Fortinet FCSS NST flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Security Fabric root

The FortiGate that anchors the Security Fabric, discovers downstream FortiSwitch, FortiAP, and FortiClient devices, and shares their telemetry with FortiAnalyzer for centralized visibility and logging.

VDOM inter-VDOM link

A virtual link pair connecting two VDOMs on the same appliance. Traffic between VDOMs requires an inter-VDOM link plus firewall policies, because VDOMs share no routing table or implicit path.

Transparent mode limits

A FortiGate in transparent mode forwards at Layer 2 between paired interfaces and cannot terminate IPsec tunnels or use profiles requiring a routed IP address, though many scanning profiles still apply.

Intra-zone traffic default

Traffic between interfaces inside the same zone is denied by default. Disabling intra-zone-deny on the zone allows such traffic to be evaluated by firewall policies instead of being dropped automatically.

Implicit deny policy

The final invisible policy that drops all traffic not matched by any configured policy. It logs only when logging is enabled on the implicit rule, so unmatched traffic can otherwise be silent.

FortiGuard license impact

Without a valid FortiGuard subscription, security engines may still run but signature and database updates stop, so detection coverage degrades silently until licenses are renewed.

Active-active HA throughput

In active-active FGCP, sessions distribute across units but UTM inspection can pin a flow to one unit, so aggregate inspected throughput does not scale linearly with unit count.

Zone-based policy design

Grouping interfaces of similar security posture into a zone lets one firewall policy cover many links, reducing policy count while preserving per-interface routing and addressing.

Static route distance

Administrative distance breaks ties between routes to the same destination; the lower value wins, and static routes default to distance 10, below OSPF at 110.

Policy route precedence

Policy routes are evaluated before the destination-based routing table. A matching policy route forwards traffic to its configured gateway or interface regardless of what the routing table says.

Floating static route

A static route configured with a distance higher than the dynamic protocol's distance, so it stays inactive unless the dynamic route is withdrawn, providing backup path failover.

OSPF neighbor requirements

OSPF neighbors must agree on area ID, hello and dead intervals, and MTU. Mismatched timers or MTU prevent adjacency, even when interface addressing and authentication are correct.

Interface allowaccess

The allowaccess list controls which administrative protocols an interface accepts, such as ping, HTTPS, or SSH. A protocol missing from the list is dropped even if addressing is correct.

SD-WAN health check

SLA probes measure latency, jitter, and packet loss per member. Members failing the configured SLA are removed from selection, so rules only choose among members that currently pass.

Session table authority

The session table records live flows. Route or policy changes do not alter established sessions, so clearing sessions is often required before new routing or NAT behavior takes effect.

Central NAT behavior

When central NAT is enabled, NAT is configured in central SNAT and DNAT rule tables and per-policy NAT settings are ignored, changing how source and destination translation is applied.

ECMP condition

Equal-cost multipath occurs when multiple routes to the same destination share the same distance and priority. Traffic then distributes across the next hops rather than selecting one.

Flow versus proxy inspection

Flow-based inspection streams packets through the IPS engine with limited buffering. Proxy-based inspection buffers and reassembles content, enabling full file scanning and content disarm features.

Certificate inspection mode

SSL certificate inspection reads the server certificate and SNI without decrypting traffic. It enables category and SNI-based control but cannot inspect encrypted payloads for threats or applications.

Deep SSL inspection

Deep inspection terminates TLS using a FortiGate CA-signed certificate, decrypting traffic for full content scanning. Clients must trust the FortiGate CA, and pinned applications may need exemptions.

SSL inspection exemptions

Exempt lists bypass decryption for chosen categories, domains, or applications. They prevent certificate errors for pinned apps and trusted services while keeping inspection for other traffic.

Antivirus quarantine

Quarantine stores files flagged as infected on the FortiGate for later review or submission. It requires storage space and is separate from blocking, which simply drops the file transfer.

Web filter URL precedence

Within a web filter profile, URL filter entries are evaluated before category actions for a request, so a specific URL allow or block overrides the broader category decision.

Application control visibility

Application control identifies applications by signature regardless of port, but encrypted sessions require SSL deep inspection for the engine to recognize applications inside the TLS payload.

IPS sensor default action

Signatures not matched by a specific sensor entry inherit the sensor's default action. Setting it to block affects all unmatched signatures, so tune filters before changing the default.

DNS filter dependency

DNS filtering only works when client DNS queries traverse the FortiGate. Clients using external resolvers or encrypted DNS bypass the profile unless DNS is redirected or DoT and DoH are blocked.

IPsec phase 1 versus 2

Phase 1 negotiates IKE parameters, authentication, and proposals between peers. Phase 2 negotiates ESP security associations and traffic selectors that define which subnets the tunnel carries.

Route-based versus policy-based IPsec

Route-based IPsec uses a tunnel interface and works with dynamic routing and many subnets. Policy-based IPsec matches traffic directly in the policy and needs mirrored configuration on both peers.

Dial-up IPsec address pool

A dial-up IPsec server assigns client tunnel addresses from an IP pool or DHCP. Client and server must agree on the pool, and overlapping local and remote subnets break the tunnel.

SSL VPN tunnel mode

SSL VPN tunnel mode installs a virtual adapter on the client and routes subnet traffic through the FortiGate, requiring a portal, an ssl.root policy, and successful user authentication.

FSSO user mapping

FSSO learns Active Directory logon events from collectors and maps workstation IP addresses to usernames. Policies match on that mapping, so stale entries cause user-based rules to fail.

HA override and priority

With override enabled, a higher-priority secondary preempts the primary when it recovers. Without override, the current primary remains primary regardless of priority until a failover occurs.