Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 451–525

Why this answer

How to eliminate wrong answers

Option A is wrong because VDOMs do not have a 'traffic VDOM capability' setting; all VDOMs can forward traffic by default, and the ability to ping in one direction proves VDOM B is capable of processing traffic. Option C is wrong because if a firewall policy in VDOM B were blocking traffic, the ping from VDOM A to VDOM B would also fail, as the policy would block the forward direction as well. Option D is wrong because an MTU mismatch would cause fragmentation issues or packet drops for large packets, but ICMP echo requests and replies are typically small and would not be affected by a high MTU setting; moreover, the symptom is a complete timeout, not partial or intermittent failure.

Why this answer

How to eliminate wrong answers

Option A is wrong because FortiGate HA requires both units to run the same firmware version; if they differ, the cluster will not form at all or will show 'version mismatch', not just a synchronization failure. Option B is wrong because if the HA heartbeat interface is down, the cluster would show 'heartbeat lost' or 'standalone' status, not 'synchronization failed'—the units would not be able to communicate at all. Option C is wrong because NAT policies are a data-plane configuration and do not affect HA configuration synchronization, which is a control-plane function.

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling BFD removes sub-second failure detection entirely, reverting to slower routing protocol timers (e.g., OSPF dead interval of 40 seconds), which would significantly increase failover time. Option B is wrong because enabling BFD on the management interface is irrelevant to SD-WAN WAN link resilience; BFD on the management interface monitors management-plane connectivity, not data-plane SD-WAN paths. Option C is wrong because increasing the minimum transmit interval (e.g., to 200 ms) would directly increase the base detection time for all failures, including sustained outages, thereby increasing failover time, which contradicts the requirement to not significantly increase failover time.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'maximize bandwidth' strategy load-balances traffic across all members, not providing the required active/passive failover behavior. Option B is wrong because 'lowest cost' strategy selects the link with the lowest cost metric, which does not guarantee MPLS as the primary link or failover based on link health. Option D is wrong because 'manual' strategy requires explicit user intervention to switch links, lacking automatic failover based on link failure or SLA degradation.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling management access on all VDOMs except the root VDOM does not inherently separate management traffic from production data; the root VDOM itself may still carry production traffic, and this approach does not create a dedicated management plane. Option B is wrong because using inter-VDOM routing to route management traffic to the root VDOM mixes management and production traffic at the routing layer, defeating the purpose of isolation and introducing potential security risks. Option D is wrong because assigning all interfaces to the management VDOM would collapse all traffic—including production data—into the management domain, eliminating any separation and exposing management functions to production threats.

Why this answer

How to eliminate wrong answers

Option A is wrong because a connector to an external threat feed is not a required component of an automation stitch; the stitch uses a trigger (like a log event) and actions, not an external feed connector. Option B is wrong because the trigger is not predefined; the administrator must configure a trigger (e.g., event handler or schedule) and at least one action, so an action alone is insufficient. Option D is wrong because a schedule is only one type of trigger (time-based) and a script is one type of action; the stitch requires a trigger and action, but not exclusively a schedule and script—other triggers (e.g., event-based) and actions (e.g., email, webhook) are valid.

Why this answer

How to eliminate wrong answers

Option B is wrong because 'Incoming Webhook' is a trigger that waits for an external HTTP request, not for an IPS signature event; it cannot directly react to local IPS logs. Option C is wrong because 'FortiOS CLI' is not a valid trigger type in automation stitches; triggers are events like 'Event Log', 'Incoming Webhook', or 'Schedule', not CLI commands. Option D is wrong because 'Schedule' is a time-based trigger (e.g., daily at 2 AM), not an event-driven trigger for an IPS signature; 'Banned IP' is not a valid action name—the correct action is 'Add IP to Blocklist'.

Why this answer

How to eliminate wrong answers

Option A is wrong because header policies apply to the policy list within a VDOM, not specifically to the management VDOM; the management VDOM is a separate administrative domain used for managing the FortiGate, not for applying traffic policies. Option B is wrong because header policies do not bypass security profiles; they are simply positioned at the top of the policy list and still enforce all configured security profiles (e.g., antivirus, IPS) unless explicitly disabled in the policy. Option D is wrong because the name of the policy package is defined when creating the package, not by a header policy; header policies are entries within the package, not a naming mechanism.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (Policy-based routing) is wrong because it overrides the routing table for specific traffic based on policies, but does not create multiple independent routing tables; it only redirects traffic within a single routing table. Option C (VDOM) is wrong because VDOMs create separate virtual firewalls with their own routing tables, but the question asks for multiple routing tables within a single VDOM, not separate VDOMs. Option D (ECMP) is wrong because ECMP (Equal-Cost Multi-Path) is a load-balancing technique that distributes traffic across multiple paths within a single routing table, not a mechanism to create multiple routing tables.

Why this answer

How to eliminate wrong answers

Option B (Policy-based routing) is wrong because it only controls traffic forwarding based on policies, not creating separate virtual firewalls with independent routing tables and administrators. Option C (VRRP) is wrong because it provides high availability and redundancy between FortiGates, not isolation of tenant traffic within a single device. Option D (VLANs) is wrong because VLANs segment Layer 2 broadcast domains and can be used with VDOMs, but alone they do not provide independent routing tables, administrators, or security policies for each tenant.

Why this answer

How to eliminate wrong answers

Option A is wrong because if the interface were down, the log would show 'interface down' or 'link down', not 'SLA mismatch'. Option B is wrong because an unreachable SLA probe server would generate 'probe failure' or 'server unreachable' logs, not 'SLA mismatch'. Option D is wrong because if the SD-WAN rule were not enabled, the traffic would not be evaluated against SLA thresholds at all, and no 'SLA mismatch' log would appear.

Why this answer

How to eliminate wrong answers

Option A is wrong because the 'diagnose debug vd case' command works for both traffic and management VDOMs; there is no separate command for traffic VDOMs. Option B is wrong because an administratively disabled VDOM still exists in the configuration and can be referenced by name; the command would not return 'VDOM not found' but would instead show the VDOM as disabled. Option C is wrong because the VDOM context of the administrator does not affect the ability to reference another VDOM by name in this debug command; the error is about the VDOM name not being found, not about context permissions.

Why this answer

How to eliminate wrong answers

Option A is wrong because the firewall policy for ZTNA must permit traffic from the ZTNA gateway (the proxy IP) to the internal application; a deny rule would explicitly block the proxy, but the question states the policy is correct. Option B is wrong because the client does not need a direct route to the internal application; in ZTNA, the client connects only to the FortiGate's external proxy IP, and the FortiGate handles routing to the internal application. Option C is wrong because while FortiClient authentication is required for ZTNA access, the question states users cannot connect despite a correct policy and reachable application, implying the authentication is likely successful; the issue is specifically with the ZTNA rule's proxy destination mapping.

Why this answer

How to eliminate wrong answers

Option A is wrong because Global ADOMs manage FortiGates in any mode (transparent, NAT/route, or VDOM), not just transparent mode; the transparent mode limitation is a misconception. Option B is wrong because regular ADOMs do support meta fields; meta fields are a feature available in both regular and Global ADOMs for adding custom metadata to objects. Option D is wrong because Global ADOMs do not have unlimited device capacity; device limits are determined by the FortiManager model and license, not by the ADOM type.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a missing route would cause a different debug flow message, such as 'no route to destination' or 'route lookup failed', and the packet would be dropped at the routing stage, not at the firewall policy stage. Option C is wrong because an invalid source IP address (e.g., RFC 1918 on a public interface) would typically be dropped by antispoofing checks or a specific firewall policy, not by a generic 'no matching policy' message; the debug flow would show 'invalid source' or 'reverse path check failed'. Option D is wrong because a full session table would cause a 'session table full' or 'no session available' message in the debug flow, and the drop would occur during session creation, not during policy lookup.

Why this answer

How to eliminate wrong answers

Option A is wrong because HTTPS without SSL inspection does not prevent the WAF from inspecting HTTP traffic; FortiGate can still inspect the decrypted traffic if SSL inspection is configured, but the WAF operates on the application layer and can block SQL injection regardless of encryption as long as the traffic is decrypted. Option C is wrong because a WAF profile set to monitor mode would log attacks but not block them, which would be a plausible reason for SQL injection not being blocked, but the question asks for the 'most likely' reason, and an inactive FortiGuard subscription is a more fundamental issue that prevents signature-based detection entirely. Option D is wrong because applying the WAF profile to the wrong firewall policy would mean the profile is not applied to the traffic at all, but the administrator has already configured the profile and noticed it is not blocking attacks, implying the profile is applied; the issue is with the signature database, not policy application.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Destination-IP-based hashing uses only the destination IP, which would not guarantee that traffic from the same source IP uses the same next hop; different destinations could be load-balanced to different paths. Option C is wrong because Weighted random distributes traffic probabilistically based on weights, not deterministically by source IP, so packets from the same source could take different paths. Option D is wrong because Round-robin cycles through next hops in order without any per-source affinity, breaking source-IP stickiness.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because Local-in Policy controls traffic destined to the FortiGate itself (e.g., management access), not traffic passing through the FortiGate, so it cannot block outbound traffic to a malicious IP. Option C is wrong because FortiGuard Outbreak Prevention is a subscription service that provides real-time threat intelligence and blocking for known outbreaks, but it does not allow custom automated responses based on a specific alert from FortiSIEM; it operates independently via FortiGuard updates. Option D is wrong because FortiGate VPN is a feature for secure remote access and site-to-site connectivity, not for automated threat response or IP blocking based on threat intelligence feeds.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because automation stitches are used for event-triggered automated responses (e.g., quarantine actions), not for enabling VDOM management on FortiManager. Option B is wrong because adding the FortiGate to the global ADOM only allows management of the global VDOM (Root), not individual customer VDOMs like CustomerA. Option C is wrong because VDOM management is enabled on FortiGate by default when VDOMs are created; the missing piece is the ADOM configuration on FortiManager, not a toggle on the FortiGate.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'Auto-link' is not a valid FortiManager setting; it likely confuses with 'Auto-update' or device-level linking, which does not control automatic policy push. Option C is wrong because configuring a schedule for policy installation only automates the push at predefined times, not immediately upon change, which does not meet the requirement for automatic push on every change. Option D is wrong because enabling 'Central Management' on the FortiGate is a device-level setting that allows the FortiGate to be managed by FortiManager, but it does not control automatic policy package updates from FortiManager.

Why this answer

How to eliminate wrong answers

Option A is wrong because configuring the FortiAnalyzer IP under system global settings only applies to the management VDOM (or the global context in non-VDOM mode), not to all VDOMs; logs from other VDOMs would not be sent. Option C is wrong because the management VDOM cannot act as a log relay for other VDOMs; each VDOM must independently send its logs to the FortiAnalyzer. Option D is wrong because there is no 'centralized logging' command under config log setting; logging is always configured per VDOM, and the concept of centralized logging refers to the FortiAnalyzer receiving logs from multiple sources, not a FortiGate-side setting.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'diagnose debug application had 0' enables debug logging for the HA daemon at debug level 0, which is used for troubleshooting HA protocol issues but does not display a concise status summary or identify the primary unit. Option B is wrong because 'diagnose sys ha dump' outputs raw internal HA state data, including timers and counters, which is too verbose and not intended for quickly checking primary/secondary status. Option D is wrong because 'show system ha' is not a valid FortiGate CLI command; the correct syntax uses 'get' (e.g., 'get system ha status') for operational state retrieval, while 'show' is used in other vendors like Cisco.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because LLDP (Link Layer Discovery Protocol) is used for neighbor discovery and topology mapping, not for enabling a FortiExtender as a WAN interface; the FortiGate does not require LLDP to recognize or manage the FortiExtender. Option C is wrong because bridge mode would cause the FortiExtender to act as a transparent bridge, forwarding traffic without performing NAT or routing, which prevents it from functioning as a secondary WAN interface that provides its own public IP and gateway. Option D is wrong because creating a VLAN interface for the FortiExtender is unnecessary; the FortiExtender connects via a physical port or USB, and the FortiGate manages it through a dedicated management interface, not a VLAN sub-interface.

Why this answer

How to eliminate wrong answers

Option B (Attachment Filtering) is wrong because it focuses on scanning email attachments for malware or prohibited file types, not on rewriting URLs in email bodies. Option C (Bounce Verification) is wrong because it validates the authenticity of bounce messages to prevent backscatter spam, not URL manipulation. Option D (Anti-Spam) is wrong because it uses techniques like RBLs, greylisting, and heuristic analysis to filter unwanted bulk email, not to rewrite or scan URLs for malicious content.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because proxy-based inspection does not prevent verdict retrieval; FortiGate can receive and act on FortiSandbox verdicts regardless of inspection mode, as verdicts are handled at the FortiGate-FortiSandbox communication level, not the inspection engine. Option B is wrong because trusted hosts are used for administrative access control to the FortiGate GUI/CLI, not for FortiSandbox communication; FortiSandbox connectivity relies on IP reachability and API keys, not trusted host lists. Option D is wrong because setting an antivirus profile to block without scanning would prevent file submission entirely, not cause a scenario where files are sent but no verdict is returned; the logs confirm submission occurred, ruling out this option.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `--context http-header` is not a valid keyword in FortiGate IPS signatures; the correct approach is to use `--service HTTP` to scope the signature to HTTP traffic. Option B is wrong because the pattern 'User-Agent: EXPLOIT' is incomplete—it does not include the full string 'EXPLOIT_2024', so it would fail to detect the specific exploit. Option C is wrong because the pattern 'EXPLOIT_2024' alone would match the string anywhere in the HTTP payload, not specifically in the User-Agent header, leading to false positives or missed detections.

Why this answer

How to eliminate wrong answers

Option B is wrong because a self-signed certificate would cause FortiGate to reject the connection only if the firewall policy has SSL certificate inspection set to 'certificate-inspection' or 'deep-inspection' with an untrusted CA; if deep inspection is not enabled, FortiGate simply passes the encrypted traffic without scanning, regardless of certificate trust. Option C is wrong because an expired FortiGuard antivirus subscription would prevent signature updates but would not stop scanning of already-decrypted traffic; the antivirus engine would still attempt to scan using the last known signatures. Option D is wrong because flow-based vs proxy-based inspection affects how the antivirus engine processes traffic (flow-based uses pattern matching on the fly, proxy-based buffers and reassembles), but both modes require decrypted traffic to scan HTTPS; if deep inspection is not enabled, neither mode can scan the encrypted payload.

Why this answer

How to eliminate wrong answers

Option A is wrong because password encryption mismatch (e.g., different private keys or encryption settings) would cause authentication or decryption failures, not a failure to sync the configuration itself. Option C is wrong because HA priority determines which unit becomes primary during an election, but it does not affect whether configuration synchronization occurs; a low priority unit can still receive config sync if it is enabled. Option D is wrong because session-pickup is a feature for preserving stateful sessions during failover, not for synchronizing the configuration; disabling it would cause sessions to drop, not prevent config sync.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because you do not need to create any VDOMs before enabling the feature; you can enable VDOMs first, then create them after the reboot. Option B is wrong because disabling firewall policies is not a prerequisite; the FortiGate will automatically flush all policies when VDOMs are enabled and the device reboots. Option D is wrong because inter-VDOM routing is an optional configuration that can be set up after VDOMs are enabled and created, not a required step during the initial enablement process.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because load balancing across multiple links is achieved through ECMP (Equal-Cost Multi-Path) routing or SD-WAN load-balancing rules, not BFD, which only detects failures. Option C is wrong because encrypting BGP updates between peers is done using IPsec or MD5/TCP-AO authentication, not BFD, which has no encryption capability. Option D is wrong because authenticating OSPF neighbors is performed using OSPF authentication (plaintext, MD5, or SHA) in the OSPF packet header, not BFD, which focuses solely on bidirectional liveness detection.

Why this answer

How to eliminate wrong answers

Option A is wrong because if the FortiGate were not receiving ICMP replies from 8.8.8.8, the performance SLA would mark the link as dead and fail over to port2, which is not the described behavior. Option B is wrong because 'Manual' strategy requires explicit interface selection and does not use performance SLA data at all, but the question states 'Best Quality' strategy is configured. Option D is wrong because 'volume' is a load-balancing algorithm for distributing traffic, not a strategy for selecting the best link based on latency; 'lowest-latency' is not a valid SD-WAN strategy option in FortiOS.

Why this answer

How to eliminate wrong answers

Option A is wrong because the FortiSandbox feature is enabled globally under System > FortiSandbox, not per VDOM; VDOM settings do not control the submission of files to FortiSandbox. Option C is wrong because the FortiSandbox server IP is configured under System > FortiSandbox, not under Security Fabric > Fabric Connectors; Fabric Connectors are for integration with other Fortinet products like FortiAnalyzer or FortiSIEM. Option D is wrong because FortiCloud registration is required for cloud-based services like FortiGuard, but not for on-premises FortiSandbox communication; the FortiGate and FortiSandbox communicate directly via API over HTTPS.

Why this answer

How to eliminate wrong answers

Option A is wrong because mismatched OSPF network types (broadcast vs. point-to-point) affect neighbor adjacency formation and LSA flooding, not the metric of redistributed routes. Option C is wrong because interface costs influence OSPF intra-area and inter-area path selection, but they do not affect the metric of redistributed external routes (E2). Option D is wrong because configuring area 0 as a stub would block Type 5 LSAs entirely, preventing any external routes (including redistributed ones) from appearing in area 0, whereas the question states the routes appear as 'O E2' with an invalid metric.

Why this answer

How to eliminate wrong answers

Option A is wrong because Weighted ECMP distributes traffic based on configured weight ratios, but it still uses per-packet or per-flow hashing depending on the underlying method; it does not inherently guarantee session persistence unless combined with a per-flow hash. Option C is wrong because Source-IP-based hashing only considers the source IP, which can cause packets from the same session (same source and destination) to be split if the source IP alone does not uniquely identify the flow, leading to asymmetric routing. Option D is wrong because Spillover is a load balancing method that sends traffic to a secondary link only when the primary link's bandwidth threshold is exceeded; it does not use hashing and can break session continuity when traffic spills over mid-session.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because converting the management VDOM to a traffic VDOM does not impose any memory limit; it merely changes the VDOM's role, which does not address excessive memory consumption. Option C is wrong because moving the management VDOM to a separate physical FortiGate is an expensive and unnecessary hardware solution that does not leverage the built-in resource management capabilities of the existing device. Option D is wrong because disabling unused features may reduce memory usage but does not guarantee a hard limit; the management VDOM could still consume excessive memory from enabled features, and this approach lacks the precision and enforcement of a configured memory cap.

Why this answer

How to eliminate wrong answers

Option A is wrong because `duration=3600` indicates the session has been active for 1 hour, not idle; idle time is tracked separately (e.g., via `idle` field in the full output). Option B is wrong because `proto=6` explicitly indicates TCP, not UDP (UDP uses protocol 17). Option D is wrong because `proto_state=01` represents TCP state ESTABLISHED (0x01), not a half-open state (which would be SYN_SENT or SYN_RECV, typically state 0x02 or 0x04).

Why this answer

How to eliminate wrong answers

Option B is wrong because an overly aggressive SLA threshold would cause the link to be considered down more easily, not prevent failback after recovery; the issue is about failback, not detection. Option C is wrong because cost influences initial path selection and load balancing, not failback behavior; a higher-cost link would not be preferred for failback, and the FortiGate does not use cost to decide whether to revert traffic. Option D is wrong because if the SLA probe interval were longer than the outage, the SLA would never detect the outage, so traffic would not fail over at all; the scenario states failover occurred, so the probe interval is not the cause.

Why this answer

How to eliminate wrong answers

Option A is wrong because CDR does not use machine learning; it is a deterministic process that removes active content and reconstructs files, whereas FortiGate's machine learning-based detection is handled by FortiGuard AI/ML or other advanced threat protection features. Option B is wrong because CDR does not repair files corrupted during transmission; it sanitizes files by stripping potentially dangerous elements, and file corruption recovery is outside its scope. Option C is wrong because CDR does not compress files for faster scanning; it actually increases file size slightly due to reconstruction overhead, and compression is unrelated to its security purpose.

Why this answer

How to eliminate wrong answers

Option B is wrong because mismatched pre-shared keys would cause Phase 1 to fail, not Phase 2; Phase 1 is already up in this scenario. Option C is wrong because aggressive Dead Peer Detection (DPD) settings can cause tunnels to flap (go up and down), but they do not produce a 'no proposal chosen' error; that error is specific to Phase 2 proposal mismatches. Option D is wrong because certificate validation failure would also prevent Phase 1 from completing, as certificates are used during IKE authentication in Phase 1, not Phase 2.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because if the internal application were not responding, the FortiGate would log a different error such as 'connection refused' or 'upstream timeout', not a 'ZTNA session timeout'. Option C is wrong because a 5-second timeout on the internal application would cause an upstream timeout or 504 error, not a ZTNA session timeout, and the log message specifically points to the proxy's idle timeout. Option D is wrong because if FortiClient were not receiving ZTNA tags, the user would not be able to access the ZTNA gateway at all; the issue occurs after successful gateway access, ruling out tag delivery problems.

Why this answer

How to eliminate wrong answers

Option A is wrong because FortiSandbox inline scanning is not a setting in the antivirus profile; it is a mode of operation where traffic is held until sandbox verdict is received, but the actual submission is controlled by the 'Submit files to FortiSandbox' option. Option B is wrong because Content Disarm and Reconstruction (CDR) is a separate feature that sanitizes files by removing active content, not for submitting files to FortiSandbox. Option C is wrong because Outbreak Prevention is a FortiGuard service that provides real-time threat intelligence, not a mechanism to submit files to FortiSandbox.

Why this answer

How to eliminate wrong answers

Option A (Spillover) is wrong because the Spillover algorithm uses a traffic volume threshold (in Mbps or sessions) to determine when to shift traffic to another link, not a cost metric; it does not consider link cost as the primary selection criterion. Option B (Sessions) is wrong because the Sessions algorithm distributes traffic based on the number of active sessions per link, aiming for session count balance, not cost-based primary path selection with a threshold. Option D (Volume) is wrong because the Volume algorithm balances traffic based on the total bytes transferred per link, not on a cost metric or a threshold that triggers spillover from the lowest-cost link.

Why this answer

How to eliminate wrong answers

Option A is wrong because the prefix is learned via BGP (as shown by 'get router info bgp network'), not an IGP; administrative distance only affects route selection between different protocols, not BGP multi-path behavior. Option C is wrong because administrative distance is irrelevant when comparing two BGP-learned routes from the same protocol; BGP uses its own path selection algorithm (weight, local preference, AS-path, etc.) to choose the best path. Option D is wrong because eBGP multihop is only needed when the BGP peers are not directly connected (TTL=1 default); it has no effect on load balancing across multiple paths to the same prefix.

Why this answer

How to eliminate wrong answers

Option B is wrong because a hold timer expiry would cause the session to transition to Idle, not Active, as the hold timer is reset upon receiving a keepalive or update; an expired hold timer indicates a failure to receive messages, leading to a teardown. Option C is wrong because if the BGP neighbor is not reachable due to a routing issue, the session would typically remain in Idle (not Active) because the TCP connection cannot be initiated; Active state implies the TCP connection is being attempted but the BGP open message negotiation is failing. Option D is wrong because an incorrect BGP password (MD5 authentication) would cause the TCP connection to fail entirely, resulting in the session staying in Idle, not Active, as the TCP three-way handshake would not complete.

Why this answer

How to eliminate wrong answers

Option A is wrong because configuring a static route in VDOM-A pointing to the server's subnet via the VDOM-B gateway is insufficient; a VDOM link and firewall policies are required to establish the inter-VDOM connection, and the gateway must be the VDOM link interface, not the VDOM-B gateway. Option C is wrong because there is no global 'inter-VDOM routing' toggle under system settings; inter-VDOM routing is enabled implicitly by creating a VDOM link and configuring policies. Option D is wrong because a physical interface cannot be assigned to two VDOMs simultaneously; each VDOM requires its own dedicated interfaces, and sharing a physical interface would break logical separation.

Why this answer

How to eliminate wrong answers

Option B is wrong because defining a list of allowed source IPs for management access is the purpose of an access control list (ACL) or a local-in policy, not a prefix list. Option C is wrong because specifying the next-hop for a set of routes is done using a route map with the set next-hop command or a static route, not a prefix list. Option D is wrong because setting BGP community values on matched prefixes is performed using a route map with the set community command, while a prefix list only matches routes and does not modify attributes.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because if a firewall policy were blocking BGP port 179, the TCP connection would fail to establish, typically resulting in an 'Idle' or 'Connect' state, not 'Active', and the administrator has already verified IP connectivity. Option C is wrong because a hold timer set too high would not prevent the session from leaving the Active state; it only affects how long the router waits for keepalives after the session is established. Option D is wrong because the BGP network statement is used to advertise prefixes into BGP, not to establish the BGP peering session; missing network statements would not prevent the TCP connection or OPEN message exchange.

Why this answer

How to eliminate wrong answers

Option A is wrong because setting application control to proxy-based inspection alone does not enable SSL decryption; it only changes the inspection mode, but the firewall still cannot see inside encrypted HTTPS traffic without a decryption policy. Option B is wrong because 'allow-ssl-inspection' is not a valid system setting in FortiOS; SSL inspection is configured via SSL/SSH profiles and applied to firewall policies, not a global toggle. Option C is wrong because a DNS filter blocks based on domain names, but social media applications can use IP addresses, alternate domains, or bypass DNS resolution, so it does not reliably block the application traffic itself.

Why this answer

How to eliminate wrong answers

Option A is wrong because a memory leak would manifest as steadily increasing memory consumption over time, not as high CPU usage by ipsengine; the 'diagnose sys top' output shows CPU usage, not memory. Option C is wrong because antivirus scanning is handled by the 'avengine' process, not 'ipsengine'; the question explicitly states ipsengine is the culprit. Option D is wrong because a routing loop causes packet bouncing and high CPU due to routing table lookups (handled by the kernel or 'fwd' process), not by the IPS engine, which inspects application-layer traffic.

Why this answer

How to eliminate wrong answers

Option A is wrong because security logs record security-related events like intrusion prevention, antivirus, and web filtering actions, not system resource metrics like CPU usage or session counts. Option C is wrong because event logs capture system events such as administrative logins, configuration changes, and HA events, but they do not include periodic performance data for CPU or session monitoring. Option D is wrong because traffic logs contain details about individual network sessions (source/destination IP, ports, bytes transferred) and are not designed to report aggregate system resource utilization over time.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 'diagnose ha reset-uptime' resets the HA uptime statistics counters and does not initiate any failover or role change. Option B is wrong because 'execute shutdown on the primary' will power off the primary unit, causing an uncontrolled failover that may drop active sessions and disrupt services, which contradicts the goal of testing without service disruption. Option C is wrong because 'execute ha synchronize' forces a manual configuration and session synchronization from the primary to the standby, but it does not trigger a role switch or failover.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because 'set role' with 'primary' and 'standby' is not a valid SD-WAN configuration; FortiGate SD-WAN uses priority values and strategies, not role-based primary/standby assignments, and the 'redundant' strategy is for load balancing, not failover. Option C is wrong because equal priority with 'lowest cost' strategy would load-balance traffic across both links based on cost, not enforce MPLS as primary and broadband as backup. Option D is wrong because static routes with different distances control routing table selection, not SD-WAN link failover; SD-WAN rules override static route behavior and require SD-WAN-specific configuration to achieve policy-based failover.

Why this answer

How to eliminate wrong answers

Option A is wrong because VDOMs operate in separate virtual routers by default; placing them in the same virtual router would merge their routing tables, defeating isolation and requiring inter-VDOM routing to be explicitly configured. Option B is wrong because static routes alone cannot forward traffic between VDOMs without a physical or logical interface connecting them; the route would have no valid next-hop interface. Option D is wrong because there is no global 'inter-VDOM routing' toggle; inter-VDOM traffic must be explicitly allowed via a VDOM link or inter-VDOM link policy, not a global setting.

Why this answer

How to eliminate wrong answers

Option A is wrong because an unreachable authentication server would generate authentication failure or timeout messages (e.g., 'auth timeout' or 'radius no response'), not 'no response from client' which is a client-side connectivity issue. Option B is wrong because tunnel mode vs web mode is a configuration setting on the FortiGate; if tunnel mode were misconfigured, the client would either fail to connect entirely or show a different error like 'tunnel mode mismatch', not a lack of response from the client. Option D is wrong because an expired SSL VPN certificate would cause SSL handshake failures or certificate validation errors (e.g., 'certificate verify failed' or 'SSL error'), not a 'no response from client' message which occurs after the SSL session is established.

Why this answer

How to eliminate wrong answers

Option A is wrong because BFD does not exchange or synchronize routing tables; it only monitors the bidirectional forwarding path between peers. Option B is wrong because BFD does not perform load balancing; it is a detection mechanism that can be used alongside ECMP or SD-WAN to trigger path changes upon failure. Option D is wrong because BFD does not encrypt routing updates; it sends simple, unencrypted control packets (RFC 5880) and relies on the underlying transport for security if needed.

Why this answer

How to eliminate wrong answers

Option B is wrong because BFD is fully compatible with BGP and is commonly used to accelerate link failure detection in BGP sessions; RFC 5880 and RFC 5881 define BFD for IP links, and FortiGate supports BFD for BGP. Option C is wrong because if the BGP hold timer were shorter than the BFD detection time, BGP would time out before BFD detects a failure, but the problem is intermittent flapping, not BGP hold timer expiration; in fact, BFD detection times are typically much shorter than BGP hold timers (e.g., 150ms vs 3 seconds). Option D is wrong because setting BFD minimum transmit and receive intervals too high would make BFD less sensitive, reducing false positives and flapping, not causing it; the issue is intervals being too low, not too high.