I85PREP
⌘ K
Fortinet FCF study materials
Fortinet FCF study resources

Fortinet FCF practice questions

One question at a time. Build your Fortinet FCF understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security Fundamentals

Which OSI layer is responsible for logical addressing and path selection between networks?

  1. Session layer
  2. Data link layer
  3. Transport layer
  4. Network layer Correct answer.

Explanation

The network layer handles logical addressing (such as IP addresses) and routing decisions that move packets between different networks. The data link layer deals with physical addressing and local delivery, while transport and session layers handle end-to-end delivery and dialog control.

Question 2Network Security Fundamentals

A firewall rule matches traffic based on the destination port number. Which protocol header field is the firewall examining?

  1. ICMP header type field
  2. TCP or UDP header port field Correct answer.
  3. IP header protocol field
  4. Ethernet header type field

Explanation

Port numbers are carried in the TCP and UDP headers, so matching on a destination port requires parsing the transport-layer header. The IP protocol field only identifies which transport protocol is in use, and the Ethernet type field identifies the network-layer protocol.

Question 3Network Security Fundamentals

What is the primary security purpose of a DMZ in a network architecture?

  1. To encrypt all internal east-west traffic between endpoints
  2. To isolate publicly reachable services from the internal trusted network Correct answer.
  3. To aggregate multiple WAN links into a single logical connection
  4. To provide redundant default gateways for high availability

Explanation

A DMZ is a segmented zone that hosts internet-facing services so that compromise of those hosts does not directly expose the internal network. Traffic between the DMZ and internal networks is typically restricted by firewall policy.

Question 4Network Security Fundamentals

Which statement correctly describes the difference between stateful and stateless packet inspection?

  1. Stateless inspection requires deep content inspection of application payloads
  2. Stateful inspection tracks connection state and allows return traffic for established sessions Correct answer.
  3. Stateless inspection maintains a session table of established connections
  4. Stateful inspection evaluates each packet independently without tracking flows

Explanation

A stateful firewall records connection state and can automatically permit return traffic belonging to an established session. A stateless filter examines each packet in isolation and must be given explicit rules for both directions.

Question 5Network Security Fundamentals

Which protocol provides encryption, integrity, and authentication for IP packets at the network layer?

  1. SSH
  2. SNMPv3
  3. HTTPS
  4. IPsec Correct answer.

Explanation

IPsec operates at the network layer and can provide confidentiality, integrity, and peer authentication for IP traffic, commonly used for site-to-site VPNs. The other protocols protect specific application sessions rather than arbitrary IP packets.

Question 6Network Security Fundamentals

Which address range is reserved for private use under RFC 1918?

  1. 192.0.2.0/24
  2. 169.254.0.0/16
  3. 172.16.0.0/12 Correct answer.
  4. 198.51.100.0/24

Explanation

RFC 1918 defines the private ranges 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, which are not routed on the public internet. The other ranges listed serve documentation and link-local purposes.

Question 7Network Security Fundamentals

What does a security zone represent on a firewall?

  1. A logical grouping of interfaces that share the same security policy Correct answer.
  2. A cryptographic key store used for VPN tunnels
  3. A list of admin accounts permitted to log in
  4. A physical port used exclusively for management access

Explanation

Zones group interfaces so that policy can be written between trust levels rather than per physical port. Traffic between zones is controlled by firewall rules, which simplifies policy management.

Question 8Network Security Fundamentals

Which characteristic distinguishes a firewall policy's implicit deny from an explicit deny rule?

  1. The implicit deny is logged by default while the explicit deny is not
  2. The implicit deny is the default action for traffic matching no rule, while the explicit deny is a configured rule Correct answer.
  3. The explicit deny blocks traffic before any other rule is evaluated
  4. The implicit deny applies only to inbound traffic

Explanation

Most firewalls drop traffic that matches no configured rule, which is the implicit deny at the end of the policy list. An explicit deny is a rule an administrator writes, often to log or to block a specific source before a broader permit.

Question 9Network Security Fundamentals

A firewall administrator wants return traffic for outbound sessions to be allowed automatically. Which configuration achieves this with a stateful firewall?

  1. Bidirectional permit rules for every service used
  2. A permit rule from the internal zone to the external zone only Correct answer.
  3. A NAT pool with a single address
  4. A static route pointing to the external interface

Explanation

On a stateful firewall, a single outbound permit rule creates session entries that allow the corresponding return traffic. Writing rules in both directions is unnecessary and increases policy complexity.

Question 10Network Security Fundamentals

An administrator must allow DNS queries from an internal subnet to a specific external resolver while blocking all other outbound traffic. What is the most precise policy design?

  1. Deny all traffic from the internal subnet to the resolver
  2. Permit all UDP traffic from the internal subnet to any destination
  3. Permit TCP port 443 from the internal subnet to any destination
  4. Permit UDP port 53 from the internal subnet to the resolver address, with a deny-all rule after it Correct answer.

Explanation

Least-privilege policy permits only the required service, protocol, and destination. Specifying UDP port 53 and the resolver address limits exposure, and the trailing deny-all enforces default blocking.

Question 11Network Security Fundamentals

A network uses 192.168.10.0/26. How many usable host addresses does each subnet provide?

  1. 30
  2. 64
  3. 126
  4. 62 Correct answer.

Explanation

A /26 leaves 6 host bits, giving 64 addresses per subnet. Subtracting the network and broadcast addresses leaves 62 usable host addresses.

Question 12Network Security Fundamentals

Which NAT behavior allows many internal hosts to share a single public address by translating source ports?

  1. Policy-based routing
  2. Port address translation Correct answer.
  3. Destination NAT
  4. Static one-to-one NAT

Explanation

Port address translation maps multiple internal sessions to one public IP by rewriting source ports so sessions remain distinguishable. Static one-to-one NAT consumes one public address per internal host.

Question 13Network Security Fundamentals

An organization needs to connect two sites over the internet with confidentiality and integrity for all traffic between them. Which design best meets the requirement?

  1. A site-to-site IPsec tunnel between the two firewalls Correct answer.
  2. A remote-access SSL VPN for each site's users
  3. A GRE tunnel without encryption between the two routers
  4. A port mirroring session across the WAN link

Explanation

An IPsec tunnel provides encryption and integrity for traffic between the two gateways, protecting all traffic that traverses it. GRE alone encapsulates traffic but does not encrypt it, so confidentiality would not be met.

Question 14Network Security Fundamentals

What is the main security benefit of network segmentation?

  1. It replaces the need for firewall policy between subnets
  2. It guarantees that no malware can enter the network
  3. It reduces the scope of a compromise and limits lateral movement Correct answer.
  4. It eliminates the need for authentication on internal hosts

Explanation

Segmenting a network into zones limits how far an attacker can move after compromising a host, because traffic between segments must pass through control points. It does not remove the need for authentication or policy enforcement.

Question 15Network Security Fundamentals

Which statement accurately describes the function of a proxy in a security architecture?

  1. It terminates client connections and initiates new connections to the server on the client's behalf Correct answer.
  2. It forwards packets at line rate without inspecting content
  3. It encrypts all traffic between routers on the WAN
  4. It assigns IP addresses to clients on the local segment

Explanation

A proxy terminates the client session, evaluates the request, and opens a separate connection to the destination. This allows content inspection and policy enforcement at the application layer.

Question 16Network Security Fundamentals

A security team wants to detect traffic that matches known malicious patterns without blocking it. Which deployment best fits?

  1. Passive IDS monitoring a mirrored span port Correct answer.
  2. Inline IPS in blocking mode
  3. A stateful firewall with default deny
  4. A DHCP relay on the core switch

Explanation

A passive IDS receives copies of traffic through a span or tap and generates alerts without dropping packets. Inline blocking would alter traffic, which conflicts with the requirement to detect only.

Question 17Network Security Fundamentals

Which authentication factor category does a hardware token generating time-based codes represent?

  1. Something you know
  2. Somewhere you are
  3. Something you are
  4. Something you have Correct answer.

Explanation

A hardware token is a physical object the user possesses, which places it in the something-you-have category. Combining it with a password yields multi-factor authentication across two categories.

Question 18Network Security Fundamentals

What is the purpose of a security policy's default deny rule at the end of the rule list?

  1. To log permitted traffic for auditing
  2. To ensure unmatched traffic is dropped rather than allowed Correct answer.
  3. To translate addresses for outbound sessions
  4. To accelerate rule matching by shortening the list

Explanation

Placing an explicit deny at the end makes the default blocking behavior visible and enforceable, so any traffic not matched by an earlier permit is dropped. This supports least-privilege enforcement and clarifies intent.

Question 19Network Security Fundamentals

How does a stateful firewall treat a TCP packet with the ACK flag set that does not match any existing session?

  1. It typically drops it because it is not part of an established session Correct answer.
  2. It converts it into a new session automatically
  3. It always permits it because ACK packets are trusted
  4. It forwards it to the DMZ for inspection

Explanation

Stateful firewalls expect non-SYN TCP packets to belong to a tracked session. An ACK packet with no matching session is usually dropped because it could be part of a scan or spoofing attempt.

Question 20Network Security Fundamentals

Which technique helps mitigate ARP spoofing on a local network segment?

  1. Increasing the ARP cache timeout to several hours
  2. Using static routes for all internal subnets
  3. Enabling dynamic ARP inspection with trusted DHCP snooping bindings Correct answer.
  4. Disabling spanning tree on all access ports

Explanation

Dynamic ARP inspection validates ARP packets against DHCP snooping bindings so that forged replies from an attacker are dropped. This prevents a host from redirecting traffic by impersonating another host's address.

Question 21Network Security Fundamentals

A firewall policy permits HTTPS from the internal zone to the external zone. A user reports that DNS resolution fails. Which analysis is most accurate?

  1. The HTTPS rule is misconfigured because it should use port 80
  2. DNS traffic is always permitted by the implicit deny rule
  3. The HTTPS rule also permits DNS because both use TCP
  4. DNS requires a separate permit for UDP or TCP port 53, which the current policy lacks Correct answer.

Explanation

DNS uses port 53, which is not covered by a rule permitting only port 443. Name resolution therefore fails until a policy allows the required DNS traffic to the resolver.

Question 22Network Security Fundamentals

Which statement best explains why IPsec uses separate security associations for each direction of a bidirectional tunnel?

  1. Separate associations are needed to support NAT traversal
  2. Each direction has its own keys and parameters, so a single association cannot describe both Correct answer.
  3. Each direction must use a different encryption algorithm by standard
  4. IPsec requires two tunnels because routers cannot forward return traffic

Explanation

An IPsec security association is unidirectional and defines the algorithms, keys, and parameters for traffic in one direction. A bidirectional tunnel therefore uses a pair of associations, one per direction.

Question 23Network Security Fundamentals

An administrator observes that a new deny rule placed at the bottom of the policy list has no effect on blocked traffic that was previously permitted. What is the most likely cause?

  1. Deny rules cannot be placed at the bottom of a policy list
  2. The firewall requires a reboot before evaluating new rules
  3. Logging must be enabled before a deny rule becomes active
  4. The deny rule must be placed above the existing permit rule to take effect Correct answer.

Explanation

Firewalls evaluate rules in order and act on the first match. If a permit rule for the same traffic appears earlier, the later deny is never reached, so the deny must precede it.

Question 24Network Security Fundamentals

A site-to-site IPsec VPN uses ESP in tunnel mode. Which statement about the packet structure is correct?

  1. The entire original IP packet is encapsulated and protected, with a new outer IP header added Correct answer.
  2. Only the TCP header is authenticated while payloads remain in clear text
  3. ESP in tunnel mode encrypts headers but not payload data
  4. The original IP header is left unencrypted and only the payload is protected

Explanation

In tunnel mode, the whole original IP packet becomes the payload of a new packet with an outer IP header, and ESP protects the encapsulated content. Transport mode, by contrast, preserves the original IP header.

Question 25Network Security Fundamentals

A firewall performs destination NAT to publish an internal web server. Which combination of translations is typically required for this to work correctly?

  1. Only the destination address is translated on inbound packets, with no reverse translation
  2. Translation of the server's port only, leaving addresses unchanged
  3. Inbound destination translation to the server address plus reverse source translation of the server's replies Correct answer.
  4. Source translation of all inbound client packets to the firewall address

Explanation

Destination NAT rewrites the inbound destination to the internal server, and the return traffic must be translated back so the client sees replies from the public address it contacted. This reverse translation is essential for a working session.

Question 26Network Security Fundamentals

Which OSI model layer is responsible for logical addressing and path selection between networks?

  1. Layer 7, the application layer
  2. Layer 2, the data link layer
  3. Layer 4, the transport layer
  4. Layer 3, the network layer Correct answer.

Explanation

The network layer handles IP addressing and routing decisions that move packets between distinct networks. Data link addresses frames locally, transport manages sessions and ports, and application supports user-facing protocols.

Question 27Network Security Fundamentals

Which protocol provides reliable, connection-oriented delivery with sequencing and acknowledgments?

  1. ARP
  2. UDP
  3. ICMP
  4. TCP Correct answer.

Explanation

TCP establishes a session with a handshake and guarantees ordered, acknowledged delivery. UDP is connectionless, ICMP carries control and error messages, and ARP resolves IP addresses to MAC addresses.

Question 28Network Security Fundamentals

What is the primary role of a DMZ in a network security architecture?

  1. To store backups of internal database servers
  2. To replace the perimeter firewall with a router
  3. To encrypt all traffic leaving the internal network
  4. To isolate publicly reachable services from the internal network Correct answer.

Explanation

A DMZ is a segmented zone that hosts internet-facing services so that compromise of those hosts does not directly expose the internal LAN. Access between the DMZ and internal networks is then tightly controlled by policy.

Question 29Network Security Fundamentals

Which protocol is used by a stateful firewall to track the setup and teardown of TCP sessions?

  1. SNMP
  2. TCP's own three-way handshake and FIN/RST flags Correct answer.
  3. SMTP
  4. TFTP

Explanation

A stateful firewall inspects TCP flags to build a session table entry at SYN, confirm it at SYN-ACK/ACK, and remove it on FIN or RST. Management and mail protocols do not define session state for the firewall.

Question 30Network Security Fundamentals

Which protocol translates a known IP address into a MAC address on a local segment?

  1. DHCP
  2. DNS
  3. NTP
  4. ARP Correct answer.

Explanation

ARP broadcasts a request for the hardware address that owns a given IPv4 address and caches the reply. DNS resolves names, DHCP assigns addresses, and NTP synchronizes clocks.

Question 31Network Security Fundamentals

Which security control category does an intrusion prevention system represent?

  1. Compensating contractual
  2. Physical
  3. Preventive technical Correct answer.
  4. Administrative

Explanation

An IPS is a technical control that inspects traffic inline and drops malicious packets, making it preventive. Administrative controls are policies and procedures, physical controls are barriers, and contractual controls are legal agreements.

Question 32Network Security Fundamentals

What does the CIA triad's confidentiality property primarily protect against?

  1. Loss of availability during an outage
  2. Unauthorized disclosure of information Correct answer.
  3. Undetected modification of data
  4. Failure to authenticate a user

Explanation

Confidentiality ensures information is disclosed only to authorized parties, typically through encryption and access control. Integrity addresses modification, availability addresses uptime, and authentication is a supporting mechanism rather than the property itself.

Question 33Network Security Fundamentals

Which address type is used when a host sends a packet to every device on its local subnet?

  1. Broadcast Correct answer.
  2. Unicast
  3. Multicast
  4. Anycast

Explanation

A broadcast is delivered to all hosts on the local broadcast domain, such as 255.255.255.255 or a directed subnet broadcast. Unicast targets one host, anycast targets the nearest of a group, and multicast targets subscribed group members only.

Question 34Network Security Fundamentals

An administrator needs to permit only web browsing from a guest VLAN while blocking access to internal server subnets. Which policy design element is most directly required?

  1. A routing entry pointing the guest default gateway at an internal server
  2. A policy matching any source and any destination with action accept
  3. A NAT rule translating guest addresses to the server subnet
  4. A policy matching the guest source zone with destination limited to the internet-facing zone Correct answer.

Explanation

Scoping the policy by source zone and restricting the destination zone enforces least privilege for guest traffic. A permit-any rule defeats segmentation, and the other options would actively direct guest traffic toward internal resources.

Question 35Network Security Fundamentals

A firewall sits between a LAN and the internet and must allow replies to outbound connections without a separate inbound rule. Which mechanism accomplishes this?

  1. Port mirroring
  2. Stateful session tracking Correct answer.
  3. Static routing
  4. Round-robin load balancing

Explanation

Stateful inspection records each outbound session so that return packets matching the session are accepted automatically. Routing, mirroring, and load balancing do not create implicit return-path permissions.

Question 36Network Security Fundamentals

Which statement best describes how a screened subnet differs from a single-homed firewall deployment?

  1. It requires all internal hosts to use public IP addresses
  2. It removes the need for any access control list on the perimeter router
  3. It places public services in a separate segment reachable only through the firewall Correct answer.
  4. It eliminates the need for a default route on the internal network

Explanation

A screened subnet, or DMZ, isolates publicly reachable systems behind the firewall on their own segment. It supplements rather than replaces perimeter filtering, and it does not change internal addressing or routing requirements.

Question 37Network Security Fundamentals

A host sends a packet to 192.168.1.255 on a /24 network. How is that packet handled?

  1. It is dropped because the address is invalid
  2. It is routed to the default gateway for internet delivery
  3. It is delivered only to the DHCP server
  4. It is flooded to all hosts in the 192.168.1.0/24 broadcast domain Correct answer.

Explanation

The all-ones host portion of a /24 is the directed broadcast address for that subnet, so the frame is flooded within the broadcast domain. It is not routed as normal unicast traffic and is not limited to a single service.

Question 38Network Security Fundamentals

Which technique most directly reduces the risk of a compromised web server in a DMZ pivoting to the internal database?

  1. Disabling logging on the DMZ segment
  2. Restricting DMZ-to-internal flows to specific required ports and hosts Correct answer.
  3. Placing the database in the same subnet as the web server
  4. Allowing the DMZ to initiate any connection to the internal zone

Explanation

Least-privilege policy between zones limits a compromised host to only the flows it legitimately needs. Broad DMZ-to-internal access, co-location, and reduced logging all increase blast radius or hinder detection.

Question 39Network Security Fundamentals

A user can reach an internal server by IP address but not by hostname. Which troubleshooting step is most appropriate first?

  1. Reinstall the client operating system
  2. Replace the firewall's default route
  3. Verify the DNS server configured on the client and test resolution Correct answer.
  4. Rebuild the server's TCP/IP stack

Explanation

Successful access by IP with failure by name points to name resolution, so checking the configured DNS server and testing a query isolates the fault. The other steps are disproportionate and unrelated to name resolution.

Question 40Network Security Fundamentals

Which statement describes the difference between a hub and a switch in terms of traffic exposure?

  1. A hub repeats traffic to all ports, while a switch forwards frames only to the destination port Correct answer.
  2. A hub forwards frames only to the destination port, while a switch floods all ports
  3. Both devices forward frames identically to all ports
  4. A switch operates at Layer 3 while a hub operates at Layer 4

Explanation

A hub is a shared-medium repeater, so every attached host sees all traffic, whereas a switch learns MAC addresses and forwards frames only to the relevant port. This makes hubs a greater eavesdropping risk.

Question 41Network Security Fundamentals

An organization wants to log all connections to a public web server while still allowing legitimate clients. Which approach satisfies this?

  1. Permit the required service and enable logging on that policy Correct answer.
  2. Disable the policy and rely on server logs only
  3. Deny all traffic to the server and review logs weekly
  4. Permit all services to the server without logging

Explanation

A permit rule scoped to the needed service with logging enabled provides both availability and an audit trail. Denying the service breaks availability, disabling the policy removes enforcement, and permit-all without logging sacrifices visibility.

Question 42Network Security Fundamentals

Which protocol and port combination is used for secure web browsing?

  1. TCP 80
  2. UDP 53
  3. TCP 443 Correct answer.
  4. TCP 25

Explanation

HTTPS uses TCP port 443 to carry TLS-protected HTTP. Port 80 is plaintext HTTP, port 53 is DNS, and port 25 is SMTP.

Question 43Network Security Fundamentals

Which statement explains why a firewall uses zones rather than individual interfaces in policy definitions?

  1. Zones allow policies to be written once and applied to all interfaces assigned to that zone Correct answer.
  2. Zones eliminate the need for IP addressing on interfaces
  3. Zones automatically encrypt traffic between members
  4. Zones remove the requirement for routing between segments

Explanation

Grouping interfaces into zones lets administrators express intent, such as internal to external, and reuse the same policy across many physical or logical interfaces. Zones do not replace addressing, encryption, or routing.

Question 44Network Security Fundamentals

A firewall administrator must block a specific malicious IP address while allowing all other traffic to the same service. Where should the deny rule be placed?

  1. After the implicit deny at the end of the list
  2. In a separate policy package that is never installed
  3. Below the general permit rule for that service
  4. Above the general permit rule for that service Correct answer.

Explanation

Most firewalls evaluate rules top-down and stop at the first match, so a specific deny must precede the broader permit. Placing it below the permit means the permit matches first, and rules after the implicit deny are unreachable.

Question 45Network Security Fundamentals

Which characteristic of UDP makes it preferable for real-time voice traffic?

  1. It provides guaranteed in-order delivery
  2. It retransmits lost packets immediately
  3. It establishes a session with a three-way handshake
  4. It has lower overhead and does not wait for retransmissions Correct answer.

Explanation

UDP avoids handshakes and retransmission delays, which suits latency-sensitive voice where a late packet is useless. TCP's reliability features would add delay that degrades call quality.

Question 46Network Security Fundamentals

An analyst sees a large volume of SYN packets to many destination ports from a single source with no completed handshakes. Which activity is most likely occurring?

  1. A port scan Correct answer.
  2. A DNS zone transfer
  3. A DHCP lease renewal
  4. A backup replication job

Explanation

Many SYN attempts without completed handshakes across multiple ports indicate reconnaissance scanning. Zone transfers, backups, and lease renewals produce different, typically established, traffic patterns.

Question 47Network Security Fundamentals

A network engineer must summarize four contiguous /24 networks into a single route. Which prefix length represents the aggregate?

  1. /22 Correct answer.
  2. /23
  3. /26
  4. /25

Explanation

Four /24 networks combine by borrowing two bits, giving a /22 that covers all four. A /23 covers only two, and /25 and /26 are smaller than a single /24.

Question 48Network Security Fundamentals

A firewall policy allows HTTP from the internal zone to the external zone, but users report that pages load only partially. Which cause is most consistent with this symptom?

  1. The DNS server is unreachable
  2. TCP port 443 is blocked for the same destinations Correct answer.
  3. The default gateway is misconfigured
  4. The client has an incorrect subnet mask

Explanation

Partial page loads commonly occur when the primary request succeeds but related secure resources are blocked, such as HTTPS on port 443. Total name resolution or routing failures would prevent the page from loading at all.

Question 49Network Security Fundamentals

Two hosts on the same VLAN can ping each other, but a host on that VLAN cannot reach a host on another VLAN despite correct IP addresses. Which device function is most likely missing?

  1. NTP synchronization
  2. Inter-VLAN routing Correct answer.
  3. MAC address learning on the switch
  4. DNS forwarding

Explanation

Traffic between VLANs must be routed, either by a Layer 3 switch or a firewall acting as gateway. Successful same-VLAN pings confirm local switching, so the failure lies in the routing path between subnets.

Question 50Network Security Fundamentals

A firewall performs source NAT for outbound traffic, but an inbound connection to an internal server fails while the server itself is healthy. Which explanation is most likely?

  1. The firewall's clock is out of sync
  2. The NAT rule translates the source address but no destination translation exposes the server Correct answer.
  3. The internal server has no route to the internet
  4. The switch port for the server is in the wrong VLAN

Explanation

Source NAT alone hides internal addresses and provides no inbound mapping, so external clients cannot reach the server without a destination translation or virtual IP. The other conditions would not specifically prevent inbound reachability to a healthy host.