I85PREP
⌘ K
Fortinet FCSS SOC study materials
Fortinet FCSS SOC study resources

Fortinet FCSS SOC practice questions

One question at a time. Build your Fortinet FCSS SOC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Operations

In a FortiAnalyzer deployment, which component is responsible for receiving and parsing logs from FortiGate devices before they are stored in the log database?

  1. The FortiGuard update daemon
  2. The log receiver (oftpd) service Correct answer.
  3. The report scheduler
  4. The HA primary controller

Explanation

FortiAnalyzer uses a dedicated log receiver service to accept syslog and OFTP log traffic from managed devices, then hands entries to the parser that normalizes fields into the SQL log database. The FortiGuard daemon handles signature and database updates, and the report scheduler only generates reports from already stored data.

Question 2Security Operations

An analyst wants FortiAnalyzer to raise an event when a single source IP triggers more than 20 IPS signature hits within 5 minutes. Which feature should be configured?

  1. A report template with a chart filter
  2. A log forwarding filter to a syslog server
  3. A FortiView filter saved as a dashboard widget
  4. A custom event handler with a log-based trigger Correct answer.

Explanation

Event handlers in FortiAnalyzer evaluate log conditions such as count of matching logs within a time window and generate alerts or actions when thresholds are crossed. FortiView filters and report templates are for visualization and reporting, not automated alerting.

Question 3Security Operations

Which FortiAnalyzer log view best supports an analyst who needs to pivot from a single suspicious session to all related traffic by source IP, destination IP, or application?

  1. Report generation history
  2. Raw log archive download
  3. Device configuration revision list
  4. Log Browse with drill-down filters Correct answer.

Explanation

Log Browse lets an analyst start from a single log entry and drill down by field values such as source IP, destination IP, or application to see correlated sessions. Raw archives and configuration revisions do not provide interactive field-based pivoting.

Question 4Security Operations

In FortiSIEM, which component correlates normalized events and applies rule logic to generate incidents?

  1. The FortiGate IPS engine
  2. The Supervisor and worker rule engine Correct answer.
  3. The FortiClient EMS connector
  4. The FortiAnalyzer report engine

Explanation

FortiSIEM's Supervisor coordinates workers that run the correlation rule engine against normalized events to produce incidents. FortiGate IPS, FortiClient EMS, and FortiAnalyzer reporting are separate products that do not perform FortiSIEM rule correlation.

Question 5Security Operations

A SOC analyst receives an alert about a possible compromised host and wants to isolate it from the network while preserving forensic evidence. Which FortiEDR action is most appropriate as an initial containment step?

  1. Reimage the endpoint immediately
  2. Isolate the endpoint while retaining collected telemetry Correct answer.
  3. Disable the endpoint's antivirus signature updates
  4. Delete the endpoint from the inventory

Explanation

FortiEDR isolation cuts the endpoint off from network communication while keeping the agent active and telemetry intact, which supports later forensic review. Deleting inventory, disabling updates, or reimaging destroys evidence or reduces visibility before analysis is complete.

Question 6Security Operations

Which FortiGate log type records traffic that is allowed or denied by firewall policies and is the primary source for session analysis in FortiAnalyzer?

  1. Configuration logs
  2. Event logs
  3. Traffic logs Correct answer.
  4. IPS logs

Explanation

Traffic logs capture session-level details such as source, destination, application, and action for each connection, making them the main data source for session analysis. Event logs record system and administrative activity, IPS logs record intrusion detections, and configuration logs track config changes.

Question 7Security Operations

What is the primary purpose of a playbook in a FortiSOAR-based SOC workflow?

  1. To store raw firewall logs for long-term retention
  2. To generate compliance reports on a schedule
  3. To automate and standardize the steps analysts take to triage and respond to incidents Correct answer.
  4. To replace the need for a SIEM correlation engine

Explanation

FortiSOAR playbooks encode repeatable investigation and response steps so analysts can automate enrichment, containment, and notification tasks consistently. They do not store raw logs, replace SIEM correlation, or serve as reporting engines.

Question 8Security Operations

Which indicator type is most useful for detecting command-and-control traffic when analyzing DNS logs in a SOC investigation?

  1. Periodic DHCP lease renewals
  2. Repeated queries to algorithmically generated domain names Correct answer.
  3. Routine ARP broadcasts on the local segment
  4. High volume of internal NTP synchronization

Explanation

Malware using domain generation algorithms produces many seemingly random domain lookups, which is a strong C2 indicator in DNS logs. NTP, DHCP, and ARP activity are normal network housekeeping and are not C2 indicators.

Question 9Security Operations

An analyst is triaging an alert and needs to determine whether an observed IP address has previously been associated with malicious activity. Which enrichment source provides this context most directly?

  1. A threat intelligence feed with IP reputation data Correct answer.
  2. The firewall's NAT session count
  3. The device's routing table
  4. The endpoint's disk utilization metrics

Explanation

Threat intelligence feeds supply reputation and historical context for IPs, domains, and hashes, which is exactly what triage needs to judge whether an address is known-bad. Routing tables, NAT counts, and disk metrics describe infrastructure state, not threat reputation.

Question 10Security Operations

A FortiAnalyzer event handler is configured with a threshold of 10 failed logins from the same user within 3 minutes. What does the threshold count represent?

  1. The number of devices forwarding logs to the analyzer
  2. The number of matching log entries within the defined time window Correct answer.
  3. The number of days logs are retained before matching
  4. The number of administrators allowed to view the alert

Explanation

In a log-based event handler, the threshold defines how many logs matching the filter must occur inside the time window before the event fires. It is not related to device counts, viewer permissions, or retention periods.

Question 11Security Operations

During an investigation, an analyst observes that FortiAnalyzer shows no logs from a newly added FortiGate. Which troubleshooting step should be checked first?

  1. Delete and recreate all report templates
  2. Verify the device is authorized on FortiAnalyzer and log forwarding is enabled on the FortiGate Correct answer.
  3. Change the FortiAnalyzer administrative password
  4. Rebuild the FortiAnalyzer log database

Explanation

Logs will not appear until the FortiGate is registered and authorized on FortiAnalyzer and its logging configuration points to the analyzer. Database rebuilds, report changes, and password changes do not address missing device registration or forwarding.

Question 12Security Operations

Which approach best reduces alert fatigue in a SOC using FortiSIEM while preserving detection of genuine threats?

  1. Increase the severity of every rule to the maximum
  2. Disable all correlation rules and rely on manual log review
  3. Tune correlation rules and suppress known-benign patterns with documented exceptions Correct answer.
  4. Forward all raw events directly to analysts' email inboxes

Explanation

Careful rule tuning and documented suppression of known-benign activity reduces false positives without eliminating detection coverage. Disabling rules, inflating severity, or flooding inboxes increases risk or noise rather than reducing fatigue.

Question 13Security Operations

A FortiGate is configured to send logs to FortiAnalyzer over OFTP on the default port. Which port does OFTP use?

  1. 22
  2. 514
  3. 443 Correct answer.
  4. 514 UDP only

Explanation

OFTP, the Fortinet proprietary log transport used between FortiGate and FortiAnalyzer, operates over TCP port 443 by default. Port 514 is associated with syslog, and port 22 is SSH for administration.

Question 14Security Operations

An analyst needs to correlate a suspicious outbound connection with the user who initiated it. Which log field or enrichment is most directly useful when user identity logging is enabled?

  1. The policy ID field alone
  2. The user name field populated by authentication events Correct answer.
  3. The interface name field
  4. The log severity field

Explanation

When identity-based logging is enabled, traffic logs can include the authenticated user associated with a session, allowing analysts to tie connections to people. Interface, policy ID, and severity describe the connection or event but not the identity of the initiator.

Question 15Security Operations

In FortiEDR, what distinguishes a 'security event' from a raw telemetry record?

  1. Telemetry is generated only after an event is closed
  2. A security event is only created by manual analyst input
  3. Security events contain no process information
  4. A security event is generated when collected activity matches detection logic, while telemetry is the underlying observed activity Correct answer.

Explanation

FortiEDR continuously collects endpoint telemetry and raises security events when that activity matches detection logic or behavioral rules. Telemetry is the raw observed activity, and events are the flagged findings derived from it.

Question 16Security Operations

Which FortiSIEM capability allows an analyst to define a watchlist of high-value assets and prioritize incidents involving them?

  1. Endpoint disk imaging
  2. CMDB-based asset grouping and watchlists Correct answer.
  3. FortiGate policy lookup
  4. Raw syslog forwarding

Explanation

FortiSIEM maintains a configuration management database of assets, and watchlists or groups can mark high-value assets so incidents touching them are prioritized. Syslog forwarding, policy lookup, and disk imaging do not provide asset-based prioritization.

Question 17Security Operations

An analyst observes a spike in denied outbound connections to many distinct external IPs on uncommon ports from one internal host. Which hypothesis should be investigated first?

  1. The firewall policy order was reversed
  2. The NTP server is unreachable
  3. The DNS server is misconfigured
  4. The host may be infected and attempting command-and-control or scanning Correct answer.

Explanation

Many denied outbound attempts to diverse external addresses on uncommon ports from a single host strongly suggest malware beaconing or scanning behavior. Policy ordering, DNS misconfiguration, and NTP reachability would not typically produce this pattern.

Question 18Security Operations

Which log source is most appropriate for detecting an attacker attempting lateral movement using remote service creation on Windows hosts?

  1. Firewall traffic logs only
  2. Windows security event logs forwarded to the SIEM Correct answer.
  3. DNS query logs only
  4. FortiGate configuration change logs

Explanation

Remote service creation generates Windows security events such as service installation and logon activity, which are captured in forwarded Windows event logs. Firewall, DNS, and configuration logs lack the host-level detail needed to confirm service creation.

Question 19Security Operations

A SOC manager wants to measure how quickly analysts begin working on incidents after they are created. Which metric best represents this?

  1. Mean time to resolve
  2. Mean time to acknowledge Correct answer.
  3. Mean time to detect
  4. Alert volume per day

Explanation

Mean time to acknowledge measures the interval between incident creation and the analyst's first response, capturing responsiveness at triage. Detection measures how long threats go unnoticed, resolution measures total closure time, and alert volume measures workload.

Question 20Security Operations

An analyst is building a FortiAnalyzer report and wants charts to reflect only traffic from a specific subnet. Which report configuration element should be adjusted?

  1. The log retention policy
  2. The dataset or filter conditions applied to the report Correct answer.
  3. The FortiAnalyzer administrative timeout
  4. The device's HA priority

Explanation

Report datasets and filters determine which logs are included in charts, so restricting to a subnet requires adjusting the dataset query or filter conditions. Administrative timeouts, HA priority, and retention policy do not control report content.

Question 21Security Operations

A FortiGate forwards logs to two FortiAnalyzer units in an HA cluster. What is the primary benefit of this configuration for SOC operations?

  1. Reduced need for log parsing
  2. Log continuity if one analyzer node fails Correct answer.
  3. Faster FortiGate throughput
  4. Automatic malware removal on endpoints

Explanation

Sending logs to an HA pair of FortiAnalyzer units provides redundancy so that log collection and analysis continue if one node fails. It does not increase FortiGate throughput, remove endpoint malware, or eliminate parsing requirements.

Question 22Security Operations

An analyst finds a log entry showing an IPS signature triggered on traffic that was ultimately allowed by policy. What is the most accurate interpretation?

  1. The log is necessarily a false positive
  2. The IPS sensor was disabled for all policies
  3. The signature matched the traffic, but the firewall policy action permitted the session Correct answer.
  4. The traffic never reached the FortiGate

Explanation

IPS logs record signature matches independently of the eventual firewall policy action, so a triggered signature can coexist with an allowed session when the policy action is accept. It does not prove the sensor is disabled, the traffic never arrived, or that the alert is false.

Question 23Security Operations

During incident response, an analyst needs to preserve log integrity for potential legal proceedings. Which practice best supports this goal?

  1. Rely solely on screenshots of the log viewer
  2. Edit log entries to remove noise before export
  3. Export logs with hashing and maintain a documented chain of custody Correct answer.
  4. Store exports only on the analyst's local workstation

Explanation

Forensic soundness requires exporting logs in a verifiable form with integrity hashes and a documented chain of custody so their authenticity can be demonstrated. Altering logs, keeping unreplicated local copies, or relying on screenshots undermines integrity and admissibility.

Question 24Security Operations

A FortiSIEM correlation rule is producing incidents for legitimate administrative activity performed by the IT team from a management subnet. Which adjustment preserves detection while reducing these false positives?

  1. Delete the correlation rule entirely
  2. Add a rule exception scoped to the management subnet and known admin accounts Correct answer.
  3. Lower the rule's time window to zero
  4. Disable logging on the management subnet devices

Explanation

Scoped exceptions that exclude known-good sources and accounts suppress expected activity while keeping the rule active for other contexts. Deleting the rule, zeroing the window, or disabling logging removes detection or breaks correlation.

Question 25Security Operations

An analyst observes that a FortiAnalyzer log database is growing rapidly and queries have slowed. Which combination of actions best addresses this without losing required investigative data?

  1. Disable all logging from every device
  2. Reduce the number of administrators
  3. Review retention and archiving settings and tune which log types are stored Correct answer.
  4. Delete the database without archiving

Explanation

Balancing retention, archiving, and selective log storage controls database growth while preserving data needed for investigations. Disabling logging or deleting data destroys evidence, and reducing administrators does not affect database size.

Question 26Security Operations

In a FortiSOAR incident response workflow, which component is responsible for executing a sequence of automated steps such as enriching indicators and then notifying a channel, while tracking each step's status?

  1. A report template scheduled for delivery
  2. A manual task assigned to a queue
  3. A playbook with defined nodes and connectors Correct answer.
  4. A dashboard widget bound to a saved query

Explanation

Playbooks in FortiSOAR are the automation construct: they chain nodes, connectors, and decision logic, and each node's execution status is recorded so analysts can audit what ran. Dashboards and reports only present data, and manual tasks depend on human action rather than automated step execution.

Question 27Security Operations

An analyst wants FortiSIEM to raise an incident when a single user account authenticates successfully from two different countries within ten minutes. Which mechanism should be used to express this logic?

  1. A watchlist of approved countries
  2. A saved search with a manual review step
  3. A rule that groups events by user and compares geo fields over a time window Correct answer.
  4. A dashboard showing authentication events by country

Explanation

FortiSIEM rules evaluate event attributes against conditions and can group by a key such as user, then compare attributes like source country across a defined time window. Saved searches and dashboards display results but do not generate incidents from cross-event conditions, and a watchlist alone only tags matching entities.

Question 28Security Operations

When FortiEDR classifies a file as malicious and blocks it, which artifact should an analyst collect first to understand the full chain of process activity that led to the verdict?

  1. The endpoint's network interface configuration
  2. The raw antivirus signature database version
  3. The process tree associated with the security event Correct answer.
  4. The endpoint's installed software inventory

Explanation

FortiEDR records process lineage, so the process tree attached to a security event shows the parent-child chain and the commands that produced the malicious file. Signature version, software inventory, and interface configuration describe the endpoint's state but not the causal activity chain.

Question 29Security Operations

A SOC uses FortiAnalyzer event handlers to generate alerts. Which design choice most directly reduces duplicate alerts for the same underlying condition while keeping the condition visible to analysts?

  1. Applying a suppression or grouping setting so repeated matches collapse into one alert Correct answer.
  2. Lowering the severity of every handler by one level
  3. Disabling handlers and relying on manual log review
  4. Increasing the log retention period

Explanation

Grouping or suppression settings let an event handler collapse repeated matches for the same source, condition, or entity into a single alert, preserving visibility without flooding the queue. Retention length does not change alert volume, blanket severity reduction hides priority, and disabling handlers removes detection entirely.

Question 30Security Operations

Which FortiGate log field is most useful for attributing a session to a specific authenticated user when firewall authentication or FSSO is in use?

  1. The policy ID
  2. The session duration
  3. The user name recorded in the traffic log Correct answer.
  4. The destination interface name

Explanation

When authentication or FSSO is in play, the traffic log carries the authenticated user identity, which is the field that ties activity to a person. Interface names, policy IDs, and durations describe the session's path and shape but not the human identity behind it.

Question 31Security Operations

An analyst needs to detect beaconing behavior where an internal host contacts the same external destination at near-regular intervals. Which analysis technique is most appropriate?

  1. Counting total bytes transferred per host
  2. Reviewing the top talkers report for the day
  3. Examining connection interval variance over time for repeated destinations Correct answer.
  4. Checking the number of distinct destination ports used

Explanation

Beaconing is characterized by regularity, so measuring the variance of intervals between repeated connections to the same destination is the direct test; low variance suggests automation. Byte counts, top-talker rankings, and port diversity can hint at anomalies but do not establish periodicity.

Question 32Security Operations

Which FortiAnalyzer feature allows an analyst to save a set of log filters and reuse them across investigations without rebuilding the query each time?

  1. A report schedule
  2. A log forwarding filter
  3. An event handler threshold
  4. A saved log search or filter view Correct answer.

Explanation

Saved searches and filter views persist the query definition so the same criteria can be reapplied quickly during later investigations. Report schedules control delivery, event handlers generate alerts, and forwarding filters govern which logs leave the device.

Question 33Security Operations

During an investigation, an analyst finds that an internal host resolved a domain that was registered three days ago and that the domain resolves to an IP also contacted directly by the same host. Which conclusion is best supported?

  1. The activity can be dismissed because only one domain is involved
  2. The activity is benign because the host resolved the name successfully
  3. The combination of young domain age and direct IP contact is suspicious and warrants deeper host and traffic review Correct answer.
  4. The host is definitely compromised and should be reimaged immediately

Explanation

Newly registered domains contacted alongside direct IP access are a recognized suspicious pattern, but they are indicators, not proof, so the defensible action is deeper review of host and traffic evidence. Immediate reimaging skips confirmation, and successful resolution or a single-domain count does not make the activity benign.

Question 34Security Operations

Which FortiSIEM entity type should an analyst use to track a group of business-critical servers so incidents involving them are elevated in priority?

  1. A CMDB watchlist or group of monitored assets Correct answer.
  2. A notification template
  3. A parsing rule
  4. A report folder

Explanation

FortiSIEM maintains asset context in its CMDB, and grouping or watchlisting critical assets lets rules and incident views weight them for prioritization. Report folders organize output, notification templates format messages, and parsing rules normalize raw log fields.

Question 35Security Operations

An analyst must determine whether a suspicious process on an endpoint made outbound connections during its execution window. Which pair of data sources provides the most direct evidence?

  1. Endpoint process telemetry and firewall traffic logs Correct answer.
  2. User login history and email gateway logs
  3. Asset inventory and patch compliance reports
  4. DHCP lease history and DNS zone files

Explanation

Process telemetry establishes what ran and when, and firewall traffic logs show outbound sessions with timestamps, so correlating the two answers the question directly. Inventory, patch reports, lease history, zone files, login history, and mail logs provide context but not the process-to-connection link.

Question 36Security Operations

Which practice best supports defensible incident timelines when multiple analysts contribute findings during a live response?

  1. Relying on memory during the post-incident review
  2. Recording findings in personal notes and consolidating at closure
  3. Logging each action and observation with a timestamp and author in a shared case record Correct answer.
  4. Summarizing only the final resolution in the ticket

Explanation

A shared case record with timestamped, attributed entries preserves who did what and when, which is the basis for a defensible timeline and later review. Personal notes, recollection, and resolution-only summaries lose sequence and attribution.

Question 37Security Operations

An analyst observes a workstation sending SMB traffic to many internal hosts on port 445 in rapid succession, with each attempt failing authentication. Which hypothesis is best supported by this pattern?

  1. The workstation is attempting credential-based lateral movement across the network Correct answer.
  2. The workstation has a misconfigured default gateway
  3. The workstation is receiving a software update from a peer
  4. The workstation is performing a backup of shared folders

Explanation

Rapid SMB connection attempts to many internal hosts with repeated authentication failures match the pattern of an account or tool trying credentials against remote services, a lateral movement technique. Backups and updates target defined servers rather than sweeping many hosts, and a gateway fault would impair routing rather than produce this fan-out.

Question 38Security Operations

Which FortiGate log setting determines whether traffic that is denied by a policy is recorded at all?

  1. The log-all-traffic option applied globally
  2. The log severity level assigned to the policy
  3. The FortiAnalyzer storage quota
  4. The per-policy logging setting for denied sessions Correct answer.

Explanation

Denied-session logging is governed by the logging configuration attached to the policy that blocks the traffic, so a policy with denied-session logging disabled produces no entry. Global options, severity labels, and analyzer quotas affect volume or storage but not whether the denial is generated.

Question 39Security Operations

A rule in FortiSIEM fires on every privileged command executed by administrators, producing heavy noise during normal maintenance. Which change preserves detection of genuinely unusual privileged activity?

  1. Deleting the rule and relying on change management records
  2. Redirecting the resulting incidents to an unmonitored queue
  3. Adding conditions that exclude known maintenance windows or approved administrator identities Correct answer.
  4. Raising the rule's threshold to an unreachable value

Explanation

Scoping the rule with exclusions for approved administrators or scheduled maintenance keeps the detection active for unusual privileged activity while removing expected noise. Deleting the rule, making the threshold unreachable, or hiding incidents removes detection rather than refining it.

Question 40Security Operations

An analyst is asked to determine which internal hosts communicated with a known malicious IP during the past month, but the traffic was encrypted and no payload inspection is available. Which evidence remains sufficient to answer the question?

  1. Session metadata showing source, destination, and timestamps Correct answer.
  2. Decrypted payload contents
  3. Endpoint antivirus scan results
  4. Email header transcripts

Explanation

Even without payload visibility, session metadata such as source address, destination address, and timing answers who contacted the address and when. Payload contents are unavailable by premise, and endpoint scans or mail headers do not establish network contact with that IP.

Question 41Network Security

In FortiGate session handling, which statement best describes how the first packet of a new TCP flow is processed when a security policy permits the traffic?

  1. The packet is forwarded without inspection and only later packets are matched to policy.
  2. The packet is dropped until the client completes a TCP handshake with the FortiGate proxy.
  3. The packet triggers a session lookup miss, is evaluated against policy, and a session entry is created for subsequent packets. Correct answer.
  4. The packet is always sent to the IPS engine before any session is created.

Explanation

FortiGate is a stateful device: the first packet of a flow misses the session table, traverses policy and inspection, and then creates a session entry so later packets take the fast path. This session-first design is what allows consistent inspection and NAT for the whole flow.

Question 42Network Security

An administrator wants FortiGate to inspect encrypted traffic without installing certificates on every client, relying on the client trusting the corporate CA instead. Which configuration concept applies?

  1. Full tunnel mode with split tunneling disabled
  2. Deep inspection using a forward proxy with a CA certificate presented to clients Correct answer.
  3. Passive SSL mirroring on the ingress interface
  4. Certificate pinning bypass mode on the firewall policy

Explanation

Deep inspection terminates the TLS session at the FortiGate, presents a certificate signed by a CA the client trusts, then re-encrypts to the server. This lets the firewall inspect decrypted content without per-client certificate installation.

Question 43Network Security

Which FortiGate feature allows multiple security profiles to be grouped and applied together in a single policy?

  1. DHCP relay
  2. Virtual domain
  3. Static route
  4. Security profile group Correct answer.

Explanation

A security profile group bundles profiles such as antivirus, IPS, web filter, and application control so they can be attached to a policy as one unit. This simplifies policy management and keeps profile application consistent.

Question 44Network Security

A FortiGate has two interfaces in the same subnet, each with a different administrative distance default route. Which route is installed in the routing table?

  1. Neither route is installed until manually confirmed
  2. Both routes are installed and load balanced equally
  3. The route with the higher administrative distance
  4. The route with the lower administrative distance Correct answer.

Explanation

When multiple routes to the same destination exist, FortiGate prefers the one with the lowest administrative distance. Only equal-distance routes are considered for equal-cost load balancing.

Question 45Network Security

Which FortiGate action in a firewall policy determines whether traffic is allowed, denied, or subjected to further inspection?

  1. The policy comments
  2. The policy action Correct answer.
  3. The policy NAT toggle
  4. The policy schedule

Explanation

The policy action (accept or deny, with inspection applied on accept) is the field that decides the fate of matching traffic. Schedule, comments, and NAT settings modify when or how traffic is handled but do not decide allow versus block.

Question 46Network Security

What is the primary purpose of an IPsec phase 2 selector on a FortiGate VPN?

  1. To define the traffic that is encrypted across the tunnel Correct answer.
  2. To authenticate the peers before key exchange
  3. To negotiate the encryption and hashing algorithms
  4. To assign a virtual IP address to the client

Explanation

Phase 2 selectors (local and remote subnets) define which traffic is protected by the IPsec tunnel. Phase 1 handles peer authentication and algorithm negotiation.

Question 47Network Security

Which FortiGate interface mode allows multiple VLANs to be carried on a single physical link?

  1. Aggregate interface
  2. VLAN sub-interface Correct answer.
  3. Tunnel interface
  4. Loopback interface

Explanation

A VLAN sub-interface is created on a physical interface to carry 802.1Q tagged traffic for a specific VLAN. This allows multiple VLANs to share one physical link.

Question 48Network Security

What does FortiGate do when a packet matches no firewall policy?

  1. It applies the implicit deny and drops the packet Correct answer.
  2. It logs the packet and forwards it to the next policy
  3. It forwards the packet using the default route
  4. It sends the packet to the management interface

Explanation

Firewall policies are evaluated top-down, and traffic that matches none of them falls to the implicit deny at the end of the policy list. The packet is dropped and may be logged depending on logging settings.

Question 49Network Security

An administrator needs FortiGate to block access to a category of websites for all users in a subnet while allowing a small group of executives. Which design is most appropriate?

  1. Disable web filtering and rely on DNS filtering for all users
  2. Place an allow policy for the executive source above a web-filtering deny policy for the subnet Correct answer.
  3. Place a deny policy for the subnet above an allow policy for the executive source
  4. Apply the web filter only to the executive source address

Explanation

FortiGate evaluates policies top-down and stops at the first match, so the more specific allow for executives must appear before the broader subnet policy. Ordering the specific exception first ensures executives are not caught by the general block.

Question 50Network Security

A FortiGate is configured with a static route to 10.10.0.0/16 via 192.168.1.1 and a more specific route to 10.10.5.0/24 via 192.168.2.1. Where is traffic destined for 10.10.5.20 sent?

  1. To the default gateway, because the destination is remote
  2. To 192.168.1.1, because it was configured first
  3. To both next hops, because the routes overlap
  4. To 192.168.2.1, because the longest prefix match wins Correct answer.

Explanation

FortiGate uses longest prefix match when selecting among routes to the same destination, so the /24 route takes precedence over the /16 route. Administrative distance only breaks ties among routes with the same prefix length.