CCSE (EC-Council Certifications) flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Security Fabric connector

An authorization token that links a FortiGate to another Fabric component such as FortiManager, FortiAnalyzer, or FortiSandbox so they can share logs, objects, and threat intelligence.

Admin profile least privilege

A named set of permissions assigned to an administrator account. Granting only the required read/write scopes limits the blast radius of a compromised or mistaken admin.

VDOM mode

A FortiGate operating mode that partitions the device into independent virtual domains, each with its own interfaces, routing table, and policies. Enabling it requires a reboot.

Configuration backup

A saved copy of the FortiGate configuration, restorable locally or via FortiManager. Encrypted private keys are included only when the backup passphrase is supplied.

Firmware upgrade path

The documented sequence of firmware versions required to reach a target release. Skipping a required intermediate version is unsupported and can corrupt the configuration.

HA management access

In a cluster, only the primary holds the configured management IP. The secondary is reached through the dedicated HA management interface or after a failover.

First-match policy evaluation

Firewall policies are evaluated top-down and the first matching policy is applied; later policies are ignored. Unmatched traffic hits the implicit deny.

VIP destination NAT

A virtual IP maps an external address and port to an internal server. The VIP must be referenced as the policy destination for translation to occur.

Central SNAT

Source NAT configured in a central table keyed by source, destination, and egress interface. It takes precedence over NAT configured inside individual firewall policies.

Policy route

A route that overrides the routing table for matching traffic based on source, destination, protocol, or port. Evaluated before the normal FIB lookup.

FQDN address object

An address object that resolves a domain name via DNS and updates automatically when the record's TTL expires. Useful for policies targeting cloud services.

Local-in policy

A policy that controls traffic destined to the FortiGate itself, such as management access and routing protocols, separate from traffic forwarded through the device.

Proxy vs flow antivirus

Proxy-based scanning buffers the whole file for deeper inspection at higher latency; flow-based scanning inspects the stream with lower latency but less depth.

IPS sensor action

The per-signature response in an IPS sensor: block, monitor, or reset. Overrides let a profile tune individual signatures without disabling the whole sensor.

SSL deep inspection

The FortiGate terminates and re-originates TLS using a forward-proxy certificate. Clients must trust the inspection CA; certificate-pinned apps break unless excluded.

Application control

A security profile that identifies applications by signature rather than port, allowing or blocking them by category. Encrypted traffic requires SSL inspection for full visibility.

FortiSandbox verdict

The result returned after detonating a suspicious file: clean, suspicious, or malicious. The antivirus profile can enforce the verdict as an action.

Routing precedence

Policy routes are evaluated first, then directly connected routes, then static routes, then dynamic routes. Within a source, the longest prefix match wins.

Transparent mode

An interface mode where the FortiGate bridges traffic without changing IP addresses. Policies and profiles still apply, but the device is not a routing hop.

Static route distance

An administrative distance value on a static route. Lower distance wins; equal distance and priority across routes enables equal-cost multipath.

VLAN sub-interface

A logical interface on a physical port carrying an 802.1Q tag. It gets its own IP address and is referenced by policies like a normal interface.

SD-WAN health check

A probe that measures latency, jitter, and packet loss against SLA targets for each member link, used by SD-WAN rules to steer traffic.

IPsec Phase 1

The IKE negotiation that authenticates peers and establishes the ISAKMP SA, agreeing on encryption, hashing, DH group, and authentication method.

IPsec Phase 2

The negotiation that creates the IPsec SA for ESP traffic, defining the encryption and authentication algorithms, PFS group, and the protected subnet selectors.

SSL VPN tunnel mode

A remote-access mode that gives the client a virtual adapter and full network access to protected subnets, with authentication by local, LDAP, RADIUS, or certificate.

HA active-passive

A cluster mode where one unit forwards all traffic and the other stands by. Failover is triggered by heartbeat loss or a monitored interface failure.

HA split-brain

A condition where cluster members lose heartbeat connectivity and each believes it is primary, causing duplicate IPs and inconsistent forwarding until the link is restored.

Sniffer packet command

diagnose sniffer packet captures traffic on an interface with a BPF filter; level 4 shows interface names and level 6 shows packet payload.

Debug flow

diagnose debug flow shows the policy lookup, NAT, and routing decisions for matching packets, revealing exactly where traffic is dropped or accepted.

Asymmetric routing

A condition where the return path differs from the forward path, so the FortiGate sees only one direction and drops the session as invalid.

Session table exhaustion

A state where the session limit is reached, causing new connections to be dropped. Often caused by a DoS or by overly long session timeouts.

Log subtype filtering

FortiAnalyzer and local logs are filtered by subtype such as traffic, utm, event, or anomaly, and by policy ID, to isolate which inspection stage handled the traffic.

SNMPv3 monitoring

A monitoring protocol version that adds authentication and encryption over SNMPv1/v2c, exposing interface counters, CPU, memory, and session counts to a manager.