I85PREP
⌘ K
FCP FortiGate Administrator study materials
FCP FortiGate Administrator study resources

FCP FortiGate Administrator practice questions

One question at a time. Build your FCP FortiGate Administrator understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Firewall Policy and NAT

Which firewall policy action permits traffic while still applying security profiles and logging to the session?

  1. LEARN
  2. MONITOR
  3. ACCEPT Correct answer.
  4. DENY

Explanation

An ACCEPT policy action allows the traffic to pass and lets the policy's security profiles, NAT settings, and logging apply to the session. DENY silently drops matching traffic, while LEARN and MONITOR are not standard FortiGate policy actions for this purpose.

Question 2Firewall Policy and NAT

By default, in which direction does a FortiGate evaluate a new session against firewall policies?

  1. Random order based on session hash
  2. Top-down from the first policy toward the last Correct answer.
  3. Bidirectional match on first packet from either side
  4. Bottom-up from the last policy toward the first

Explanation

The FortiGate evaluates a new session against policies sequentially from the top of the policy list downward and stops at the first policy that matches all criteria. Policy order therefore matters, and more specific policies should generally be placed above broader ones.

Question 3Firewall Policy and NAT

Which firewall policy setting controls whether the FortiGate performs source NAT on matching traffic?

  1. Service
  2. NAT Correct answer.
  3. Schedule
  4. Logging

Explanation

The NAT option in a firewall policy enables or disables source NAT for matching traffic, and when enabled the translated address is derived from the outgoing interface address or a configured IP pool. Service, schedule, and logging control other aspects of matching and handling.

Question 4Firewall Policy and NAT

What is the purpose of a virtual IP (VIP) in FortiGate firewall policy?

  1. To assign a secondary management address to the FortiGate
  2. To load balance traffic across multiple WAN links
  3. To perform destination NAT, mapping an external address to an internal server Correct answer.
  4. To reserve bandwidth for a specific application

Explanation

A VIP performs destination NAT: traffic sent to the external (mapped) address is translated to the internal real server address. This is commonly used to publish internal servers to the internet.

Question 5Firewall Policy and NAT

Which policy component defines the source and destination addresses that must match for a firewall policy to apply?

  1. Security profiles
  2. Traffic shapers
  3. Authentication rules
  4. Address objects Correct answer.

Explanation

Firewall policies match traffic using source and destination address objects (along with interfaces, services, and schedules). Address objects let administrators reference subnets or hosts consistently across policies.

Question 6Firewall Policy and NAT

When source NAT is enabled on an outbound policy without an IP pool, which address is typically used as the translated source?

  1. The FortiGate's loopback address
  2. The original client address
  3. The outgoing interface's IP address Correct answer.
  4. The destination server's address

Explanation

With NAT enabled and no pool specified, the FortiGate uses the IP address of the outgoing interface as the translated source address. This is the default behavior for hiding internal addresses behind a WAN interface.

Question 7Firewall Policy and NAT

Which interface role should be assigned to an interface that connects to the public internet in a typical FortiGate deployment?

  1. WAN Correct answer.
  2. DMZ
  3. Loopback
  4. LAN

Explanation

The WAN role designates an interface facing an untrusted or external network such as the internet, which affects default behaviors and policy design. LAN and DMZ roles are used for internal and perimeter networks respectively.

Question 8Firewall Policy and NAT

Which address object type represents a contiguous range of IP addresses rather than a single host or subnet?

  1. MAC address
  2. IP Range Correct answer.
  3. FQDN
  4. Geography

Explanation

An IP Range object specifies a start and end IP address, covering a contiguous block that may not align to a subnet boundary. FQDN, Geography, and MAC address objects match on other criteria.

Question 9Firewall Policy and NAT

A policy is configured with source 10.0.1.0/24 and destination 192.168.5.10. A host at 10.0.1.50 sends traffic to 192.168.5.10. Which statement is true?

  1. The policy does not match because the source is a single host
  2. The policy matches only if logging is enabled
  3. The policy matches only if a service is also defined
  4. The policy matches because the source falls within the configured subnet Correct answer.

Explanation

Address matching is based on whether the packet's source or destination falls within the object's defined subnet or range. A host at 10.0.1.50 is contained in 10.0.1.0/24, so the source criterion is satisfied.

Question 10Firewall Policy and NAT

An administrator wants internal clients to reach an internet web server through the FortiGate while hiding their private addresses. Which configuration accomplishes this?

  1. A VIP mapping the web server to a public address
  2. An inbound policy with NAT disabled
  3. An outbound policy with NAT enabled and the WAN interface as outgoing Correct answer.
  4. A policy with the action set to DENY

Explanation

Source NAT on an outbound policy translates the clients' private addresses to the WAN interface address (or a pool), hiding them from the internet. A VIP is used for inbound destination NAT, not for hiding outbound clients.

Question 11Firewall Policy and NAT

A FortiGate has two policies: policy 1 permits 10.0.0.0/16 to any with the action ACCEPT, and policy 2 blocks 10.0.5.0/24 to any with the action DENY. Traffic from 10.0.5.20 to the internet is evaluated. What is the result?

  1. The traffic is dropped because no policy matches
  2. The traffic is permitted only if logging is enabled on policy 2
  3. The traffic is permitted because policy 1 is evaluated first Correct answer.
  4. The traffic is denied because policy 2 is more specific

Explanation

Policies are evaluated top-down and the first full match wins. Because policy 1 matches 10.0.5.20 and appears above policy 2, it is applied and the traffic is permitted; the more specific DENY policy is never reached.

Question 12Firewall Policy and NAT

Which configuration is required so that external users can reach an internal web server at 192.168.10.20 using public address 203.0.113.10?

  1. A VIP with external IP 203.0.113.10 and mapped IP 192.168.10.20, plus an inbound policy Correct answer.
  2. An outbound policy with NAT enabled
  3. A static route to 203.0.113.10
  4. An IP pool containing 192.168.10.20

Explanation

Publishing an internal server requires a VIP that maps the external address to the server's real address, plus a firewall policy permitting traffic from the external interface to the internal interface using that VIP as destination.

Question 13Firewall Policy and NAT

What does the 'match-vip' setting in a firewall policy control?

  1. Whether the policy logs VIP traffic only
  2. Whether the policy matches traffic destined to a VIP object Correct answer.
  3. Whether the policy permits ICMP to a VIP
  4. Whether the policy applies source NAT to VIP traffic

Explanation

The match-vip setting determines whether a policy can match traffic whose destination is a VIP object, which is relevant when policies reference the VIP or its pre-translation address. It affects policy matching for VIP-destined sessions.

Question 14Firewall Policy and NAT

Which object should be used to translate outbound traffic to a pool of public addresses rather than the interface address?

  1. Address Group
  2. Service Group
  3. IP Pool Correct answer.
  4. Virtual IP

Explanation

An IP Pool defines one or more addresses that the FortiGate can use as the translated source for NAT, either for overloading or one-to-one mapping. This is selected in the policy's NAT configuration.

Question 15Firewall Policy and NAT

An administrator enables NAT on an outbound policy and selects a fixed-port IP pool. What is the effect?

  1. The pool is used only for inbound traffic
  2. Destination addresses are translated instead of source addresses
  3. Each internal host always uses the same external address and source port Correct answer.
  4. Source ports are randomized for every session

Explanation

A fixed-port IP pool preserves a consistent external address and source port mapping for a given internal host, which is useful for services that require stable source information. This differs from the default port-overloading behavior.

Question 16Firewall Policy and NAT

Which policy criterion must match for identity-based policies to apply to a user's traffic?

  1. The user must be on the WAN interface
  2. The policy must use a schedule of always
  3. The user must be authenticated and recognized by the FortiGate Correct answer.
  4. The policy must have NAT disabled

Explanation

Identity-based policies rely on the FortiGate recognizing the user through authentication (for example, firewall or FSSO authentication). Once the user is identified, policies referencing that user or group can match the traffic.

Question 17Firewall Policy and NAT

A policy uses the service object ALL. Which traffic does it match?

  1. Only ICMP
  2. Only HTTP and HTTPS
  3. Only TCP and UDP traffic
  4. All IP protocols and ports Correct answer.

Explanation

The predefined ALL service matches all IP protocols and ports, effectively removing service as a restricting criterion. Administrators often replace ALL with specific services to tighten policy scope.

Question 18Firewall Policy and NAT

Which statement best describes the relationship between a firewall policy and a security profile group?

  1. The profile group is applied to permitted traffic to inspect it for threats Correct answer.
  2. The profile group determines whether the policy matches the traffic
  3. The profile group replaces the need for a policy action
  4. The profile group performs source NAT

Explanation

Security profiles (or a profile group) are attached to an ACCEPT policy to inspect traffic that the policy permits, providing antivirus, IPS, web filtering, and similar protections. They do not determine policy matching or perform NAT.

Question 19Firewall Policy and NAT

An administrator wants a specific subnet's traffic to bypass a broad DENY policy placed above it in the list. What is the most appropriate change?

  1. Move the DENY policy to the bottom and rely on the implicit deny
  2. Disable logging on the DENY policy
  3. Change the DENY policy action to ACCEPT
  4. Add an ACCEPT policy for the subnet above the DENY policy Correct answer.

Explanation

Because the first matching policy wins, a more specific ACCEPT policy must be placed above the broader DENY policy for that subnet to be permitted. This preserves the DENY for other traffic while allowing the exception.

Question 20Firewall Policy and NAT

Which NAT scenario is described when both source and destination addresses are translated in the same session?

  1. No NAT
  2. Destination NAT only
  3. Full NAT (source and destination NAT together) Correct answer.
  4. Source NAT only

Explanation

When a session undergoes both source NAT and destination NAT, it is often referred to as full NAT. This can occur, for example, when internal clients access an internal server through its public VIP address.

Question 21Firewall Policy and NAT

Which behavior occurs when a VIP is configured with port forwarding, for example external port 8080 mapped to internal port 80?

  1. The VIP applies only to outbound traffic
  2. The port mapping is ignored and all ports are forwarded
  3. The source port is translated instead of the destination port
  4. The destination port is translated along with the destination address Correct answer.

Explanation

A VIP with port forwarding translates both the destination address and the destination port, so requests to the external port reach the internal server on the configured internal port. This is common for publishing services on non-standard external ports.

Question 22Firewall Policy and NAT

A FortiGate uses a one-to-one IP pool for source NAT. Which statement accurately describes this configuration?

  1. The pool provides destination translation for inbound servers
  2. All internal hosts share a single external address and port range
  3. The pool disables NAT for matching traffic
  4. Each internal host is mapped to a dedicated external address Correct answer.

Explanation

A one-to-one IP pool maps each internal host to its own external address, preserving the host's identity externally while still translating addresses. This differs from overloading, where many hosts share one address.

Question 23Firewall Policy and NAT

An administrator creates a policy with source 'all', destination 'all', service 'ALL', and action ACCEPT on the WAN-to-LAN direction. What is the primary security concern?

  1. It permits all inbound traffic to internal networks without restriction Correct answer.
  2. It blocks legitimate outbound traffic
  3. It prevents security profiles from being applied
  4. It disables logging on the FortiGate

Explanation

A broad ACCEPT policy on the WAN-to-LAN direction allows any external traffic to reach internal networks, effectively bypassing the intended protection of the implicit deny. Policies should be scoped to specific addresses and services.

Question 24Firewall Policy and NAT

Which statement correctly distinguishes a central NAT configuration from per-policy NAT?

  1. Central NAT requires that each policy enable NAT individually
  2. Central NAT applies only to inbound VIP traffic
  3. Central NAT disables the use of IP pools
  4. Central NAT defines NAT rules referenced by policies rather than enabling NAT per policy Correct answer.

Explanation

With central NAT, NAT rules and IP pools are defined centrally and policies reference them, rather than enabling NAT individually on each policy. This centralizes translation management across many policies.

Question 25Firewall Policy and NAT

Which firewall policy action explicitly drops matching traffic without sending a response to the source?

  1. ACCEPT
  2. LEARN
  3. MONITOR
  4. DENY Correct answer.

Explanation

The DENY action silently discards matching packets; no TCP reset or ICMP unreachable is returned. ACCEPT permits the traffic, while LEARN and MONITOR are not valid policy actions in FortiOS.

Question 26Firewall Policy and NAT

Which policy matching criterion uses the application signature database to identify traffic by application rather than by TCP or UDP port?

  1. Application control Correct answer.
  2. Schedule
  3. Internet service
  4. Service

Explanation

Application control identifies traffic by application signature, independent of port. Service matches by protocol and port number, Internet service matches by a predefined destination database entry, and schedule matches by time.

Question 27Firewall Policy and NAT

What is the effect of setting the firewall policy action to DENY?

  1. The FortiGate sends a TCP reset to the client and drops the packet.
  2. The FortiGate drops the packet without sending a reset or ICMP message. Correct answer.
  3. The FortiGate logs the packet but forwards it to the destination.
  4. The FortiGate redirects the packet to the next policy in the list.

Explanation

The DENY action silently drops matching packets; no TCP reset or ICMP unreachable is generated. This differs from REJECT, which sends a reset or ICMP message. Logging is controlled separately by the log setting.

Question 28Firewall Policy and NAT

An administrator wants to translate outbound traffic to a single public IP address but must preserve the original source port. Which IP pool type should be used?

  1. Port block allocation
  2. Fixed-port range
  3. One-to-one
  4. Overload Correct answer.

Explanation

An overload pool uses a single IP address and translates source ports dynamically, preserving the ability to multiplex many sessions. One-to-one pools map one internal address to one external address, fixed-port ranges restrict the translated port range, and port block allocation assigns blocks of ports per host.

Question 29Firewall Policy and NAT

Which statement correctly describes the order in which a FortiGate evaluates firewall policies?

  1. Policies are evaluated by most specific match first, regardless of list order.
  2. Policies are evaluated from the top of the list downward, and the first match is applied. Correct answer.
  3. Policies are evaluated from the bottom of the list upward.
  4. Policies are evaluated in random order until a match is found.

Explanation

FortiGate evaluates policies sequentially from the top of the list downward and applies the first policy whose criteria match the traffic. Once a match is found, no further policies are evaluated. Therefore, policy order directly determines which rule takes effect.

Question 30Firewall Policy and NAT

Which firewall policy setting must be enabled for a policy to apply only to traffic from users who have authenticated and whose user group matches the policy?

  1. Destination interface
  2. Source interface
  3. User group Correct answer.
  4. Service

Explanation

Identity-based policies require a user group in the policy's source criteria; the FortiGate matches traffic only after the user is identified and belongs to that group. Source and destination interfaces and service are separate matching criteria.

Question 31Firewall Policy and NAT

A firewall policy is configured with service ALL. Which traffic does this policy match?

  1. All IP traffic, including ICMP and other IP protocols. Correct answer.
  2. Only HTTP, HTTPS, and DNS traffic.
  3. Only traffic that matches a predefined application signature.
  4. Only TCP and UDP traffic on well-known ports.

Explanation

The service object ALL matches all IP protocols and ports, including ICMP and protocols other than TCP and UDP. It is not limited to well-known ports or to a specific application list.

Question 32Firewall Policy and NAT

An administrator wants to use a central NAT table instead of per-policy NAT. Which statement correctly describes central NAT?

  1. NAT is applied automatically to all policies without any configuration.
  2. NAT is configured in a separate central NAT table and is applied to policies that reference the table. Correct answer.
  3. NAT is configured only for destination translation and cannot translate source addresses.
  4. NAT is enabled per policy and uses the outgoing interface address by default.

Explanation

Central NAT uses a dedicated NAT table (with NAT rules) that policies reference, separating NAT configuration from individual policy NAT settings. Per-policy NAT is the default method where NAT is enabled on each policy.

Question 33Firewall Policy and NAT

An administrator configures a VIP with port forwarding, mapping external port 8080 to internal port 80 on 192.168.10.20. Which statement accurately describes the resulting behavior?

  1. The FortiGate translates only the destination port and leaves the IP address unchanged.
  2. The FortiGate translates the destination IP and port for inbound sessions, and translates the source IP of the internal server for return traffic. Correct answer.
  3. The FortiGate translates the source IP of inbound clients to the VIP address.
  4. The FortiGate translates only the destination IP address and leaves the port unchanged.

Explanation

A VIP with port forwarding performs destination NAT, changing both the destination IP and port for inbound traffic. For return traffic, the FortiGate translates the internal server's source IP back to the VIP address so the client sees the original destination.

Question 34Firewall Policy and NAT

Which NAT scenario is described when a policy translates both the source and destination addresses of a session?

  1. Destination NAT only
  2. Source NAT only
  3. No NAT
  4. Full NAT (source and destination NAT) Correct answer.

Explanation

When both source and destination addresses are translated, it is referred to as full NAT or source-destination NAT. This commonly occurs when an internal client accesses an internal server via its public VIP address and the source is also translated.

Question 35Routing and Network Configuration

On a FortiGate, which CLI command displays the current routing table?

  1. get system arp
  2. show system route
  3. get router info routing-table all Correct answer.
  4. diagnose ip route list

Explanation

The routing table is inspected with get router info routing-table followed by a filter such as all, static, or connected. The command reads the active Forwarding Information Base maintained by the routing process.

Question 36Routing and Network Configuration

Which route type does a FortiGate prefer when multiple routes to the same destination exist with identical distance and priority?

  1. The route learned most recently
  2. The route with the longest prefix length
  3. The route with the highest metric
  4. The route with the lowest metric Correct answer.

Explanation

FortiOS selects routes by administrative distance first, then priority, then metric. When distance and priority tie, the lower metric wins.

Question 37Routing and Network Configuration

What is the default administrative distance of a static route on a FortiGate?

  1. 10 Correct answer.
  2. 5
  3. 110
  4. 20

Explanation

Static routes in FortiOS default to an administrative distance of 10. Connected routes use distance 0, and OSPF routes default to 110.

Question 38Routing and Network Configuration

Which interface type must be configured on a FortiGate for it to act as a DHCP server for a subnet?

  1. A zone containing only VLAN sub-interfaces
  2. A layer 2 interface in a software switch
  3. A redundant interface
  4. A layer 3 interface with a static IP in that subnet Correct answer.

Explanation

A DHCP server is bound to an interface that has an IP address in the subnet being served. The FortiGate answers DHCP requests received on that interface.

Question 39Routing and Network Configuration

Which protocol does a FortiGate use by default to resolve MAC addresses for next-hop IPs on an Ethernet interface?

  1. DHCP
  2. ARP Correct answer.
  3. RARP
  4. NDP

Explanation

IPv4 next-hop resolution on Ethernet uses ARP. The FortiGate caches the resulting IP-to-MAC mappings and ages them out.

Question 40Routing and Network Configuration

Which interface addressing mode allows a FortiGate interface to obtain its IP address from an upstream DHCP server?

  1. PPPoE
  2. One-arm sniffer
  3. Manual
  4. DHCP Correct answer.

Explanation

Setting the interface addressing mode to DHCP makes the FortiGate a DHCP client on that interface. The learned address, gateway, and DNS can then be used for routing and system settings.

Question 41Routing and Network Configuration

What does a policy route on a FortiGate do?

  1. It applies only to traffic originated by the FortiGate itself
  2. It filters routes learned from dynamic routing protocols
  3. It forwards matching traffic out a specified interface or gateway regardless of the routing table Correct answer.
  4. It permanently replaces the static routing table entry for a destination

Explanation

Policy routes are evaluated before the routing table for matching traffic and can override the normal destination-based lookup. They are commonly used for source-based forwarding and link steering.

Question 42Routing and Network Configuration

Which statement describes an equal-cost multi-path (ECMP) configuration on a FortiGate?

  1. Traffic is duplicated and sent over every path simultaneously
  2. Traffic is load balanced across multiple next hops that have equal distance, priority, and metric Correct answer.
  3. Traffic is always sent over the single oldest route
  4. Traffic is load balanced only when the paths have different administrative distances

Explanation

ECMP occurs when several routes to the same destination share the same distance, priority, and metric. FortiOS then balances sessions across the eligible next hops.

Question 43Routing and Network Configuration

An administrator adds a static route to 10.50.0.0/16 with distance 10 and another to 10.50.0.0/16 with distance 20. Which route is installed in the routing table?

  1. The distance 20 route
  2. Neither route, because the entries conflict
  3. The distance 10 route Correct answer.
  4. Both routes, balanced equally

Explanation

When two routes match the same destination, the one with the lower administrative distance is preferred and installed. The higher-distance route stays inactive unless the preferred one is withdrawn.

Question 44Routing and Network Configuration

A FortiGate has a default route via 203.0.113.1 (distance 10) and a default route via 198.51.100.1 (distance 10, priority 5). The first route has default priority. Which default route is used?

  1. The route via 203.0.113.1 Correct answer.
  2. Both, using ECMP
  3. The route via 198.51.100.1
  4. Neither, because priorities differ

Explanation

With equal distance, FortiOS compares priority and prefers the lower value. The route with default (lower) priority wins over the one with priority 5, so ECMP does not occur.

Question 45Routing and Network Configuration

Users on a FortiGate LAN cannot reach the internet, but the FortiGate can ping internet hosts. The default route exists and a firewall policy allows the LAN subnet outbound. What is the most likely cause?

  1. NAT is not enabled on the outbound policy Correct answer.
  2. The default route metric is too low
  3. The LAN interface has no ARP entry for the internet host
  4. The FortiGate is missing a route to the LAN subnet

Explanation

If the FortiGate itself reaches the internet but LAN clients cannot, the usual cause is missing source NAT on the outbound policy, so replies are not routed back. Local reachability confirms routing and DNS on the device.

Question 46Routing and Network Configuration

Which configuration is required on a FortiGate to route between two VLAN sub-interfaces on the same physical interface?

  1. Each VLAN sub-interface must have an IP address and the physical interface must carry the tagged traffic Correct answer.
  2. A software switch must include both VLANs
  3. Both VLANs must share a single IP address
  4. The physical interface must have an IP address in both subnets

Explanation

VLAN sub-interfaces act as separate layer 3 interfaces, each needing its own IP address and matching VLAN ID. The parent interface passes tagged frames to the sub-interfaces.

Question 47Routing and Network Configuration

What is the purpose of the priority setting on a static route in FortiOS?

  1. It controls the order in which routes age out
  2. It sets the OSPF cost advertised for the route
  3. It determines the DSCP value applied to forwarded packets
  4. It breaks ties between routes with the same distance before metric is considered Correct answer.

Explanation

Static route priority is a tiebreaker used after administrative distance and before metric. A lower priority value is preferred when distances are equal.

Question 48Routing and Network Configuration

Which two pieces of information does a FortiGate need to forward a packet to a destination not on a directly connected subnet?

  1. An ARP entry for the final destination and a static DNS entry
  2. A matching route and a resolvable next-hop address Correct answer.
  3. The destination MAC address and a DNS server
  4. A firewall policy and a DHCP lease

Explanation

The FortiGate looks up the destination in the routing table to find the egress interface and next hop, then resolves the next-hop MAC address. Both the route and next-hop resolution must succeed.

Question 49Routing and Network Configuration

A FortiGate has two WAN links and the administrator wants outbound web traffic from a specific server to always use WAN2 while all other traffic uses WAN1. Which feature accomplishes this?

  1. A static route to the server's subnet via WAN2
  2. A policy route matching the server's source address with WAN2 as the outgoing interface Correct answer.
  3. An ECMP group containing WAN1 and WAN2
  4. An inbound firewall policy on WAN2

Explanation

Policy routes match on criteria such as source address and direct matching traffic to a chosen outgoing interface ahead of the routing table. This steers only the specified server's traffic without affecting other flows.

Question 50Routing and Network Configuration

Which statement about a FortiGate operating as a DHCP relay is correct?

  1. It requires the interface to have an IP address in the client subnet
  2. It assigns addresses from a local pool and forwards the lease to the server
  3. It forwards client DHCP requests to a specified external DHCP server Correct answer.
  4. It converts DHCP requests into PPPoE sessions

Explanation

DHCP relay forwards broadcast DHCP requests from clients to a configured remote DHCP server, which manages the address pool. The FortiGate does not allocate addresses locally in relay mode.