I85PREP
⌘ K
FCP study materials
FCP study resources

FCP practice questions

One question at a time. Build your FCP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Fabric and Network Security Fundamentals

In a FortiGate security fabric, which component is responsible for collecting logs and correlating events from multiple fabric devices for analysis?

  1. FortiSwitch
  2. FortiAP
  3. FortiAnalyzer Correct answer.
  4. FortiClient

Explanation

FortiAnalyzer is the fabric component that receives logs from FortiGate and other fabric devices, stores them, and provides correlation, reporting, and event analysis. FortiClient, FortiSwitch, and FortiAP are endpoint and access-layer devices that generate or forward data rather than serve as the central analytics platform.

Question 2Security Fabric and Network Security Fundamentals

Which FortiGate feature allows multiple physical or virtual FortiGate devices to be managed and synchronized as a single logical unit for redundancy?

  1. HA cluster Correct answer.
  2. Security fabric root
  3. VDOM
  4. Traffic shaping

Explanation

High availability (HA) clustering groups FortiGate units so they share configuration and session state, providing failover and a single logical management view. VDOMs virtualize a single device, the fabric root designates topology leadership, and traffic shaping controls bandwidth rather than device redundancy.

Question 3Security Fabric and Network Security Fundamentals

What is the primary purpose of the FortiGate security fabric root?

  1. To act as the central point that shares threat intelligence and coordinates fabric devices Correct answer.
  2. To provide DHCP services to all fabric segments
  3. To terminate all IPSec tunnels in the organization
  4. To store configuration backups for managed FortiSwitches

Explanation

The fabric root FortiGate aggregates and distributes threat intelligence and coordinates connected fabric devices, enabling a unified security posture. IPSec termination, configuration backups, and DHCP are individual services a FortiGate may offer but are not the defining role of the fabric root.

Question 4Security Fabric and Network Security Fundamentals

A FortiGate profile uses a security profile group that applies antivirus, IPS, and web filtering to traffic in one policy. What is the main administrative benefit of grouping profiles this way?

  1. It reduces the number of policies needed and applies consistent inspection Correct answer.
  2. It disables logging to reduce disk usage
  3. It replaces the need for firewall address objects
  4. It encrypts traffic between fabric devices automatically

Explanation

Profile groups bundle multiple security profiles so a single firewall policy can apply consistent inspection, simplifying policy management. They do not encrypt inter-device traffic, remove the need for address objects, or turn off logging.

Question 5Security Fabric and Network Security Fundamentals

Which Fortinet product provides endpoint protection and can share telemetry with the security fabric?

  1. FortiWeb
  2. FortiMail
  3. FortiSandbox
  4. FortiClient Correct answer.

Explanation

FortiClient is the endpoint agent that provides antivirus, web filtering, and telemetry sharing with the fabric. FortiMail handles email security, FortiSandbox performs dynamic malware analysis, and FortiWeb protects web applications.

Question 6Security Fabric and Network Security Fundamentals

What does a FortiGate use to identify and authorize a user before applying identity-based firewall policies?

  1. An authentication rule referencing a user group Correct answer.
  2. A VLAN trunk configuration
  3. A static route entry
  4. A NAT pool

Explanation

Authentication rules reference user groups so the FortiGate can identify users through methods such as LDAP, RADIUS, or local accounts before matching identity-based policies. Static routes, VLAN trunks, and NAT pools affect traffic forwarding and translation, not user identification.

Question 7Security Fabric and Network Security Fundamentals

Which statement best describes a demilitarized zone (DMZ) in a FortiGate network design?

  1. A segment reserved exclusively for SD-WAN members
  2. A segment that bypasses all firewall inspection
  3. A segment that hosts public-facing services with stricter policy control than the internal LAN Correct answer.
  4. A segment used only for backup traffic between FortiGates

Explanation

A DMZ isolates publicly accessible servers from the internal network, so traffic between the internet, DMZ, and LAN is controlled by distinct policies. It does not bypass inspection, serve only backups, or exist solely for SD-WAN.

Question 8Security Fabric and Network Security Fundamentals

An administrator wants a FortiGate to send traffic to FortiSandbox for dynamic analysis when files are suspicious. Which security profile should be configured to enable this submission?

  1. Application control
  2. Antivirus Correct answer.
  3. VoIP profile
  4. Data loss prevention

Explanation

The antivirus profile includes sandbox inspection settings that submit suspicious files to FortiSandbox for dynamic analysis. Application control classifies applications, DLP prevents data leakage, and VoIP profiles tune voice traffic handling.

Question 9Security Fabric and Network Security Fundamentals

A FortiGate has two internet connections and uses SD-WAN. What is the primary function of an SD-WAN rule?

  1. To select the outbound interface based on criteria such as latency and link quality Correct answer.
  2. To create VDOMs for tenant separation
  3. To authenticate users against an LDAP server
  4. To assign IP addresses to endpoints

Explanation

SD-WAN rules steer traffic across member links using criteria like latency, jitter, and priority to maintain application performance. They do not perform user authentication, VDOM creation, or DHCP address assignment.

Question 10Security Fabric and Network Security Fundamentals

Which FortiGate feature lets an administrator logically divide a single device into multiple independent virtual firewalls?

  1. Virtual domains (VDOMs) Correct answer.
  2. IP pools
  3. Policy routes
  4. HA clusters

Explanation

VDOMs partition one FortiGate into multiple virtual instances, each with its own interfaces, policies, and routing table. HA clusters combine devices, policy routes override routing decisions, and IP pools are used for NAT.

Question 11Security Fabric and Network Security Fundamentals

What is the role of the FortiGate fabric connector when integrating with a third-party or Fortinet product?

  1. It disables local logging on the FortiGate
  2. It converts all traffic to a single encryption protocol
  3. It replaces the FortiGate routing table with the external product's routes
  4. It provides a configured integration channel that exchanges events and actions with the external product Correct answer.

Explanation

Fabric connectors define integrations that let the FortiGate exchange information and trigger actions with external products, such as quarantine or threat feeds. They do not replace routing, force encryption, or disable local logging.

Question 12Security Fabric and Network Security Fundamentals

A security policy on a FortiGate has NAT enabled with a dynamic IP pool. What does this configuration accomplish for outbound traffic?

  1. It encrypts the payload between client and server
  2. It translates source addresses to addresses from the pool Correct answer.
  3. It authenticates the source user before forwarding
  4. It translates destination addresses before routing

Explanation

Enabling NAT with an IP pool translates the source address of outbound sessions to an address drawn from the pool. Destination translation is done by virtual IPs or destination NAT, authentication is separate, and encryption is not a NAT function.

Question 13Security Fabric and Network Security Fundamentals

Which FortiGate security profile is designed to detect and block traffic based on application signatures rather than ports?

  1. Web filter
  2. Application control Correct answer.
  3. Email filter
  4. Antivirus

Explanation

Application control uses signatures to identify applications regardless of port or protocol, allowing policies to permit or block them precisely. Antivirus targets malware, web filter categorizes URLs, and email filter handles mail content.

Question 14Security Fabric and Network Security Fundamentals

What is the purpose of a FortiGate virtual IP (VIP) in a typical inbound service deployment?

  1. To define a user group for authentication
  2. To map a public address and port to an internal server address and port Correct answer.
  3. To create a backup route for failover
  4. To assign a management address to the FortiGate itself

Explanation

A VIP performs destination NAT, mapping a public-facing address and port to the internal server's actual address and port. Management addresses, backup routes, and user groups are configured through different objects.

Question 15Security Fabric and Network Security Fundamentals

Which logging destination allows a FortiGate to send logs to FortiAnalyzer for centralized storage and reporting?

  1. SNMP trap receiver
  2. Local disk only
  3. Console output
  4. Syslog to FortiAnalyzer over the fabric Correct answer.

Explanation

FortiGate can send logs to FortiAnalyzer using the fabric or syslog-based logging configuration, enabling centralized storage and reporting. Local disk, console, and SNMP traps do not provide FortiAnalyzer's analytics capabilities.

Question 16Security Fabric and Network Security Fundamentals

An administrator configures a FortiGate to use LDAP for user authentication. Which object must the authentication rule reference so identified users match identity-based policies?

  1. An IP pool
  2. A static route
  3. A user group populated by the LDAP server Correct answer.
  4. A virtual IP object

Explanation

Authentication rules reference user groups, and groups can be populated from LDAP so authenticated users inherit group membership for policy matching. Virtual IPs, IP pools, and static routes do not carry identity information.

Question 17Security Fabric and Network Security Fundamentals

Which capability distinguishes a FortiGate in NAT mode from one in transparent mode?

  1. NAT mode disables all interface addressing
  2. NAT mode cannot apply security profiles
  3. Transparent mode requires a VDOM license
  4. NAT mode routes between IP subnets and can apply NAT, while transparent mode forwards at Layer 2 as a bridge Correct answer.

Explanation

In NAT mode the FortiGate acts as a router with IP-addressed interfaces and can perform NAT and full inspection. In transparent mode it bridges traffic at Layer 2, typically without changing IP addresses, and still applies security profiles.

Question 18Security Fabric and Network Security Fundamentals

A FortiGate policy includes an IPS sensor and a web filter. Which statement correctly describes the order in which these profiles process a matching session?

  1. Only one security profile can be active per policy
  2. The web filter runs only after the IPS sensor blocks a packet
  3. The IPS sensor runs only on traffic that the web filter permits
  4. The FortiGate applies the configured profiles as part of unified inspection of the session, not as unrelated sequential tools Correct answer.

Explanation

Security profiles in a policy operate together within the FortiGate's inspection pipeline on the same session, each examining traffic according to its function. They are not gated so that one profile runs only after another permits traffic, and multiple profiles can be active in one policy.

Question 19Security Fabric and Network Security Fundamentals

Which design choice best supports micro-segmentation inside a FortiGate-managed network?

  1. Creating separate VLANs and zones with inter-zone policies that restrict traffic Correct answer.
  2. Disabling logging on internal segments
  3. Placing all servers in one flat VLAN with a single permit-any policy
  4. Using only transparent mode for all interfaces

Explanation

Micro-segmentation relies on dividing the network into smaller zones or VLANs and enforcing least-privilege inter-zone policies. A flat VLAN with permit-any, disabled logging, or universal transparent mode undermines visibility and control.

Question 20Security Fabric and Network Security Fundamentals

A FortiGate HA cluster is configured in active-passive mode. What happens to session handling when a failover occurs?

  1. All interfaces are administratively disabled until manual intervention
  2. The cluster reverts to transparent mode automatically
  3. The primary fails over to the secondary, which takes over the cluster IP and continues forwarding traffic Correct answer.
  4. Both units forward traffic simultaneously in all cases

Explanation

In active-passive HA, the secondary monitors the primary and assumes the cluster address and forwarding role upon failover, ideally preserving sessions through synchronization. Simultaneous forwarding describes active-active, and failover does not change operating mode or disable interfaces.

Question 21Security Fabric and Network Security Fundamentals

An administrator wants fabric devices to share threat intelligence so that a threat detected on one FortiGate can inform others. Which fabric capability supports this?

  1. Fabric threat intelligence sharing through the root FortiGate Correct answer.
  2. Static routing between fabric members
  3. Per-device isolated logging with no synchronization
  4. Disabling security profiles on edge devices

Explanation

Fabric threat intelligence sharing lets the root FortiGate distribute indicators and detections across fabric members for coordinated response. Isolated logging, static routing, and disabling profiles do not share threat data and can reduce protection.

Question 22Security Fabric and Network Security Fundamentals

A FortiGate uses a policy route to send traffic from a specific subnet out a secondary WAN link. How does the policy route interact with the routing table?

  1. Policy routes apply only to inbound traffic destined for the FortiGate
  2. The policy route is evaluated before the routing table and overrides it for matching traffic Correct answer.
  3. Policy routes replace the need for security policies
  4. The routing table always takes precedence over policy routes

Explanation

Policy routes are evaluated ahead of the routing table and, when traffic matches their criteria, direct it to the specified gateway or interface. The routing table handles non-matching traffic, policy routes affect forwarded traffic, and security policies are still required for inspection.

Question 23Security Fabric and Network Security Fundamentals

Which combination best reflects a defense-in-depth approach on a FortiGate protecting an internal network?

  1. Only endpoint antivirus with no network inspection
  2. Layered controls including segmentation, authentication, security profiles, and centralized logging Correct answer.
  3. Only NAT translation without any inspection
  4. A single permit-any policy with logging disabled

Explanation

Defense in depth layers multiple independent controls so that a failure in one does not remove all protection. Segmentation, authentication, security profiles, and centralized logging each address different threats, whereas permit-any, endpoint-only, or NAT-only designs leave major gaps.

Question 24Security Fabric and Network Security Fundamentals

A FortiGate blocks a file download because antivirus scanning identifies a known malicious signature. The administrator wants the FortiGate to also submit unknown files to FortiSandbox for dynamic analysis while still enforcing the antivirus profile. Which FortiGate configuration element provides this integration?

  1. A fabric connector configured for FortiSandbox, referenced from the antivirus profile Correct answer.
  2. A virtual IP that redirects file downloads to the FortiSandbox appliance
  3. An SD-WAN rule that steers file traffic to the FortiSandbox interface
  4. A policy route that forwards all unknown traffic to the FortiSandbox gateway

Explanation

FortiSandbox integration on a FortiGate is established through a fabric connector object, which the antivirus profile then references so suspicious files can be submitted for dynamic analysis. The connector supplies the address, credentials, and status of the sandbox appliance, and the antivirus profile decides when files are sent. This keeps inline inspection and sandbox submission within the normal security profile workflow.

Question 25Firewall Policies and Traffic Shaping

On a FortiGate, which component of a firewall policy defines the source and destination addresses that the policy matches?

  1. The source and destination address objects referenced in the policy Correct answer.
  2. The traffic shaping profile attached to the policy
  3. The schedule object assigned to the policy
  4. The logging options enabled on the policy

Explanation

A firewall policy matches traffic using the source and destination address objects configured in the policy, together with service, schedule, and user criteria. The shaping profile, schedule, and logging settings affect how matched traffic is handled or recorded rather than which addresses the policy matches.

Question 26Firewall Policies and Traffic Shaping

What is the default action for traffic that does not match any enabled firewall policy on a FortiGate interface?

  1. It is allowed and logged
  2. It is denied and dropped Correct answer.
  3. It is allowed but not logged
  4. It is shaped to the default bandwidth profile

Explanation

FortiGate uses an implicit deny at the end of the policy table, so traffic matching no enabled policy is dropped. This default behavior enforces a deny-by-default posture unless an explicit accept policy exists.

Question 27Firewall Policies and Traffic Shaping

Which firewall policy action must be selected for traffic to be inspected by a security profile such as antivirus or IPS?

  1. LEARN
  2. DENY
  3. ACCEPT Correct answer.
  4. ISOLATE

Explanation

Security profiles such as antivirus, IPS, and web filtering are applied to traffic that an ACCEPT policy allows. DENY policies block traffic without profile inspection, and LEARN or ISOLATE options are not standard FortiGate policy actions.

Question 28Firewall Policies and Traffic Shaping

In a FortiGate policy, which setting determines whether the policy is evaluated in the policy table at a given time?

  1. The logging setting enabled on the policy
  2. The NAT setting enabled on the policy
  3. The schedule object assigned to the policy Correct answer.
  4. The traffic shaping priority assigned to the policy

Explanation

Each policy references a schedule object that defines when the policy is active, such as always or a recurring time window. Outside that schedule the policy is not evaluated, so traffic falls through to later policies or the implicit deny.

Question 29Firewall Policies and Traffic Shaping

What is the purpose of the traffic shaping policy feature on a FortiGate?

  1. To authenticate users against a remote LDAP server
  2. To apply bandwidth limits and priorities to traffic based on matching criteria Correct answer.
  3. To route traffic between virtual domains
  4. To translate private addresses to public addresses

Explanation

Traffic shaping policies match traffic using criteria such as source, destination, service, and application, then apply bandwidth limits and priority treatment. They are separate from address translation, authentication, and VDOM routing functions.

Question 30Firewall Policies and Traffic Shaping

Which traffic shaping method on FortiGate enforces a hard maximum bandwidth for matched traffic?

  1. Per-IP shaper
  2. Shared shaper Correct answer.
  3. Priority queue
  4. DSCP marking

Explanation

A shared traffic shaper defines a maximum bandwidth and is applied to a policy to cap the aggregate bandwidth for matched traffic. Per-IP shapers apply limits per source address, while priority queues and DSCP marking influence treatment rather than defining a hard aggregate cap.

Question 31Firewall Policies and Traffic Shaping

When a FortiGate policy has NAT enabled and the traffic matches, which address is translated by default?

  1. The destination address is translated to the incoming interface address
  2. Neither address is translated because NAT is disabled
  3. Both source and destination addresses are translated
  4. The source address is translated to the outgoing interface address Correct answer.

Explanation

Enabling NAT on a policy performs source NAT by default, translating the source address to the address of the outgoing interface. Destination NAT requires a VIP or IP pool mapping rather than the default NAT setting.

Question 32Firewall Policies and Traffic Shaping

Which policy ordering behavior applies when two enabled ACCEPT policies match the same traffic?

  1. Both policies are combined into a single rule
  2. The last matching policy in the table is applied
  3. The first matching policy in the table is applied Correct answer.
  4. The most specific policy is always applied

Explanation

FortiGate evaluates policies from top to bottom and applies the first enabled policy that matches the traffic. Later policies are not evaluated for that connection, so ordering directly affects which profiles and shaping are applied.

Question 33Firewall Policies and Traffic Shaping

An administrator wants to cap download bandwidth to 10 Mbps for all users accessing a specific web server, while allowing each user up to 2 Mbps. Which combination of shapers accomplishes this?

  1. A single shared shaper of 12 Mbps on the outbound policy
  2. A shared shaper of 2 Mbps on the outbound policy plus a per-IP shaper of 10 Mbps
  3. A shared shaper of 10 Mbps on the outbound policy plus a per-IP shaper of 2 Mbps Correct answer.
  4. A single per-IP shaper of 10 Mbps on the outbound policy

Explanation

A shared shaper caps the aggregate bandwidth for all matched traffic, so 10 Mbps limits the total download. A per-IP shaper applied alongside it limits each individual source to 2 Mbps, giving both aggregate and per-user control.

Question 34Firewall Policies and Traffic Shaping

A FortiGate has an ACCEPT policy for LAN-to-WAN traffic with no security profiles, and a second ACCEPT policy below it with antivirus and IPS. Users report that virus scanning is not occurring. What is the most likely cause?

  1. The second policy is disabled by its schedule
  2. The first matching policy has no profiles, so the second policy is never evaluated Correct answer.
  3. The antivirus database is outdated on the FortiGate
  4. The traffic is being shaped by a default profile

Explanation

FortiGate applies only the first enabled policy that matches the traffic, so the profile-less policy above the inspection policy bypasses scanning. Reordering the policies so the inspection policy matches first resolves the issue.

Question 35Firewall Policies and Traffic Shaping

Which traffic shaping setting on a firewall policy references a shaper that limits bandwidth per source IP address?

  1. Per-IP shaper Correct answer.
  2. Shared shaper
  3. Maximum bandwidth
  4. Priority

Explanation

A per-IP shaper enforces a bandwidth limit independently for each source IP address matched by the policy. A shared shaper applies one aggregate limit to all matched traffic instead of per-address limits.

Question 36Firewall Policies and Traffic Shaping

An administrator needs guest wireless traffic to reach the internet only between 08:00 and 18:00 on weekdays. Which configuration accomplishes this?

  1. Assign a recurring schedule to the guest ACCEPT policy covering those hours Correct answer.
  2. Enable logging on the guest ACCEPT policy
  3. Enable NAT on the guest ACCEPT policy
  4. Assign a shared shaper to the guest ACCEPT policy

Explanation

A recurring schedule object defines the days and times when a policy is active, so assigning it to the guest policy restricts access to the specified window. Shaping, NAT, and logging settings do not control when the policy is evaluated.

Question 37Firewall Policies and Traffic Shaping

Which statement correctly distinguishes a firewall policy from a traffic shaping policy on FortiGate?

  1. A firewall policy controls whether traffic is allowed and inspected, while a traffic shaping policy applies bandwidth limits and priority Correct answer.
  2. Both policies perform identical functions and differ only in name
  3. A firewall policy applies bandwidth limits, while a traffic shaping policy controls whether traffic is allowed
  4. A firewall policy only performs NAT, while a traffic shaping policy performs all inspection

Explanation

Firewall policies determine permit or deny decisions and which security profiles are applied. Traffic shaping policies match traffic separately and assign shapers, priorities, or reverse shaper behavior for bandwidth control.

Question 38Firewall Policies and Traffic Shaping

A company wants outbound VoIP traffic to receive preferential treatment over bulk file transfers when the WAN link is congested. Which FortiGate feature should be configured?

  1. A schedule on the bulk transfer policy
  2. NAT with a pool for VoIP traffic
  3. Traffic priority with a high-priority setting for VoIP and a low-priority setting for bulk transfers Correct answer.
  4. An authentication rule for VoIP users

Explanation

Traffic priority settings on policies determine queue treatment when the link is congested, so VoIP should be set to high priority and bulk transfers to low priority. NAT, schedules, and authentication rules do not control congestion treatment.

Question 39Firewall Policies and Traffic Shaping

What does enabling the reverse shaper option on a traffic shaping policy accomplish?

  1. It applies shaping to return traffic in the opposite direction Correct answer.
  2. It inverts the priority of the matched traffic
  3. It disables shaping for the matched traffic
  4. It reverses the source and destination addresses in the policy

Explanation

The reverse shaper option applies the configured shaper to traffic returning in the opposite direction, which is useful for controlling download bandwidth when the shaping policy matches upload traffic. It does not swap addresses or invert priority.

Question 40Firewall Policies and Traffic Shaping

A FortiGate policy uses a shared shaper of 5 Mbps for outbound traffic, and a second policy uses a per-IP shaper of 1 Mbps for the same destination. Which statement describes the resulting behavior for a single user?

  1. The user is limited to 1 Mbps and all users together are limited to 5 Mbps Correct answer.
  2. The user is limited to 5 Mbps and all users together are limited to 1 Mbps
  3. The user is limited to 6 Mbps with no aggregate limit
  4. Both shapers are ignored because they conflict

Explanation

The per-IP shaper enforces a 1 Mbps ceiling for each individual user, while the shared shaper enforces a 5 Mbps aggregate ceiling across all matched traffic. Both limits apply simultaneously, so the effective per-user rate is the lower of the two constraints.

Question 41Firewall Policies and Traffic Shaping

Which policy setting must be configured so that traffic from an internal subnet is translated to the external interface address when leaving the FortiGate?

  1. Enable NAT and select the outgoing interface as the translated address Correct answer.
  2. Disable NAT and add a static route to the external interface
  3. Enable NAT and assign a schedule to the policy
  4. Enable NAT and create a virtual IP for the internal subnet

Explanation

Source NAT on a policy translates the source address to the outgoing interface address when NAT is enabled and the interface is used as the translation source. A virtual IP is used for destination NAT, not for translating internal sources to the external address.

Question 42Firewall Policies and Traffic Shaping

What is the effect of placing a DENY policy above an ACCEPT policy that match the same traffic?

  1. The DENY policy is ignored because DENY policies are evaluated last
  2. Both policies are applied and the traffic is allowed with logging
  3. The traffic is allowed because ACCEPT policies take precedence
  4. The traffic is blocked because the DENY policy is evaluated first Correct answer.

Explanation

Policies are evaluated in table order, so a DENY policy placed above a matching ACCEPT policy blocks the traffic before the ACCEPT policy is reached. Policy action does not change evaluation order.

Question 43Firewall Policies and Traffic Shaping

Which traffic shaping configuration applies a bandwidth guarantee rather than only a maximum limit?

  1. A shared shaper with only a maximum bandwidth value
  2. A policy with priority set to low
  3. A shaper with guaranteed bandwidth configured alongside maximum bandwidth Correct answer.
  4. A per-IP shaper with only a maximum bandwidth value

Explanation

FortiGate shapers can define guaranteed bandwidth in addition to maximum bandwidth, reserving capacity for matched traffic. A maximum-only shaper caps traffic but does not reserve bandwidth, and priority alone does not guarantee bandwidth.

Question 44Firewall Policies and Traffic Shaping

An administrator creates a traffic shaping policy to limit streaming video, but the limit is not being applied. Which condition is the most likely cause?

  1. The traffic shaping policy uses a shared shaper instead of a per-IP shaper
  2. The traffic shaping policy references an address object
  3. The firewall policy has logging disabled
  4. The traffic shaping policy is placed below a firewall policy that accepts the traffic without shaping Correct answer.

Explanation

Traffic shaping policies are evaluated in order alongside firewall policies, so a firewall policy that accepts the traffic before the shaping policy is reached will forward it without the intended limit. The shaping policy must match before the accepting policy applies.

Question 45Firewall Policies and Traffic Shaping

A FortiGate has a policy with a shared shaper of 20 Mbps for all LAN-to-WAN traffic and a separate per-IP shaper of 5 Mbps for a specific application. Which outcome occurs for four users each running the application simultaneously?

  1. Each user is limited to 20 Mbps and the aggregate is limited to 5 Mbps
  2. Each user is limited to 25 Mbps with no aggregate limit
  3. Each user is limited to 5 Mbps with no aggregate limit
  4. Each user is limited to 5 Mbps and the aggregate is limited to 20 Mbps Correct answer.

Explanation

The per-IP shaper caps each user at 5 Mbps, and the shared shaper caps the combined traffic at 20 Mbps. With four users the aggregate could reach 20 Mbps, which is exactly the shared cap, so both limits are consistent.

Question 46Firewall Policies and Traffic Shaping

Which statement best explains why a firewall policy with NAT enabled and no security profiles can prevent later inspection policies from working?

  1. Security profiles only apply to DENY policies
  2. NAT strips security profiles from all later policies in the table
  3. Enabling NAT disables the IPS engine globally
  4. The first matching policy is applied, so later policies with profiles are never evaluated for that traffic Correct answer.

Explanation

FortiGate stops at the first matching policy, so an early NAT policy without profiles forwards the traffic without inspection and later policies are not consulted. The fix is to attach profiles to the first matching policy or reorder the table.

Question 47Firewall Policies and Traffic Shaping

A network engineer needs to guarantee 2 Mbps for business applications while allowing them to burst up to 10 Mbps. Which shaper configuration meets this requirement?

  1. Set maximum bandwidth to 2 Mbps and guaranteed bandwidth to 10 Mbps on the shaper
  2. Set guaranteed bandwidth to 2 Mbps and maximum bandwidth to 10 Mbps on the shaper Correct answer.
  3. Set a per-IP shaper of 10 Mbps with no guaranteed bandwidth
  4. Set priority to high and maximum bandwidth to 2 Mbps on the shaper

Explanation

Guaranteed bandwidth reserves a minimum rate of 2 Mbps for the matched traffic, while maximum bandwidth allows bursts up to 10 Mbps. Reversing the values would guarantee more than the maximum, which is inconsistent.

Question 48Firewall Policies and Traffic Shaping

Which two characteristics must a traffic shaping policy use to match traffic before applying a shaper? Choose the option that correctly describes the matching criteria.

  1. Only the user group assigned to the policy
  2. Source and destination addresses, service, and application criteria defined in the policy Correct answer.
  3. Only the DSCP value of the packet
  4. Only the interface on which the traffic arrives

Explanation

Traffic shaping policies match traffic using criteria such as source and destination addresses, services, and application control signatures, similar to firewall policy matching. Interface, DSCP, or user group alone is insufficient to define the full match.

Question 49Firewall Policies and Traffic Shaping

A FortiGate policy is configured with a schedule that is active only on weekends, but users report access being blocked on Saturday. Which explanation is most plausible?

  1. An earlier enabled policy or the implicit deny is matching the traffic before the weekend policy Correct answer.
  2. The schedule object is invalid because weekends are not supported
  3. NAT is disabled on the weekend policy
  4. The weekend policy has no traffic shaper attached

Explanation

If an earlier policy matches the traffic or no policy matches and the implicit deny applies, access is blocked regardless of the weekend policy. Policy order and the presence of a matching policy determine the outcome, not the schedule alone.

Question 50Firewall Policies and Traffic Shaping

On FortiGate, which policy attribute determines whether traffic matching a firewall policy is subject to a configured traffic shaper?

  1. The schedule object attached to the policy
  2. The NAT setting enabled on the policy
  3. The traffic shaping setting enabled on the firewall policy itself Correct answer.
  4. The logging option chosen for the policy

Explanation

Shaping is applied through the traffic shaping option on the firewall policy, which references a shared or per-IP shaper object. The schedule only controls when the policy is active, and NAT or logging settings do not activate shaping on their own. Without that shaping setting enabled, matching traffic passes unshaped.