I85PREP
⌘ K
Fortinet FCSS NST study materials
Fortinet FCSS NST study resources

Fortinet FCSS NST practice questions

One question at a time. Build your Fortinet FCSS NST understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security Architecture and Design

In a FortiGate high availability deployment, which protocol and port are used for HA heartbeat and synchronization traffic between cluster members?

  1. UDP 703 Correct answer.
  2. UDP 514
  3. TCP 22
  4. TCP 443

Explanation

FortiGate FGCP clustering uses Ethernet layer-2 heartbeat frames over the HA interfaces, and the associated synchronization/control traffic is identified as EtherType 0x8890 with the HA control port UDP 703. This traffic must be permitted on the dedicated HA heartbeat link between cluster members.

Question 2Network Security Architecture and Design

A security architect is designing segmentation for a FortiGate-protected data center. Which FortiGate construct provides Layer 2 switching between multiple internal interfaces while still allowing firewall policy enforcement between them?

  1. A redundant interface
  2. A zone
  3. A VLAN sub-interface
  4. A software switch Correct answer.

Explanation

A software switch groups several interfaces into one Layer 2 broadcast domain, and FortiGate still applies firewall policies to the switch interface as a whole. Redundant interfaces provide link redundancy only, zones group interfaces for policy convenience, and VLAN sub-interfaces tag traffic on a single parent.

Question 3Network Security Architecture and Design

Which FortiGate feature should be enabled to inspect traffic that is encrypted with TLS so that intrusion prevention can analyze the payload?

  1. Virtual domain segmentation
  2. Explicit web proxy with authentication
  3. Deep inspection with an SSL inspection profile Correct answer.
  4. Flow-based antivirus only

Explanation

SSL inspection profiles, applied with deep inspection, terminate and re-originate TLS so that IPS, antivirus, and application control can examine decrypted content. Without deep inspection, encrypted payloads remain opaque to those security profiles.

Question 4Network Security Architecture and Design

An organization wants FortiGate to enforce security policy for traffic between workloads inside a private cloud without routing that traffic through a physical appliance. Which FortiGate deployment model fits?

  1. FortiGate VM deployed inline as a virtual appliance in the cloud network Correct answer.
  2. FortiGate as a standalone DHCP server
  3. FortiGate in transparent mode at the internet edge
  4. FortiGate in one-arm sniffer mode

Explanation

A FortiGate VM placed inline in the cloud virtual network can enforce policy on east-west workload traffic because the traffic is routed or bridged through the virtual appliance. Transparent and sniffer modes at an edge or one-arm position do not put the appliance in the workload path.

Question 5Network Security Architecture and Design

Which statement best describes the role of a virtual domain (VDOM) on a FortiGate?

  1. It duplicates configuration across cluster members.
  2. It provides hardware acceleration for IPsec tunnels.
  3. It creates an independent routing and policy instance within one appliance. Correct answer.
  4. It encrypts inter-VDOM traffic automatically.

Explanation

A VDOM is a logical partition with its own interfaces, routing table, policies, and administrators, allowing one appliance to serve multiple independent security domains. Inter-VDOM links can connect VDOMs, but encryption and HA synchronization are separate functions.

Question 6Network Security Architecture and Design

A designer needs to protect a FortiGate cluster so that if the primary unit fails, the secondary takes over with minimal disruption while both units inspect traffic. Which HA mode should be selected?

  1. Standalone
  2. Active-passive
  3. Virtual clustering with two VDOMs
  4. Active-active Correct answer.

Explanation

Active-active HA distributes session processing across cluster members so both units actively handle traffic, while still providing failover if one member fails. Active-passive keeps the secondary idle until failover, and standalone is not a cluster mode.

Question 7Network Security Architecture and Design

Which FortiGate interface mode forwards traffic without changing IP addresses or requiring the FortiGate to be a routing hop?

  1. NAT/route mode
  2. PPPoE mode
  3. DHCP client mode
  4. Transparent mode Correct answer.

Explanation

In transparent mode the FortiGate acts as a Layer 2 bridge, so hosts keep their existing IP addresses and the appliance is not a routing hop. NAT/route mode makes the FortiGate a Layer 3 gateway that rewrites addresses.

Question 8Network Security Architecture and Design

An architect is planning a hub-and-spoke topology where branch FortiGates build tunnels to a central FortiGate and branch-to-branch traffic must traverse the hub. Which design element is required on the hub?

  1. A single IPsec phase 1 with no phase 2 selectors
  2. Split tunneling enabled on the hub only
  3. Dynamic routing disabled on all spokes
  4. Static routes pointing to each spoke tunnel and policies permitting spoke-to-spoke flows Correct answer.

Explanation

In hub-and-spoke IPsec, the hub needs routes that direct each spoke subnet into the correct tunnel and policies that allow traffic to be forwarded between spoke tunnels. Without those routes and policies, spoke-to-spoke traffic cannot traverse the hub.

Question 9Network Security Architecture and Design

Which FortiGate component is used to define reusable address, service, and user objects that can be referenced by multiple firewall policies?

  1. Session table
  2. Firewall addresses and service objects Correct answer.
  3. HA heartbeat configuration
  4. Static route table

Explanation

Address and service objects are named, reusable definitions that policies reference, which keeps policy design consistent and maintainable. Routes, sessions, and HA settings are operational constructs, not reusable policy objects.

Question 10Network Security Architecture and Design

A FortiGate must inspect north-south traffic from many VLANs while keeping a single policy set. Which design approach reduces policy count while preserving segmentation?

  1. Disable intra-VLAN routing entirely
  2. Group the VLAN sub-interfaces into a zone and write policies against the zone Correct answer.
  3. Assign a separate physical interface and policy for every VLAN
  4. Convert all VLANs to a software switch with no policies

Explanation

Zones let multiple interfaces or VLAN sub-interfaces share one policy set, reducing policy sprawl while interfaces remain distinct Layer 3 segments. A software switch without policies removes enforcement rather than preserving segmentation.

Question 11Network Security Architecture and Design

Which statement about FortiGate security fabric is accurate for an architecture that centralizes logging and management of multiple FortiGate devices?

  1. Security fabric requires all devices to run in transparent mode.
  2. FortiManager and FortiAnalyzer can provide centralized policy management and log analytics for managed FortiGates. Correct answer.
  3. FortiGate devices cannot forward logs to a central collector.
  4. Each FortiGate must be managed individually with no shared logging.

Explanation

FortiManager centralizes policy and device management, while FortiAnalyzer collects and analyzes logs from managed FortiGates, which is a core security fabric design pattern. Individual management and lack of log forwarding contradict that model.

Question 12Network Security Architecture and Design

A designer wants to prevent users on a guest VLAN from reaching the internal server VLAN while allowing both to reach the internet through the same FortiGate. What is the most direct control?

  1. A static route that blackholes the server subnet
  2. A firewall policy denying guest-to-server traffic placed above the general internet policy Correct answer.
  3. A DHCP reservation for guest devices
  4. Disabling NAT on the guest VLAN

Explanation

Firewall policies are evaluated top-down, so an explicit deny policy from guest to server placed before broader allow policies blocks that flow while internet access remains permitted. Blackhole routes and DHCP changes do not provide granular inter-VLAN control.

Question 13Network Security Architecture and Design

In an IPsec site-to-site design, what is the purpose of the phase 2 selectors?

  1. To set the DH group for key exchange
  2. To specify the HA heartbeat interface
  3. To define the local and remote subnets whose traffic is protected by the tunnel Correct answer.
  4. To authenticate peers with certificates

Explanation

Phase 2 selectors specify the source and destination subnets that the IPsec tunnel will carry, effectively defining the interesting traffic. Peer authentication and DH groups belong to phase 1, and HA heartbeat is unrelated.

Question 14Network Security Architecture and Design

A FortiGate is deployed at the internet edge with a single public IP and must allow inbound access to an internal web server. Which design accomplishes this?

  1. An IP pool used for outbound NAT
  2. A static route pointing the public IP to the server
  3. A DHCP server on the WAN interface
  4. A VIP (virtual IP) with a firewall policy permitting the mapped service Correct answer.

Explanation

A virtual IP maps the public address and port to the internal server, and a firewall policy permits the inbound service to the VIP. Routes and outbound IP pools do not provide destination address translation for inbound access.

Question 15Network Security Architecture and Design

An architect must ensure that a FortiGate cluster maintains session state during a failover. Which configuration supports this requirement?

  1. Place the members in different VDOMs
  2. Enable session synchronization between HA members Correct answer.
  3. Configure each member with a unique hostname only
  4. Disable session pickup on the cluster

Explanation

Session synchronization replicates session state between cluster members so established connections survive a failover. Disabling session pickup or isolating members in separate VDOMs prevents state from being shared.

Question 16Network Security Architecture and Design

Which FortiGate routing feature allows the appliance to select a route based on the source address of traffic in addition to the destination?

  1. Policy routes Correct answer.
  2. Equal-cost multi-path routes
  3. Connected routes
  4. Static default routes

Explanation

Policy routes match on criteria such as source address, destination, and service, allowing forwarding decisions beyond destination-only lookup. ECMP, default, and connected routes are destination-based and do not consider source address.

Question 17Network Security Architecture and Design

A security architect is choosing between flow-based and proxy-based inspection for a FortiGate profile. Which statement is accurate?

  1. Proxy-based inspection reassembles and buffers traffic to apply multiple profiles in a single pass. Correct answer.
  2. Flow-based inspection cannot apply IPS signatures.
  3. Flow-based inspection buffers files fully before scanning.
  4. Proxy-based inspection disables antivirus scanning.

Explanation

Proxy-based inspection terminates and buffers traffic so several security profiles can be applied in one pass, whereas flow-based inspection scans packets and streams as they pass. Both modes can apply IPS and antivirus, though with different buffering behavior.

Question 18Network Security Architecture and Design

Which design consideration is most important when placing a FortiGate in transparent mode between an existing router and a switch?

  1. The FortiGate management interface must be on a different subnet than the bridged networks. Correct answer.
  2. All hosts must be re-addressed to the FortiGate subnet.
  3. The FortiGate must be the default gateway for all hosts.
  4. NAT must be enabled on the bridged interfaces.

Explanation

In transparent mode the FortiGate bridges traffic without changing host addressing, so it must not be the default gateway and hosts keep their addresses. A separate management subnet keeps administrative access reachable without conflicting with bridged traffic.

Question 19Network Security Architecture and Design

Which FortiGate feature provides application-level visibility and control for traffic that uses non-standard ports, such as peer-to-peer applications?

  1. MAC address filtering
  2. Route redistribution
  3. Static NAT
  4. Application control Correct answer.

Explanation

Application control identifies applications by their signatures and behavior rather than relying solely on port numbers, so it can detect applications on non-standard ports. MAC filtering, NAT, and route redistribution operate at lower layers or on routing, not application identification.

Question 20Network Security Architecture and Design

An organization requires that administrative access to FortiGate be restricted to a dedicated management network. Which design element enforces this?

  1. Telnet enabled on the WAN interface
  2. HTTPS enabled on all interfaces for convenience
  3. Administrative access protocols enabled only on the management interface, with trusted-host restrictions Correct answer.
  4. A permissive policy from any source to the FortiGate interface

Explanation

Limiting administrative protocols to the management interface and restricting trusted hosts narrows the attack surface for management access. Enabling management protocols broadly or permitting any source undermines that control.

Question 21Network Security Architecture and Design

A designer is evaluating an SD-WAN architecture using FortiGate. Which capability is central to steering traffic across multiple WAN links?

  1. SD-WAN rules that select members based on SLA health checks Correct answer.
  2. Disabling all WAN interfaces except one
  3. Static routes with no health checks
  4. Using only a single default route

Explanation

FortiGate SD-WAN uses health checks and rules to select the best member link for traffic based on measured SLA criteria such as latency and jitter. Static single-path routing cannot dynamically steer traffic across links.

Question 22Network Security Architecture and Design

Which statement about FortiGate VDOM link design is correct when traffic must pass between two VDOMs on the same appliance?

  1. An inter-VDOM link provides a path, and firewall policies on each VDOM control the traffic. Correct answer.
  2. Traffic between VDOMs is always blocked and cannot be configured.
  3. VDOMs share a single routing table by default.
  4. Inter-VDOM traffic bypasses all firewall inspection.

Explanation

An inter-VDOM link creates a virtual interface pair connecting two VDOMs, and policies in each VDOM govern which traffic may traverse it. Each VDOM maintains its own routing table, and inter-VDOM traffic is still subject to policy.

Question 23Network Security Architecture and Design

A FortiGate cluster uses two VDOMs and the architect wants each VDOM to have its own primary unit. Which HA configuration enables this?

  1. Standalone mode on both units
  2. Active-passive HA with a single primary
  3. Virtual clustering with a primary per VDOM Correct answer.
  4. Session pickup disabled

Explanation

Virtual clustering assigns HA primary roles per VDOM, so different cluster members can be primary for different VDOMs. A single active-passive primary serves all VDOMs from one unit, and standalone mode provides no clustering.

Question 24Network Security Architecture and Design

Which FortiGate design choice best limits the blast radius of a compromised internal host while still allowing it to reach required services?

  1. Routing all internal traffic through a single permissive interface
  2. Segmenting hosts by function into separate VLANs with least-privilege policies between them Correct answer.
  3. Disabling logging on internal segments
  4. Placing all internal hosts in one flat VLAN with a permit-any policy

Explanation

Segmentation by function with least-privilege inter-segment policies confines a compromised host's reachable targets, reducing blast radius. Flat networks with permit-any policies allow lateral movement across the entire internal network.

Question 25Network Security Architecture and Design

An architect is designing IPsec dial-up VPN for remote users and wants each user authenticated individually while sharing one tunnel configuration. Which design approach is appropriate?

  1. Disabling phase 2 on the dial-up tunnel
  2. XAuth or certificate-based user authentication on a dial-up IPsec phase 1 Correct answer.
  3. Static site-to-site tunnels for every user
  4. A single pre-shared key shared by all users with no per-user credentials

Explanation

Dial-up IPsec can use a shared phase 1 configuration while authenticating each user through XAuth or certificates, giving per-user identity and accounting. A single shared pre-shared key without per-user credentials provides no individual accountability.

Question 26Network Security Architecture and Design

An architect is documenting how FortiGate applies security profiles to traffic that passes between two VLANs on the same physical interface. In the default operating mode, at which point in the packet path are UTM profiles evaluated?

  1. Only after the packet has been forwarded and a return packet is received
  2. At the kernel driver level before any firewall policy is matched
  3. After the packet is routed to the egress interface but before it is transmitted Correct answer.
  4. Before the routing decision is made, while the packet is still on the ingress interface

Explanation

A FortiGate processes traffic in the order: ingress, firewall policy lookup, routing/egress selection, then UTM inspection, then egress transmission. Security profiles are attached to the policy, and the scan happens after the route has selected the outgoing interface. This ordering matters for design because asymmetric or policy-routed paths can cause the scan to occur on an unexpected interface.

Question 27Network Security Architecture and Design

A designer must allow a FortiGate to be managed from a dedicated out-of-band network while blocking administrative access from the production-facing interfaces. Which FortiGate construct directly enforces this?

  1. An IPsec tunnel between the FortiGate and the OOB switch
  2. Administrative access protocols enabled per interface Correct answer.
  3. A firewall policy that denies HTTPS to the FortiGate interface address
  4. A static route pointing management traffic to the OOB gateway

Explanation

FortiGate administrative access (HTTPS, SSH, ping, FMG, etc.) is enabled or disabled per interface, so restricting management to the OOB interface is the direct control. A deny policy can also block traffic, but the interface-level protocol setting is the canonical mechanism and applies before policy. Combining both is common practice for defense in depth.

Question 28Network Security Architecture and Design

Which FortiGate feature should an architect choose when the design requires the appliance to forward traffic between two segments without altering source or destination IP addresses and without participating in routing?

  1. Policy-based NAT
  2. Transparent mode
  3. NAT mode
  4. Virtual wire pair Correct answer.

Explanation

A virtual wire pair binds two interfaces so traffic passes between them without MAC or IP rewriting and without a routing decision, which is the closest to a true bump-in-the-wire. Transparent mode still participates in bridging and ARP, and NAT mode performs routing and address translation. Virtual wire pairs are commonly used for inline inspection of an existing L2 path.

Question 29Network Security Architecture and Design

A security architect is designing segmentation for a FortiGate that must serve multiple tenants with separate policy sets, separate routing tables, and separate administrators. Which FortiGate capability is the appropriate building block?

  1. Virtual domains (VDOMs) Correct answer.
  2. Policy-based routing
  3. Interface zones
  4. Multiple HA clusters

Explanation

VDOMs provide independent routing tables, firewall policies, and administrator scoping within a single FortiGate, which is the standard mechanism for multi-tenant or multi-function segmentation. Zones and PBR are within-VDOM features that do not isolate routing or admin scope. HA clustering is about redundancy, not tenancy.

Question 30Network Security Architecture and Design

An architect is documenting FortiGate SD-WAN for a branch with two WAN links. Which statement correctly describes how SD-WAN health checks influence path selection?

  1. They replace routing protocols by advertising prefixes to upstream routers
  2. They automatically provision IPsec tunnels to every remote peer
  3. They measure latency, jitter, and packet loss per member and can trigger SLA-based steering Correct answer.
  4. They encrypt member links so traffic is protected across the internet

Explanation

SD-WAN health checks probe each member link and report latency, jitter, and loss, which the SD-WAN rules use to decide whether a member meets its SLA. Steering decisions are then made per rule based on those measurements. Health checks do not perform routing advertisement, encryption, or tunnel provisioning.

Question 31Network Security Architecture and Design

Which FortiGate object type is the correct place to define a reusable group of addresses that many firewall policies across several VDOMs will reference?

  1. Schedule
  2. Service group
  3. Virtual IP
  4. Address group Correct answer.

Explanation

An address group bundles address objects so policies can reference them collectively, and it can be created per VDOM and reused across policies in that VDOM. Service groups bundle services, schedules control when policies are active, and VIPs handle destination NAT. Grouping addresses reduces policy sprawl and simplifies change management.

Question 32Network Security Architecture and Design

An architect is designing a FortiGate HA pair for a data center and needs to know which protocol carries HA state and session synchronization between the cluster members.

  1. FGCP over the HA heartbeat interfaces Correct answer.
  2. STP over the internal switch
  3. BFD over the WAN links
  4. VRRP over the data interfaces

Explanation

FortiGate Clustering Protocol (FGCP) runs over the configured HA heartbeat interfaces and carries cluster state, heartbeats, and session synchronization. VRRP, BFD, and STP are unrelated protocols that do not carry FortiGate HA state. Using dedicated heartbeat interfaces is best practice to avoid contention with data traffic.

Question 33Network Security Architecture and Design

A designer is choosing between a FortiGate deployed as a gateway at the internet edge and one deployed as an internal segmentation firewall. Which design outcome most directly justifies the internal segmentation deployment?

  1. It enforces east-west policy between internal segments that the edge firewall never sees Correct answer.
  2. It reduces the number of public IP addresses required at the edge
  3. It eliminates the need for the edge firewall
  4. It removes the need for routing between internal VLANs

Explanation

An internal segmentation firewall sits between internal zones and enforces policy on east-west traffic that never traverses the internet edge. This limits lateral movement and contains compromised hosts. It does not replace the edge firewall, reduce public addressing needs, or remove the need for routing.

Question 34Network Security Architecture and Design

An architect is designing a FortiGate for a site that must inspect encrypted inbound traffic to an internal web server while preserving the server's certificate chain for external clients. Which design element is required?

  1. A one-arm sniffer VDOM with no policy
  2. A full SSL deep-inspection profile applied to outbound traffic
  3. An inbound SSL inspection profile with the server certificate installed on the FortiGate Correct answer.
  4. A transparent proxy with no certificate configured

Explanation

Inbound SSL inspection requires the FortiGate to present a certificate to external clients, so the server certificate (or a certificate the clients trust for that name) must be installed on the FortiGate. The profile then decrypts, inspects, and re-encrypts to the server. Outbound deep inspection protects outbound sessions and is a different use case.

Question 35Network Security Architecture and Design

A designer wants traffic between two VDOMs on the same FortiGate to be inspected by firewall policy. Which configuration is required?

  1. A single VDOM link with a shared policy applied globally
  2. A virtual wire pair spanning both VDOMs
  3. A VDOM link pair with a policy in each VDOM referencing the link interfaces Correct answer.
  4. An IPsec tunnel between the two VDOMs

Explanation

Inter-VDOM links appear as interfaces in each VDOM, and each side must have a policy that permits traffic out of and into the link. This allows each VDOM to apply its own inspection and logging. A single link without policies on both sides will drop traffic, and IPsec or virtual wire pairs are not required for intra-device VDOM traffic.

Question 36Network Security Architecture and Design

An architect is planning a hub-and-spoke topology where spokes must reach each other through the hub. Which FortiGate design element allows the hub to forward spoke-to-spoke traffic without requiring a full mesh of tunnels?

  1. A hub policy that permits spoke subnets to the hub's IPsec interfaces with intra-hub forwarding Correct answer.
  2. A separate tunnel between every pair of spokes
  3. Disabling split tunneling on every spoke
  4. Using NAT on the hub for all spoke traffic

Explanation

In a hub-and-spoke design, the hub accepts tunnels from all spokes and forwards traffic between them according to policy, which avoids a full mesh. The spokes only need a tunnel to the hub. A full mesh, disabling split tunneling, or NAT on the hub are not required for spoke-to-spoke reachability.

Question 37Network Security Architecture and Design

A FortiGate must route traffic from a specific application subnet through a secondary ISP while all other traffic uses the primary ISP. Which FortiGate feature is designed for this requirement?

  1. OSPF with equal-cost multipath
  2. Static routes with equal distance
  3. SD-WAN with a single member
  4. Policy routes Correct answer.

Explanation

Policy routes match on criteria such as source address and direct matching traffic to a specified gateway or interface, which is exactly the source-based steering requirement. Static routes with equal distance would not differentiate by source, ECMP would load-balance rather than steer by source, and a single-member SD-WAN provides no alternate path.

Question 38Network Security Architecture and Design

An architect is evaluating whether to use flow-based or proxy-based inspection for a FortiGate protecting a high-throughput data center. Which statement correctly reflects the trade-off?

  1. Flow-based inspection offers higher throughput but fewer inspection features than proxy-based Correct answer.
  2. Proxy-based inspection cannot inspect HTTPS traffic
  3. Flow-based inspection buffers whole files by default while proxy-based does not
  4. Proxy-based inspection offers higher throughput and more features than flow-based

Explanation

Flow-based inspection scans packets as they stream through and is generally faster, while proxy-based inspection reassembles and buffers content, enabling more granular features at a throughput cost. The choice depends on the required depth of inspection versus performance. Proxy-based inspection can inspect HTTPS when SSL inspection is configured.

Question 39Network Security Architecture and Design

A designer needs to ensure that a FortiGate cluster keeps existing sessions alive when the primary unit fails. Which configuration supports this requirement?

  1. HA override enabled on both units
  2. Session pickup enabled on the cluster Correct answer.
  3. Two heartbeat interfaces configured
  4. Heartbeat interval set to its maximum

Explanation

Session pickup (session synchronization) causes the primary to replicate session state to the secondary so established connections survive a failover. Heartbeat tuning affects failure detection timing, not session state. HA override affects which unit becomes primary, not session preservation.

Question 40Network Security Architecture and Design

An architect is designing a FortiGate policy for guest users that must reach the internet but must not reach internal RFC1918 subnets. Which design approach most directly enforces this?

  1. A policy from the guest zone to the internal zone with a deny action
  2. A policy from the guest zone to the internet zone with a destination that excludes internal subnets Correct answer.
  3. A policy from the guest zone to the internet zone with no destination restriction
  4. A policy from the internal zone to the guest zone with a deny action

Explanation

The cleanest design is an allow policy from guest to internet with a destination that only includes internet addresses, so internal destinations are never matched. A deny policy would also block internal access, but the allow-with-restricted-destination pattern is more explicit and avoids relying on deny ordering. The direction of the last option is reversed and does not restrict guest traffic.

Question 41Network Security Architecture and Design

A designer is selecting a FortiGate model for a branch that must run IPS, antivirus, and application control at 1 Gbps with all profiles enabled. Which specification is most relevant to the decision?

  1. IPsec VPN throughput
  2. Firewall throughput
  3. Threat protection throughput Correct answer.
  4. Concurrent sessions

Explanation

Threat protection throughput measures performance with multiple security profiles enabled, which matches the stated requirement. Firewall throughput reflects plain forwarding without profiles, IPsec throughput reflects tunnel performance, and concurrent sessions reflect table capacity rather than inspection speed. Sizing on firewall throughput alone commonly leads to undersized appliances.

Question 42Network Security Architecture and Design

An architect is designing a FortiGate for a remote site that must survive the loss of its WAN link while still allowing local users to reach local servers. Which design element is required?

  1. An IPsec tunnel to the headquarters
  2. A local policy permitting the local subnet to the local server subnet on an internal interface Correct answer.
  3. A central NAT policy for local traffic
  4. A default route pointing to the WAN gateway

Explanation

Local survivability requires that traffic between local subnets be permitted by policy and routed locally, without depending on the WAN. A default route to the WAN is unavailable during an outage, a tunnel to headquarters is also down, and central NAT is unrelated to local routing. Designing local breakout and local policy is the standard approach.

Question 43Network Security Architecture and Design

An architect is designing FortiGate integration with a fabric that centralizes logging and management. Which statement correctly describes the role of FortiAnalyzer in this design?

  1. It performs inline traffic inspection for the fabric
  2. It terminates IPsec tunnels for branch devices
  3. It collects logs and generates reports from multiple FortiGate devices Correct answer.
  4. It provides DHCP and DNS services to the fabric

Explanation

FortiAnalyzer is the centralized logging, analytics, and reporting component of the fabric. It receives logs from FortiGates and other devices and produces reports and event correlation. It does not inspect inline traffic, terminate VPNs, or provide network services such as DHCP or DNS.

Question 44Network Security Architecture and Design

A designer is planning an IPsec dial-up VPN for remote users and wants each user authenticated individually while sharing a single tunnel configuration. Which design element supports this?

  1. A virtual wire pair between the FortiGate and the client
  2. A unique pre-shared key per user with no user authentication
  3. A site-to-site tunnel with a single pre-shared key
  4. XAuth or IKEv2 EAP authentication with a shared pre-shared key and per-user credentials Correct answer.

Explanation

Dial-up IPsec commonly uses a shared pre-shared key for the gateway with XAuth or IKEv2 EAP to authenticate individual users. This scales to many users without distributing unique keys. Per-user pre-shared keys do not scale, a site-to-site tunnel is not user-based, and virtual wire pairs are not a VPN mechanism.

Question 45Network Security Architecture and Design

An architect is designing a FortiGate HA cluster with two VDOMs and wants each VDOM to have its own primary unit. Which HA configuration enables this?

  1. Active-active HA with session pickup disabled
  2. HA override enabled on both units
  3. Virtual clustering with per-VDOM priority settings Correct answer.
  4. Active-passive HA with a single primary for all VDOMs

Explanation

Virtual clustering assigns VDOMs to different primary units by setting priorities per VDOM, which distributes processing load and provides per-VDOM failover. A single active-passive cluster has one primary for all VDOMs, active-active does not by itself give per-VDOM primaries, and HA override affects election behavior rather than VDOM distribution.

Question 46Network Security Architecture and Design

An architect is designing a FortiGate policy for a data center where a compromised host must be contained quickly. Which design choice best limits the blast radius while preserving the host's ability to reach required services?

  1. A deny-all policy with no exceptions
  2. Relying solely on the edge firewall for internal traffic
  3. Micro-segmentation with least-privilege policies and logging per segment Correct answer.
  4. A single broad permit policy from the server zone to all zones

Explanation

Micro-segmentation with least-privilege policies limits what a compromised host can reach and provides logging for detection and response. A broad permit policy allows lateral movement, a deny-all policy breaks required services, and relying only on the edge firewall leaves east-west traffic uninspected.

Question 47Network Security Architecture and Design

A designer is evaluating asymmetric routing through a FortiGate HA pair where return traffic may traverse a different unit. Which design consideration is most important?

  1. Disabling session pickup to avoid state conflicts
  2. Increasing the heartbeat interval to reduce overhead
  3. Ensuring session state is synchronized so either unit can process return traffic Correct answer.
  4. Enabling HA override on both units

Explanation

Asymmetric paths across HA members require synchronized session state so the unit receiving return traffic can match the existing session. Disabling session pickup would break that, HA override affects election, and heartbeat tuning affects failure detection rather than state matching. Designing symmetric paths is preferable, but state sync is the key enabler.

Question 48Network Security Architecture and Design

An architect is designing a FortiGate to inspect traffic between two internal segments that must remain on the same Layer 2 broadcast domain. Which design choice preserves the broadcast domain while still applying policy?

  1. Transparent mode with policies applied to the bridged interfaces Correct answer.
  2. A one-arm sniffer VDOM
  3. A virtual wire pair with no policies
  4. NAT mode with a routed interface per segment

Explanation

Transparent mode bridges interfaces so the segments remain in one broadcast domain while firewall policies still apply to the bridged traffic. NAT mode would split the broadcast domain by routing, a virtual wire pair without policies provides no enforcement, and a sniffer VDOM only observes traffic.

Question 49Network Security Architecture and Design

An architect is designing a FortiGate SD-WAN rule that must prefer a low-latency link for voice but fall back to a secondary link when the primary exceeds its SLA. Which configuration element expresses this?

  1. A policy route that always selects the primary link
  2. An SD-WAN rule with a health-check SLA target and a priority-ordered member list Correct answer.
  3. An IPsec tunnel with dead peer detection
  4. A static route with a lower distance to the primary link

Explanation

SD-WAN rules reference health checks and SLA targets and can order members by priority so the primary is preferred until it fails the SLA, then the secondary is used. Static routes and policy routes do not react to measured latency, and DPD detects peer failure rather than SLA degradation.

Question 50Network Security Architecture and Design

An architect is designing a FortiGate for a multi-tenant environment and must ensure that each tenant's administrator cannot see other tenants' policies or logs. Which FortiGate feature provides this isolation?

  1. A shared super_admin account for all tenants
  2. Administrator profiles scoped to a VDOM Correct answer.
  3. A single global policy set with comments per tenant
  4. Interface zones shared across tenants

Explanation

VDOM-scoped administrator accounts with restricted profiles limit each tenant's visibility and control to its own VDOM, including policies and logs. A shared super_admin account grants access to everything, shared zones and a single global policy set do not isolate tenants. This is the standard multi-tenancy pattern on FortiGate.