ADOM to manage certain policies across all devices while allowing local customization. Which two statements about global ADOM are true? (Choose two.)

Select 2 answers

A.Header/footer policies can only be configured in the global ADOM

B.Global ADOM supports per-device policy objects

C.Regular ADOMs can import policy packages from the global ADOM

D.Global ADOM requires a separate FortiManager license

E.Global ADOM policies are installed on all managed FortiGates in all ADOMs

AnswersA, C

Header and footer policies are typically defined in the global ADOM to enforce consistent security baselines.

Why this answer

Header and footer policies are global constructs that can only be created and managed within the global ADOM. These policies are automatically applied to all policy packages across all regular ADOMs, ensuring consistent enforcement at the top and bottom of the policy list without local modification.

Exam trap

The trap here is that candidates often assume global ADOM policies are automatically installed on all devices, but in reality they only apply to policy packages that are explicitly imported from the global ADOM into a regular ADOM.

Full explanation →

412

MCQmedium

A network admin configures inter-VDOM routing between two VDOMs on a FortiGate. The admin creates a firewall policy in VDOM A allowing traffic to VDOM B, but traffic is still not passing. What additional step is required?

A.Configure a static route in VDOM B pointing back to VDOM A

B.Enable inter-VDOM routing under config system global

C.Assign the inter-VDOM link to both VDOMs

D.Create a firewall policy in VDOM B to permit the traffic from VDOM A

AnswerD

Inter-VDOM traffic requires policies on both VDOMs to allow the session. Without the return policy, the session is blocked.

Why this answer

Inter-VDOM routing on a FortiGate requires firewall policies in both VDOMs to permit traffic in both directions. Even if VDOM A has a policy allowing traffic to VDOM B, VDOM B must have a corresponding policy to allow the return traffic or the initial traffic from VDOM A to be processed. Without this, the FortiGate drops the packets due to asymmetric policy enforcement.

Exam trap

The trap here is that candidates assume a single firewall policy in the source VDOM is sufficient, but FortiGate requires policies in both VDOMs for inter-VDOM traffic to pass, mirroring the behavior of separate physical firewalls.

How to eliminate wrong answers

Option A is wrong because static routes are not inherently required for inter-VDOM routing; the inter-VDOM link is a direct connection, and routing is handled automatically if the link is configured correctly. Option B is wrong because inter-VDOM routing is enabled by default on FortiGate and does not require a global command; the relevant setting is 'set inter-vdom-routing enable' under config system global, but it is already enabled by default. Option C is wrong because the inter-VDOM link is automatically assigned to both VDOMs when created; no additional assignment step is needed.

Full explanation →

413

Multi-Selectmedium

A security analyst wants to use automation stitches on FortiGate to automatically block an IP address when a critical severity event is logged. Which TWO components are essential to create this automation stitch? (Choose two.)

Select 2 answers

A.A FortiGuard subscription

B.A FortiAnalyzer to store logs

C.An action that adds the source IP to a firewall address group

D.A static route to the internet

E.A trigger that matches critical severity logs

AnswersC, E

The action defines the response, such as blocking the IP.

Why this answer

An automation stitch in FortiGate requires an action to execute a specific task, such as adding a source IP to a firewall address group, which effectively blocks the IP. This action is essential for enforcing the security response triggered by the stitch.

Exam trap

The trap here is that candidates often confuse optional components (like FortiGuard or FortiAnalyzer) with essential ones, mistakenly thinking external services or connectivity are required for the stitch's core trigger and action logic.

Full explanation →

414

MCQeasy

A FortiGate administrator wants to check if the device is experiencing high CPU usage due to a specific process. Which command should they use to display real-time process CPU usage?

A.show system resource

B.diagnose sys top

C.get system performance status

D.diagnose debug application crashlog read

AnswerB

Shows real-time process list with CPU usage.

Why this answer

The 'diagnose sys top' command provides a real-time, top-like view of FortiGate processes, showing CPU and memory usage per process. This allows the administrator to identify which specific process is consuming high CPU, making it the correct choice for this diagnostic task.

Exam trap

The trap here is that candidates often confuse 'show system resource' (overall stats) with per-process diagnostics, or they mistakenly think 'get system performance status' provides process-level detail, when it only shows aggregate performance metrics.

How to eliminate wrong answers

Option A is wrong because 'show system resource' displays overall system resource usage (CPU, memory, disk) but does not break down usage by individual process. Option C is wrong because 'get system performance status' shows aggregate performance statistics (e.g., sessions, CPU load average) without per-process detail. Option D is wrong because 'diagnose debug application crashlog read' is used to read crash logs for debugging crashes, not for monitoring real-time process CPU usage.

Full explanation →

415

MCQmedium

A FortiGate administrator configures SAML SSO with FortiGate as the Identity Provider (IdP). Users are redirected to the FortiGate login page, but after successful authentication, they are not redirected back to the service provider. What is a likely cause?

A.SAML authentication timeout is too short

B.The assertion consumer service URL is misconfigured on the FortiGate

C.The ACS URL on the service provider does not match the FortiGate's SAML settings

D.The SP certificate is not imported on the FortiGate

AnswerB

Why this answer

When FortiGate is the IdP, it must have the correct Assertion Consumer Service (ACS) URL to which the SAML response is sent after authentication. A mismatch prevents the redirect back to the SP.

Full explanation →

416

MCQmedium

An administrator needs to deploy a honeypot solution to detect and deceive attackers inside the network. Which Fortinet product is BEST suited for this purpose?

A.FortiDeceptor

B.FortiSandbox

C.FortiEDR

D.FortiNAC

AnswerA

FortiDeceptor provides honeypots and decoys to detect lateral movement.

Why this answer

FortiDeceptor is a dedicated deception-based security solution that deploys decoys (honeypots) and lures across the network to detect and misdirect attackers. It integrates with FortiGate and FortiSIEM to provide automated threat isolation and forensic data collection, making it the best choice for a honeypot deployment.

Exam trap

The trap here is that candidates may confuse FortiSandbox's file analysis with deception technology, but FortiSandbox does not deploy decoys or lures within the network for attacker interaction.

How to eliminate wrong answers

Option B (FortiSandbox) is wrong because it focuses on analyzing suspicious files and URLs in a sandboxed environment, not on deploying honeypots or decoys for attacker deception. Option C (FortiEDR) is wrong because it provides endpoint detection and response capabilities, including behavioral analysis and threat hunting, but does not include honeypot or deception technology. Option D (FortiNAC) is wrong because it is a network access control solution that manages device authentication and compliance, not a deception-based detection tool.

Full explanation →

417

Multi-Selecthard

An administrator is configuring a hub-and-spoke ADVPN with IBGP as the overlay routing protocol. The hub is configured as a route reflector. Which two conditions must be met for a shortcut tunnel to be established between two spokes? (Choose TWO)

Select 2 answers

A.The hub must have a route to the spoke's subnet via the IPsec tunnel

B.The spokes must use overlapping IPsec proposal sets

C.The hub must have 'set auto-discovery-shortcut-mode both'

D.The spokes must be in the same VDOM

E.The spokes must have 'set auto-discovery-shortcut-mode client' enabled

AnswersA, E

The hub needs to have the route in its routing table to advertise to other spokes.

Why this answer

For shortcut tunnels to establish, the hub must send a shortcut offer to the spokes. This requires that the hub learns the route from one spoke via IBGP and reflects it to the other spoke. The spoke must also have auto-discovery-shortcut-mode enabled to accept the shortcut.

Additionally, the spokes must be able to communicate directly (no NAT between them).

Full explanation →

418

Multi-Selecthard

A security administrator wants to implement automated threat response using FortiGate automation stitches. Which THREE components are mandatory when creating an automation stitch? (Choose three.)

Select 3 answers

A.Schedule (e.g., daily at midnight)

B.Stitch name

C.Action (e.g., 'CLI Script', 'Add IP to Blocklist')

D.Trigger (e.g., 'Event Log' or 'FortiOS CLI')

E.Condition (e.g., filter on event type)

AnswersC, D, E

What happens when the stitch fires.

Why this answer

An automation stitch requires at least one action to execute when triggered. Actions define the actual response, such as running a CLI script, adding an IP to a blocklist, or sending an email. Without an action, the stitch would have no effect on the network.

Exam trap

The trap here is that candidates often confuse 'mandatory components' with 'required fields in the GUI' — the stitch name is a required field in the GUI but is not a functional component of the automation logic, while the condition is often overlooked as optional but is considered mandatory in the NSE7 exam because it is essential for practical threat response filtering.

Full explanation →

419

Multi-Selectmedium

A company has two FortiGate devices at different sites connected via an IPsec VPN tunnel using IKEv2. The tunnel is established but intermittent packet loss is observed. Which two configuration changes should be applied to improve stability? (Choose two.)

Select 2 answers

A.Reduce the DPD retry interval to 3 seconds.

B.Increase the phase1 lifetime to 86400 seconds.

C.Change the IKE version to IKEv1.

D.Increase the phase2 rekey time to 8 hours.

E.Enable Dead Peer Detection (DPD) on the tunnel interface.

AnswersD, E

Longer rekey intervals reduce the frequency of rekeying, which can disrupt traffic.

Why this answer

Intermittent packet loss during stable VPN tunnels is often caused by frequent rekey events or DPD misconfiguration. Option D (increase phase2 rekey time to 8 hours) reduces the frequency of rekeying, minimizing packet loss during key regeneration. Option E (enable Dead Peer Detection on the tunnel interface) allows the FortiGate to detect peer failures more reliably without aggressive settings.

Option A (reduce DPD retry interval to 3 seconds) is too aggressive and can cause flapping on lossy links. Option B (increase phase1 lifetime) does not address the packet loss issue, as phase1 rekeying is less frequent. Option C (change to IKEv1) would reduce stability since IKEv2 is more robust and supports faster rekeying.

Exam trap

The trap here is that candidates often think reducing DPD intervals or increasing lifetimes always improves stability, but in reality, aggressive DPD can cause flapping on lossy links, and IKEv2 is inherently more stable than IKEv1 for VPN tunnels.

Full explanation →

420

Drag & Dropmedium

Drag and drop the steps to troubleshoot a FortiGate SSL VPN connection failure into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Start with basic configuration, then user authentication, then policies, then debug, then routing.

Full explanation →

421

MCQeasy

In FortiGate's ZTNA, what is the purpose of a 'ZTNA tag'?

A.To identify a device's compliance status and attributes for policy enforcement.

B.To mark packets for quality of service (QoS) prioritization.

C.To label network interfaces for traffic steering.

D.To assign a security level to application traffic.

AnswerA

Why this answer

ZTNA tags are dynamic attributes (e.g., OS type, antivirus status) assigned to devices based on posture checks. They are used in firewall policies to grant access based on device compliance, not for routing or QoS.

Full explanation →

422

Multi-Selecthard

An administrator uses FortiManager automation stitches to respond to an incident. The stitch includes a trigger, one or more actions, and conditions. Which THREE components are valid action types in an automation stitch?

Select 3 answers

A.CLI script execution

B.Remote script execution

C.FortiGate reboot

D.Email notification

E.FortiAnalyzer report generation

AnswersA, B, D

CLI scripts can be run on managed devices.

Why this answer

CLI script execution is a valid action type in FortiManager automation stitches because it allows the administrator to run a predefined CLI script on a managed FortiGate device directly from the stitch. This enables automated configuration changes or troubleshooting commands in response to a trigger, such as blocking an IP address after an intrusion detection event.

Exam trap

The trap here is that candidates may confuse 'remote script execution' with local device actions like reboot, or assume FortiAnalyzer integration is an action type, when in fact automation stitches only support CLI scripts, remote scripts, and email notifications as valid action types.

Full explanation →

423

MCQeasy

What is the purpose of a Global ADOM in FortiManager?

A.To store backup configurations only

B.To manage all FortiGates in a single VDOM

C.To share common objects and policies across multiple ADOMs

D.To replace the root ADOM for system settings

AnswerC

Global ADOM allows sharing of objects like address objects, services, and policies across ADOMs.

Why this answer

A Global ADOM in FortiManager is a special administrative domain that stores objects and policies shared across multiple regular ADOMs. This allows administrators to define common objects (e.g., address groups, services, schedules) once in the Global ADOM and then reference them in per-ADOM policies, ensuring consistency and reducing duplication. It does not replace the root ADOM, nor is it limited to backups or single-VDOM management.

Exam trap

The trap here is that candidates often confuse the Global ADOM with the root ADOM or think it is for backup purposes, when in fact it is specifically designed for sharing objects and policies across multiple ADOMs to enforce consistency in multi-tenant or multi-region deployments.

How to eliminate wrong answers

Option A is wrong because the Global ADOM is not for storing backup configurations; backups are handled separately via the system backup feature or the CLI. Option B is wrong because the Global ADOM does not manage all FortiGates in a single VDOM; it manages shared objects across multiple ADOMs, each of which can contain multiple VDOMs. Option D is wrong because the Global ADOM does not replace the root ADOM for system settings; the root ADOM remains the administrative domain for system-level configuration (e.g., system admin, HA, firmware), while the Global ADOM focuses on shared policy objects.

Full explanation →

424

Multi-Selectmedium

A network administrator is troubleshooting a scenario where remote users can connect via FortiClient VPN but cannot access internal resources. The FortiGate has a valid IPsec VPN configuration. Which THREE checks should the administrator perform to resolve the issue?

Select 3 answers

A.Check if there is a route on the internal network pointing back to the VPN subnet

B.Ensure that NAT is disabled on the VPN policy

C.Increase the MTU on the VPN interface

D.Disable DPD on the VPN phase 1

E.Verify that the firewall policy allows traffic from the VPN IP pool to the internal network

AnswersA, B, E

Without a return route, responses can't reach the VPN clients.

Why this answer

If the internal network lacks a route back to the VPN subnet (e.g., 10.10.10.0/24), return traffic from internal resources will be dropped or misrouted, preventing remote users from accessing those resources even though the IPsec tunnel is established. This is a classic asymmetric routing issue where the FortiGate sends traffic to the internal network, but the internal router has no path back to the VPN client IPs.

Exam trap

The trap here is that candidates often focus on tunnel-level settings like MTU or DPD when the real issue is a missing return route or firewall policy, which are common misconfigurations in IPsec VPN deployments.

Full explanation →

425

MCQmedium

A FortiGate administrator sees the following output: "diagnose sys session filter dport 443 diagnose sys session list session info: proto=6 proto_state=01 duration=3600 expire=3599" What does this session duration and expire time indicate?

A.The session has a timeout of 7200 seconds (2 hours)

B.The session is about to be torn down

C.The session is newly established

D.The session is using UDP protocol

AnswerA

Duration + expire = total timeout, 3600+3599=7199~7200.

Why this answer

The session duration of 3600 seconds and expire time of 3599 seconds indicate that the session has been active for 3600 seconds and has 3599 seconds remaining before timeout. Since the total timeout is the sum of duration and expire time (3600 + 3599 = 7199, approximately 7200 seconds), this matches the default TCP session timeout of 7200 seconds (2 hours) on FortiGate. The 'proto_state=01' confirms a TCP session in established state, and the output shows the session is still valid with a long remaining lifetime.

Exam trap

The trap here is that candidates often misinterpret 'duration' and 'expire' as independent values rather than recognizing that their sum equals the total session timeout, leading them to incorrectly assume the session is about to expire or is newly established.

How to eliminate wrong answers

Option B is wrong because the expire time of 3599 seconds is very large, indicating the session is far from being torn down; a session about to be torn down would have an expire time near 0. Option C is wrong because the duration of 3600 seconds shows the session has been active for an hour, not newly established; a newly established session would have a duration near 0. Option D is wrong because 'proto=6' explicitly indicates TCP (protocol 6), not UDP (protocol 17), and the 'proto_state=01' is a TCP state flag.

Full explanation →

426

MCQeasy

A network engineer is configuring a FortiGate HA cluster with two FortiGate 100F units in active-passive mode. The engineer wants to use VDOMs to separate guest and corporate traffic. After initial setup, the engineer configures two VDOMs: 'guest' and 'corp'. Both VDOMs have interfaces assigned. The HA status shows 'synchronized'. However, the engineer notices that traffic from the corporate network is not being forwarded correctly. Pings from the corporate LAN to the internet fail. The guest network works fine. The engineer checks the routing table on the active unit and sees that the default route is present in the 'corp' VDOM. What is the most likely cause of the issue?

A.The interface assigned to the corp VDOM is administratively down.

B.The default route in the corp VDOM has an incorrect gateway IP address.

C.The HA cluster must be in active-active mode for VDOMs to work.

D.The VDOM link between the root VDOM and corp VDOM is not configured.

AnswerB

If the gateway IP is wrong, traffic will not be forwarded, even though the route is present in the routing table.

Why this answer

The most likely cause is an incorrect gateway IP address in the default route for the 'corp' VDOM. Since the guest VDOM works correctly, the HA cluster and VDOM configuration are functional, and the issue is isolated to the corporate VDOM's routing. A misconfigured next-hop IP would prevent traffic from reaching the internet, even though the route itself is present in the routing table.

Exam trap

The trap here is that candidates may assume the issue is with HA synchronization or VDOM links, but the fact that one VDOM works and the other does not points directly to a per-VDOM configuration error, such as an incorrect default route gateway.

How to eliminate wrong answers

Option A is wrong because if the interface were administratively down, the 'corp' VDOM would not have a working link, but the engineer would typically see the interface status as 'down' in the GUI or CLI, and the default route would not be relevant; the issue is specifically with forwarding, not interface state. Option C is wrong because VDOMs work in both active-passive and active-active HA modes; there is no requirement for active-active mode to use VDOMs. Option D is wrong because VDOM links are only needed for inter-VDOM routing, not for forwarding traffic from a VDOM to the internet; the 'corp' VDOM has its own interfaces and default route, so a VDOM link is not required for this scenario.

Full explanation →

427

MCQhard

A FortiGate has an SD-WAN configuration with two members (wan1, wan2). The performance SLA monitors latency to 8.8.8.8. The admin notices that even when the SLA is satisfied on both members, all traffic uses wan1. The SD-WAN rule is configured with 'strategy = best quality'. What is the most likely cause?

A.A firewall policy is overriding the SD-WAN rule

B.The best quality strategy selects the member with the best SLA metric, which is wan1 by default when both meet SLA

C.The performance SLA is incorrectly configured, causing wan2 to be ignored

D.The SD-WAN rule has 'set match-vip disable' which forces all traffic to wan1

AnswerB

Best quality uses a tie-breaking order; it does not load balance equally.

Why this answer

When the SD-WAN rule uses 'best quality' strategy and both members meet the performance SLA, FortiGate selects the member with the best (lowest) latency metric. By default, if both members have equal SLA satisfaction, the first member in the SD-WAN configuration (wan1) is chosen as the tie-breaker. This explains why all traffic uses wan1 even though both links are healthy.

Exam trap

The trap here is that candidates assume 'best quality' always selects the best-performing link, but they overlook the implicit tie-breaking rule that defaults to the first configured member when SLA metrics are equal.

How to eliminate wrong answers

Option A is wrong because firewall policies in FortiGate do not override SD-WAN rules; SD-WAN rules are evaluated before firewall policies, and traffic matching an SD-WAN rule is forwarded according to that rule. Option C is wrong because the performance SLA is correctly configured (monitoring 8.8.8.8) and both members satisfy it, so the issue is not misconfiguration but the tie-breaking behavior of 'best quality'. Option D is wrong because 'set match-vip disable' controls whether virtual IP (VIP) objects are matched in the SD-WAN rule, not which WAN member is selected; it has no effect on member selection.

Full explanation →

428

MCQmedium

An administrator is configuring a FortiGate in transparent mode for an enterprise network. The existing gateway firewall must remain in place. How should the administrator configure the FortiGate's interfaces to ensure minimal disruption?

A.Enable VDOMs and separate the interfaces into different VDOMs

B.Place both interfaces in the same VDOM and assign a shared management IP

C.Assign each interface a unique IP address on different subnets

D.Use 802.1Q trunking on a single physical interface

AnswerB

Transparent mode requires both interfaces to be in the same VDOM with a single management IP.

Why this answer

In transparent mode, FortiGate acts as a Layer 2 bridge, so both interfaces must belong to the same VDOM and share a single management IP to allow administrative access without breaking the Layer 2 path. This configuration ensures the existing gateway firewall remains in place and traffic flows uninterrupted, as the FortiGate does not perform routing between its interfaces.

Exam trap

The trap here is that candidates often assume transparent mode requires unique IPs on each interface (like in NAT/route mode), leading them to choose Option C, but in transparent mode all interfaces share a single management IP to maintain Layer 2 transparency.

How to eliminate wrong answers

Option A is wrong because enabling VDOMs and separating interfaces into different VDOMs would break the Layer 2 bridging required in transparent mode, causing traffic to be routed between VDOMs and disrupting the existing gateway firewall. Option C is wrong because assigning each interface a unique IP address on different subnets would force the FortiGate to route between them, which is incompatible with transparent mode's Layer 2 operation and would disrupt the existing network topology. Option D is wrong because 802.1Q trunking on a single physical interface is used for VLAN segmentation in NAT/route mode, not for transparent mode, and does not provide the required Layer 2 bridge between two separate interfaces.

Full explanation →

429

MCQmedium

You want to use policy-based routing (PBR) to send traffic from a specific subnet to a different next-hop than the default route. Which configuration is required?

A.Configure a route map under 'config router policy'

B.Create a firewall policy with 'set policy-based-route enable'

C.Enable 'set pbr-enforce-symmetric' on the interface

D.Configure a prefix list and apply to the static route

AnswerA

PBR uses route maps with set-next-hop in the policy route configuration.

Why this answer

Policy-based routing (PBR) on FortiGate is configured under 'config router policy' using route maps. This allows you to match traffic based on criteria such as source subnet and set a specific next-hop, overriding the default route. Option A correctly identifies the required configuration path for PBR.

Exam trap

The trap here is that candidates confuse PBR configuration with firewall policy settings or static route modifications, but FortiGate requires the explicit 'config router policy' and route map syntax to define policy-based routing rules.

How to eliminate wrong answers

Option B is wrong because 'set policy-based-route enable' is not a valid command; firewall policies use 'set action accept' and policy-based routing is applied via route maps, not a firewall policy toggle. Option C is wrong because 'set pbr-enforce-symmetric' is used to enforce symmetric routing for PBR traffic on an interface, but it is not the configuration required to define the PBR rule itself. Option D is wrong because a prefix list applied to a static route can influence route selection but does not implement PBR, which requires a route map under 'config router policy' to match and set next-hop.

Full explanation →

430

MCQmedium

A FortiGate administrator wants to use FortiManager to manage multiple FortiGates in different geographic regions. To isolate configuration changes, the administrator creates separate ADOMs for each region. Which type of ADOM should be used to allow some common objects (like address groups) to be shared across all regions?

A.Per-Device ADOM

B.Global ADOM

C.Regular ADOM

D.Meta ADOM

AnswerB

Correct. Global ADOM objects are available to all regular ADOMs.

Why this answer

The Global ADOM is designed to store and share common objects, such as address groups, policies, and schedules, across all ADOMs in a FortiManager deployment. When an administrator creates separate ADOMs for each region, the Global ADOM acts as a central repository for objects that need to be consistent everywhere, allowing per-region ADOMs to reference these shared objects without duplicating them. This ensures configuration isolation for region-specific settings while maintaining a single source of truth for global resources.

Exam trap

The trap here is that candidates often confuse 'Global ADOM' with 'Regular ADOM' or assume that a 'Per-Device ADOM' can be configured to share objects, when in fact only the Global ADOM provides a centralized, cross-ADOM object repository in FortiManager.

How to eliminate wrong answers

Option A is wrong because a Per-Device ADOM is used when each managed FortiGate requires its own independent ADOM with no sharing of objects, which defeats the purpose of sharing common objects across regions. Option C is wrong because a Regular ADOM (also called a per-ADOM ADOM) is the default type that isolates all objects within that ADOM and does not inherently support sharing objects with other ADOMs; it would require manual duplication or import/export to share objects. Option D is wrong because Meta ADOM is not a valid ADOM type in FortiManager; the correct term is 'Global ADOM' for cross-ADOM object sharing, and 'Meta ADOM' is a distractor that does not exist in the FortiManager architecture.

Full explanation →

431

MCQmedium

A FortiGate administrator needs to manage multiple FortiGate devices centrally. They want to deploy policy packages from FortiManager to specific VDOMs on each device. Which FortiManager object must be configured first?

A.Device Group

B.Install Preview

C.Policy Package

D.Administrative Domain (ADOM)

AnswerD

ADOMs provide the logical grouping for devices and VDOMs.

Why this answer

The Administrative Domain (ADOM) is the top-level container in FortiManager that defines the management boundary for a set of FortiGate devices and their VDOMs. Before you can create or assign policy packages to specific VDOMs on managed devices, you must first configure the ADOM to enable multi-tenancy and VDOM-level management. Without an ADOM, FortiManager cannot isolate or target individual VDOMs for policy deployment.

Exam trap

The trap here is that candidates often think a Policy Package (Option C) is the first object to configure, overlooking that FortiManager requires the ADOM to be set up first to establish the management scope and VDOM mapping before any policy package can be created or linked to a specific VDOM.

How to eliminate wrong answers

Option A is wrong because a Device Group is a logical grouping of FortiGate devices used for bulk operations or installation targets, but it does not provide the necessary VDOM-level isolation or management context required to deploy policy packages to specific VDOMs. Option B is wrong because Install Preview is a verification step that shows the changes to be installed after a policy package has been configured and assigned; it is not a prerequisite object. Option C is wrong because a Policy Package contains the firewall policies and objects, but it cannot be created or assigned to a specific VDOM until the ADOM is configured to define the management domain and enable VDOM-level policy targeting.

Full explanation →

432

MCQmedium

In a hub-and-spoke VPN, spokes cannot communicate with each other directly. The administrator wants to allow direct spoke-to-spoke traffic without routing through the hub. Which technology should be configured?

A.Static routes on spokes

B.IKEv1 with mode-config

C.GRE over IPsec

D.ADVPN with IKEv2

AnswerD

ADVPN uses IKEv2 to dynamically establish shortcut tunnels.

Why this answer

ADVPN (Auto Discovery VPN) enables shortcut tunnels between spokes after initial hub communication, allowing direct traffic.

Full explanation →

433

MCQhard

An administrator configures an automation stitch in FortiManager to execute a CLI script on a FortiGate when a specific event is triggered. The automation stitch is enabled but does not run when the event occurs. What is the most likely cause?

A.The event trigger is set to high severity only

B.The FortiGate does not support automation stitches

C.The automation stitch has not been installed to the FortiGate

D.The CLI script contains an invalid command

AnswerC

Automation stitches must be installed (pushed) to the FortiGate before they become active.

Why this answer

In FortiManager, automation stitches are created and stored in the central management database but must be explicitly installed to the managed FortiGate via the 'Install Wizard' or a direct policy/object install. Until the stitch is installed, the FortiGate does not have the configuration locally, so even if the stitch is enabled in FortiManager and the event occurs, the FortiGate will not execute the CLI script. This is a common oversight where administrators assume enabling the stitch in FortiManager automatically pushes it to the device.

Exam trap

The trap here is that candidates assume enabling the automation stitch in FortiManager is sufficient for it to run on the FortiGate, overlooking the critical step of installing the configuration to the managed device, which is a common point of failure in centralized management workflows.

How to eliminate wrong answers

Option A is wrong because the event trigger in FortiManager can be configured for any severity level (low, medium, high, or any), and by default, triggers are not restricted to high severity only; if the trigger were set to high severity only, the event would still run if the event matched that severity, so this would not prevent the stitch from running entirely. Option B is wrong because FortiGate devices running FortiOS 6.0 or later fully support automation stitches, and the question states the stitch is configured in FortiManager, implying the FortiGate is a supported model. Option D is wrong because an invalid command in the CLI script would cause the script to fail during execution, not prevent the automation stitch from being triggered; the stitch would still run and attempt to execute the script, but the script would produce an error.

Full explanation →

434

MCQmedium

When troubleshooting an IPsec VPN phase 1 negotiation failure, which debug command should the administrator run to see detailed IKE negotiation messages?

A.diagnose vpn ike log

B.diagnose debug application ike -1

C.get vpn ipsec tunnel details

D.diagnose debug application ipsec -1

AnswerB

This enables IKE debug with level -1 for verbose output.

Why this answer

The command 'diagnose debug application ike -1' enables detailed IKE (Internet Key Exchange) debug messages in FortiOS, which are essential for troubleshooting Phase 1 negotiation failures. This command captures the full IKE negotiation exchange, including proposals, authentication, and Diffie-Hellman group selection, allowing the administrator to identify where the failure occurs.

Exam trap

The trap here is that candidates often confuse the IKE debug command with the IPsec debug command, mistakenly thinking 'diagnose debug application ipsec -1' will show Phase 1 negotiation details, when in fact it only shows kernel-level IPsec processing and not the IKE control-plane messages.

How to eliminate wrong answers

Option A is wrong because 'diagnose vpn ike log' is not a valid FortiOS command; the correct command uses 'diagnose debug application ike' with a debug level. Option C is wrong because 'get vpn ipsec tunnel details' only displays the current state and configuration of established tunnels, not the real-time IKE negotiation messages needed for troubleshooting Phase 1 failures. Option D is wrong because 'diagnose debug application ipsec -1' debugs the IPsec kernel-level processing (e.g., encryption/decryption), not the IKE control-plane negotiation, so it will not show Phase 1 messages.

Full explanation →

435

Multi-Selectmedium

A FortiGate administrator is configuring a multi-VDOM deployment. The administrator wants to use a single physical interface for multiple VDOMs. Which TWO methods allow this?

Select 2 answers

A.Use the same physical interface in multiple VDOMs directly

B.Use NP6 virtual interfaces (e.g., virtual wire) on supported models

C.Configure VLAN subinterfaces and assign each to a different VDOM

D.Create a software switch interface and assign it to multiple VDOMs

E.Configure inter-VDOM routing to share the same IP subnet

AnswersB, C

Some FortiGate models with NP6 processors support virtual interfaces that can be assigned to different VDOMs.

Why this answer

On supported FortiGate models with NP6 processors, you can create NP6 virtual interfaces (e.g., virtual wire pairs) that allow a single physical interface to be shared across multiple VDOMs without VLAN tagging. Option C is correct because VLAN subinterfaces can be created on a physical interface and each subinterface assigned to a different VDOM, enabling multi-VDOM use of the same physical port.

Exam trap

The trap here is that candidates often assume a physical interface can be directly shared among VDOMs (Option A), not realizing that FortiGate requires either VLAN subinterfaces or NP6 virtual interfaces to achieve this separation.

Full explanation →

436

Multi-Selecteasy

A FortiGate administrator is planning to use policy packages in FortiManager to manage firewall policies for multiple devices. Which TWO statements about policy packages are true?

Select 2 answers

A.Header and footer policies can be used to enforce common rules across all policies

B.Policy packages are automatically applied to the device upon creation

C.Policy packages cannot include NAT policies

D.A policy package can be shared among multiple FortiGate devices

E.A policy package can contain policies for different VDOMs

AnswersA, D

Header policies are processed first, footer policies last, allowing consistent enforcement.

Why this answer

Header and footer policies in FortiManager allow administrators to enforce common rules across all policies in a policy package. Header policies are evaluated before the main policy set, and footer policies are evaluated after, ensuring consistent security controls such as logging or traffic shaping are applied universally without manual duplication.

Exam trap

The trap here is that candidates often assume policy packages are automatically applied upon creation (Option B) or that they cannot contain NAT rules (Option C), but FortiManager requires explicit installation and fully supports NAT policies within the same package.

Full explanation →

437

MCQhard

An administrator configured FortiGate to forward suspected malicious files to FortiSandbox. They set the action to 'block' for malicious verdicts. Some files are being blocked, but others with a 'clean' verdict are allowed. However, they notice that some files that should have been sent to FortiSandbox are not being forwarded. Which reason is MOST likely?

A.The FortiGate antivirus engine is set to proxy-based mode

B.The FortiGate has insufficient disk space for temporary files

C.The file size exceeds the maximum size configured for FortiSandbox scanning

D.The FortiSandbox device is overloaded and rejecting submissions

AnswerC

File size limits in the scanning profile prevent oversized files from being submitted to FortiSandbox.

Why this answer

The most likely reason is that the file size exceeds the maximum size configured for FortiSandbox scanning. FortiGate has a configurable limit (default 10 MB) for files sent to FortiSandbox; files larger than this threshold are not forwarded, even if the antivirus engine would otherwise trigger a submission. This explains why some files are blocked or allowed based on verdicts, while others are never submitted.

Exam trap

The trap here is that candidates often assume network or resource issues (overloaded FortiSandbox or disk space) are the cause, but the question specifically describes files that 'should have been sent' but are not, pointing to a configuration-based filter like file size limits rather than transient failures.

How to eliminate wrong answers

Option A is wrong because proxy-based mode is a valid inspection mode for FortiGate antivirus and does not prevent file forwarding to FortiSandbox; it actually supports file submission. Option B is wrong because insufficient disk space for temporary files would cause local scanning or caching issues, but FortiSandbox submissions are streamed or queued, not dependent on local temporary storage for forwarding. Option D is wrong because an overloaded FortiSandbox may delay or queue submissions, but it does not cause files to be completely not forwarded; FortiGate will still attempt submission and handle timeouts gracefully.

Full explanation →

438

MCQhard

Based on the exhibit, what can be concluded about the session?

A.The session is a one-way session with only outbound traffic.

B.The session is not being logged.

C.The session is offloaded to the NPU for hardware acceleration.

D.The session is in the 'npu' state, meaning it is being processed by the CPU.

AnswerC

The 'npu' flag indicates hardware offloading to the network processor.

Why this answer

The session state 'npu' indicates that the session has been offloaded to the Network Processor Unit (NPU) for hardware acceleration. This is a normal and expected state for traffic that matches hardware-offloadable profiles, allowing the NPU to process packets at wire speed without CPU intervention.

Exam trap

The trap here is that candidates often confuse the 'npu' state with CPU processing, assuming it means 'NPU processing by CPU' rather than recognizing it as hardware offload, leading them to select Option D incorrectly.

How to eliminate wrong answers

Option A is wrong because the session state 'npu' does not imply one-way or only outbound traffic; it simply indicates hardware offload, and sessions can be bidirectional. Option B is wrong because the session state 'npu' does not indicate whether logging is enabled or disabled; logging is configured separately via firewall policies or session log settings. Option D is wrong because the 'npu' state means the session is offloaded to the NPU for hardware acceleration, not that it is being processed by the CPU; CPU processing would be indicated by states like 'tcp' or 'udp' without offload.

Full explanation →

439

MCQmedium

An administrator is troubleshooting a split-brain situation in an HA cluster. They run 'get system ha status' and see that both FortiGates report themselves as primary. Which command should they run to force the secondary unit to take over as primary?

A.execute ha failover

B.reboot the primary unit

C.diagnose sys ha reset-uptime

D.diagnose sys ha stop

AnswerC

Resets the uptime, which can trigger a priority re-evaluation and failover.

Why this answer

'diagnose sys ha reset-uptime' resets the HA uptime counter on the local unit. In Fortinet HA, during a split-brain, both units have the same priority and uptime may be a tiebreaker. To force the secondary to become primary, the administrator should run this command on the current primary to reset its uptime counter to zero.

This makes the secondary's uptime higher, so when the next HA election occurs (e.g., after a link flap or manual trigger), the secondary will be elected as the new primary, resolving the split-brain condition.

Exam trap

The trap here is that candidates often confuse 'diagnose sys ha reset-uptime' with a command that directly forces a role change, when in reality it manipulates the uptime tiebreaker to indirectly influence the election process after a failover event.

How to eliminate wrong answers

Option A is wrong because 'execute ha failover' forces the current primary to become secondary and the secondary to become primary, but in a split-brain where both units think they are primary, this command on either unit will not resolve the conflict—it may cause both to attempt failover simultaneously, worsening the split-brain. Option B is wrong because rebooting the primary unit will temporarily remove it from the cluster, but the secondary (also claiming primary) will remain, and upon reboot, the original primary may rejoin as primary again, perpetuating the split-brain unless the underlying cause (e.g., heartbeat failure) is addressed. Option D is wrong because 'diagnose sys ha stop' halts the HA process on the unit it is run on, effectively removing it from the cluster, but it does not force the other unit to become the sole primary; it simply stops HA functionality, which can lead to a loss of redundancy and does not resolve the split-brain state.

Full explanation →

440

Multi-Selecthard

A security engineer wants to implement advanced threat protection for email using FortiMail. Which THREE features should be enabled to provide comprehensive protection against sophisticated email threats? (Choose three.)

Select 3 answers

A.URL rewriting and click-time protection

B.FortiSandbox integration for email attachments

C.Anti-Spam filter

D.DMARC verification

E.Attachment size limits

AnswersA, B, D

URL rewriting protects against phishing links.

Why this answer

URL rewriting and click-time protection (A) is correct because it proactively neutralizes malicious URLs in emails by rewriting them to route through FortiMail's proxy, enabling real-time inspection at the time of click. This defends against phishing and credential-harvesting attacks that use URLs to deliver payloads or steal credentials, even if the URL was benign at delivery time.

Exam trap

The trap here is that candidates often mistake basic anti-spam or administrative controls (like attachment size limits) for advanced threat protection features, overlooking that sophisticated threats require dynamic, behavior-based defenses such as URL rewriting, sandboxing, and email authentication protocols.

Full explanation →

441

MCQhard

You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is timed out

B.The session is closing (FIN_WAIT)

C.The session is in SYN_SENT state, waiting for SYN-ACK

D.The session is fully established (proto_state=01 means established)

AnswerC

proto_state=01 indicates SYN_SENT.

Why this answer

The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In Fortinet's session table, `proto_state=01` for TCP indicates the session is in the SYN_SENT state, meaning the firewall has forwarded a SYN packet and is waiting for a SYN-ACK from the remote host. The session is not yet established, as the three-way handshake has not completed.

Exam trap

The trap here is that candidates often misinterpret `proto_state=01` as an established session because they associate '01' with a binary 'on' or 'active' state, but in Fortinet's TCP state encoding, 01 specifically means SYN_SENT, not established.

How to eliminate wrong answers

Option A is wrong because the session has an expire value of 3599 seconds, meaning it is still active and not timed out. Option B is wrong because a FIN_WAIT state would be represented by a different proto_state value (e.g., 04 or 05), not 01; proto_state=01 specifically indicates SYN_SENT, not a closing state. Option D is wrong because proto_state=01 does not mean established; an established TCP session would show proto_state=02 (SYN_RCVD) or proto_state=03 (ESTABLISHED) in Fortinet's session table.

Full explanation →

442

MCQhard

During a ZTNA deployment, an administrator notices that traffic from a specific internal application is being routed through the ZTNA gateway but is not reaching the destination server. The FortiGate policy allows the traffic, and the client has a valid ZTNA connection. What is the most likely cause of the issue?

A.The ZTNA proxy rule on the FortiGate is misconfigured, pointing to the wrong destination IP or port.

B.The client's FortiClient agent is not connected to the EMS server.

C.The destination server does not have internet connectivity.

D.The FortiGate policy is set to deny traffic from the client's subnet.

AnswerA

A misconfigured proxy rule would cause traffic to be sent to the wrong destination.

Why this answer

In a ZTNA deployment, the FortiGate acts as a reverse proxy for internal applications. If the ZTNA proxy rule is misconfigured with an incorrect destination IP or port, the FortiGate will forward the traffic to the wrong backend server or service, causing the connection to fail even though the client has a valid ZTNA connection and the firewall policy permits the traffic.

Exam trap

The trap here is that candidates often assume the issue is with the client's connectivity or the firewall policy, but the key is that a valid ZTNA connection and permissive policy do not guarantee correct proxy forwarding—the proxy rule itself must accurately point to the destination server.

How to eliminate wrong answers

Option B is wrong because the client already has a valid ZTNA connection, which requires the FortiClient agent to be connected to the EMS server for authentication and posture checks; if it were disconnected, the ZTNA connection would not be established. Option C is wrong because the destination server does not need internet connectivity; ZTNA traffic is proxied through the FortiGate, and the server only needs reachability from the FortiGate, not the public internet. Option D is wrong because the question explicitly states that the FortiGate policy allows the traffic, so a deny policy for the client's subnet would contradict that condition.

Full explanation →

443

Multi-Selectmedium

A FortiGate is configured as a ZTNA proxy. The administrator wants to ensure that only devices with a specific ZTNA tag assigned by FortiClient EMS are allowed to access the application. Which two configuration steps are required? (Choose two.)

Select 2 answers

A.Configure a firewall policy with the ZTNA proxy as destination and enable 'allow only ZTNA'

B.Create a firewall policy allowing all traffic to the ZTNA proxy

C.Enable 'set ztna-tag' on the FortiGate interface

D.Create a ZTNA access rule with a condition matching the tag

E.Import the ZTNA tag from EMS into FortiGate

AnswersD, E

Why this answer

To restrict access based on ZTNA tags, the tag must be imported from FortiClient EMS into FortiGate (option E) and then used in a ZTNA access rule condition that matches the tag (option D). This ensures only devices with the specific tag are allowed.

Full explanation →

444

Multi-Selectmedium

An administrator is investigating a security incident where a workstation is communicating with a known command and control (C2) server. The FortiGate has IPS enabled but did not block the traffic. Which TWO configuration issues could explain why the IPS did not detect the C2 communication? (Choose two.)

Select 2 answers

A.The firewall policy does not have SSL deep inspection enabled

B.The IPS sensor is configured in 'Inline' mode

C.The IPS sensor has 'Logging' disabled

D.The IPS sensor does not include signatures for the C2 protocol or pattern

E.The FortiGate is operating in 'Transparent' mode

AnswersA, D

Without SSL inspection, encrypted C2 traffic is invisible to IPS.

Why this answer

Without SSL deep inspection, the FortiGate cannot decrypt HTTPS traffic to inspect the payload for C2 signatures. IPS operates on decrypted content; if the C2 communication uses TLS, the IPS engine only sees encrypted packets and cannot match application-layer signatures. Enabling SSL deep inspection with a valid CA certificate is required to decrypt and inspect the traffic.

Exam trap

The trap here is that candidates often assume 'Inline' mode or 'Transparent' mode inherently affect detection capability, when in fact they only affect traffic flow or logging, not the IPS engine's ability to inspect decrypted content.

Full explanation →

445

MCQmedium

An administrator configures a route map on a FortiGate to redistribute connected routes into OSPF. The route map sets a metric of 100. After applying, the redistributed routes appear with metric 20. What is the most likely reason?

A.The route map is applied to the wrong direction

B.OSPF does not allow metric setting via route maps

C.The route map is not applied to the redistribution configuration

D.The metric type is set to type 1

AnswerC

If the route map is not referenced in the 'redistribute connected' command, it has no effect.

Why this answer

The most likely reason the redistributed routes appear with metric 20 instead of the configured 100 is that the route map was not applied to the redistribution configuration. In FortiGate OSPF redistribution, a route map must be explicitly referenced under the 'redistribute connected' command; otherwise, the route map is ignored, and OSPF uses its default metric of 20 for redistributed connected routes.

Exam trap

The trap here is that candidates assume creating a route map automatically applies it to redistribution, but FortiGate requires explicit application under the redistribution command, and the default metric of 20 is used if no route map is referenced.

How to eliminate wrong answers

Option A is wrong because route maps in OSPF redistribution do not have a 'direction' like in route filtering; they are applied as a filter or modifier during the redistribution process itself, so direction is not a factor. Option B is wrong because OSPF does allow metric setting via route maps using the 'set metric' action, which is a standard feature in FortiGate OSPF configuration. Option D is wrong because setting the metric type to type 1 does not affect the metric value; it changes how the metric is calculated (adding internal cost), but the base metric would still be set by the route map if applied correctly.

Full explanation →

446

MCQmedium

An administrator configures a route-map to match prefix-list 'PREFIX' and set metric 20. Which OSPF route redistribution uses this route-map correctly?

A.config router ospf config redistribute "connected" set route-map "RM" end

B.config router policy config route-map edit "RM" config rule set match-ip-address "PREFIX" set set-metric 20 end end

C.config router ospf set route-map "RM"

D.config router prefix-list edit "PREFIX" set rule permit 10.0.0.0/8 end

AnswerA

Route-map is applied in the redistribute configuration.

Why this answer

In FortiOS, the route-map is applied to a specific redistribution rule under 'config router ospf' using the 'set route-map' command within the 'config redistribute' block. This correctly associates the route-map 'RM' with the redistribution of connected routes into OSPF, matching the prefix-list 'PREFIX' and setting the metric to 20.

Exam trap

The trap here is that candidates often confuse the global 'set route-map' under 'config router ospf' (which is not a valid command in FortiOS) with the per-redistribution 'set route-map' inside 'config redistribute', leading them to select option C instead of A.

How to eliminate wrong answers

Option B is wrong because it shows the route-map configuration itself, not the OSPF redistribution command that uses it; the question asks which OSPF route redistribution uses the route-map correctly, and this option omits the OSPF configuration entirely. Option C is wrong because 'set route-map' under 'config router ospf' is a global OSPF setting that applies to all redistributions, but it is not the correct syntax for applying a route-map to a specific redistribution source; the correct method is to use 'set route-map' within the 'config redistribute' block for the specific protocol (e.g., connected). Option D is wrong because it shows the prefix-list configuration, not the OSPF redistribution command; the prefix-list is a match condition within the route-map, not the redistribution itself.

Full explanation →

447

MCQhard

An administrator runs 'diagnose debug application fnbam 3' and sees many entries with state 'sctp'. The FortiGate has flow-based inspection enabled. What is being indicated?

A.Traffic is being fast-forwarded without security profile inspection

B.The FortiGate is performing SCTP deep inspection

C.The FortiGate is using proxy-based inspection

D.There is an SCTP-based attack in progress

AnswerA

fnbam entries with 'sctp' indicate sessions that bypass full scanning.

Why this answer

The 'diagnose debug application fnbam 3' command shows the FortiGate's flow-based Network Processor (NPU) session offload status. When entries show state 'sctp', it indicates that the traffic is being handled by the SCTP (Session Control Traffic Path) fast-path, meaning the session is offloaded to the NPU for hardware acceleration and bypasses security profile inspection. This is normal for flow-based inspection when traffic matches fast-path criteria, not an indication of SCTP protocol inspection or attacks.

Exam trap

The trap here is that candidates see 'sctp' and immediately think of the Stream Control Transmission Protocol (SCTP) rather than recognizing it as a FortiGate-specific acronym for 'Session Control Traffic Path' in the NPU offload context.

How to eliminate wrong answers

Option B is wrong because SCTP deep inspection would require explicit SCTP inspection profiles and would show different debug states (e.g., 'deep_inspect'), not 'sctp' in fnbam output. Option C is wrong because proxy-based inspection would show states like 'proxy' or 'deep' in fnbam debug, not 'sctp', and the question explicitly states flow-based inspection is enabled. Option D is wrong because 'sctp' state in fnbam indicates normal fast-path offloading, not an attack; attack indicators would appear in IPS logs or as 'drop' states, not as 'sctp'.

Full explanation →

448

MCQmedium

An administrator runs 'diagnose sys session filter dport 443' and sees 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate?

A.The session is a UDP flow

B.The session is in TCP SYN_SENT state

C.The session will expire in 3599 milliseconds

D.The session has been idle for 3600 seconds

AnswerB

proto_state=01 is SYN_SENT, but the long duration indicates an established session. The actual state is ESTABLISHED (not listed). So B is incorrect.

Why this answer

The output shows proto=6 (TCP) and proto_state=01 (SYN_SENT). However, a session with a duration of 3600 seconds cannot remain in SYN_SENT state; it would have timed out or transitioned to ESTABLISHED. Therefore, the output is contradictory and none of the provided options correctly describe the session.

Option A is wrong because proto=6 is TCP, not UDP. Option B is wrong because a session alive for an hour cannot be in SYN_SENT. Option C is wrong because 'expire' is in seconds, not milliseconds.

Option D is wrong because 'duration' is the total session time, not idle time.

Exam trap

Candidates often misinterpret proto_state values or confuse duration with idle time. Here, proto_state=01 suggests SYN_SENT, but the long duration indicates an established session, meaning none of the provided options are correct.

How to eliminate wrong answers

Option A is wrong because 'proto=6' explicitly indicates TCP, not UDP (UDP is protocol 17). Option C is wrong because the 'expire' value is in seconds, not milliseconds; 3599 seconds remain before the session times out. Option D is wrong because 'duration=3600' represents the total time the session has existed since creation, not idle time; idle time is tracked separately via the 'idle' field in the session dump.

Full explanation →

449

MCQmedium

A network administrator is troubleshooting an IPsec VPN tunnel that is not coming up. The configuration uses IKEv2 with pre-shared keys. The administrator runs 'diagnose vpn ike log-filter' and sees no logs. What is the most likely cause?

A.IKE debug is not enabled

B.The pre-shared key does not match

C.The tunnel name is misspelled in the filter

D.The remote gateway is unreachable

AnswerA

Why this answer

Without enabling IKE debug, the diagnose command will not show any output even if the tunnel is failing. The log-filter only filters the debug output; debug must be started first.

Full explanation →

450

MCQmedium

A FortiGate is configured with VRF. Which statement about VRF is true?

A.Interfaces can belong to multiple VRFs simultaneously.

B.VRF allows multiple routing tables to coexist on the same FortiGate.

C.Routes from different VRFs can be automatically redistributed without configuration.

D.VRF can only be used when OSPF is enabled.

AnswerB

VRF creates separate routing tables for segmentation.

Why this answer

VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, each with its own set of interfaces, routes, and forwarding decisions. This enables network segmentation and traffic isolation without requiring separate physical devices, making option B correct.

Exam trap

The trap here is that candidates often assume interfaces can belong to multiple VRFs (like VLAN sub-interfaces can belong to multiple VLANs), but in VRF, each interface is exclusively bound to a single VRF instance.

How to eliminate wrong answers

Option A is wrong because a physical or logical interface can belong to only one VRF at a time; an interface is assigned to a specific VRF instance and cannot be shared across multiple VRFs simultaneously. Option C is wrong because routes between VRFs are not automatically redistributed; explicit route leaking or inter-VRF routing policies (e.g., using route maps or VRF leak commands) must be configured to share routes between VRFs. Option D is wrong because VRF is independent of any specific routing protocol; it works with static routes, BGP, OSPF, RIP, or any combination, and does not require OSPF to be enabled.

Full explanation →

Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 376–450