Fortinet FCX flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

FortiTelemetry port

Security Fabric devices exchange telemetry over TCP 8013 by default. Firewalls between Fabric members must permit this port for topology discovery and downstream device reporting.

Root FortiGate role

The root FortiGate aggregates downstream Fabric devices, holds the complete topology view, and shares Fabric connectors. Downstream FortiGates act as clients reporting upward to the root.

VDOM inter-VDOM link

An inter-VDOM link is a virtual point-to-point pair connecting two VDOMs on the same FortiGate. It moves traffic between VDOMs without physical cabling or external interfaces.

FGCP session pickup

Session pickup synchronizes session state between HA cluster members so established TCP sessions survive a failover. Without it, clients must re-establish connections after the primary unit fails.

Flow-based versus proxy-based inspection

Flow-based inspection scans packets in a single streaming pass with lower latency. Proxy-based inspection buffers and reconstructs content, enabling deeper detection but reducing throughput and supporting fewer protocols.

SD-WAN performance SLA

A performance SLA probes each SD-WAN member for latency, jitter, and packet loss against configured thresholds. Members failing the SLA are avoided by rules that select best-quality paths.

FortiLink default VLAN

FortiLink is the management channel between FortiGate and managed FortiSwitch. It uses VLAN 4094 by default and carries switch discovery, configuration, and control traffic.

CAPWAP tunnel versus bridge mode

In tunnel mode, FortiAP sends client traffic encapsulated to the FortiGate for policy enforcement. In bridge mode, the AP switches traffic locally onto the wired VLAN.

WPA3 SAE

Simultaneous Authentication of Equals replaces the WPA2 pre-shared key handshake in WPA3-Personal. It resists offline dictionary attacks by making each session key unique and forward secret.

ZTNA access proxy

A FortiOS access proxy publishes an internal application through a certificate-protected front end. Users authenticate and are granted per-application access, so the application is never directly exposed.

FortiSASE point of presence

FortiSASE routes endpoint traffic to the nearest cloud point of presence, where SWG, CASB, ZTNA, and firewall inspection apply. Distance to the PoP directly affects user latency.

Inline versus API CASB

Inline CASB inspects SaaS traffic as it passes through the SASE point of presence in real time. API CASB connects directly to the SaaS provider for retroactive visibility and stored-data controls.

SSL VPN web versus tunnel mode

Web mode proxies individual applications through a browser without a client. Tunnel mode installs a client and routes IP traffic, supporting more applications but requiring endpoint software.

FortiClient EMS compliance tags

FortiClient EMS reports endpoint posture and assigns compliance tags. ZTNA and SASE policies can require these tags before granting access, enforcing device health alongside user identity.

FortiGate-VM licensing models

FortiGate-VM is offered as bring-your-own-license or pay-as-you-go on public clouds. License tiers cap throughput and features, so instance sizing must match inspection requirements.

Cloud security posture management

CSPM tools such as FortiCNP collect cloud configuration data through read-only roles and compare it against benchmarks like CIS. They report misconfigurations, excessive permissions, and exposed resources.

VPC traffic inspection routing

To inspect cloud traffic with FortiGate-VM, subnet route tables must direct traffic through the firewall interfaces. Without route changes, workloads bypass the firewall entirely.

FortiCASB API connector

FortiCASB connects to SaaS applications using OAuth-authorized API access. It monitors user activity, detects anomalies, and applies data loss prevention to data already stored in the cloud.

Infrastructure as code deployment

Terraform and CloudFormation templates automate FortiGate-VM deployment in public clouds. Autoscaling groups require synchronized licensing and configuration across all launched instances.

FortiAnalyzer event correlation

FortiAnalyzer parses collected logs into events and correlates related events into incidents. Analysts investigate incidents rather than raw log entries, reducing noise in daily operations.

FortiSOAR playbook

A FortiSOAR playbook is an automated workflow triggered by an incident. It chains connectors for enrichment, notification, and enforcement, with optional manual approval steps before disruptive actions.

FortiEDR behavioral detection

FortiEDR captures kernel-level process and file activity and detects malicious behavior rather than relying only on signatures. It can terminate processes, quarantine files, and isolate hosts.

FortiNDR network detection

FortiNDR analyzes network traffic and submitted files for malicious behavior. It integrates with FortiGate and FortiEDR so detections can trigger containment across the estate.

Mean time to detect

MTTD measures the interval from an incident's first occurrence to its detection. It is calculated from incident timestamps, not from the number of alerts generated.

Incident response stages

Standard stages are detection, triage, investigation, containment, eradication, recovery, and lessons learned. SOAR playbooks map automated and manual actions to each stage.

Purdue model levels

The Purdue model separates physical process, controllers, supervisory systems, operations, an industrial DMZ, and enterprise IT into levels. Segmentation between levels limits lateral movement into control networks.

OT passive monitoring

OT protocols are latency-sensitive and often unauthenticated, so active scanning can disrupt controllers. Passive traffic analysis discovers assets and detects threats without sending probes.

IEC 62443 zones and conduits

IEC 62443 groups assets with common security requirements into zones and controls traffic between them through conduits. The industrial DMZ is a conduit brokering IT-to-OT flows.

FortiGate Rugged series

FortiGate Rugged appliances are built for industrial environments with extended temperature tolerance and DIN-rail mounting. They provide NGFW inspection at remote plants and substations.

Virtual patching in OT

When controllers cannot be patched due to uptime constraints, IPS signatures applied at the network layer block known exploit traffic. This compensating control reduces exposure without touching the device.

OT incident containment priority

In OT, containment must protect physical safety and process continuity. Isolating controllers requires coordination with plant operations, because abrupt network cuts can halt production or create hazards.

OT asset discovery constraints

Asset discovery in OT favors passive traffic analysis or vendor-safe queries. Aggressive probing can crash legacy controllers, so FortiNAC profiling must be tuned to avoid active scans.