Courseiva

Fortinet NSE 7 Advanced Security NSE7 (NSE7) — Questions 526–600

940 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 7

Page 8 of 13

Page 9
526
MCQmedium

An administrator sees the following output from 'get router info routing-table': S 0.0.0.0/0 [10/0] via 192.168.1.1, port1 S 0.0.0.0/0 [10/0] via 192.168.2.1, port2 They have configured ECMP load balancing. However, traffic to a specific destination IP is always using port1. What is the likely reason?

A.The firewall policy only allows traffic on port1
B.ECMP uses per-packet load balancing by default and the traffic is a single flow
C.One of the static routes has a lower administrative distance
D.The destination IP hash results in the same link for all sessions due to the load balancing algorithm
AnswerD

FortiGate's ECMP uses a hash of source/dest IP and port. If only one flow exists, it will consistently use the same link.

Why this answer

D is correct because FortiGate ECMP load balancing uses a hash-based algorithm (source-destination IP, port, or protocol) by default, not per-packet. When the hash of the destination IP consistently maps to the same link (port1), all sessions to that specific IP will use that interface, even though multiple routes exist with equal administrative distance and cost.

Exam trap

The trap here is that candidates confuse per-packet load balancing (which would alternate packets within a single flow) with FortiGate's default per-session hash-based ECMP, leading them to incorrectly select Option B.

How to eliminate wrong answers

Option A is wrong because firewall policies are stateful and apply to traffic after routing decisions are made; they do not influence which route is selected for a given destination. Option B is wrong because FortiGate ECMP does not use per-packet load balancing by default; it uses per-session load balancing based on a hash of the 5-tuple (or source/destination IP), so a single flow will always use the same link. Option C is wrong because both static routes show the same administrative distance [10] and cost [0], so they are equal-cost paths; a lower administrative distance would cause one route to be preferred over the other, but that is not the case here.

Full explanation →
527
MCQeasy

Which feature in FortiOS enables a FortiGate to act as a proxy for client-initiated connections to internal applications without requiring a VPN client, by verifying device posture and user identity?

A.IPsec VPN with XAuth authentication
B.SSL VPN with web mode portal
C.FortiGate's explicit web proxy
D.ZTNA (Zero Trust Network Access) proxy
AnswerD

Why this answer

ZTNA proxy provides application-level access without full network connectivity, enforcing identity and posture checks. IPsec and SSL VPN give full network access. Explicit proxy is for web traffic only.

Full explanation →
528
MCQhard

An administrator runs 'diagnose ips anomaly list' and sees many 'data_leak' events from a specific internal IP address. The IPS sensor has the default pre-defined signatures enabled. What additional step should the administrator take to block this specific anomaly?

A.Enable protocol anomaly detection in the antivirus profile
B.Create a custom IPS signature to match the anomaly pattern and apply it to the IPS sensor
C.Enable the 'data_leak' signature in the IPS sensor and set action to 'block'
D.Configure a firewall policy with application control to block the traffic
AnswerB

Custom signatures allow precise detection of protocol anomalies beyond pre-defined signatures.

Why this answer

The 'diagnose ips anomaly list' command shows protocol anomaly events, which are detected by the IPS engine's built-in anomaly detection logic, not by pre-defined signatures. To block a specific anomaly pattern like 'data_leak', the administrator must create a custom IPS signature that matches the exact anomaly characteristics and apply it to the IPS sensor. Pre-defined signatures cannot be modified to block anomalies; only custom signatures can target these events.

Exam trap

The trap here is that candidates confuse 'anomaly events' with 'pre-defined signatures', assuming they can simply enable or block a signature by name, when in fact anomalies require custom signature creation to be blocked.

How to eliminate wrong answers

Option A is wrong because protocol anomaly detection is a core IPS engine feature, not part of the antivirus profile, and enabling it in an antivirus profile would not affect IPS anomaly blocking. Option C is wrong because 'data_leak' is not a pre-defined signature in the IPS sensor; it is an anomaly event type, and pre-defined signatures cannot be enabled or set to 'block' for anomalies. Option D is wrong because application control operates at Layer 7 and cannot block low-level protocol anomalies detected by the IPS engine; it would only block application-specific traffic, not the anomaly itself.

Full explanation →
529
MCQmedium

A network admin needs to apply a common set of firewall rules at the beginning of every policy package for all VDOMs managed by FortiManager. The rules should be automatically inserted and not editable within each VDOM. What should be configured?

A.VDOM policy templates
B.Global policy objects
C.Policy package header policies
D.Central management policies
AnswerC

Header policies are prepended to all policy packages in the ADOM.

Why this answer

Header policies in policy packages allow global policies that apply before VDOM-specific policies. They are defined at the ADOM level and cannot be modified within individual VDOMs.

Full explanation →
530
Multi-Selectmedium

An administrator needs to integrate a FortiSwitch with a FortiGate for LAN edge management. The FortiGate will manage the switch via the LAN interface. Which TWO steps are required? (Choose two.)

Select 2 answers
A.Enable switch controller on the FortiGate.
B.Assign an IP address to the FortiSwitch's management VLAN on the FortiGate.
C.Configure the FortiSwitch in standalone mode.
D.Disable STP on the FortiSwitch ports connected to the FortiGate.
E.Connect the FortiSwitch to a port configured as a 'switch' interface type.
AnswersA, E

The switch controller feature must be enabled to manage FortiSwitch devices.

Why this answer

Enabling the switch controller on the FortiGate activates the FortiLink management protocol, which is required for the FortiGate to discover, configure, and manage the FortiSwitch as a managed switch. Option E is correct because the physical port connecting the FortiSwitch must be configured as a 'switch' interface type (FortiLink interface) to establish the proprietary control and data plane communication between the devices.

Exam trap

The trap here is that candidates often think they need to manually assign a management IP or disable STP, but FortiLink automates these functions, making manual configuration unnecessary and even disruptive.

Full explanation →
531
MCQmedium

A FortiGate administrator is configuring a site-to-site IPsec VPN with IKEv2. The remote peer supports multiple proposals. The administrator wants to ensure that the VPN tunnel uses AES256-GCM for encryption and SHA256 for integrity. Which configuration setting should be used to enforce this preference?

A.Set the 'proposal' list with AES256-GCM and SHA256 as the first entry
B.Enable 'set proposal-mode strict'
C.Use IKEv2 rekey to change the proposal after initial handshake
D.Configure a phase2 selectors with the exact traffic of interest
AnswerA

The order of proposals defines priority; the first matching proposal is selected. Placing AES256-GCM/SHA256 first ensures it is preferred.

Why this answer

In IKEv2, the proposal order determines the preference. The first matching proposal is used. To enforce AES256-GCM and SHA256, the administrator should set those as the first proposal in the phase1 and phase2 configuration.

Full explanation →
532
Multi-Selectmedium

An administrator needs to enable automation stitches to automatically block a malicious IP address detected by FortiSandbox. Which two components are required? (Choose two.)

Select 2 answers
A.A trigger that detects the FortiSandbox verdict
B.A static route to the malicious IP
C.An SSL certificate for the FortiGate
D.An action that adds the IP to a local threat feed
E.A firewall policy that allows the traffic
AnswersA, D

Trigger initiates the automation stitch.

Why this answer

Automation stitches require a trigger to initiate the workflow. In this scenario, the trigger must detect the FortiSandbox verdict (e.g., malicious or clean) to start the automated response. Without a trigger, the stitch has no event to react to, making it non-functional.

Exam trap

The trap here is that candidates often confuse the trigger requirement with other network components like routing or certificates, or mistakenly think a firewall policy allowing traffic is needed for the automation to work, when in fact the action modifies security policies to block the IP.

Full explanation →
533
MCQhard

An administrator runs 'diagnose sys session filter dport 443' and sees the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is a TCP connection that has been active for 3600 seconds and will expire in 3599 seconds
B.The session is a UDP DNS request
C.The session is being blocked by a firewall policy
D.The session is an SSL VPN tunnel
AnswerA

Correct interpretation of fields.

Why this answer

The output shows 'proto=6' which indicates TCP (protocol 6), 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds. The 'proto_state=01' is a TCP state code indicating an established connection. This is a standard FortiGate diagnostic session output.

Exam trap

The trap here is that candidates may misinterpret 'proto=6' as a generic protocol number without recalling that protocol 6 is specifically TCP, leading them to incorrectly associate the output with UDP-based services like DNS or SSL VPN tunnels.

How to eliminate wrong answers

Option B is wrong because UDP uses protocol 17, not protocol 6, and DNS requests typically use UDP port 53, not TCP port 443. Option C is wrong because the output shows an active session with a duration and expiry, indicating the session is allowed and tracked, not blocked; a blocked session would not have a duration or expire value. Option D is wrong because an SSL VPN tunnel is typically encapsulated in UDP (port 443) or uses a different session type, and the output shows a raw TCP session (proto=6) with no indication of VPN encapsulation or tunnel ID.

Full explanation →
534
MCQeasy

An administrator needs to configure a site-to-site IPsec VPN with a remote FortiGate that has a dynamic IP address. Which phase1 parameter must be set to support this?

A.Enable Perfect Forward Secrecy (PFS)
B.Enable NAT traversal
C.Use certificate-based authentication
D.Set mode to aggressive and use a pre-shared key
AnswerD

Aggressive mode allows the responder to initiate without knowing the peer IP; pre-shared key is used for authentication.

Why this answer

When the remote FortiGate has a dynamic IP address, the local FortiGate cannot initiate the VPN because it does not know the remote peer's IP. Setting the phase1 mode to aggressive and using a pre-shared key allows the remote peer to initiate the connection by sending its identity (ID) in the first exchange, enabling the local FortiGate to identify and authenticate the peer without requiring a static IP address for the remote side.

Exam trap

The trap here is that candidates often confuse NAT traversal (which handles NAT devices) with the need for a dynamic IP peer, or they assume certificate-based authentication alone solves the issue, but the key requirement is the ability to identify the peer without a known IP address, which aggressive mode enables.

How to eliminate wrong answers

Option A is wrong because Perfect Forward Secrecy (PFS) is a phase2 parameter that ensures that if a private key is compromised, past session keys are not exposed; it does not address dynamic IP peer identification. Option B is wrong because NAT traversal is used to handle IPsec packets traversing NAT devices by encapsulating them in UDP, not to support a peer with a dynamic IP address. Option C is wrong because certificate-based authentication can be used with either main or aggressive mode, but it does not solve the problem of a dynamic IP peer; aggressive mode with a pre-shared key is specifically required to allow the peer to initiate without a known IP.

Full explanation →
535
MCQmedium

An administrator observes that traffic from a specific subnet is being dropped by the FortiGate. The session table shows the sessions with 'proto_state=01' and 'expire=0'. What does this indicate?

A.The sessions have expired and are being cleaned up
B.The antivirus scanning is causing a delay
C.The sessions are being offloaded to the NPU
D.The firewall policy is blocking the traffic
AnswerA

Expire=0 means the session has timed out.

Why this answer

In FortiGate session tables, 'proto_state=01' indicates a TCP session in the SYN-SENT state (the first step of the three-way handshake), and 'expire=0' means the session has no remaining time-to-live. This combination typically occurs when the session timed out or was reset before completing the handshake, and the entry is now being cleaned up by the session table garbage collector. Option A is correct because these are stale sessions that have expired and are in the process of removal.

Exam trap

The trap here is that candidates may misinterpret 'proto_state=01' as a normal established session or assume 'expire=0' means the session is actively being blocked, rather than recognizing it as a timed-out SYN-SENT session being cleaned up.

How to eliminate wrong answers

Option B is wrong because antivirus scanning delays would not cause 'expire=0' or 'proto_state=01'; AV scanning affects data processing but does not directly set session expiration to zero or alter the TCP state to SYN-SENT. Option C is wrong because NPU offloading is indicated by flags like 'offload' or 'npu' in the session table, not by 'proto_state=01' and 'expire=0'; offloaded sessions maintain normal state and expiration values. Option D is wrong because a firewall policy blocking traffic would result in denied sessions that may not appear in the session table at all, or would show a different state (e.g., 'proto_state=00' or 'deny'), not a SYN-SENT state with zero expiration.

Full explanation →
536
MCQhard

An administrator configures a FortiGate with a management VDOM. Which of the following is true about the management VDOM?

A.The management VDOM supports inter-VDOM routing
B.The management VDOM can be used to route production traffic
C.The management VDOM can be shared across multiple FortiGates in a HA cluster
D.The management VDOM cannot have any firewall policies
AnswerD

The management VDOM is used solely for management; it does not process data traffic and therefore does not have firewall policies.

Why this answer

The management VDOM is a special-purpose VDOM used exclusively for out-of-band management traffic (e.g., GUI, SSH, SNMP). It operates in a separate management plane and cannot contain firewall policies because it is not designed to inspect or forward data-plane traffic. This isolation ensures that management access remains available even if the data-plane VDOMs are overloaded or misconfigured.

Exam trap

The trap here is that candidates confuse the management VDOM with a regular VDOM that can have firewall policies and route traffic, but Fortinet explicitly restricts the management VDOM to a non-data-plane role with no policy enforcement.

How to eliminate wrong answers

Option A is wrong because inter-VDOM routing is a data-plane function that requires firewall policies and routing configurations, which the management VDOM explicitly does not support. Option B is wrong because the management VDOM is strictly for management traffic (e.g., HTTPS, SSH, SNMP) and cannot be used to route production or user data traffic. Option C is wrong because the management VDOM is a per-FortiGate construct; in an HA cluster, each unit maintains its own management VDOM configuration and cannot share it across cluster members.

Full explanation →
537
MCQeasy

Which SD-WAN load balancing algorithm distributes traffic based on the number of active sessions per SD-WAN member?

A.Sessions
B.Source-dest-IP
C.Spillover
D.Volume
AnswerA

Sessions balances by number of active sessions.

Why this answer

The Sessions algorithm in Fortinet SD-WAN distributes traffic by counting the number of active sessions currently traversing each SD-WAN member interface. The member with the fewest active sessions receives the next new session, ensuring a balanced session load across the SD-WAN links. This is distinct from volume-based or hash-based algorithms, as it directly uses session count as the metric.

Exam trap

The trap here is that candidates often confuse 'Sessions' with 'Volume' or 'Spillover', assuming traffic distribution is always based on bandwidth usage rather than session count, which is a distinct metric in Fortinet SD-WAN load balancing.

How to eliminate wrong answers

Option B (Source-dest-IP) is wrong because it uses a hash of source and destination IP addresses to deterministically map traffic to a member, not the number of active sessions. Option C (Spillover) is wrong because it directs traffic to a primary member until a configured bandwidth threshold is exceeded, then spills over to a backup member; it does not consider session counts. Option D (Volume) is wrong because it distributes traffic based on the total bytes transferred per member, not the number of active sessions.

Full explanation →
538
MCQhard

An administrator is integrating a FortiExtender with a FortiGate. The FortiExtender is connected to port5 and configured with a cellular WAN connection. What must be configured on the FortiGate to allow the FortiExtender to provide WAN connectivity as an SD-WAN member?

A.Create a static route to the FortiExtender's management IP to use it as a gateway.
B.Configure port5 as a physical member and assign the FortiExtender's SIM card details.
C.Enable the 'fortiextender' option on port5 and configure the FortiExtender as an SD-WAN member using the virtual wan interface.
D.Use the FortiExtender as a standalone router and configure policy-based routing on the FortiGate.
AnswerC

The FortiExtender creates a virtual interface (e.g., wan or lte) that can be added as an SD-WAN member. Port5 must have the FortiExtender feature enabled.

Why this answer

To integrate a FortiExtender as an SD-WAN member, the FortiGate must enable the 'fortiextender' option on the physical port (port5) to which the FortiExtender is connected. This creates a virtual wan interface that represents the FortiExtender's cellular WAN connection, allowing it to be added as an SD-WAN member for load balancing and failover policies. No static route or SIM card configuration is needed on the FortiGate, as the FortiExtender handles cellular authentication and routing internally.

Exam trap

The trap here is that candidates assume the FortiExtender must be configured as a separate router or that SIM details must be entered on the FortiGate, when in fact the FortiGate only needs to enable the 'fortiextender' option to treat the FortiExtender as a logical SD-WAN member.

How to eliminate wrong answers

Option A is wrong because a static route to the FortiExtender's management IP is not required; the FortiExtender acts as a WAN extension, not a gateway that needs a separate route. Option B is wrong because SIM card details are configured on the FortiExtender itself, not on the FortiGate; port5 must be configured with the 'fortiextender' option, not as a physical SD-WAN member. Option D is wrong because using the FortiExtender as a standalone router with policy-based routing defeats the purpose of SD-WAN integration; the FortiExtender must be managed as a virtual interface on the FortiGate to participate in SD-WAN rules.

Full explanation →
539
MCQmedium

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

A.Run a packet sniffer on the FortiGate to capture traffic between the subnets.
B.Check the session table for session limits and session congestion.
C.Disable hardware acceleration on the FortiGate.
D.Configure SNAT on the policy to translate the source IP.
AnswerB

Peak hour timeouts often indicate session table exhaustion; checking this is the quickest diagnostic step.

Why this answer

Intermittent connectivity during peak hours strongly suggests session table exhaustion or session congestion. The FortiGate's session table has a finite capacity, and when it fills up, new sessions are dropped, causing timeouts. Checking the session table for limits and congestion is the fastest, least intrusive first step to confirm whether the firewall is running out of session resources before performing more complex diagnostics.

Exam trap

The trap here is that candidates often jump to packet capture or hardware acceleration as the first step, overlooking the session table as the most common cause of intermittent peak-hour connectivity issues.

How to eliminate wrong answers

Option A is wrong because running a packet sniffer is a reactive, resource-intensive step that should be taken only after ruling out session table issues; it does not directly reveal session limits or congestion. Option C is wrong because disabling hardware acceleration is a drastic step that can degrade performance and is only warranted if a specific hardware offload bug is suspected, not as a first troubleshooting step for peak-hour timeouts. Option D is wrong because configuring SNAT does not resolve session table exhaustion; it changes the source IP but does not increase the session table capacity or address congestion.

Full explanation →
540
MCQmedium

A FortiGate is configured with a ZTNA access proxy rule for a web application. The administrator wants to enforce that only devices with a specific FortiClient tag (e.g., 'Compliant') can access the application. Where is this tag-based access control configured?

A.In the FortiClient EMS policy
B.In the firewall policy that permits traffic from the ZTNA gateway to the application
C.In the SSL inspection profile
D.In the ZTNA access proxy rule under the ZTNA gateway configuration
AnswerD

The access proxy rule includes conditions such as device tags (e.g., Compliant) to determine if access is allowed.

Why this answer

In FortiGate ZTNA, device posture tags from FortiClient are evaluated in the ZTNA access proxy rule under the ZTNA gateway configuration. The administrator configures the tag match condition directly in the access proxy rule, not in a firewall policy, SSL profile, or EMS policy. Therefore, option D is correct.

Full explanation →
541
MCQeasy

Which FortiGate IPS feature allows administrators to create rules that detect network traffic patterns deviating from normal protocol behavior?

A.Rate-based signatures
B.Custom signatures
C.Protocol anomaly
D.Geo-IP blocking
AnswerC

Protocol anomaly detection is specifically for detecting deviations from protocol standards.

Why this answer

Protocol anomaly detection in FortiGate IPS allows administrators to define rules that identify deviations from standard protocol behavior as defined by RFCs. Unlike signature-based detection, which matches known attack patterns, protocol anomaly detection flags traffic that violates expected protocol structures, such as malformed packets or illegal flag combinations. This enables the detection of zero-day exploits and protocol abuse without requiring a pre-existing signature.

Exam trap

The trap here is that candidates confuse 'protocol anomaly' with 'custom signatures' or 'rate-based signatures,' assuming any custom rule or threshold-based detection can identify protocol deviations, but FortiGate specifically reserves protocol anomaly for RFC-based behavioral analysis, not pattern matching or volumetric thresholds.

How to eliminate wrong answers

Option A is wrong because rate-based signatures are designed to detect traffic patterns based on thresholds (e.g., connections per second) rather than deviations from normal protocol behavior; they focus on volume anomalies, not protocol compliance. Option B is wrong because custom signatures are user-defined patterns (e.g., using the FSL language) that match specific content or byte sequences, not protocol deviations; they rely on known attack signatures, not behavioral analysis. Option D is wrong because Geo-IP blocking filters traffic based on geographic source or destination IP addresses, which is unrelated to protocol behavior or anomaly detection.

Full explanation →
542
MCQmedium

A company uses FortiMail for email security. They want to prevent email spoofing by verifying that incoming emails originate from authorized servers. Which email authentication method should be configured on FortiMail to check the sending server's IP against a published SPF record?

A.SPF verification
B.DKIM verification
C.DMARC verification
D.Sender Policy Framework (SPF) is not supported on FortiMail
AnswerA

SPF checks if the sending IP is authorized by the domain's SPF record.

Why this answer

SPF (Sender Policy Framework) verification on FortiMail checks the sending server's IP address against the SPF record published in the domain's DNS. This directly matches the requirement to verify that incoming emails originate from authorized servers, as SPF is designed to prevent spoofing by validating the envelope sender's domain against a list of permitted IPs.

Exam trap

The trap here is that candidates may confuse SPF verification with DKIM or DMARC, thinking that any of these methods directly check the sending server's IP, when only SPF performs that specific IP-to-record lookup.

How to eliminate wrong answers

Option B (DKIM verification) is wrong because DKIM uses a digital signature to verify that an email was not tampered with during transit and that it came from a domain that signs its messages, but it does not check the sending server's IP against a published record. Option C (DMARC verification) is wrong because DMARC builds on SPF and DKIM to provide a policy for how to handle failures, but it is not the method that directly checks the sending server's IP against an SPF record. Option D (Sender Policy Framework (SPF) is not supported on FortiMail) is wrong because FortiMail fully supports SPF verification as part of its anti-spoofing and anti-phishing capabilities.

Full explanation →
543
MCQhard

A FortiGate is running OSPF with multiple areas. The admin wants to redistribute a static route for 192.168.100.0/24 into OSPF. After configuring 'config router ospf' with 'redistribute static' enabled, the route appears in the OSPF database but is not being advertised to other areas. What is the most likely cause?

A.The 'redistribute static' command needs a route map to filter the route correctly.
B.The static route's administrative distance is too high for OSPF.
C.The router is an ABR and the static route is being redistributed as a type 5 LSA, which is not flooded into stub areas.
D.OSPF must be configured with 'default-information originate' to allow redistribution.
AnswerC

Type 5 LSAs are blocked in stub areas. To redistribute into stub areas, the route must be advertised as a type 7 LSA.

Why this answer

An ABR does not flood Type 5 LSAs (which are generated by redistribution) into stub areas or NSSAs. Since the route appears in the OSPF database on the ABR but is not advertised to other areas, the most likely cause is that the receiving area is a stub area, which by design blocks Type 5 LSAs. The redistribution of a static route into OSPF creates a Type 5 LSA, which is only flooded throughout the AS except into stub areas and NSSAs.

Exam trap

The trap here is that candidates often overlook the impact of stub area restrictions on Type 5 LSAs and mistakenly focus on redistribution syntax or administrative distance, rather than understanding that ABR behavior in stub areas blocks external routes by default.

How to eliminate wrong answers

Option A is wrong because a route map is not required for basic redistribution of a static route; it is optional for filtering or modifying attributes. Option B is wrong because administrative distance is a Cisco concept used for route selection within a router's routing table, not a factor in OSPF LSA flooding or redistribution behavior. Option D is wrong because 'default-information originate' is used to inject a default route into OSPF, not to enable redistribution of static routes; redistribution is already configured with 'redistribute static'.

Full explanation →
544
MCQeasy

An organization wants to implement Network Access Control (NAC) using FortiNAC. The goal is to automatically quarantine any device that does not have the latest antivirus definitions. Which FortiNAC component enforces this policy?

A.FortiNAC Collector
B.FortiNAC Profiler
C.FortiNAC Enforcement Engine
D.FortiNAC Portal
AnswerC

The Enforcement Engine applies the policy actions (e.g., quarantine) based on compliance state.

Why this answer

FortiNAC uses policies to define security requirements. The Enforcement Engine applies the policy by changing the VLAN or applying ACLs on network devices to quarantine non-compliant endpoints.

Full explanation →
545
MCQmedium

A FortiGate administrator configures a ZTNA access proxy rule to allow access to an internal application only if the user's device has the tag 'Compliant'. The tag is assigned by FortiClient EMS. However, a user with a compliant device is still blocked. The admin sees in the ZTNA logs that the tag is not being received. What should the administrator check FIRST?

A.Verify that the FortiClient is connected to the internet
B.Confirm that the ZTNA rule is enabled and using the correct port
C.Check if the application server is reachable from the FortiGate
D.Ensure the EMS connector is configured under Security Fabric > External Connectors
AnswerD

The Endpoint Control connector to EMS must be configured and authorized. Without this, FortiGate cannot receive any tags from EMS.

Why this answer

For ZTNA tags to be sent to FortiGate, the FortiClient must be registered with EMS and the EMS must be configured as an endpoint control connector on FortiGate. If the connector is missing or misconfigured, FortiGate cannot retrieve tags.

Full explanation →
546
MCQmedium

You run the following command on a FortiGate: 'diagnose vpn ike gateway list' and see that the DPD status for a VPN peer is 'dead'. What does this indicate?

A.The remote peer has been manually disconnected from the network
B.The VPN tunnel is still up but the peer is not responding to DPD messages
C.The IKE SA is still active but the IPsec SA has expired
D.The VPN peer has been detected as unreachable and the tunnel is considered down
AnswerD

DPD status 'dead' means the peer is not responding, so FortiGate marks the tunnel as down.

Why this answer

DPD (Dead Peer Detection) is used to check the liveness of a VPN peer. 'Dead' means the peer is not responding to DPD messages, indicating the tunnel is down.

Full explanation →
547
Multi-Selectmedium

A FortiGate is deployed as a LAN edge switch with multiple FortiSwitch units connected. The administrator wants to configure VLANs and manage the switches centrally. Which TWO features must be enabled on the FortiGate to achieve this? (Select TWO.)

Select 2 answers
A.LLDP-MED
B.Configure a separate management VRF
C.Create VLAN interfaces on the FortiGate and assign them to the FortiLink interface
D.FortiLink on the interface connecting to the FortiSwitch
E.STP (Spanning Tree Protocol) on the FortiGate
AnswersC, D

VLANs are defined on the FortiGate and communicated to switches via FortiLink.

Why this answer

VLAN interfaces must be created on the FortiGate and assigned to the FortiLink interface to enable centralized VLAN management. The FortiGate acts as the controller, pushing VLAN configurations to connected FortiSwitch units via the FortiLink tunnel, allowing the administrator to manage all VLANs from a single point without logging into each switch individually.

Exam trap

The trap here is that candidates often think LLDP-MED or STP must be manually configured for switch management, but FortiLink abstracts these protocols and handles them automatically, making options A and E red herrings.

Full explanation →
548
MCQmedium

An administrator is deploying FortiClient with ATP features. They want to ensure that if a process is detected as malicious by the FortiClient machine learning engine, the endpoint is isolated from the network. Which configuration should they use?

A.Create a firewall policy to block traffic from that endpoint
B.Enable 'auto-network-access' in the FortiClient profile
C.Configure an automation stitch with trigger 'FortiClient event' and action 'quarantine endpoint'
D.Enable 'FortiClient quarantine' in the antivirus profile
AnswerC

Automation stitches can respond to FortiClient events and isolate the endpoint.

Why this answer

An automation stitch with the trigger 'FortiClient event' and action 'quarantine endpoint' allows FortiGate to automatically isolate an endpoint when the FortiClient machine learning engine detects a malicious process. This integration leverages FortiGate's Security Fabric to enforce network isolation based on endpoint telemetry, ensuring the compromised host is blocked from communicating with the rest of the network.

Exam trap

The trap here is confusing endpoint file quarantine (antivirus profile) with network quarantine (automation stitch), leading candidates to select Option D, which only addresses local file remediation, not network isolation.

How to eliminate wrong answers

Option A is wrong because creating a firewall policy to block traffic from that endpoint is a manual, static approach that does not automatically respond to the FortiClient machine learning detection; it requires pre-defined IP addresses or user groups and lacks dynamic triggering. Option B is wrong because 'auto-network-access' in the FortiClient profile controls automatic VPN or network access for the client, not isolation of a compromised endpoint; it is unrelated to quarantine actions. Option D is wrong because 'FortiClient quarantine' in the antivirus profile is a legacy setting that quarantines files locally on the endpoint, not the endpoint itself from the network; it does not trigger network isolation via FortiGate.

Full explanation →
549
MCQhard

A FortiGate administrator runs the following CLI command: 'diagnose ips anomaly log' The output shows numerous 'tcp_syn_flood' events from a single source IP. To mitigate this, the administrator wants to block the source IP automatically. Which feature should be used?

A.IPS Custom Signature
B.Local-in Policy
C.IP Block List
D.Automation Stitch
AnswerD

Automation stitches can automate responses to events like syn flood.

Why this answer

The 'diagnose ips anomaly log' command displays anomalies detected by the FortiGate's DoS (Denial of Service) sensor, such as TCP SYN flood events. An Automation Stitch (Option D) is the correct feature to automatically block the source IP because it can trigger a 'Block IP' action based on a 'IPS Anomaly' event, creating an automated response without manual intervention.

Exam trap

The trap here is that candidates often confuse the IP Block List (a static or manually managed list) with the Automation Stitch (the automated engine that can dynamically add entries to that list based on events), leading them to select Option C instead of D.

How to eliminate wrong answers

Option A is wrong because an IPS Custom Signature is used to detect and block specific application-layer attacks (e.g., SQL injection, buffer overflows) based on pattern matching, not to automatically block IPs based on DoS anomaly events like TCP SYN flood. Option B is wrong because a Local-in Policy controls traffic destined to the FortiGate itself (management traffic), not traffic passing through the FortiGate, and cannot automatically block a source IP based on anomaly logs. Option C is wrong because the IP Block List is a static list of manually or dynamically blocked IPs, but it does not provide the automated trigger-and-response mechanism needed to react to an anomaly event in real-time; it is a component that can be used within an Automation Stitch, not the feature itself.

Full explanation →
550
Multi-Selecthard

A network security team is evaluating options for web application security. They need to protect a critical web application from SQL injection and cross-site scripting (XSS) attacks, and they require granular control over HTTP request parameters. Which THREE factors should influence their decision between using FortiGate's WAF profiles versus deploying a dedicated FortiWeb appliance?

Select 3 answers
A.FortiGate's WAF supports integration with FortiSandbox for file upload inspection
B.FortiGate's WAF profiles offer the same level of customization as FortiWeb for signature creation
C.FortiWeb can perform SSL offloading and load balancing, reducing load on the web servers
D.FortiWeb provides dedicated hardware and software optimized for web application security, offering higher throughput and lower latency for WAF processing
E.FortiWeb allows creation of custom signatures for application-layer attacks like SQL injection and XSS with greater flexibility
AnswersC, D, E

FortiWeb can handle SSL termination and distribute traffic, which is beneficial for performance.

Why this answer

FortiWeb is a dedicated web application firewall appliance with specialized hardware and software optimized for WAF processing, offering higher throughput and lower latency compared to the integrated WAF profiles on a FortiGate. Additionally, FortiWeb can perform SSL offloading and load balancing, which reduces the processing burden on web servers and improves overall performance. These capabilities make FortiWeb the superior choice when granular control and high-performance protection against SQL injection and XSS are required.

Exam trap

The trap here is that candidates assume FortiGate's WAF profiles are as feature-rich as FortiWeb, but FortiWeb is purpose-built with dedicated hardware and software for web application security, offering superior performance, customization, and additional features like SSL offloading and load balancing that FortiGate lacks.

Full explanation →
551
MCQeasy

An administrator wants to enforce that only managed FortiClient endpoints with up-to-date antivirus and a specific OS version can access a sensitive internal network via IPsec VPN. Which feature should be used to achieve this?

A.ZTNA tags
B.FortiNAC
C.SAML SSO
D.FortiClient EMS compliance enforcement
AnswerD

FortiClient EMS allows the administrator to define compliance rules and enforce them during VPN connection.

Why this answer

FortiClient EMS can enforce compliance rules such as requiring up-to-date antivirus and specific OS version. When a FortiClient connects to the FortiGate VPN, the FortiGate can check the endpoint's posture via FortiClient EMS and apply a matching firewall policy.

Full explanation →
552
MCQhard

An administrator runs 'diagnose ips anomaly http' and sees many entries with 'type=SQLi' and 'score=0'. What does a score of 0 indicate?

A.The anomaly detection is disabled
B.The traffic showed suspicious patterns but did not meet the threshold
C.The IPS sensor is not applied to any policy
D.The traffic is definitely an SQL injection attack
AnswerB

Score 0 means no anomaly above threshold; it's a low-confidence event.

Why this answer

In Fortinet's IPS anomaly detection, a score of 0 indicates that the traffic exhibited suspicious patterns (e.g., SQLi signatures) but did not accumulate enough anomaly points to meet the configured threshold for triggering an action. This means the traffic was flagged as potentially malicious but was not deemed severe enough to warrant logging or blocking, so it remains in a 'monitoring' state without enforcement.

Exam trap

The trap here is that candidates assume a score of 0 means 'no threat' or 'disabled', but Fortinet uses 0 to indicate a sub-threshold detection that is still tracked, not a lack of detection.

How to eliminate wrong answers

Option A is wrong because a score of 0 does not indicate that anomaly detection is disabled; if detection were disabled, the 'diagnose ips anomaly http' command would not show any entries for that traffic. Option C is wrong because the IPS sensor not being applied to any policy would result in no IPS inspection at all, not a score of 0 with SQLi type entries; the presence of entries proves the sensor is applied. Option D is wrong because a score of 0 explicitly means the traffic did not meet the threshold to be classified as a definite attack; a score above the threshold would indicate a confirmed SQL injection attempt.

Full explanation →
553
MCQhard

A FortiGate admin runs 'diagnose ips anomaly list' and sees many 'tcp_src_session' events from a single internal IP. The admin suspects a scanning attack. What action should be taken to block this traffic without affecting legitimate traffic?

A.Create a firewall rule to block the IP address entirely
B.Create a custom IPS signature to detect and block the scanning pattern
C.Enable 'tcp_src_session' anomaly action to 'block' in the IPS sensor
D.Use a WAF profile to block the IP based on rate
AnswerB

A custom signature can precisely target the scan behavior.

Why this answer

Creating a custom IPS signature allows you to define specific patterns (e.g., multiple TCP SYN packets to different ports from the same source) that match scanning behavior, and then set the action to 'block'. This granular approach blocks only the malicious scanning traffic while permitting legitimate traffic from the same IP, unlike a blanket IP block or a global anomaly action that could impact normal sessions.

Exam trap

The trap here is that candidates often confuse anomaly-based detection (which triggers on aggregate session counts) with signature-based detection (which matches specific packet patterns), leading them to choose Option C, not realizing that blocking the anomaly would indiscriminately drop all traffic from the source IP, including legitimate sessions.

How to eliminate wrong answers

Option A is wrong because blocking the entire IP address would also drop any legitimate traffic from that host, which is too aggressive and not required if only scanning behavior needs to be stopped. Option C is wrong because enabling 'tcp_src_session' anomaly action to 'block' in the IPS sensor would block all traffic from that source IP once the anomaly threshold is exceeded, including legitimate sessions, and does not differentiate between scanning and normal traffic. Option D is wrong because a WAF profile is designed for HTTP/HTTPS web application traffic and cannot block TCP-based scanning patterns at the network layer; it would not inspect or rate-limit raw TCP SYN floods or port scans.

Full explanation →
554
Multi-Selecthard

An administrator is configuring FortiMail to improve email security. Which three of the following features are part of FortiMail's advanced threat protection? (Choose three.)

Select 3 answers
A.Web Filtering
B.Application Control
C.Email Authentication (SPF, DKIM, DMARC)
D.Content Disarm and Reconstruction (CDR)
E.Sandboxing (integration with FortiSandbox)
AnswersC, D, E

FortiMail supports email authentication protocols.

Why this answer

Email Authentication (SPF, DKIM, DMARC) is part of FortiMail's advanced threat protection because it verifies sender identity and prevents email spoofing and phishing. SPF checks the sending server's IP against authorized records, DKIM uses cryptographic signatures to ensure message integrity, and DMARC provides policy enforcement for alignment. These mechanisms collectively reduce the risk of domain impersonation and are integral to FortiMail's anti-phishing capabilities.

Exam trap

The trap here is that candidates confuse FortiGate's UTM features (Web Filtering, Application Control) with FortiMail's specialized email security features, leading them to select options that are not part of FortiMail's advanced threat protection.

Full explanation →
555
MCQmedium

A FortiGate admin configures automation stitches in FortiManager to trigger a script when a specific incident occurs. The script runs but does not produce the expected result. Which FortiAnalyzer feature should the admin use to verify the automation stitch executed correctly?

A.Reports
B.FortiView
C.Playbooks
D.Incident Management
AnswerD

Incidents show automation stitch execution logs.

Why this answer

Incident Management in FortiAnalyzer provides a detailed log of automation stitch execution, including trigger events, script actions, and any errors. This allows the admin to verify whether the stitch ran as expected and to diagnose why the script did not produce the intended result.

Exam trap

The trap here is that candidates confuse FortiAnalyzer's Incident Management with FortiSOAR's Playbooks, or assume FortiView's real-time logs are sufficient for post-execution verification, when in fact Incident Management provides the persistent, searchable audit trail needed for automation stitch debugging.

How to eliminate wrong answers

Option A is wrong because Reports in FortiAnalyzer are used for scheduled or ad-hoc summary data (e.g., traffic trends, security summaries) and do not provide real-time or per-incident execution logs of automation stitches. Option B is wrong because FortiView is a real-time monitoring dashboard for traffic and security events, not a tool for reviewing automation stitch execution history or script output. Option C is wrong because Playbooks are a feature of FortiSOAR, not FortiAnalyzer, and are used for orchestrated incident response workflows, not for verifying FortiManager automation stitch execution.

Full explanation →
556
MCQeasy

Which FortiAnalyzer feature allows an administrator to create a sequence of automated response actions triggered by a specific log event?

A.Reports
B.Incidents
C.Playbooks
D.FortiView
AnswerC

Playbooks define automated response actions based on triggers such as log events.

Why this answer

Playbooks in FortiAnalyzer allow administrators to define a sequence of automated response actions that are triggered by specific log events. This feature enables event-driven automation, such as executing CLI scripts, sending alerts, or integrating with external systems via webhooks, directly from the FortiAnalyzer interface.

Exam trap

The trap here is that candidates often confuse Playbooks with Incidents, assuming Incidents can automate responses, but Incidents are purely for manual or semi-automated case management, not for defining automated action sequences triggered by log events.

How to eliminate wrong answers

Option A is wrong because Reports are used for generating scheduled or on-demand summaries of log data and traffic trends, not for triggering automated responses to individual log events. Option B is wrong because Incidents are containers for grouping related alerts and logs for investigation, but they do not themselves define automated action sequences. Option D is wrong because FortiView provides real-time and historical visualization of network traffic and security events, but it lacks the capability to execute automated response actions based on log triggers.

Full explanation →
557
Multi-Selectmedium

A FortiGate administrator wants to use threat intelligence feeds to block known malicious IP addresses. Which TWO steps are required to accomplish this? (Choose two.)

Select 2 answers
A.Create an external threat feed connector pointing to the IoC source
B.Enable IPS on all policies
C.Configure FortiGuard to push feeds automatically
D.Create a firewall policy with the threat feed as the source or destination
E.Subscribe to FortiSandbox
AnswersA, D

The connector fetches the list of malicious IPs.

Why this answer

An external threat feed connector must be created in FortiGate to import indicators of compromise (IoC) from a third-party source. This connector defines the URL, authentication, and update interval for the feed, allowing FortiGate to consume and store the malicious IP addresses as a local threat feed object.

Exam trap

The trap here is that candidates often confuse the external threat feed connector with FortiGuard push feeds or assume that enabling IPS is necessary to use threat feeds, when in fact the two required steps are creating the connector and then applying it in a firewall policy.

Full explanation →
558
MCQeasy

A network engineer is deploying FortiGate VDOMs and needs to limit the number of VDOMs per FortiGate to comply with licensing. Which command can be used to check the maximum VDOMs allowed?

A.get system status
B.show system vdom
C.execute vdom limit
D.diagnose sys vdom list
AnswerA

Includes 'Max VDOMs' information.

Why this answer

The 'get system status' command displays the current FortiGate system status, including the maximum number of VDOMs allowed by the installed license. This is the correct command to verify the licensed VDOM limit before deploying additional VDOMs.

Exam trap

The trap here is that candidates confuse operational commands like 'show system vdom' or 'diagnose sys vdom list' with the license-aware command 'get system status', which is the only one that shows the licensed VDOM cap.

How to eliminate wrong answers

Option B is wrong because 'show system vdom' is a FortiOS command that lists configured VDOMs and their status, but it does not display the licensed maximum VDOM limit. Option C is wrong because 'execute vdom limit' is not a valid FortiOS command; there is no such command to check or set the VDOM limit. Option D is wrong because 'diagnose sys vdom list' is a diagnostic command that shows operational VDOM information, such as IDs and states, but it does not reveal the licensed maximum number of VDOMs.

Full explanation →
559
MCQmedium

An administrator configures two VDOMs as shown in the exhibit. They create an inter-VDOM link between VDOM1 and VDOM2. They then add a firewall policy in VDOM1 allowing traffic from port1 to the inter-VDOM link, and a policy in VDOM2 allowing traffic from the inter-VDOM link to port2. However, traffic from 192.168.1.10 to 10.10.10.50 fails. What is the most likely cause?

A.Firewall policies are not correctly configured
B.The inter-VDOM link is not configured
C.Missing route in VDOM1 for the 10.10.10.0/24 network
D.The allowaccess setting on port2 does not include ping
AnswerC

VDOM1 needs a route to the destination network via the inter-VDOM link.

Why this answer

Inter-VDOM link traffic requires routing in both VDOMs. Even with correct firewall policies, VDOM1 must have a route to the destination network (10.10.10.0/24) pointing to the inter-VDOM link interface. Without this route, VDOM1 drops the packet before it can be forwarded across the link, causing the failure.

Exam trap

The trap here is that candidates assume firewall policies alone control inter-VDOM traffic, overlooking that routing is a prerequisite for forwarding packets across the inter-VDOM link.

How to eliminate wrong answers

Option A is wrong because the firewall policies are correctly configured: VDOM1 allows traffic from port1 to the inter-VDOM link, and VDOM2 allows traffic from the inter-VDOM link to port2. Option B is wrong because the inter-VDOM link is explicitly stated as created, so it exists. Option D is wrong because the allowaccess setting on port2 controls management access (e.g., ping, HTTPS) to the interface itself, not transit traffic passing through the interface; transit traffic is governed by firewall policies and routing.

Full explanation →
560
MCQhard

An administrator runs 'get router info routing-table bgp' and sees that a route for 10.20.0.0/16 is learned via BGP from a neighbor. However, the route does not appear in the routing table. The administrator checks the BGP configuration and sees that 'network 10.20.0.0 255.255.0.0' is not configured under BGP. What is the most likely reason?

A.A route map is filtering the received route
B.The route is a default route (0.0.0.0/0) and is being suppressed
C.The BGP neighbor is not in the Established state
D.The route is not in the routing table because BGP requires the network statement to originate the route
AnswerA

Even though the route is learned, it may be filtered by an inbound route map before being installed in the routing table.

Why this answer

The route for 10.20.0.0/16 is learned via BGP from a neighbor and appears in the BGP table, but it is not installed in the routing table. The most likely reason is that a route map is filtering the received route, preventing it from being installed. Since the network statement is not configured under BGP, the route is not originated locally, but it can still be received from a neighbor; however, an inbound or outbound route map can deny the route from entering the routing table.

Exam trap

The trap here is that candidates often assume a missing 'network' statement prevents any BGP route from being installed, but the network statement only affects route origination, not the installation of received routes from a neighbor.

How to eliminate wrong answers

Option B is wrong because the route is a specific prefix (10.20.0.0/16), not a default route (0.0.0.0/0), and default route suppression is unrelated to the absence of a network statement. Option C is wrong because the BGP table shows the route is learned from a neighbor, which requires the BGP session to be in the Established state; if the neighbor were not Established, the route would not appear in the BGP table at all. Option D is wrong because the network statement is only required for originating a route into BGP, not for receiving routes from a neighbor; received routes can be installed in the routing table without a network statement, provided no filters block them.

Full explanation →
561
MCQhard

An admin runs 'diagnose sys session filter dport 443' and sees the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?

A.The session is being blocked by a firewall policy
B.The session is in SYN_SENT state, waiting for a reply
C.The session is established and has been active for 1 hour
D.The session is in TIME_WAIT state after a FIN
AnswerC

State '01' means established; duration is 3600 seconds = 1 hour.

Why this answer

The output shows `proto=6` (TCP), `proto_state=01` (ESTABLISHED in Fortinet's session table), `duration=3600` seconds (1 hour), and `expire=3599` seconds (remaining lifetime). This combination indicates a fully established TCP session that has been active for one hour and is still valid, not blocked or in a transitional state.

Exam trap

The trap here is that candidates confuse `proto_state=01` with a blocking state or a handshake-in-progress state, when in fact it specifically indicates an established TCP connection in Fortinet's session table.

How to eliminate wrong answers

Option A is wrong because a blocked session would not show a `proto_state=01` (ESTABLISHED) or have a non-zero duration/expire; blocked sessions are typically dropped before a session entry is created or show a different state. Option B is wrong because `proto_state=01` corresponds to ESTABLISHED, not SYN_SENT; SYN_SENT is represented by `proto_state=02` in FortiOS session table. Option D is wrong because TIME_WAIT is represented by `proto_state=04` or `05` after a FIN exchange, not `01`, and the duration/expire values indicate an active session, not one in a closing state.

Full explanation →
562
MCQmedium

An administrator configures a WAF profile on FortiGate to protect a web application. However, the administrator notices that SQL injection attacks are not being blocked. What should the administrator check first?

A.The SQL injection signatures are enabled in the WAF profile
B.The WAF profile is attached to the correct firewall policy
C.The FortiGate has a valid Advanced Web Protection subscription
D.The web application is using HTTPS and SSL inspection is configured
AnswerA

WAF profiles have signature sets; SQL injection must be enabled.

Why this answer

SQL injection attacks are blocked by specific signatures within the WAF profile. If these signatures are not enabled, the WAF will not inspect HTTP requests for SQL injection patterns, allowing attacks to pass through. The administrator must verify that the SQL injection signatures are toggled on under the WAF profile's signature configuration.

Exam trap

The trap here is that candidates often assume attaching the WAF profile to a firewall policy is sufficient, overlooking the granular signature enablement required within the profile itself.

How to eliminate wrong answers

Option B is wrong because even if the WAF profile is attached to the correct firewall policy, it will not block SQL injection if the signatures themselves are disabled; the profile attachment is a prerequisite but not the root cause. Option C is wrong because a valid Advanced Web Protection subscription is required for the WAF feature to be available, but if the profile is already configured and applied, the subscription is active; the issue is signature enablement, not licensing. Option D is wrong because HTTPS and SSL inspection affect decryption of traffic, but SQL injection signatures operate on the decrypted HTTP payload; if SSL inspection is not configured, the WAF cannot inspect encrypted traffic, but the question states attacks are not being blocked, implying traffic is reaching the WAF, so the issue is signature enablement, not SSL inspection.

Full explanation →
563
MCQhard

A FortiGate administrator configures a ZTNA rule with inline CASB to control access to a SaaS application. Users can access the application but the CASB controls are not being applied. What is the most likely reason?

A.The firewall policy is configured for flow-based inspection
B.SSL inspection is not enabled
C.The CASB profile is not applied to the ZTNA rule
D.The SaaS application is not supported by FortiGate CASB
AnswerA

Inline CASB requires proxy-based inspection; flow-based mode bypasses CASB processing.

Why this answer

Inline CASB requires a proxy-based firewall policy that intercepts traffic to the SaaS application. If the policy is using flow-based inspection, CASB will not be invoked. Inline CASB works only with proxy-based inspection.

Full explanation →
564
MCQeasy

Which of the following best describes the function of FortiDeceptor in an enterprise network?

A.It provides endpoint detection and response (EDR) capabilities on workstations.
B.It deploys decoys and lures to detect attackers inside the network.
C.It acts as a web application firewall for protecting web servers.
D.It provides sandboxing for advanced malware analysis.
AnswerB

FortiDeceptor uses deception technology to detect lateral movement.

Full explanation →
565
Multi-Selectmedium

An administrator notices that some traffic through the FortiGate is not being inspected by the application control profile. Which TWO reasons could explain this? (Choose two.)

Select 2 answers
A.The inspection mode is set to proxy-based
B.The application control signatures are outdated
C.The FortiGate has high memory usage
D.The application control profile is disabled
E.Traffic matches a different policy without the application control profile
AnswersD, E

Incorrect. If the profile is disabled globally, no traffic would be inspected; but the question specifies 'some traffic' not being inspected, which points to a per-policy issue.

Why this answer

The two valid reasons are that traffic may match a different policy without the application control profile (E), and that the application control profile may be disabled on the policy the traffic hits (D). Option A is incorrect because proxy-based inspection is required for application control; setting it to proxy-based enables inspection. Option B is incorrect because outdated signatures still allow inspection, albeit with reduced effectiveness.

Option C is incorrect because high memory usage may impact performance but does not entirely prevent inspection.

Exam trap

Candidates often confuse proxy-based inspection with disabling application control. In reality, proxy-based mode is necessary for deep application control inspection. The real reason for missed inspection is typically policy misconfiguration—traffic hitting a policy without the profile applied.

Full explanation →
566
MCQhard

An administrator configures an HA cluster with two FortiGates using an FGCP active-passive configuration. After a failover, the new primary FortiGate shows all sessions are lost. The administrator has 'sync session' enabled in the HA configuration. What is the MOST likely reason sessions were not synchronized?

A.The HA heartbeat interface is overloaded, causing session synchronization packets to be dropped
B.The passive unit's 'session-pickup' setting is disabled
C.The 'failover-monitor' interface is down on the active unit, preventing session sync
D.The 'session-ttl' setting is set to zero on the active unit
AnswerA

Session synchronization uses the heartbeat link; if it is overloaded or has high latency, session sync packets can be lost, leading to session loss after failover.

Why this answer

In an FGCP active-passive cluster, session synchronization relies on the heartbeat interface to transmit session-pickup packets from the active unit to the passive unit. If the heartbeat interface is overloaded (e.g., due to excessive traffic or misconfigured bandwidth), these packets can be dropped, causing the passive unit to lack the session table after a failover. The fact that 'sync session' is enabled but sessions are still lost points directly to a transport issue on the heartbeat link, not a configuration or policy problem.

Exam trap

The trap here is that candidates often assume 'sync session' alone guarantees session pickup, overlooking that the heartbeat interface must have sufficient capacity to carry the synchronization traffic without drops.

How to eliminate wrong answers

Option B is wrong because 'session-pickup' is a global setting that must be enabled on both units for session synchronization to work; if it were disabled, sessions would never sync, but the question states 'sync session' is enabled, implying the feature is active. Option C is wrong because the 'failover-monitor' interface monitors link status for triggering failover, not for session synchronization; a down failover-monitor interface would cause a failover event, not prevent session sync packets from being sent. Option D is wrong because 'session-ttl' controls the timeout for idle sessions, not the synchronization process; setting it to zero would cause sessions to expire immediately, but the symptom here is that sessions are lost after failover, not that they expire prematurely.

Full explanation →
567
Multi-Selecthard

An organization uses FortiGate with OSPF and BGP. Recently, routes from BGP are not being preferred over OSPF routes, causing suboptimal routing. The administrator wants to ensure BGP routes are preferred. Which two actions can achieve this? (Choose two.)

Select 2 answers
A.Decrease the administrative distance of BGP routes to 5.
B.Configure route-map to set metric to 1 on BGP routes.
C.Increase the administrative distance of OSPF routes to 120.
D.Set a higher weight on BGP routes for the prefixes.
AnswersA, C

Decreasing BGP AD to 5 makes it more preferred over OSPF AD 110.

Why this answer

Decreasing the administrative distance (AD) of BGP routes to 5 makes them more trustworthy than OSPF routes (default AD 110). Since a lower AD is preferred, BGP routes will be installed in the routing table over OSPF routes, ensuring BGP is preferred for forwarding decisions.

Exam trap

The trap here is that candidates confuse inter-protocol route selection (governed by administrative distance) with intra-protocol BGP path selection attributes (like weight, local preference, or metric), leading them to incorrectly choose options that modify BGP-specific attributes that have no effect on OSPF vs. BGP preference.

Full explanation →
568
Multi-Selecthard

Which THREE actions should be taken to optimize FortiGate ATP performance while maintaining security?

Select 3 answers
A.Implement allow lists for trusted IP addresses to bypass scanning
B.Disable unnecessary security profiles to reduce CPU load
C.Enable proxy-based inspection for all traffic
D.Enable flow-based inspection for antivirus and IPS
E.Use SSL certificate inspection only for trusted categories
AnswersA, D, E

Bypassing scanning for trusted sources improves performance.

Why this answer

Implementing allow lists for trusted IP addresses to bypass scanning (Option A) reduces unnecessary processing of traffic that is known to be safe, thereby optimizing FortiGate ATP performance without compromising security. This approach leverages the FortiGate's ability to exempt trusted sources from deep inspection, which lowers CPU and memory load while maintaining protection for untrusted traffic.

Exam trap

The trap here is that candidates often assume disabling security profiles (Option B) is acceptable for performance optimization, but the question explicitly requires maintaining security, making this a violation of the core constraint.

Full explanation →
569
MCQhard

A FortiGate is deployed with two ISPs and SD-WAN. The organization uses OSPF to exchange routes with a remote branch. The administrator notices that the FortiGate is not installing OSPF-learned routes into the routing table. The OSPF configuration is verified to be correct, and neighbors are established. Which configuration could be causing the issue?

A.The SD-WAN health-check is configured with 'update-static-route' and is overriding OSPF routes.
B.The administrative distance of OSPF is set to 200, which is higher than the default 110.
C.A distribute-list configured under OSPF is filtering the routes from being installed.
D.The OSPF interface is configured as 'passive', which prevents route exchange.
AnswerC

A distribute-list in OSPF can filter which routes are installed into the routing table, even if neighbors are up.

Why this answer

A distribute-list applied under OSPF can filter routes from being installed into the routing table even when OSPF neighbors are fully established and the OSPF database contains the routes. This is a common cause of routes being learned but not installed, as the filter operates after the SPF calculation and before route insertion.

Exam trap

The trap here is that candidates assume OSPF neighbors being up and routes appearing in the OSPF database guarantee route installation, but a distribute-list can silently block installation without affecting neighbor adjacency or the LSDB.

How to eliminate wrong answers

Option A is wrong because the SD-WAN health-check with 'update-static-route' only affects static routes, not OSPF-learned routes; it cannot override OSPF routes in the routing table. Option B is wrong because the default administrative distance for OSPF is 110, and setting it to 200 would make OSPF routes less preferred but would not prevent them from being installed if no better route exists; the question states routes are not installed at all, not that they are overridden. Option D is wrong because a passive OSPF interface prevents sending or receiving OSPF hellos and thus prevents neighbor formation, but the question states neighbors are established, so passive configuration cannot be the issue.

Full explanation →
570
MCQmedium

A FortiGate is configured with multiple VRF instances. The administrator needs to ensure that traffic from VRF 10 can reach a server in VRF 20. Which configuration is required?

A.Enable inter-VRF routing by setting 'vrf-leak enable' on the VRF instances
B.Configure a firewall policy that allows traffic between the VRFs
C.Place both interfaces in the same VRF
D.Use static routes with the appropriate VRF tags to leak routes between VRFs
AnswerD

Route leaking can be done with static routes or redistribution.

Why this answer

Inter-VRF route leaking in FortiGate is achieved by configuring static routes with the 'vrf' tag to specify the source VRF and using the 'dst-vrf' or 'vrf-leak' settings to export routes into the destination VRF. This allows traffic from VRF 10 to reach a server in VRF 20 by ensuring the necessary routes are present in both VRFs without merging the VRFs.

Exam trap

The trap here is that candidates often assume a firewall policy alone can enable inter-VRF communication, forgetting that routing must first be established between the VRFs via route leaking or static routes with VRF tags.

How to eliminate wrong answers

Option A is wrong because 'vrf-leak enable' is not a valid command in FortiGate; route leaking is done via static routes or policy-based routing, not by enabling a VRF-level toggle. Option B is wrong because a firewall policy alone cannot route traffic between VRFs; it only controls access, but without proper route leaking, the traffic will not have a valid path to the destination VRF. Option C is wrong because placing both interfaces in the same VRF defeats the purpose of VRF segmentation and does not achieve inter-VRF routing; it simply merges the VRFs.

Full explanation →
571
MCQmedium

A FortiGate is running OSPF with multiple areas. The administrator needs to redistribute a static route into OSPF. Which command will correctly configure redistribution of static routes into OSPF process 10?

A.config router ospf config redistribute edit static set status enable next end end
B.config router policy set redistribute static end
C.config router static set redistribute ospf end
D.config router ospf set redistribute static enable end
AnswerD

This is the correct syntax to enable redistribution of static routes into OSPF.

Why this answer

In FortiOS, the command to redistribute static routes into OSPF is configured directly under the OSPF process using `set redistribute static enable` within `config router ospf`. This enables the redistribution of static routes into OSPF process 10, as specified in the question.

Exam trap

The trap here is that candidates often confuse the FortiOS syntax with Cisco IOS, where redistribution is configured under `router ospf` with `redistribute static subnets`, leading them to choose Option A which mimics a Cisco-style configuration block, but FortiOS uses a flat `set redistribute static enable` command instead.

How to eliminate wrong answers

Option A is wrong because the `config redistribute` subcommand under OSPF is used for route redistribution within OSPF, but the correct syntax for enabling redistribution of static routes is `set redistribute static enable` at the OSPF process level, not a separate `edit static` block. Option B is wrong because `config router policy` is not a valid command in FortiOS for OSPF redistribution; route policies are configured under `config router policy` but redistribution is set within the OSPF process itself. Option C is wrong because `config router static` is used for static route configuration, not for OSPF redistribution; the `set redistribute ospf` command does not exist in this context.

Full explanation →
572
Multi-Selecthard

A FortiGate is configured with BGP to an SD-WAN member link. The administrator wants to prefer one link over another for specific routes based on AS path length. Which THREE configurations can influence BGP path selection? (Choose three.)

Select 3 answers
A.Set the metric (MED) to a lower value on the desired link.
B.Use a route map to prepend AS numbers to the AS path for the less preferred link.
C.Configure the 'set aspath' command in a route map to change the AS path.
D.Set a higher local preference on the desired link.
E.Configure weight on the neighbor to prefer routes from that neighbor.
AnswersB, D, E

AS path prepending makes the path longer, thus less preferred.

Why this answer

Prepending AS numbers to the AS path of the less preferred link artificially lengthens the AS path, making that route less attractive in BGP path selection. BGP prefers the shortest AS path, so the link without prepending will be chosen for the specific routes.

Exam trap

The trap here is that candidates confuse 'set aspath' (which replaces the entire AS path) with AS path prepending, or they incorrectly think MED directly relates to AS path length, when in fact MED is a separate metric that only applies within the same AS.

Full explanation →
573
Multi-Selecteasy

An administrator wants to enforce that only devices with the latest antivirus signatures and a corporate disk encryption solution can access a sensitive application via ZTNA. Which two FortiClient EMS components must be configured? (Choose two.)

Select 2 answers
A.Device posture checks
B.VPN tunnels
C.SAML SSO
D.ZTNA tags
AnswersA, D

Device posture checks verify compliance criteria like AV signatures and encryption.

Why this answer

ZTNA tags define compliance requirements, and device posture checks evaluate endpoint security state. Together they enable conditional access based on endpoint compliance.

Full explanation →
574
Drag & Dropmedium

Drag and drop the steps to configure a FortiGate as a DHCP server into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The correct sequence to configure a FortiGate as a DHCP server is: first select the interface that will serve DHCP, then enable DHCP on that interface, set the IP address scope (range), configure additional options such as default gateway and DNS servers, and finally apply the configuration. This order ensures dependencies are met and the configuration is valid.

Full explanation →
575
MCQmedium

An administrator configures inter-VDOM routing between VDOMs A and B. Both VDOMs are on the same FortiGate. The admin creates a policy allowing traffic from VDOM A to VDOM B. Traffic from VDOM A to VDOM B fails. What is the most likely cause?

A.VDOM A and VDOM B must be in the same administrative VDOM
B.The VDOMs are in transparent mode
C.There is no firewall policy in VDOM B to allow the return traffic
D.The inter-VDOM link is not configured
AnswerC

Inter-VDOM traffic requires policies in both VDOMs. The policy in VDOM A allows traffic to VDOM B, but a policy in VDOM B must permit the return traffic.

Why this answer

In a FortiGate inter-VDOM routing setup, traffic initiated from VDOM A to VDOM B requires a firewall policy in VDOM B to permit the return traffic. Without this policy, the FortiGate's stateful inspection engine drops the return packets because no session exists in VDOM B's session table. This is a common misconfiguration where administrators only create a policy in the source VDOM.

Exam trap

The trap here is that candidates assume a single policy in the source VDOM is sufficient, overlooking that FortiGate's stateful inspection requires explicit policies in both VDOMs for bidirectional traffic flow.

How to eliminate wrong answers

Option A is wrong because administrative VDOMs are a management concept and do not affect inter-VDOM routing; VDOMs A and B can be in different administrative domains. Option B is wrong because transparent mode VDOMs can still participate in inter-VDOM routing if configured with inter-VDOM links, and the question does not indicate transparent mode is the issue. Option D is wrong because the administrator explicitly configured inter-VDOM routing, implying the inter-VDOM link is already set up; the failure is due to missing return traffic policy, not the link itself.

Full explanation →
576
MCQeasy

Which Fortinet product is designed specifically to detect and deceive attackers by creating decoy systems and luring them away from real assets?

A.FortiDeceptor
B.FortiSandbox
C.FortiEDR
D.FortiWeb
AnswerA

FortiDeceptor uses decoys to detect and divert attackers.

Why this answer

FortiDeceptor is Fortinet's dedicated deception-based threat detection solution. It creates realistic decoy systems (honeypots) and lures attackers away from real assets, providing early detection and threat intelligence without relying on signatures. This aligns with the question's specific requirement for a product designed to detect and deceive attackers using decoys.

Exam trap

The trap here is that candidates often confuse FortiSandbox's sandboxing (which also uses isolated environments) with deception technology, but sandboxing analyzes files while deception lures attackers with decoys.

How to eliminate wrong answers

Option B (FortiSandbox) is wrong because it is a malware analysis and detection platform that executes suspicious files in a sandboxed environment to identify threats, not a deception technology that creates decoy systems. Option C (FortiEDR) is wrong because it focuses on endpoint detection, response, and real-time threat hunting on endpoints, not on deploying decoys to lure attackers. Option D (FortiWeb) is wrong because it is a web application firewall (WAF) that protects web servers from application-layer attacks, not a deception-based system for luring attackers away from assets.

Full explanation →
577
MCQhard

A network engineer is designing a FortiGate HA cluster with two units operating in active-active mode. The cluster will be placed in a VDOM-enabled environment. The engineer wants to ensure that traffic from a specific VDOM is load-balanced across both units based on source IP address. Which setting must be configured on the cluster to achieve this?

A.Configure randomize-vip under config system ha
B.Configure a virtual cluster with load-balance method source IP
C.Configure vdom-load-balance under config system ha
D.Enable session pickup and set session-pickup-delay to 0
AnswerB

Virtual cluster with load-balance method distributes traffic per source IP.

Why this answer

In a VDOM-enabled active-active HA cluster, per-VDOM load balancing is achieved by configuring a virtual cluster and setting the load-balance method to source IP. This allows the cluster to distribute traffic for that specific VDOM across both units based on the source IP hash, ensuring session persistence while balancing the load.

Exam trap

The trap here is that candidates often confuse 'vdom-load-balance' with a real command, or assume that session pickup alone can distribute traffic, when in fact virtual clusters with an explicit load-balance method are required for per-VDOM source IP-based load balancing.

How to eliminate wrong answers

Option A is wrong because 'randomize-vip' randomizes the unit that handles traffic for a virtual IP (VIP) across the cluster, but it does not provide per-VDOM source IP-based load balancing; it is used for VIP load distribution without VDOM awareness. Option C is wrong because 'vdom-load-balance' is not a valid command under 'config system ha'; the correct approach is to use virtual clusters with a specified load-balance method. Option D is wrong because session pickup and session-pickup-delay relate to session synchronization and failover behavior, not to load balancing traffic across units in active-active mode.

Full explanation →
578
MCQhard

An SD-WAN rule has two members: port1 (SLA target latency < 10ms) and port2 (SLA target latency < 20ms). The administrator runs 'diagnose sys sdwan sla-check' and sees that both members meet SLA. However, all traffic is going through port2. What is the MOST likely reason?

A.The SD-WAN strategy is set to 'load balancing' and the load balancing algorithm is 'spillover'
B.The SD-WAN strategy is set to 'manual'
C.The SD-WAN rule is configured with 'set service' that does not match the traffic
D.The 'update-static-route' is disabled on the SD-WAN
AnswerC

If the rule's service (application) does not match the traffic, the rule is not applied, and traffic uses the default route or another rule.

Why this answer

If the SD-WAN rule has a 'set service' filter that does not match the traffic being tested (e.g., it only applies to HTTP traffic while the test traffic is ICMP or UDP), the rule will not be used for that traffic, causing the traffic to fall through to a default route or another rule that uses port2. Even though both members meet SLA, the traffic is not matched by the rule, so the SD-WAN load-balancing or strategy logic never applies.

Exam trap

The trap here is that candidates assume SLA compliance alone determines traffic distribution, overlooking that the SD-WAN rule must first match the traffic via service filters before any strategy or load-balancing logic applies.

How to eliminate wrong answers

Option A is wrong because 'spillover' algorithm would send traffic to port1 until its bandwidth threshold is exceeded, then spill to port2; with both members meeting SLA, traffic would initially go to port1, not exclusively port2. Option B is wrong because 'manual' strategy requires explicit interface selection per session or policy, and if both members meet SLA, the administrator would have to manually force port2; the question states all traffic goes through port2 without manual intervention, which contradicts manual mode. Option D is wrong because 'update-static-route' being disabled only prevents the SD-WAN from dynamically updating static routes based on SLA status; it does not cause traffic to bypass a rule or force all traffic to a specific member.

Full explanation →
579
MCQhard

A FortiGate administrator notices that the traffic log shows sessions being dropped due to 'policy deny' even though a permit policy exists. The administrator checks the policy list and sees the policy is in the correct order. What could be a reason for this?

A.The session is already established and the policy change is not applied to existing sessions
B.The policy is disabled
C.The policy has an incorrect schedule
D.The traffic is being processed by a different VDOM than expected
AnswerD

If traffic is entering the wrong VDOM, it may not match the intended policy.

Why this answer

FortiGate VDOMs operate as independent virtual firewalls with separate routing and policy tables. If traffic enters a VDOM that does not contain the permit policy, the FortiGate will evaluate it against the policies within that VDOM only, resulting in a 'policy deny' drop even though a permit policy exists in a different VDOM. The administrator must verify that the traffic is being processed by the correct VDOM, typically by checking the ingress interface's VDOM association.

Exam trap

The trap here is that candidates assume a permit policy anywhere in the system applies to all traffic, forgetting that VDOMs create strict administrative boundaries where policies are not shared or visible across VDOMs.

How to eliminate wrong answers

Option A is wrong because existing sessions are not affected by policy changes; the question states the traffic log shows sessions being dropped, implying new sessions are being evaluated against the current policy set, not that old sessions are being disrupted. Option B is wrong because if the policy were disabled, it would not appear in the policy list as a permit policy, or the administrator would have noticed it is grayed out or marked as disabled in the GUI; the question explicitly says a permit policy exists. Option C is wrong because an incorrect schedule would cause the policy to be inactive at the time of the traffic, but the traffic log would typically show 'policy deny (schedule)' or a similar specific message, not a generic 'policy deny'; moreover, the administrator would likely check the schedule as part of troubleshooting.

Full explanation →
580
MCQmedium

An administrator configures a prefix list to filter routes received from a BGP neighbor. The prefix list permits 192.168.0.0/16 le 24. Which routes are permitted?

A.Only routes with prefix length exactly 16 within 192.168.0.0/16
B.Only routes with prefix length exactly 24 within 192.168.0.0/16
C.Any route with prefix length greater than 24 within 192.168.0.0/16
D.Any route with prefix length between 16 and 24 inclusive, starting with 192.168
AnswerD

The prefix list allows 192.168.0.0/16 and any more specific route up to /24 (i.e., le 24).

Why this answer

The prefix list `192.168.0.0/16 le 24` permits any route that matches the prefix `192.168.0.0/16` and has a prefix length between 16 and 24 inclusive. The `le` (less-than-or-equal-to) operator sets the maximum prefix length, so routes with lengths 16, 17, 18, 19, 20, 21, 22, 23, and 24 are all allowed, as long as they fall within the 192.168.0.0/16 network.

Exam trap

The trap here is that candidates often misinterpret `le 24` as meaning 'length exactly 24' or 'lengths less than 24', when in fact it means 'lengths from the network prefix length up to and including 24'.

How to eliminate wrong answers

Option A is wrong because it incorrectly restricts the prefix length to exactly 16, ignoring the `le 24` modifier that permits longer prefixes up to 24. Option B is wrong because it incorrectly restricts the prefix length to exactly 24, ignoring the base prefix length of 16 and the range allowed by `le`. Option C is wrong because it states prefix lengths greater than 24 are permitted, but `le 24` explicitly limits the maximum prefix length to 24, so lengths 25 or longer are denied.

Full explanation →
581
MCQhard

A FortiGate has two VDOMs: Sales and Engineering. The admin wants to allow the Engineering VDOM to manage the Sales VDOM's administrator accounts. What configuration is required?

A.Set the management VDOM to Engineering and configure Sales to accept admin connections from Engineering's IP
B.Use inter-VDOM routing to forward admin traffic
C.Enable VDOM sharing on the local-in policy
D.Create a super_admin account in Sales VDOM
AnswerA

This allows Engineering to manage Sales admins.

Why this answer

To allow the Engineering VDOM to manage the Sales VDOM's administrator accounts, the management VDOM must be set to Engineering, and the Sales VDOM must be configured to accept admin connections from Engineering's IP address. This is done via the 'set management-vdom' command under the Sales VDOM and ensuring the Sales VDOM's local-in policy permits HTTPS/SSH traffic from the Engineering VDOM's management IP. This enables cross-VDOM administrative management without requiring inter-VDOM routing or shared policies.

Exam trap

The trap here is that candidates confuse inter-VDOM routing (data plane) with management-plane cross-VDOM admin access, leading them to select Option B, or they assume a super_admin account in the target VDOM is sufficient, missing the requirement for the management VDOM to be set on the source VDOM.

How to eliminate wrong answers

Option B is wrong because inter-VDOM routing forwards data traffic between VDOMs, not management or administrative control traffic; admin connections use the management plane, not the data plane. Option C is wrong because VDOM sharing on a local-in policy does not exist; local-in policies control traffic destined to the FortiGate itself, and VDOM sharing is a separate feature for resources like routes or firewall policies, not for admin access. Option D is wrong because a super_admin account in the Sales VDOM would only grant full privileges within Sales, not allow the Engineering VDOM to manage Sales accounts; cross-VDOM admin management requires the management VDOM configuration.

Full explanation →
582
Multi-Selectmedium

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish Phase 1. The debug output shows 'no acceptable proposal'. Which TWO configuration parameters should be checked to resolve this issue?

Select 2 answers
A.Encryption algorithm
B.Diffie-Hellman group
C.IKE version
D.Pre-shared key
E.Local and remote subnets
AnswersA, B

Mismatched encryption algorithms cause proposal failure.

Why this answer

The 'no acceptable proposal' error indicates that the two IPsec peers cannot agree on a Phase 1 proposal. The encryption algorithm and Diffie-Hellman group are both mandatory parameters in the IKE proposal that must match exactly between peers. If either parameter differs, the negotiation fails with this error.

Exam trap

The trap here is that candidates often confuse Phase 1 and Phase 2 parameters, incorrectly selecting local/remote subnets (a Phase 2 setting) when the error occurs during Phase 1 negotiation.

Full explanation →
583
MCQhard

A company runs a FortiGate 600E in NAT/Route mode. They have a site-to-site VPN to a partner using route-based VPN with BGP. Recently, they added a new subnet 192.168.50.0/24 behind the FortiGate. The BGP session is up, and the route is being advertised to the partner. However, traffic from the partner to the new subnet fails. The FortiGate's routing table shows the route to 192.168.50.0/24 is present via the VPN interface. Firewall policies allow the traffic. A packet capture on the FortiGate's internal interface shows the partner's traffic arriving but no SYN-ACK being sent back. The FortiGate's session table shows sessions in 'SYN_RECV' state for the new subnet. What is the most likely cause?

A.The reverse path forwarding (RPF) check is dropping the incoming SYN.
B.The firewall policy is not configured with the correct source interface.
C.The BGP route advertisement is being filtered by a route map on the partner side.
D.The Phase 2 selector for the VPN does not include the new subnet, so the FortiGate does not encrypt the reply traffic.
AnswerD

The SYN is received but the return traffic cannot be encrypted because the Phase 2 selector does not match the new subnet, causing asymmetric routing.

Why this answer

In a route-based VPN, the Phase 2 selectors define which traffic is allowed to be encrypted and decrypted. Even though BGP advertises the new subnet 192.168.50.0/24, if the Phase 2 selector on either side does not include this subnet, the FortiGate will not encrypt the reply traffic. The packet capture shows the SYN arriving, but no SYN-ACK is sent because the FortiGate cannot find a matching Phase 2 proposal to encrypt the response, causing the session to remain in SYN_RECV state.

Exam trap

The trap here is that candidates assume BGP route advertisement alone ensures traffic flow, overlooking that IPsec Phase 2 selectors must explicitly match the new subnet for encryption to occur.

How to eliminate wrong answers

Option A is wrong because the RPF check would drop the incoming SYN packet itself, but the packet capture shows the SYN arriving successfully, and the session table shows SYN_RECV, indicating the SYN was accepted and a SYN-ACK should be generated. Option B is wrong because the firewall policy is already allowing the traffic (as stated), and the source interface is correctly set to the VPN interface; otherwise, the SYN would not have been processed and the session would not be in SYN_RECV. Option C is wrong because the BGP route is being advertised and the BGP session is up; if a route map were filtering the advertisement, the partner would not have the route to 192.168.50.0/24, but the FortiGate's routing table shows the route is present, and the partner's traffic is reaching the FortiGate.

Full explanation →
584
MCQeasy

An administrator wants to ensure that FortiGate validates the identity of the remote VPN peer using a certificate during IKEv2 phase 1. Which authentication method should the administrator select in the IPsec phase 1 configuration?

A.Aggressive mode
B.Pre-shared key
C.EAP
D.Signature (RSA)
AnswerD

Signature authentication uses digital certificates to verify identity.

Why this answer

IKEv2 supports certificate-based authentication (RSA signature) for peer identity verification.

Full explanation →
585
Multi-Selectmedium

An administrator is troubleshooting a FortiGate in transparent mode. The FortiGate is not forwarding traffic between two segments connected to port1 and port2. The administrator checks the interface configuration. Which TWO configurations are REQUIRED for a transparent mode VDOM to forward traffic? (Choose two.)

Select 2 answers
A.Spanning Tree Protocol (STP) must be enabled on both interfaces
B.Both interfaces must be assigned IP addresses in the same subnet
C.Both interfaces must be members of the same hardware switch (or software bridge)
D.A firewall policy must allow all traffic between the two interfaces
E.The VDOM must be configured in transparent mode
AnswersC, E

Traffic is forwarded between interfaces that are part of the same bridge.

Why this answer

In transparent mode, FortiGate acts as a Layer 2 bridge, so traffic must be switched between interfaces. Both interfaces must be members of the same hardware switch or software bridge to create a single broadcast domain, allowing frames to be forwarded based on MAC addresses. Without this, the interfaces are isolated and cannot forward traffic at Layer 2.

Exam trap

The trap here is that candidates often think IP addressing or firewall policies are the primary requirements for forwarding, but in transparent mode, the critical Layer 2 bridging configuration is what enables traffic to pass between interfaces.

Full explanation →
586
MCQmedium

An administrator needs to ensure that all firewall policies in a FortiGate VDOM have a common set of inspection profiles added at the end of the policy list. Which FortiManager feature best achieves this?

A.ADOM overrides
B.Central SNAT
C.Revision history
D.Policy package header/footer policies
AnswerD

Why this answer

Policy package header/footer policies in FortiManager allow you to define a set of policies that are automatically appended (or prepended) to every policy package within an ADOM or VDOM. This ensures that all firewall policies in the VDOM share a common set of inspection profiles at the end of the policy list, without manually editing each policy. It is the only feature designed specifically for this use case.

Exam trap

The trap here is that candidates often confuse ADOM overrides (which manage per-ADOM exceptions) with the ability to insert common policies, but only header/footer policies guarantee automatic placement at the end of every policy list in a VDOM.

How to eliminate wrong answers

Option A is wrong because ADOM overrides are used to apply configuration changes across multiple ADOMs or VDOMs, not to insert common inspection profiles at the end of a policy list. Option B is wrong because Central SNAT is a feature for centralized source NAT policy management, unrelated to inspection profiles or policy ordering. Option C is wrong because Revision history is a versioning and rollback feature, not a mechanism for adding common policies or profiles.

Full explanation →
587
MCQeasy

A network administrator needs to configure SD-WAN on a FortiGate to distribute traffic across two WAN links based on session count. Which load balancing algorithm should be selected in the SD-WAN rule?

A.Volume
B.Lowest-cost
C.Spillover
D.Sessions
AnswerD

Sessions algorithm balances based on the number of active sessions.

Why this answer

The 'Sessions' load balancing algorithm distributes new sessions across SD-WAN members based on the current session count, ensuring an even distribution of sessions. This directly matches the requirement to distribute traffic based on session count, as it selects the member with the fewest active sessions for each new session.

Exam trap

The trap here is confusing 'Sessions' with 'Volume' or 'Spillover', as candidates often assume bandwidth-based algorithms (like Volume) are the default for session distribution, but FortiGate's SD-WAN explicitly separates session count from byte volume in its load balancing options.

How to eliminate wrong answers

Option A is wrong because 'Volume' distributes traffic based on the total bytes transferred, not session count. Option B is wrong because 'Lowest-cost' selects the link with the lowest cost (based on cost metric), not session count. Option C is wrong because 'Spillover' forwards traffic to a primary link until a configured bandwidth threshold is exceeded, then spills over to a backup link, which is unrelated to session count.

Full explanation →
588
MCQmedium

A company has deployed a Security Fabric with a root FortiGate 600E and two downstream FortiGate 200E devices. The network also includes a FortiAnalyzer and a FortiManager. The administrator notices that the Security Fabric topology in FortiGate is not showing the downstream devices. The root FortiGate can ping the management IPs of the downstream devices. Additionally, the administrator has configured the downstream devices with the correct root IP and authorization mode is set to 'none'. However, when running 'diagnose sys fabric list' on the root, it shows the downstream devices with status 'Pending'. The root FortiGate's firewall policy allows all traffic from the downstream subnets. What is the most likely cause of the issue?

A.The downstream devices are missing the root FortiGate's serial number in the 'downstream-authorization' configuration.
B.The FortiAnalyzer is not configured to receive logs from the downstream devices.
C.The downstream devices are using a different management port than the root.
D.The root FortiGate's firewall policy is blocking the downstream devices' Fabric traffic.
AnswerA

When authorization mode is 'none', the root does not automatically authorize; the downstream must have the root's serial in the configuration.

Why this answer

The 'Pending' status in the output of 'diagnose sys fabric list' indicates that the root FortiGate has discovered the downstream devices but they have not completed the authorization handshake. Even though the authorization mode is set to 'none', each downstream FortiGate must still have the root FortiGate's serial number explicitly listed in its 'downstream-authorization' configuration to be accepted into the Security Fabric. Without this entry, the root will not finalize the adjacency, leaving the downstream devices in a pending state.

Exam trap

The trap here is that candidates assume setting authorization mode to 'none' removes all authorization requirements, but in reality, the downstream device must still explicitly list the root's serial number to complete the Fabric handshake.

How to eliminate wrong answers

Option B is wrong because FortiAnalyzer log reception is irrelevant to Security Fabric topology discovery; the Fabric adjacency is established between FortiGates via TCP port 8013/8014, independent of logging. Option C is wrong because the management port mismatch would prevent ping and connectivity, but the root can already ping the downstream devices, proving Layer 3 reachability regardless of the port used for management. Option D is wrong because the root's firewall policy already allows all traffic from the downstream subnets, and Fabric heartbeat traffic (TCP/8013) is permitted by default; the issue is not a firewall block but an authorization configuration gap.

Full explanation →
589
MCQmedium

A FortiGate is configured as a SAML identity provider (IdP) for a partner's SaaS application (SP). Users authenticate via FortiGate's local user database. The administrator successfully tests the SAML flow, but after some time, users are prompted to re-authenticate frequently. What is the most likely cause?

A.The FortiGate's SAML service provider certificate has expired
B.The SAML assertion lifetime is configured too short
C.The FortiGate's clock is not synchronized with NTP
D.The SP is using HTTP-POST binding instead of redirect
AnswerB

The assertion lifetime controls how long the SAML assertion is valid. If set too low, users need to re-authenticate when it expires.

Why this answer

SAML assertions have a validity period. If the IdP (FortiGate) sets a short assertion lifetime or the SP's session timeout is shorter, users will be prompted to re-authenticate. The most common cause is the assertion lifetime being too short.

Full explanation →
590
MCQhard

An administrator is configuring ZTNA inline CASB for a SaaS application. The goal is to block upload of files containing credit card numbers. Which configuration components are required?

A.Use FortiClient to enforce DLP on endpoints
B.Configure an IPsec VPN between FortiGate and the SaaS provider
C.Configure a ZTNA application with a CASB profile and SSL inspection
D.Configure a web filter profile with DLP sensor
AnswerC

CASB requires the proxy to decrypt traffic and apply CASB policies.

Why this answer

ZTNA inline CASB uses a ZTNA proxy with SSL inspection and a CASB profile that includes a data leak prevention (DLP) rule to detect credit card numbers.

Full explanation →
591
MCQmedium

A FortiGate is managed by FortiManager. The administrator creates a new policy package for VDOM 'Sales' and installs it. Later, they find that the previous configuration has been overwritten. What should the administrator do to avoid this in the future?

A.Set the FortiGate to backup mode
B.Enable auto-lock on the policy package
C.Use the install preview before applying the changes
D.Enable revision history
AnswerC

Correct.

Why this answer

Using the install preview allows the administrator to review the exact changes that will be applied to the FortiGate before committing them. This prevents accidental overwrites by showing a diff of the configuration, enabling the administrator to verify that the new policy package will not replace existing settings unintentionally.

Exam trap

The trap here is that candidates confuse revision history (which is post-hoc) with install preview (which is proactive), or mistakenly think auto-lock prevents overwrites when it only serializes administrative edits.

How to eliminate wrong answers

Option A is wrong because backup mode on FortiGate is used for disaster recovery or firmware upgrades, not for preventing configuration overwrites during policy package installation from FortiManager. Option B is wrong because auto-lock on a policy package prevents concurrent edits by multiple administrators, but does not prevent the installation process from overwriting the existing configuration. Option D is wrong because revision history tracks changes over time for rollback purposes, but does not provide a pre-installation review to avoid overwriting the current configuration.

Full explanation →
592
Multi-Selectmedium

A network admin needs to configure a FortiGate to load balance traffic across two ISP links using SD-WAN. The requirement is to use both links simultaneously for different sessions based on source-destination IP hash. Which two settings are required? (Select TWO.)

Select 2 answers
A.Create an SD-WAN zone with both WAN members
B.Configure an SD-WAN rule with load balancing algorithm 'source-dest-ip-hash'
C.Add a performance SLA for each member
D.Set the rule strategy to 'best quality'
E.Enable 'spillover' under the SD-WAN rule
AnswersA, B

Members must be added to the SD-WAN zone.

Why this answer

An SD-WAN zone is a logical grouping of WAN members (interfaces) that allows FortiGate to treat multiple ISP links as a single entity for load balancing and redundancy. Without creating a zone that includes both WAN members, the SD-WAN rules cannot reference them collectively for traffic distribution. Option B is correct because the 'source-dest-ip-hash' load balancing algorithm ensures that sessions with the same source and destination IP pair are consistently forwarded over the same link, enabling per-session load balancing across both ISPs simultaneously.

Exam trap

The trap here is that candidates often confuse 'load balancing algorithm' (like source-dest-ip-hash) with 'strategy' (like best quality) or assume that performance SLAs are mandatory for any SD-WAN rule, when in fact SLAs are only needed for dynamic path selection based on link quality.

Full explanation →
593
MCQmedium

An administrator runs the following command on a FortiGate: 'diagnose sys session filter dport 443' and sees output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is fully established and has been active for 1 hour
B.The session will expire in 3600 seconds and has been active for 3599 seconds
C.The session is in a TCP SYN-SENT state and has not completed the three-way handshake
D.The session is using UDP on port 443
AnswerA

Correct because proto_state=01 indicates TCP ESTABLISHED, and duration=3600 seconds confirms it has been active for 1 hour.

Why this answer

The output shows proto=6 (TCP) and proto_state=01, which in FortiGate's session table corresponds to TCP state ESTABLISHED. The duration=3600 indicates the session has existed for 3600 seconds (1 hour), and expire=3599 shows it will expire in 3599 seconds. This confirms the session is fully established, making option A correct.

Exam trap

The trap here is that candidates confuse the 'duration' and 'expire' values or assume 'proto=6' and a long duration imply an established session, but FortiGate's 'proto_state' field is the key to identifying the TCP handshake phase.

How to eliminate wrong answers

Option A is wrong because 'proto_state=01' indicates TCP SYN-SENT, not an established connection; a fully established TCP session would show 'proto_state=02' (ESTABLISHED). Option B is wrong because it misinterprets the fields: 'duration=3600' is the time the session has been active (3600 seconds), and 'expire=3599' is the remaining time before timeout, not the other way around. Option D is wrong because 'proto=6' explicitly indicates TCP, not UDP; UDP would show 'proto=17'.

Full explanation →
594
MCQhard

An administrator deploys a FortiGate in transparent mode with two VDOMs: one for the internal network and one for DMZ. The admin notices that ARP requests from internal hosts are not reaching the DMZ servers even though they are on the same VLAN. What is the most likely cause?

A.The FortiGate is not configured to proxy ARP
B.VDOMs in transparent mode are isolated layer 2 domains; inter-VDOM routing is required for communication
C.The internal and DMZ VDOMs are in different VLANs on the same physical interface
D.Transparent mode does not support VDOMs
AnswerB

Correct. VDOMs separate broadcast domains.

Why this answer

In transparent mode, each VDOM acts as an independent Layer 2 forwarding domain with its own MAC address table and VLAN database. ARP requests are broadcast frames that are confined to the VDOM where they originate; they are not forwarded to other VDOMs. Therefore, even if the internal and DMZ interfaces are on the same VLAN, the ARP request from an internal host will never reach a DMZ server unless inter-VDOM routing (Layer 3 forwarding between VDOMs) is explicitly configured.

Exam trap

The trap here is that candidates assume transparent mode operates as a simple bridge that forwards all Layer 2 traffic between all interfaces, forgetting that VDOMs create strict Layer 2 isolation boundaries even in transparent mode.

How to eliminate wrong answers

Option A is wrong because proxy ARP is a Layer 3 feature used to respond to ARP requests on behalf of another device, and it is not required for Layer 2 forwarding within the same VLAN; the issue here is Layer 2 isolation between VDOMs. Option C is wrong because the scenario states the hosts are on the same VLAN, and VDOMs in transparent mode can share the same physical interface with different VLANs, but that would not cause ARP requests to fail between VDOMs—the failure is due to VDOM isolation, not VLAN mismatch. Option D is wrong because transparent mode fully supports VDOMs; in fact, VDOMs are commonly used in transparent mode to segment Layer 2 traffic.

Full explanation →
595
MCQmedium

An administrator runs 'diagnose debug application ssl-helper -1' and sees that sessions to certain HTTPS sites are being terminated by the FortiGate. What is the MOST likely cause?

A.The FortiGate's certificate authority (CA) certificate has expired, causing SSL inspection to fail
B.The antivirus profile is blocking the HTTPS connections due to a virus signature match
C.The FortiGate is performing TCP RST injection due to a mismatch in the SSL/TLS handshake as part of deep inspection
D.The SSL deep inspection policy is set to 'certificate-inspection' which blocks sessions with mismatched certificates
AnswerC

The ssl-helper process performs deep inspection by injecting RST packets when the handshake is invalid or certificate errors occur, causing session termination.

Why this answer

The 'diagnose debug application ssl-helper -1' command shows SSL helper events, including TCP RST injection. When deep inspection is enabled and the FortiGate cannot complete the SSL/TLS handshake with the server (e.g., due to cipher mismatch, certificate validation failure, or unsupported protocol version), it sends a TCP RST to both the client and server to terminate the session. This is the most direct cause of sessions being terminated as observed in the debug output.

Exam trap

The trap here is that candidates confuse 'certificate-inspection' with 'deep inspection' and assume certificate mismatches cause TCP RSTs, but in certificate-inspection mode the FortiGate does not terminate the SSL handshake—it only inspects the certificate without decrypting, so no RST injection occurs.

How to eliminate wrong answers

Option A is wrong because an expired CA certificate on the FortiGate would cause SSL inspection to fail with a certificate validation error, but the FortiGate would typically block the session with a replacement page or drop it, not perform TCP RST injection as seen in ssl-helper debug. Option B is wrong because antivirus blocking would be logged in antivirus or proxy logs, not in ssl-helper debug, and would result in a block page or session drop, not a TCP RST from the SSL helper. Option D is wrong because 'certificate-inspection' mode does not perform deep inspection; it only checks the server certificate without decrypting traffic, so it would not cause TCP RST injection due to handshake mismatches—that behavior is specific to deep inspection (full SSL inspection).

Full explanation →
596
MCQmedium

An organization uses FortiWeb to protect its web applications. The security team wants to block requests that contain a specific custom pattern in the URL. Which feature should be used?

A.Inline Protection Profile
B.Custom Attack Signature
C.URL Access Rule
D.Web Application Firewall Policy
AnswerB

Custom signatures define patterns to block.

Why this answer

Custom Attack Signatures in FortiWeb allow administrators to define user-specific patterns to match against HTTP request elements, including the URL. This feature is designed to block requests containing custom patterns, such as a specific string in the URL, by inspecting the request and triggering an action (e.g., alert or block) when the pattern is matched. Unlike other features, Custom Attack Signatures provide the granularity needed to detect and block arbitrary, organization-defined patterns in the URL.

Exam trap

The trap here is that candidates often confuse URL Access Rules (which control access based on URL paths) with Custom Attack Signatures (which detect arbitrary patterns in the URL), leading them to select URL Access Rule when the requirement is to block a specific custom pattern, not to restrict access to a directory.

How to eliminate wrong answers

Option A is wrong because Inline Protection Profiles are used to apply a set of predefined protection rules (e.g., SQL injection, XSS) to traffic, but they do not support the creation of custom patterns for URL matching. Option C is wrong because URL Access Rules control access based on URL path patterns (e.g., allow or deny access to specific directories), but they are not designed to block requests based on arbitrary custom patterns within the URL; they operate on access control logic, not attack signature matching. Option D is wrong because a Web Application Firewall Policy defines the overall security policy (e.g., which protections are enabled), but it does not itself contain the mechanism to define and match custom patterns in the URL; that is the role of signatures or rules within the policy.

Full explanation →
597
MCQmedium

A network engineer is configuring SD-WAN on a FortiGate. They have three WAN interfaces (wan1, wan2, lte) and want traffic to the primary datacenter (10.10.10.0/24) to use wan1 unless its latency exceeds 50 ms, in which case failover to wan2. The engineer created an SD-WAN rule with a strategy of 'Manual' and selected 'wan1' as the preferred member. What additional configuration is required to achieve automatic failover based on latency?

A.Create a route map to prefer wan1 and apply it to the SD-WAN rule.
B.Set the SD-WAN rule strategy to 'Best Quality' and select latency as the metric.
C.Enable BFD on wan1 and wan2 with a minimum interval of 50 ms.
D.Configure a performance SLA for wan1 with a latency threshold of 50 ms and associate it with the SD-WAN rule.
AnswerD

The performance SLA measures latency and triggers failover when the threshold is exceeded.

Why this answer

SD-WAN automatic failover based on latency requires a Performance SLA (performance-sla) configured with a latency threshold of 50 ms, and that SLA must be associated with the SD-WAN rule. The rule's strategy should be set to 'Manual' with wan1 as preferred member, but the SLA triggers the failover when the latency exceeds the threshold, causing the rule to select the next available member (wan2). Without the SLA, the Manual strategy simply pins traffic to wan1 and never fails over.

Exam trap

The trap here is that candidates confuse BFD (which detects link failures) with Performance SLA (which measures latency and triggers failover based on quality thresholds), leading them to choose Option C instead of D.

How to eliminate wrong answers

Option A is wrong because route maps are used for policy-based routing or BGP manipulation, not for SD-WAN failover decisions; SD-WAN rules use performance SLAs and strategies, not route maps. Option B is wrong because 'Best Quality' strategy dynamically selects the best member based on metrics like latency, but the question requires a Manual strategy with failover triggered by a specific latency threshold, not continuous best-path selection. Option C is wrong because BFD (Bidirectional Forwarding Detection) detects link failures (up/down) with sub-second intervals, but it does not measure latency or trigger failover based on latency thresholds; BFD is for link liveliness, not performance-based SLA monitoring.

Full explanation →
598
MCQeasy

What is the primary purpose of Content Disarm and Reconstruction (CDR) in advanced antivirus protection?

A.To detect and block known malware using signature-based detection
B.To reconstruct files by removing potentially malicious active content such as macros and scripts
C.To submit files to FortiSandbox for behavioral analysis
D.To encrypt files in transit to prevent interception
AnswerB

CDR strips active content and rebuilds files to prevent exploits.

Why this answer

Content Disarm and Reconstruction (CDR) is designed to proactively neutralize threats by stripping or disabling potentially dangerous active content—such as macros, scripts, and embedded objects—from files while preserving the file's usability. Unlike signature-based detection, CDR does not rely on known threat signatures; instead, it reconstructs the file in a safe state, removing any elements that could execute malicious code. This makes CDR a zero-day prevention technique that blocks threats before they can be analyzed or detected by traditional methods.

Exam trap

The trap here is that candidates confuse CDR with sandboxing or signature-based detection, assuming CDR's purpose is to detect malware rather than to preemptively remove all potentially dangerous content regardless of detection status.

How to eliminate wrong answers

Option A is wrong because CDR does not use signature-based detection; it removes active content regardless of whether the content is known malware, making it effective against unknown and zero-day threats. Option C is wrong because while CDR can be used in conjunction with FortiSandbox, its primary purpose is not to submit files for behavioral analysis but to sanitize files at the gateway before delivery. Option D is wrong because encrypting files in transit is a data protection measure (e.g., TLS or IPsec) unrelated to CDR's function of removing malicious content from files.

Full explanation →
599
MCQeasy

A FortiGate administrator sees the following kernel log: 'kernel: [pid 1234] received packet with unknown or unsupported protocol 0x0800 on interface port1, drop'. What does this log indicate?

A.The packet is an ARP request that failed.
B.The packet has an invalid MAC address.
C.The interface is not configured with an IP address or is in the wrong VDOM.
D.The packet has IP options set that are not supported.
AnswerC

The kernel drops packets when the interface is not configured to handle that protocol.

Why this answer

The kernel log indicates that the interface port1 received an Ethernet frame with EtherType 0x0800 (IPv4) but the FortiGate dropped it because the interface is either not configured with an IP address or is bound to the wrong VDOM. Without an IP address or proper VDOM assignment, the kernel cannot process the packet at Layer 3, so it logs the packet as having an 'unknown or unsupported protocol' even though 0x0800 is standard IPv4.

Exam trap

The trap here is that candidates see 'unknown or unsupported protocol 0x0800' and assume it refers to an exotic or malformed protocol, when in fact 0x0800 is standard IPv4 and the issue is a missing IP address or VDOM assignment on the interface.

How to eliminate wrong answers

Option A is wrong because ARP requests use EtherType 0x0806, not 0x0800, and the log specifically mentions protocol 0x0800 (IPv4). Option B is wrong because invalid MAC addresses would generate a different log entry related to MAC filtering or source address validation, not a protocol drop. Option D is wrong because IP options are handled at a higher layer within the IP stack, and the kernel drop occurs before any IP header parsing; the log indicates the interface itself does not recognize the protocol, not that options are unsupported.

Full explanation →
600
MCQhard

A BGP peering between two FortiGates is not establishing. The administrator runs 'get router info bgp neighbor' and sees that the neighbor state is 'Idle' and the BGP configuration appears correct. What should the administrator check next?

A.Run 'diagnose ip router bgp all enable' to enable debug
B.Check the BGP AS number configuration
C.Verify that the BGP neighbor IP is reachable via the routing table
D.Increase the BGP timers
AnswerC

If the neighbor is unreachable, BGP stays in Idle state.

Why this answer

When a BGP neighbor is stuck in the 'Idle' state, it typically indicates that BGP cannot initiate the TCP connection to the neighbor. The most common cause is that the neighbor IP address is not reachable via the routing table. Even if the BGP configuration (AS number, neighbor IP) is correct, BGP will remain Idle until it can successfully open a TCP session on port 179.

Therefore, verifying IP reachability (e.g., with 'ping' or checking the routing table) is the logical next step.

Exam trap

The trap here is that candidates often jump to debugging or assume a configuration error (like AS number mismatch) when the neighbor state is Idle, but the most fundamental cause—IP reachability—is frequently overlooked.

How to eliminate wrong answers

Option A is wrong because enabling BGP debug ('diagnose ip router bgp all enable') is a troubleshooting step that should be taken after verifying basic connectivity; it generates excessive output and is not the first check for an Idle state. Option B is wrong because the question states that the BGP configuration appears correct, so checking the AS number again is redundant and unlikely to resolve the issue. Option D is wrong because increasing BGP timers (keepalive/hold) only affects established sessions or session stability, not the initial TCP connection establishment; it will not move a session out of Idle.

Full explanation →
Page 7

Page 8 of 13

Page 9

All pages

12345678910111213

Practice NSE7 by domain

Target a specific domain to shore up weak areas.

Advanced Networking and SD-WANAdvanced VPN and Zero TrustEnterprise Firewall and VDOMsAdvanced Threat ProtectionTroubleshooting and Diagnostics
See all domains with question counts →