Fortinet FCF flashcards

31 cards. Read the term and the definition here. The deck at the top of this page is optional.

Stateful firewall session table

A firewall records each permitted flow's 5-tuple and state so return traffic is allowed without a separate inbound rule, improving security and performance.

ESP versus AH

ESP encrypts payload and optionally authenticates; AH authenticates the whole packet including the IP header but does not encrypt, so AH breaks under NAT.

IKE Phase 1 purpose

Phase 1 negotiates and authenticates a secure management tunnel between IPsec peers, establishing keys used to protect Phase 2 negotiations for data SAs.

Destination NAT

Destination NAT rewrites the destination address of inbound packets, typically mapping a public IP and port to an internal server for publishing services.

DMZ purpose

A demilitarized zone hosts internet-facing services on a segment separated from the internal network, so a compromised public server cannot directly reach internal hosts.

UTM profile order

Security profiles such as IPS, antivirus, application control, and web filtering are applied only to traffic accepted by a firewall policy, in a configured inspection sequence.

VLAN versus VRF

A VLAN segments a Layer 2 broadcast domain, while a VRF maintains a separate Layer 3 routing table, allowing overlapping address space on the same device.

TCP three-way handshake

The client sends SYN, the server replies SYN-ACK, and the client sends ACK; stateful devices track this to distinguish real sessions from spoofed packets.

False negative impact

A false negative is malicious activity classified as benign, meaning the attack goes undetected; it is typically the most damaging monitoring error.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned form the standard lifecycle for handling security incidents.

MTTD and MTTR

Mean time to detect measures average detection delay; mean time to respond or resolve measures remediation speed. Lower values indicate a more effective security operation.

SOC tier escalation

Tier 1 triages alerts and filters false positives, Tier 2 investigates and contains, and Tier 3 hunts threats and handles advanced response, per documented runbooks.

Vulnerability prioritization

Prioritize remediation by severity score plus exploitability signals such as known exploitation in the wild and internet exposure, not by raw CVSS alone.

NTP for log correlation

Accurate synchronized clocks across devices are required so SIEM correlation and timeline reconstruction place events in the correct order during investigations.

SOAR playbook

A SOAR playbook automates repeatable response steps such as blocking an IP or isolating a host, reducing response time while retaining approval gates for destructive actions.

Change management controls

Each change requires a documented request, risk assessment, approval, scheduled window, rollback plan, and post-change verification to prevent outages and audit exceptions.

Log retention requirement

Retention periods must exceed the time attackers typically dwell undetected and satisfy regulatory mandates, so historical evidence remains available for investigations.

Shared responsibility model

The cloud provider secures the physical and virtualization layers, while the customer secures identity, data, configuration, and workloads within their control.

IaaS customer scope

In IaaS the customer manages the operating system, patching, middleware, applications, data, and identity, while the provider manages hardware and virtualization.

Security group behavior

Cloud security groups are stateful, instance-level allow rules; return traffic is automatically permitted, and no rule means the traffic is denied by default.

Network ACL behavior

Network ACLs are stateless subnet-level rules evaluated in numbered order; both inbound and outbound rules must explicitly permit traffic, including return flows.

Public bucket risk

Object storage buckets configured for public access expose data to anyone with the URL; continuous configuration scanning is the primary control against this misconfiguration.

Customer-managed keys

Customer-managed keys let the customer control key lifecycle and rotation in a key management service or HSM, reducing provider-side access to plaintext data.

CSPM function

Cloud security posture management continuously compares deployed configurations against baselines and compliance frameworks, flagging drift such as open ports or unused credentials.

Cloud audit logging

Provider activity logs record control-plane actions such as role changes and resource deletion; forwarding them off-account prevents tampering from erasing evidence.

Short-lived credentials

Temporary tokens issued by an identity service replace long-lived access keys, limiting the window an attacker can use stolen credentials before expiry.

CIA triad

Confidentiality protects data from unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely authorized access to systems and data.

Symmetric versus asymmetric

Symmetric algorithms such as AES use one shared key and are fast for bulk data; asymmetric algorithms such as RSA use key pairs for exchange and signatures.

Password salting

A unique random salt added to each password before hashing prevents precomputed rainbow tables and ensures identical passwords produce different stored hash values.

Zero trust principle

Zero trust removes implicit trust based on network location, requiring authentication and authorization of every request using identity, device posture, and context.

Risk calculation

Risk is commonly expressed as likelihood multiplied by impact; treatment options are mitigate, transfer, avoid, or accept, leaving residual risk after controls.