I85PREP
⌘ K
FCSS Enterprise Firewall 7.6 study materials
FCSS Enterprise Firewall 7.6 study resources

FCSS Enterprise Firewall 7.6 practice questions

One question at a time. Build your FCSS Enterprise Firewall 7.6 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Deployment and System Configuration

In a FortiGate HA cluster operating in active-passive mode, which statement describes how the primary unit handles sessions that arrive on the secondary unit's interfaces?

  1. The secondary forwards the packet to the primary over the HA heartbeat link for processing. Correct answer.
  2. The secondary drops the traffic and the primary never learns of the session.
  3. The secondary rewrites the destination MAC and answers the client directly.
  4. The secondary processes the session locally and syncs state to the primary afterward.

Explanation

In active-passive HA, only the primary processes traffic. When a packet reaches a secondary interface, the secondary forwards it to the primary across the HA heartbeat link so the primary can apply policy and build the session.

Question 2Deployment and System Configuration

Which FortiGate feature must be enabled so that a management administrator can reach the device over HTTPS on a dedicated out-of-band interface while that interface is excluded from normal data forwarding?

  1. A virtual wire pair
  2. Administrative access protocols enabled on the interface with the interface not referenced by any firewall policy Correct answer.
  3. An SD-WAN zone membership on the interface
  4. A dedicated management VDOM with a static route

Explanation

An interface becomes a management-only path when administrative access protocols such as HTTPS and SSH are enabled on it and no firewall policy references it for data traffic. Traffic destined to the FortiGate itself is handled by the local-in path rather than by forwarding policy.

Question 3Deployment and System Configuration

A FortiGate is deployed in transparent mode. Which statement correctly describes how it forwards traffic between its interfaces?

  1. It requires each interface to be in a separate VDOM with inter-VDOM links.
  2. It forwards frames between interfaces in the same bridge without changing IP addresses. Correct answer.
  3. It routes traffic between subnets using its routing table.
  4. It performs NAT on all traffic leaving the WAN interface.

Explanation

In transparent mode the FortiGate bridges interfaces together and forwards frames at Layer 2, leaving source and destination IP addresses intact. Firewall policies still apply to the bridged traffic for security inspection.

Question 4Deployment and System Configuration

Which CLI command displays the current configuration of the HA cluster, including the group name, mode, and priority values?

  1. get system ha status Correct answer.
  2. diagnose hardware sysinfo ha
  3. diagnose sys ha status
  4. show system ha

Explanation

The `get system ha status` command returns the effective HA configuration and current cluster status, including group name, mode, and priorities. The `show` command prints configuration syntax rather than the live status summary.

Question 5Deployment and System Configuration

An administrator wants FortiGate to obtain its WAN interface address, default gateway, and DNS servers automatically from the ISP. Which interface configuration accomplishes this?

  1. Set the addressing mode to manual and enter the ISP-provided values.
  2. Set the addressing mode to DHCP and enable the retrieve default gateway and DNS options. Correct answer.
  3. Set the interface role to WAN and configure a PPPoE username only.
  4. Create a static route to 0.0.0.0/0 pointing at the interface itself.

Explanation

DHCP addressing mode lets the FortiGate learn the interface IP, default gateway, and DNS servers from the ISP. The retrieve options control whether the learned gateway and DNS values are installed in the routing table and resolver.

Question 6Deployment and System Configuration

Which statement about FortiGate VDOMs is correct?

  1. All VDOMs share a single routing table but have separate firewall policies.
  2. Each VDOM maintains its own routing table, firewall policies, and administrators. Correct answer.
  3. VDOMs can only be created on physical interfaces, not on VLAN subinterfaces.
  4. Enabling VDOM mode requires a reboot only when more than two VDOMs are configured.

Explanation

VDOMs partition a FortiGate into independent virtual devices, each with its own routing table, policies, and administrative access. Inter-VDOM links provide connectivity between VDOMs when needed.

Question 7Deployment and System Configuration

A FortiGate must be configured so that administrators in the management VDOM cannot see or modify objects in the root VDOM. Which setting enforces this separation?

  1. Set the admin account's accprofile to super_admin.
  2. Assign the administrator to the management VDOM with a VDOM-scoped administrator profile. Correct answer.
  3. Configure a trusthost entry for the administrator's management subnet.
  4. Enable multi-factor authentication on the administrator account.

Explanation

Administrative visibility is scoped by the VDOM assigned to the administrator account combined with the permissions in the assigned profile. A VDOM-scoped administrator only sees and manages objects within the assigned VDOM.

Question 8Deployment and System Configuration

Which FortiGate interface type allows two physical ports to pass all traffic between them without any IP addressing or firewall policy inspection?

  1. A virtual wire pair Correct answer.
  2. A redundant interface
  3. A zone
  4. A software switch

Explanation

A virtual wire pair passes all frames between two interfaces transparently without requiring IP addresses or firewall policies. It is used for inline insertion of the FortiGate into an existing link.

Question 9Deployment and System Configuration

Which routing configuration causes the FortiGate to prefer a route learned via OSPF over a static default route when both are present?

  1. Assign the OSPF route to a different VDOM.
  2. Increase the OSPF route's metric to a value lower than the static route's distance.
  3. Enable ECMP so both routes are used simultaneously.
  4. Lower the administrative distance of the OSPF route below that of the static route. Correct answer.

Explanation

FortiGate selects routes by administrative distance first, then by metric. Lowering the OSPF route's distance below the static route's distance makes it preferred.

Question 10Deployment and System Configuration

Which FortiGate feature allows a single physical interface to carry traffic for multiple customers with separate routing and policy, without using VDOMs?

  1. Interface zones Correct answer.
  2. Policy routes
  3. Virtual router instances
  4. VLAN subinterfaces with policy-based routing

Explanation

Interface zones group multiple interfaces so a single policy can apply to all of them, which is useful for multi-tenant deployments. Zones do not provide separate routing tables, so VDOMs are still required for full separation.

Question 11Deployment and System Configuration

An administrator configures a FortiGate with two WAN links and wants traffic to fail over automatically when the primary link's gateway stops responding. Which configuration achieves this?

  1. Enable asymmetric routing on the primary interface.
  2. Enable ECMP with both default routes at the same distance.
  3. Configure a link monitor on the primary interface with a secondary default route having a higher distance. Correct answer.
  4. Configure a policy route that always uses the primary interface.

Explanation

A link monitor detects when the primary gateway is unreachable and withdraws the associated route, allowing the higher-distance backup default route to take over. This provides automatic failover without manual intervention.

Question 12Deployment and System Configuration

Which statement describes the default behavior of the FortiGate when it receives a packet that matches no firewall policy?

  1. The packet is silently dropped and no log is generated unless a deny policy exists. Correct answer.
  2. The packet is allowed if it is part of an established session.
  3. The packet is allowed and logged.
  4. The packet is forwarded to the management VDOM.

Explanation

FortiGate applies an implicit deny: traffic that matches no policy is dropped. Because no policy matched, no traffic log is generated unless an explicit deny policy or logging setting captures it.

Question 13Deployment and System Configuration

Which two settings must match for two FortiGates to form an HA cluster? (Choose the correct pairing.)

  1. Management IP and admin profile
  2. Hostname and serial number
  3. Firmware build and license type
  4. Group name and group ID Correct answer.

Explanation

HA group members must share the same HA group name and group ID to form a cluster. Hostnames and management IPs are typically unique per unit.

Question 14Deployment and System Configuration

A FortiGate in an HA cluster is configured with HA override disabled. What happens when a unit with a higher priority joins the cluster?

  1. It remains a secondary unit until the current primary fails or is rebooted. Correct answer.
  2. It becomes the primary only if its uptime is greater than the current primary's.
  3. It immediately becomes the primary unit.
  4. It is rejected from the cluster because priorities differ.

Explanation

When override is disabled, the existing primary retains its role even if a higher-priority unit joins. The higher-priority unit takes over only after a failover event such as the primary failing or being rebooted.

Question 15Deployment and System Configuration

Which FortiGate setting controls the maximum number of concurrent sessions the device will allow?

  1. The session-helper configuration
  2. The firewall session limit configured under system global Correct answer.
  3. The session-ttl setting under system global
  4. The per-policy session limit

Explanation

The global session limit under `system global` caps the total number of concurrent sessions the FortiGate maintains. Per-policy limits can further restrict sessions for specific traffic.

Question 16Deployment and System Configuration

Which FortiGate interface setting must be configured for an interface to participate in an SD-WAN zone?

  1. The interface must be configured as a VLAN subinterface.
  2. The interface must have a gateway address and be assigned to the zone. Correct answer.
  3. The interface must be in a separate VDOM from the zone.
  4. The interface must have a static IP address and no DHCP client.

Explanation

An interface joins an SD-WAN zone by being assigned to that zone in its configuration and having a gateway so health checks and steering can function. DHCP-addressed interfaces can also participate if they have a gateway.

Question 17Deployment and System Configuration

Which CLI command is used to back up the FortiGate configuration to a TFTP server?

  1. diagnose sys config backup
  2. config system backup
  3. execute backup config tftp <filename> <server> Correct answer.
  4. execute restore config tftp <filename> <server>

Explanation

The `execute backup config tftp` command uploads the current configuration to a TFTP server. The `restore` variant is used to load a configuration back onto the device.

Question 18Deployment and System Configuration

An administrator needs to restore a FortiGate to its factory default settings while preserving the current firmware version. Which action accomplishes this?

  1. Run `diagnose sys flash list` and delete the configuration partition.
  2. Run `execute formatlogdisk` from the CLI.
  3. Run `execute factoryreset` from the CLI. Correct answer.
  4. Run `execute restore config` with an empty file.

Explanation

The `execute factoryreset` command resets the configuration to factory defaults while keeping the installed firmware. It is the standard method for returning a device to a clean state.

Question 19Deployment and System Configuration

Which FortiGate feature provides a way to apply a common set of security profiles to multiple firewall policies without editing each policy individually?

  1. Security profile groups Correct answer.
  2. Service groups
  3. Schedule groups
  4. Address groups

Explanation

Security profile groups bundle multiple security profiles so the same set can be applied to many policies at once. Changing the group updates every policy that references it.

Question 20Deployment and System Configuration

A FortiGate is configured with two VDOMs and an inter-VDOM link. Which statement about traffic crossing the inter-VDOM link is correct?

  1. It requires a virtual wire pair between the VDOMs.
  2. It is automatically NATed between VDOMs.
  3. It bypasses firewall policies because it is internal traffic.
  4. It is subject to firewall policies in both VDOMs. Correct answer.

Explanation

Traffic traversing an inter-VDOM link is inspected by firewall policies in each VDOM, allowing separate security controls per tenant. NAT is not applied automatically.

Question 21Deployment and System Configuration

Which setting determines whether a FortiGate interface responds to pings sent to its own IP address?

  1. The administrative access setting for PING on the interface Correct answer.
  2. The firewall policy that permits ICMP to the interface
  3. The global ICMP redirect setting
  4. The session-helper configuration

Explanation

Administrative access protocols configured on an interface, including PING, control whether the FortiGate itself responds to ICMP echo requests sent to that interface's address. This is separate from firewall policy that governs transit traffic.

Question 22Deployment and System Configuration

Which FortiGate configuration object is required before an administrator can use a USB drive to install firmware?

  1. A USB firmware image must be placed in the root of the drive and the drive inserted before boot. Correct answer.
  2. The USB drive must be formatted with the FortiGate filesystem via `execute formatusb`.
  3. The USB drive must be registered as a firmware repository in the GUI.
  4. The USB drive must contain a valid configuration backup first.

Explanation

To install firmware from USB, the image must be placed in the root of the drive and the drive inserted so the boot loader can detect it. The device then offers the image during the boot process.

Question 23Deployment and System Configuration

An administrator wants to prevent brute-force login attempts against the FortiGate administrative interface. Which setting provides this protection?

  1. Admin lockout after a configured number of failed attempts Correct answer.
  2. Two-factor authentication
  3. Strong password policy enforcement
  4. Trusted host entries only

Explanation

The admin lockout setting blocks an account after a configured number of failed login attempts, mitigating brute-force attacks. Trusted hosts, password policy, and MFA are complementary controls but do not lock out accounts after failures.

Question 24Deployment and System Configuration

Which statement about FortiGate firmware upgrades in an HA cluster is correct?

  1. The cluster upgrades automatically when the primary is upgraded.
  2. Each unit must be upgraded individually, typically by upgrading the secondary first. Correct answer.
  3. The cluster must be dissolved before upgrading.
  4. Only the primary needs upgrading; secondaries sync firmware from the primary.

Explanation

In an HA cluster, firmware must be upgraded on each unit individually, with the secondary usually upgraded first to minimize downtime. Secondaries do not receive firmware automatically from the primary.

Question 25Deployment and System Configuration

Which FortiGate feature allows an administrator to schedule automatic configuration backups to a remote server?

  1. Configuration revision control
  2. Scheduled backup under system maintenance Correct answer.
  3. Automation stitches
  4. Log forwarding

Explanation

Scheduled backups configured under system maintenance let the FortiGate upload configuration backups to a remote server on a recurring schedule. Automation stitches can trigger actions on events but are not the standard backup scheduler.

Question 26Deployment and System Configuration

Which FortiGate interface mode allows the interface to be a member of a software switch, where all member interfaces share the same IP address and MAC address?

  1. Interface mode set to aggregate with an LACP group Correct answer.
  2. Interface mode set to static with a secondary IP
  3. Interface mode set to switch with a virtual domain assigned
  4. Interface mode set to fabric with a managed FortiSwitch

Explanation

A software switch is built by setting the member interfaces to type aggregate (without LACP) or by using the switch interface type depending on firmware, so that all members share one IP and MAC. The key rule is that member interfaces lose their own IP addressing and are bridged at Layer 2 under a single logical interface.

Question 27Deployment and System Configuration

An administrator needs to allow HTTPS administrative access on a FortiGate interface but must prevent the same interface from answering ICMP echo requests. Which configuration accomplishes this?

  1. Enable allowaccess https and create a firewall policy that blocks ICMP to the interface address
  2. Enable allowaccess https and set the interface to dedicated management mode
  3. Enable allowaccess https and disable the administrative timeout on the interface
  4. Enable allowaccess https and disable the ping administrative access option on the interface Correct answer.

Explanation

Administrative access protocols, including ping, are controlled by the allowaccess list on the interface itself. Removing ping from allowaccess while keeping https stops the FortiGate from replying to pings sent to that interface IP.

Question 28Deployment and System Configuration

Which statement correctly describes the relationship between a VDOM and its management VDOM in a multi-VDOM FortiGate?

  1. A VDOM can be assigned to a management VDOM so its administrator accounts are scoped to that management VDOM Correct answer.
  2. Each VDOM must have its own unique management VDOM configured in global settings
  3. The management VDOM is always the root VDOM and cannot be changed after creation
  4. Only the root VDOM can contain firewall policies when a management VDOM exists

Explanation

The management-vdom setting on a VDOM determines which VDOM's administrators can manage it, enabling delegated administration. Administrators defined in that management VDOM gain visibility and control over the assigned VDOM without full global access.

Question 29Deployment and System Configuration

A FortiGate has a static route to 10.10.0.0/16 with distance 10 and an OSPF-learned route to the same prefix with distance 110. Both are active in the routing table context. Which route is installed in the routing table and why?

  1. The static route, because a lower administrative distance is preferred Correct answer.
  2. Both routes, with equal-cost multipath load balancing between them
  3. The OSPF route, because it has a longer prefix match than the static route
  4. The OSPF route, because dynamic protocols take precedence over static routes

Explanation

When multiple routes match the same destination prefix, the FortiGate selects the route with the lowest administrative distance. The static route's distance of 10 is lower than OSPF's 110, so the static route is installed.

Question 30Deployment and System Configuration

Which FortiGate feature allows an administrator to define a reusable object containing subnets and then reference it in multiple firewall policies and routing configurations?

  1. Address group Correct answer.
  2. Virtual IP
  3. Service group
  4. Schedule object

Explanation

Address groups bundle multiple address objects so a single reference covers several subnets. Updating the group membership automatically affects every policy or configuration that references it.

Question 31Deployment and System Configuration

An administrator wants the FortiGate to send SNMP traps to a monitoring server only when CPU usage exceeds a defined threshold. Which configuration element must be configured to achieve this?

  1. A syslog server with severity filtering enabled for CPU events
  2. An SNMP community with read-write access and a trap receiver
  3. An SNMP user with authentication and an event threshold
  4. An SNMP community with the appropriate trap receiver and a CPU threshold event enabled Correct answer.

Explanation

SNMP traps require a configured community and trap receiver, and threshold-based traps such as CPU usage must be enabled as events. The FortiGate then generates the trap when the monitored value crosses the configured threshold.

Question 32Deployment and System Configuration

Which statement about FortiGate DNS configuration is correct when the FortiGate itself must resolve names for features such as FortiGuard and web filtering?

  1. The FortiGate uses the DNS servers configured under system DNS, with interface-learned servers as a fallback Correct answer.
  2. The FortiGate requires a DNS server on every interface that carries user traffic
  3. The FortiGate forwards all client DNS queries to the system DNS servers regardless of policy
  4. The FortiGate uses only the DNS servers learned from DHCP on WAN interfaces

Explanation

System DNS settings define the resolvers the FortiGate uses for its own lookups, and interface-learned DNS can be used when configured as such. Client DNS traffic is still subject to firewall policy and may be handled differently.

Question 33Deployment and System Configuration

An administrator configures a DHCP server on an internal FortiGate interface. Which setting determines the range of addresses handed to clients?

  1. The secondary IP addresses assigned to the interface
  2. The reserved MAC address list on the interface
  3. The IP range defined in the DHCP server configuration for that interface Correct answer.
  4. The address objects referenced in the firewall policy

Explanation

The DHCP server configuration on an interface includes an explicit IP range that defines the pool of addresses offered to clients. Other interface addresses and policy objects do not define the DHCP pool.

Question 34Deployment and System Configuration

Which action must an administrator take before a FortiGate can use a new firmware image stored on a local TFTP server for an upgrade?

  1. Register the TFTP server as a FortiGuard distribution server
  2. Configure a firewall policy allowing TFTP from the FortiGate to the server
  3. Enable the TFTP client on the management interface and set the server address
  4. Upload the firmware to the FortiGate using the execute restore image tftp command Correct answer.

Explanation

Firmware upgrades from an external server are performed with the execute restore image command specifying the protocol and server. The FortiGate then downloads and validates the image before installing it.

Question 35Deployment and System Configuration

A FortiGate administrator wants to ensure that configuration changes made in a VDOM are automatically logged with the administrator name and the changed object. Which logging configuration supports this?

  1. Enable UTM logging for the management VDOM
  2. Enable local traffic logging on all interfaces
  3. Enable FortiAnalyzer logging with the configuration change category
  4. Enable event logging and send logs to a syslog server Correct answer.

Explanation

Configuration change events are recorded as event log entries, and forwarding them to a syslog server provides an external audit trail with administrator attribution. Event logging must be enabled for these entries to be generated and forwarded.

Question 36Deployment and System Configuration

Which two configuration elements are required to establish a site-to-site IPsec tunnel between two FortiGates using pre-shared key authentication?

  1. A phase 1 configuration with matching pre-shared key and a phase 2 configuration defining the subnet pairs Correct answer.
  2. An SSL VPN portal on each peer and a user group
  3. A GRE tunnel interface on each peer and a static route
  4. A virtual IP object on each peer and a central NAT policy

Explanation

An IPsec tunnel requires phase 1 parameters that match on both peers, including the pre-shared key and proposal settings, plus phase 2 selectors that define which subnets are encrypted. Both phases are mandatory for the tunnel to negotiate and pass traffic.

Question 37Deployment and System Configuration

An administrator needs to allow remote users to connect to the FortiGate using SSL VPN with two-factor authentication. Which combination of settings is required?

  1. A DHCP reservation for each remote user
  2. A virtual IP mapping port 443 to an internal server
  3. An SSL VPN portal, a firewall policy referencing the SSL VPN interface, and a user group with two-factor authentication Correct answer.
  4. A phase 1 interface-mode tunnel and a pre-shared key

Explanation

SSL VPN access is delivered through a portal that defines the user experience, a policy that permits the SSL VPN traffic to the intended destination, and a user group whose members are subject to two-factor authentication. All three elements work together to grant authenticated access.

Question 38Deployment and System Configuration

A FortiGate is managed by a FortiManager, and the administrator notices that local configuration changes are being overwritten. Which FortiGate setting explains this behavior?

  1. The FortiGate has configuration revision control enabled locally
  2. The FortiGate has automation stitches that revert unauthorized changes
  3. The FortiGate is in backup mode for central management and retrieves configuration from FortiManager Correct answer.
  4. The FortiGate is configured with a read-only administrator account

Explanation

When a FortiGate is added to FortiManager in backup mode, FortiManager is authoritative and pushes its configuration to the device, overwriting conflicting local changes. Switching to a different management mode changes who controls the configuration.

Question 39Deployment and System Configuration

An administrator wants to segment management traffic so that only specific administrator hosts can reach the FortiGate GUI, while other hosts on the same subnet are denied. Which approach is most appropriate?

  1. Create a local-in policy that permits the administrator hosts and denies other sources to the GUI ports Correct answer.
  2. Restrict the GUI to the root VDOM only
  3. Create a firewall policy from the management subnet to the FortiGate interface
  4. Disable HTTPS administrative access on all interfaces

Explanation

Traffic destined to the FortiGate itself is controlled by local-in policies rather than regular firewall policies. A local-in policy can permit specific administrator source addresses and block others for the management ports.

Question 40Deployment and System Configuration

Which statement about FortiGate HA heartbeat interfaces is correct?

  1. Heartbeat interfaces require a virtual IP to function
  2. Heartbeat interfaces carry heartbeat and synchronization traffic and should be dedicated links Correct answer.
  3. Heartbeat interfaces must be assigned IP addresses in the same subnet as the cluster management IP
  4. Heartbeat interfaces must be routed through the same switch as user traffic

Explanation

HA heartbeat interfaces exchange hello and synchronization traffic between cluster members and are best deployed as dedicated links to avoid contention and failure detection issues. They do not require routable addresses or virtual IPs to perform this role.

Question 41Firewall Authentication

An administrator wants firewall policy authentication to apply only to users who match a specific LDAP group before they can reach the internet. Which FortiGate feature evaluates the user's group membership and applies the authentication rule during policy lookup?

  1. Certificate-based SSO with a user certificate
  2. RADIUS accounting interim updates
  3. FSSO polling connector Correct answer.
  4. Local user group with a password policy

Explanation

FSSO collects group membership from a domain controller or collector agent and maps the logged-in user to a FortiGate user group, so identity is available at policy lookup without a per-session prompt. A local group requires FortiGate to be the credential store, and RADIUS accounting only reports session start/stop data. Certificate SSO relies on the client presenting a certificate, not on directory group evaluation.

Question 42Firewall Authentication

Which authentication method lets a FortiGate verify a user's identity against an external directory server using a simple bind over port 389 or 636 without installing a collector agent?

  1. FSSO DC agent mode
  2. Kerberos SSO
  3. TACACS+ authentication
  4. LDAP authentication Correct answer.

Explanation

LDAP authentication sends the user's credentials to the directory server in a bind request, so no collector agent is needed on the domain controller. The FortiGate queries the server directly and can also use the result to retrieve group attributes. FSSO DC agent mode requires an agent installed on each DC, and TACACS+ is a separate AAA protocol not used for directory binds.

Question 43Firewall Authentication

A firewall policy is configured with an active authentication scheme, and a user opens a browser to an HTTP site. What does the FortiGate return to the client so the user can supply credentials?

  1. An ICMP redirect to the authentication server
  2. A TCP reset that forces the browser to retry
  3. A Kerberos challenge embedded in the HTTP 401 header
  4. A redirect to the FortiGate authentication captive portal page Correct answer.

Explanation

When active authentication is triggered, the FortiGate intercepts the HTTP request and redirects the browser to its authentication portal, where the user enters credentials. After successful login the original destination is reached. A TCP reset would simply break the session rather than collect credentials.

Question 44Firewall Authentication

Which statement correctly describes passive authentication on a FortiGate?

  1. The user is prompted for credentials on every new TCP session.
  2. Identity is learned from an external source such as FSSO and applied without prompting the user. Correct answer.
  3. Authentication is deferred until the user attempts an HTTPS connection.
  4. The firewall requires a client certificate before any traffic is allowed.

Explanation

Passive authentication derives the user identity from an external source, typically FSSO or RSSO, and then enforces policy based on that identity without an interactive prompt. Active authentication, by contrast, challenges the user for credentials. This distinction is central to designing transparent identity-based policies.

Question 45Firewall Authentication

Which protocol does a FortiGate use to send user authentication requests to a RADIUS server?

  1. TACACS+
  2. RADIUS Correct answer.
  3. LDAP
  4. SAML

Explanation

RADIUS servers receive Access-Request packets and reply with Access-Accept or Access-Reject, and the FortiGate acts as the RADIUS client. LDAP is a directory protocol, while SAML is used for browser-based single sign-on with an identity provider. TACACS+ is a different AAA protocol commonly used for administrative device access.

Question 46Firewall Authentication

A user authenticates successfully against an LDAP server, but the firewall policy still does not match. Which configuration element most directly determines whether the authenticated user satisfies the policy?

  1. The captive portal's idle timeout
  2. The LDAP server's distinguished-name syntax
  3. The user group referenced in the policy's source field Correct answer.
  4. The RADIUS shared secret length

Explanation

Policy matching for authenticated users depends on the user group listed as the source, and the authenticated identity must resolve to a member of that group. Correct LDAP bind settings only establish identity; they do not select the policy. Timeout values affect session lifetime, not group membership matching.

Question 47Firewall Authentication

An administrator configures an FSSO collector agent in advanced mode. Which statement about how the FortiGate learns user logon events in this mode is accurate?

  1. The client workstation sends a RADIUS accounting packet to the FortiGate.
  2. The FortiGate polls each domain controller every 60 seconds for the security event log.
  3. The FortiGate performs an LDAP bind for each user at logon time.
  4. The collector agent receives logon events from domain controllers and forwards them to the FortiGate. Correct answer.

Explanation

In advanced (collector agent) mode, domain controllers forward security logon events to the collector agent, which maintains the user-to-IP mapping and pushes updates to the FortiGate. This offloads event collection from the firewall. Polling the event log and per-user LDAP binds describe other integration methods.

Question 48Firewall Authentication

Users behind a FortiGate authenticate through a RADIUS server that returns the Filter-Id attribute. What is the primary purpose of configuring this attribute?

  1. To assign the user to a specific FortiGate user group based on the returned value Correct answer.
  2. To encrypt the RADIUS Access-Request payload
  3. To define the LDAP search base for group lookups
  4. To set the maximum concurrent sessions for the user

Explanation

The Filter-Id attribute returned in the RADIUS Access-Accept can be mapped to a FortiGate user group, allowing the RADIUS server to drive group assignment. This lets the AAA server control which policy set applies to the user. It does not encrypt the request or set session limits.

Question 49Firewall Authentication

An FSSO deployment shows a user as logged on to an IP address that has since been reassigned to a different workstation. Which mechanism is designed to correct stale user-to-IP mappings?

  1. LDAP group cache refresh
  2. RADIUS interim accounting
  3. FSSO workstation check and logoff detection Correct answer.
  4. Captive portal re-authentication

Explanation

FSSO includes workstation verification and logoff detection so the collector can confirm whether a user is still present at an IP and remove stale entries. Without it, a reassigned address could inherit the previous user's identity. Captive portal re-authentication is an active method and does not clean FSSO tables.

Question 50Firewall Authentication

A FortiGate is configured with an LDAP server object for authentication. Which setting must be correct for the firewall to successfully bind and search for users?

  1. The server must be reachable over TACACS+.
  2. The LDAP port must be set to 1812.
  3. The distinguished name and password of the bind account must be valid on the directory. Correct answer.
  4. The common-name attribute must match the FortiGate hostname.

Explanation

The FortiGate binds to the directory using the configured bind DN and password, then searches for the user under the specified base DN. If those credentials are wrong, authentication fails regardless of other settings. Port 1812 is the RADIUS authentication port, not LDAP.