I85PREP
⌘ K
Fortinet FCX study materials
Fortinet FCX study resources

Fortinet FCX practice questions

One question at a time. Build your Fortinet FCX understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1FortiOS and Security Fabric Architecture

Which FortiGate feature allows multiple independent virtual firewall instances to run on a single physical device, each with its own routing table and administrative domain?

  1. FortiAnalyzer ADOMs
  2. Security Fabric root segmentation
  3. Virtual Domains (VDOMs) Correct answer.
  4. FortiSwitch VLANs

Explanation

VDOMs partition a single FortiGate into separate virtual devices, each with independent interfaces, routing, firewall policies, and administrators. This is the standard FortiOS mechanism for multi-tenant or segmented management on one appliance.

Question 2FortiOS and Security Fabric Architecture

In the Security Fabric, which device typically acts as the Fabric root and aggregates telemetry from downstream FortiGates?

  1. A FortiAP managed in tunnel mode
  2. The upstream FortiGate configured as the Fabric root Correct answer.
  3. The FortiClient EMS server
  4. A FortiMail appliance in gateway mode

Explanation

The Security Fabric root is normally the upstream or edge FortiGate, which collects and correlates telemetry from downstream Fabric members. Downstream FortiGates connect to the root to share topology and threat information.

Question 3FortiOS and Security Fabric Architecture

Which protocol and port does FortiOS use by default for Security Fabric communication between FortiGate devices?

  1. CAPWAP over UDP 5246
  2. SSL VPN over TCP 10443
  3. IPsec over UDP 500
  4. FortiTelemetry over TCP 8013 Correct answer.

Explanation

FortiTelemetry uses TCP port 8013 by default for Security Fabric communication between FortiGate devices. Administrators must allow this port between Fabric members for topology and telemetry exchange.

Question 4FortiOS and Security Fabric Architecture

A FortiGate has two VDOMs enabled. Which statement describes what happens to global settings such as HA configuration when VDOMs are enabled?

  1. Global settings are disabled until VDOMs are removed
  2. HA and other global settings remain device-wide and are configured in the global context Correct answer.
  3. Each VDOM maintains its own independent HA configuration
  4. Global settings are automatically replicated into every VDOM's local configuration

Explanation

When VDOMs are enabled, FortiOS splits configuration into a global context and per-VDOM contexts. HA, firmware, and other device-wide settings belong to the global context and apply to the whole appliance.

Question 5FortiOS and Security Fabric Architecture

Which FortiOS interface type must be used for an interface that connects a FortiGate to a FortiSwitch managed through the Security Fabric?

  1. A redundant interface
  2. A dedicated management interface
  3. A loopback interface
  4. A FortiLink interface Correct answer.

Explanation

FortiLink is the dedicated interface type that lets a FortiGate manage FortiSwitch units as Fabric devices. It carries the control and data traffic needed for switch management and VLAN provisioning.

Question 6FortiOS and Security Fabric Architecture

An administrator wants a downstream FortiGate to join an existing Security Fabric. Which setting on the downstream device must reference the root FortiGate?

  1. The Security Fabric root's IP address and port Correct answer.
  2. The FortiGuard DDNS hostname
  3. The FortiAnalyzer log server address
  4. The FortiClient EMS serial number

Explanation

A downstream FortiGate joins the Fabric by specifying the root FortiGate's address and the Fabric port (8013 by default) in its Security Fabric settings. Once reachable, the root authorizes the device and includes it in the topology.

Question 7FortiOS and Security Fabric Architecture

Which FortiGate HA mode requires that all cluster members share the same session table so that sessions survive a failover?

  1. Virtual clustering across VDOMs
  2. Active-active with load balancing only
  3. Active-passive with session pickup enabled Correct answer.
  4. Standalone without HA

Explanation

Session pickup (session synchronization) in an HA cluster keeps the session table synchronized so established sessions continue after a failover. Active-passive with session pickup enabled is the typical configuration for seamless failover.

Question 8FortiOS and Security Fabric Architecture

What is the primary role of FortiAnalyzer in a Security Fabric deployment?

  1. Providing wireless controller functions for FortiAPs
  2. Terminating SSL VPN tunnels for remote users
  3. Centralized log collection, analysis, and reporting Correct answer.
  4. Enforcing firewall policies at the network edge

Explanation

FortiAnalyzer collects logs from Fabric devices and provides centralized analysis, correlation, and reporting. It is a visibility and analytics component rather than an inline enforcement point.

Question 9FortiOS and Security Fabric Architecture

Which component in the Security Fabric provides endpoint visibility and compliance enforcement for managed hosts?

  1. FortiSwitch
  2. FortiSandbox
  3. FortiClient EMS Correct answer.
  4. FortiWeb

Explanation

FortiClient EMS manages endpoint clients and shares endpoint telemetry and compliance status with the Security Fabric. FortiGate can then apply policies based on that endpoint information.

Question 10FortiOS and Security Fabric Architecture

Which statement best describes how VDOMs affect FortiGate routing when multiple VDOMs are enabled?

  1. Routing is handled only by the root VDOM for all traffic
  2. All VDOMs share a single global routing table
  3. Each VDOM maintains its own separate routing table Correct answer.
  4. Routing tables are inherited from the management VDOM

Explanation

Each VDOM has its own routing table, interfaces, and policies, which is what makes VDOMs behave like independent virtual firewalls. Traffic between VDOMs must be explicitly routed or handled by inter-VDOM links.

Question 11FortiOS and Security Fabric Architecture

Which FortiOS feature lets a FortiGate share threat intelligence and device topology with other Fabric members for unified visibility?

  1. DHCP relay
  2. Security Fabric connector Correct answer.
  3. Policy-based NAT
  4. Static route redistribution

Explanation

Security Fabric connectors let FortiGate exchange telemetry, topology, and threat intelligence with other Fabric devices and external integrations. This shared context enables unified visibility and coordinated response.

Question 12FortiOS and Security Fabric Architecture

An administrator enables VDOMs on a FortiGate that already has interfaces and policies configured. What is a typical consequence of enabling VDOM mode?

  1. All existing configuration is permanently deleted
  2. The device reboots into a factory default state
  3. Existing policies are automatically converted into global policies
  4. Existing interfaces and policies are moved into a default VDOM context Correct answer.

Explanation

When VDOM mode is enabled, existing configuration is placed into the default VDOM (often named root or the VDOM created for this purpose). Administrators then create additional VDOMs and move interfaces as needed.

Question 13FortiOS and Security Fabric Architecture

Which two devices typically form the core of a Security Fabric topology at a branch site with a FortiGate, FortiSwitch, and FortiAP? (Choose the best description.)

  1. The FortiGate as Fabric root managing the FortiSwitch and FortiAP as Fabric devices Correct answer.
  2. The FortiSwitch as Fabric root managing the FortiGate
  3. The FortiAP as Fabric root managing the FortiGate
  4. The FortiAnalyzer as Fabric root managing all three

Explanation

In a typical branch Fabric, the FortiGate is the root and manages the FortiSwitch via FortiLink and the FortiAP via the wireless controller. This forms the local Fabric topology that can connect upstream.

Question 14FortiOS and Security Fabric Architecture

Which FortiGate HA configuration synchronizes both configuration and session information between cluster members?

  1. FortiLink aggregation
  2. FGCP HA with session synchronization enabled Correct answer.
  3. VDOM mode without HA
  4. Standalone mode with VRRP

Explanation

FortiGate Clustering Protocol (FGCP) HA synchronizes configuration across cluster members, and enabling session synchronization also shares session state. Together they support transparent failover.

Question 15FortiOS and Security Fabric Architecture

What is the purpose of an inter-VDOM link on a FortiGate?

  1. To bridge a VDOM to the global routing table
  2. To connect two VDOMs so traffic can be routed between them Correct answer.
  3. To connect a FortiGate to a FortiSwitch via FortiLink
  4. To link two physical FortiGates in an HA cluster

Explanation

An inter-VDOM link is a virtual link pair that connects two VDOMs, allowing traffic to pass between them under policy control. It avoids consuming physical interfaces for inter-VDOM routing.

Question 16FortiOS and Security Fabric Architecture

Which FortiOS setting must be configured on the root FortiGate to authorize a downstream FortiGate to join the Security Fabric?

  1. The downstream device must use the same FortiGuard license
  2. The downstream device must be in the same HA cluster
  3. The downstream device must share the root's admin password
  4. The downstream device's serial number must be authorized on the root Correct answer.

Explanation

The root FortiGate authorizes Fabric members, typically by approving the joining device's serial number. This prevents unauthorized devices from injecting telemetry into the Fabric.

Question 17FortiOS and Security Fabric Architecture

Which statement accurately describes the relationship between the Security Fabric and FortiManager?

  1. FortiManager provides inline traffic inspection for the Fabric
  2. FortiManager can centrally manage Fabric devices and push configuration to them Correct answer.
  3. FortiManager replaces the FortiGate as the Fabric root in all deployments
  4. FortiManager is required for FortiGate HA to function

Explanation

FortiManager provides centralized management for FortiGate and other Fabric devices, including policy and object deployment. It complements the Fabric by simplifying administration across many devices.

Question 18FortiOS and Security Fabric Architecture

Which FortiGate interface mode allows multiple VLANs to be managed through a single FortiLink connection to a FortiSwitch?

  1. Each VLAN requires a separate physical FortiLink cable
  2. The FortiLink interface carries multiple VLAN sub-interfaces Correct answer.
  3. FortiLink only supports the native VLAN
  4. VLANs cannot be used over FortiLink

Explanation

A single FortiLink connection can carry multiple VLANs by using VLAN sub-interfaces on the FortiLink aggregate. This lets the FortiGate manage multiple FortiSwitch VLANs over one link.

Question 19FortiOS and Security Fabric Architecture

Which component of the Security Fabric is responsible for detonating suspicious files and returning verdicts to FortiGate?

  1. FortiSandbox Correct answer.
  2. FortiAP
  3. FortiSwitch
  4. FortiAuthenticator

Explanation

FortiSandbox runs suspicious files in an isolated environment and returns verdicts that FortiGate can use to block threats. It integrates with the Fabric to extend protection beyond signature-based detection.

Question 20FortiOS and Security Fabric Architecture

A company wants separate administrative domains on one FortiGate so that each department's administrator sees only their own policies. Which FortiOS capability should be used?

  1. VDOMs with per-administrator VDOM access Correct answer.
  2. Global policies applied to all interfaces
  3. FortiAnalyzer ADOMs only
  4. A single admin account shared by all departments

Explanation

VDOMs combined with administrator profiles scoped to specific VDOMs restrict each admin to their own domain. This provides separation of policies and visibility without separate physical devices.

Question 21FortiOS and Security Fabric Architecture

Which statement is true about the FortiGate as the Security Fabric root in a multi-tier topology?

  1. The root aggregates telemetry from downstream Fabric members and can propagate threat intelligence Correct answer.
  2. The root cannot have downstream Fabric members
  3. The root must be the device with the highest serial number
  4. The root must be a FortiAnalyzer appliance

Explanation

The Fabric root collects telemetry from downstream members and can distribute threat intelligence across the Fabric. This hierarchical model gives the root a consolidated view of the topology.

Question 22FortiOS and Security Fabric Architecture

Which FortiOS feature allows a FortiGate to act as a wireless controller for FortiAP devices in the Fabric?

  1. The integrated wireless controller on supported FortiGate models Correct answer.
  2. The FortiSandbox connector
  3. FortiLink trunking only
  4. The IPsec VPN wizard

Explanation

Supported FortiGate models include an integrated wireless controller that manages FortiAP devices as part of the Fabric. The FortiAPs then appear in the Fabric topology under the FortiGate.

Question 23FortiOS and Security Fabric Architecture

Which statement about FortiGate HA heartbeat interfaces is correct?

  1. Heartbeat interfaces carry user data traffic exclusively
  2. Heartbeat interfaces must be routed interfaces with public IP addresses
  3. Heartbeat interfaces exchange HA hello and state messages between cluster members Correct answer.
  4. Heartbeat interfaces are only used in VDOM mode

Explanation

HA heartbeat interfaces carry hello and state messages that let cluster members detect each other and coordinate failover. They are typically dedicated links and should not carry regular user traffic.

Question 24FortiOS and Security Fabric Architecture

An administrator notices that a downstream FortiGate appears in the Fabric topology but no logs reach FortiAnalyzer. Which Fabric integration should be verified?

  1. The wireless controller profile
  2. The HA heartbeat interface status
  3. The logging configuration pointing the FortiGate to FortiAnalyzer Correct answer.
  4. The FortiLink VLAN assignment

Explanation

Log delivery to FortiAnalyzer depends on the FortiGate's logging configuration specifying FortiAnalyzer as a log destination. Fabric membership alone does not guarantee logs are sent.

Question 25FortiOS and Security Fabric Architecture

Which FortiOS object is used to define a set of interfaces that belong to the same VDOM for management purposes?

  1. A global policy
  2. An HA heartbeat
  3. A FortiGuard web filter profile
  4. The VDOM itself contains and scopes its assigned interfaces Correct answer.

Explanation

Interfaces are assigned to a VDOM, and that VDOM scopes their configuration and policies. This assignment is what determines which routing table and policies apply to the interface.

Question 26FortiOS and Security Fabric Architecture

On a FortiGate acting as the Security Fabric root, which Fabric connection setting determines whether a downstream FortiGate can be authorized to join the topology?

  1. The FortiTelemetry (Fabric) setting enabled on the interface facing the downstream device Correct answer.
  2. The DHCP relay setting on the interface facing the downstream device
  3. The administrative timeout configured under the system global settings
  4. The explicit web proxy setting enabled on the interface facing the downstream device

Explanation

Security Fabric membership is carried over FortiTelemetry, so the interface that faces the downstream FortiGate must have Fabric/Telemetry connectivity enabled. Without that, the downstream device cannot be discovered or authorized as a Fabric member. DHCP relay, admin timeout, and explicit proxy settings do not control Fabric join authorization.

Question 27FortiOS and Security Fabric Architecture

A FortiGate is configured in NAT mode with two VDOMs, and an administrator wants traffic from the internal VDOM to reach the internet through the external VDOM. Which construct provides this path?

  1. A redundant (aggregate) interface split across both VDOMs
  2. A software switch that includes interfaces from both VDOMs
  3. An inter-VDOM link with a pair of interfaces assigned to the two VDOMs Correct answer.
  4. A zone object that spans interfaces in both VDOMs

Explanation

An inter-VDOM link creates a virtual point-to-point connection with one interface in each VDOM, and each side is routed and firewalled independently. This is the supported method for moving traffic between VDOMs on the same FortiGate. Zones, software switches, and aggregate interfaces must have their member interfaces inside a single VDOM.

Question 28FortiOS and Security Fabric Architecture

Which FortiGate HA mode requires all cluster members to keep an identical session table so that established sessions continue after a failover?

  1. Active-active with session synchronization enabled Correct answer.
  2. Standalone with VRRP
  3. Load-balance without session synchronization
  4. Active-passive with session pickup disabled

Explanation

Session synchronization (session pickup) copies session state to peer members so established flows survive a failover. In active-active mode all members process traffic and must share session state. Disabling session pickup or running standalone/VRRP configurations does not provide synchronized session tables.

Question 29FortiOS and Security Fabric Architecture

Which FortiOS feature lets a FortiGate act as the wireless controller for FortiAP devices in the Security Fabric?

  1. The FortiGate DNS filter profile
  2. FortiLink auto-discovery
  3. The FortiGate switch controller VLAN configuration
  4. The integrated wireless controller (WTP) profile Correct answer.

Explanation

FortiOS includes an integrated wireless controller that manages FortiAP devices through WTP (wireless termination point) profiles and related SSID/VAP configuration. FortiLink is used for FortiSwitch management, while switch controller VLANs and DNS filter profiles serve other purposes.

Question 30FortiOS and Security Fabric Architecture

An administrator enables VDOMs on a FortiGate that already has interfaces and policies configured. What is a typical consequence of the change?

  1. All existing interfaces and policies are automatically distributed evenly across the new VDOMs
  2. Existing configuration is placed in the root VDOM and must be reassigned to other VDOMs manually Correct answer.
  3. All existing policies are converted into inter-VDOM link policies automatically
  4. Enabling VDOMs requires a reboot that erases the existing configuration

Explanation

When VDOM mode is enabled, the existing configuration is retained in the root VDOM; administrators must create additional VDOMs and manually move interfaces and policies into them. FortiOS does not automatically distribute or erase configuration. Inter-VDOM links must also be created manually.

Question 31FortiOS and Security Fabric Architecture

Which component of the Security Fabric detonates suspicious files and returns verdicts to FortiGate devices?

  1. FortiManager
  2. FortiAnalyzer
  3. FortiAuthenticator
  4. FortiSandbox Correct answer.

Explanation

FortiSandbox executes suspicious files in an isolated environment and returns verdicts that Fabric members use to block malicious content. FortiAnalyzer handles logging and reporting, FortiManager handles centralized management, and FortiAuthenticator handles identity and authentication services.

Question 32FortiOS and Security Fabric Architecture

An administrator wants a downstream FortiGate to join an existing Security Fabric. Which setting on the downstream device is required?

  1. The downstream device must use the same administrator password as the root
  2. The downstream device must be configured with the same HA group name as the root
  3. The downstream device must be configured as a FortiManager proxy
  4. The downstream device must enable Security Fabric (Fabric) connection and specify the root's address Correct answer.

Explanation

A downstream FortiGate joins the Fabric by enabling the Fabric connection and pointing to the root FortiGate's address so it can be discovered and authorized. Matching HA group names, FortiManager proxy mode, and shared admin passwords are not requirements for Fabric membership.

Question 33FortiOS and Security Fabric Architecture

Which statement accurately describes how a FortiGate in the Security Fabric shares threat intelligence and device topology with other Fabric members for unified visibility?

  1. The root FortiGate aggregates Fabric data through FortiTelemetry and presents a unified topology Correct answer.
  2. Topology sharing requires all members to use the same VDOM name
  3. Topology data is exchanged only through FortiAnalyzer log forwarding
  4. Each member polls FortiGuard for topology data and rebuilds the Fabric map locally

Explanation

In the Security Fabric, the root FortiGate collects telemetry from authorized downstream members and presents the aggregated topology and threat intelligence to administrators. Members do not independently rebuild the Fabric map from FortiGuard, and VDOM naming or log forwarding alone does not provide topology sharing.

Question 34FortiOS and Security Fabric Architecture

Which FortiGate HA heartbeat interface configuration is correct for a two-member cluster?

  1. Heartbeat traffic must use the same interface as management access
  2. Heartbeat interfaces must be configured as VLAN subinterfaces
  3. Heartbeat traffic must be routed through the FortiGate's WAN interface
  4. Heartbeat interfaces should be dedicated and can be redundant across multiple physical links Correct answer.

Explanation

HA heartbeat interfaces should be dedicated and ideally redundant so that loss of one link does not cause a split-brain or failover. Sharing heartbeat with management or WAN traffic is discouraged, and VLAN subinterfaces are optional rather than required.

Question 35FortiOS and Security Fabric Architecture

An administrator notices that a downstream FortiGate appears in the Fabric topology but no logs reach FortiAnalyzer. Which configuration is the most likely cause?

  1. The downstream FortiGate is using active-passive HA
  2. The downstream FortiGate has an inter-VDOM link configured
  3. The downstream FortiGate lacks a logging configuration pointing to FortiAnalyzer Correct answer.
  4. The downstream FortiGate has VDOMs disabled

Explanation

Fabric membership is separate from log forwarding; a downstream FortiGate must have logging configured to send logs to FortiAnalyzer. VDOM mode, HA mode, and inter-VDOM links do not by themselves prevent logs from reaching FortiAnalyzer.

Question 36FortiOS and Security Fabric Architecture

Which FortiOS object groups interfaces within the same VDOM for shared policy and management purposes?

  1. A zone Correct answer.
  2. A VDOM link
  3. A software switch
  4. A redundant interface

Explanation

A zone groups multiple interfaces within a single VDOM so policies can reference the zone instead of individual interfaces. VDOM links connect VDOMs, software switches create a broadcast domain, and redundant interfaces bundle physical links.

Question 37FortiOS and Security Fabric Architecture

A branch site has a FortiGate, a FortiSwitch, and FortiAPs. Which two devices typically form the core of the Security Fabric topology at that site?

  1. The FortiAPs and the FortiSwitch
  2. The FortiGate and the FortiAPs
  3. The FortiGate and the FortiSwitch Correct answer.
  4. The FortiSwitch and the FortiAnalyzer

Explanation

At a branch, the FortiGate and FortiSwitch form the wired core of the Fabric, with the FortiGate as the root and the FortiSwitch managed through FortiLink. FortiAPs extend wireless access but are not part of the wired core pair, and FortiAnalyzer is typically centralized rather than at the branch.

Question 38FortiOS and Security Fabric Architecture

Which statement best describes the relationship between the Security Fabric and FortiManager in a FortiOS deployment?

  1. FortiManager must be a Fabric member for Fabric telemetry to function
  2. FortiManager replaces the root FortiGate as the Fabric root
  3. FortiManager provides centralized management of Fabric devices while the FortiGate root aggregates Fabric telemetry Correct answer.
  4. FortiManager disables FortiTelemetry on managed devices

Explanation

FortiManager centrally manages policies and device configuration for Fabric devices, while the root FortiGate aggregates Fabric telemetry for visibility. FortiManager does not replace the root role, is not required for telemetry, and does not disable FortiTelemetry.

Question 39FortiOS and Security Fabric Architecture

In a FortiOS Security Fabric deployment, which protocol and port do Fabric-enabled FortiGate devices use by default to establish the telemetry and synchronization connection between the root and downstream members?

  1. UDP 500 and ESP for IPsec Fabric tunnels
  2. TCP 443 using the FortiGate Fabric Connector over HTTPS
  3. TCP 541 using the FortiTelemetry protocol Correct answer.
  4. UDP 5246 using CAPWAP control messaging

Explanation

Fabric devices exchange telemetry and synchronization data over TCP port 541, the FortiTelemetry port, which must be permitted between Fabric members for the root to learn downstream topology and share Fabric data. HTTPS management on 443 is used for GUI and API administration, not for the Fabric telemetry channel itself.

Question 40FortiOS and Security Fabric Architecture

A FortiGate at a branch site is added as a downstream Fabric device, but its interfaces are not visible in the root FortiGate topology view. Which action most directly addresses this symptom?

  1. Change the downstream FortiGate management port from 443 to 8443
  2. Enable the Security Fabric connection on the downstream FortiGate and authorize it from the root FortiGate Correct answer.
  3. Convert the downstream FortiGate to transparent mode so the root can discover its interfaces
  4. Disable VDOM mode on the root FortiGate so all downstream interfaces are merged into the root VDOM

Explanation

A downstream device appears in the Fabric only after the Fabric connection is enabled locally and the root authorizes that device; until authorization completes, the root cannot retrieve the downstream interface inventory. Transparent mode, VDOM changes, and management port numbers do not control whether Fabric topology data is exchanged.

Question 41Secure Networking (NGFW, SD-WAN, Switching, Wireless LAN)

On a FortiGate, which security fabric component is responsible for enforcing application control and IPS on traffic passing between internal segments in transparent mode?

  1. A separate FortiSwitch ACL applied only to the management VLAN
  2. The FortiAnalyzer log aggregation policy
  3. The FortiAP controller profile pushed to access points
  4. The FortiGate itself, applying UTM profiles to the forwarded bridge traffic Correct answer.

Explanation

A FortiGate in transparent mode still inspects and applies UTM profiles such as IPS and application control to the traffic it bridges between interfaces. The device functions as an invisible Layer 2 hop while retaining full security processing. Other fabric components provide management, logging, or wireless control rather than inline UTM enforcement.

Question 42Secure Networking (NGFW, SD-WAN, Switching, Wireless LAN)

An administrator wants SD-WAN to prefer a primary MPLS link and fail over to a broadband link only when the MPLS link exceeds 150 ms latency. Which SD-WAN element implements this behavior?

  1. An ECMP route with equal cost across both members
  2. A static route with a higher administrative distance on the broadband link
  3. A policy route that matches the MPLS interface only
  4. A performance SLA with an SD-WAN rule using the lowest-cost or manual strategy Correct answer.

Explanation

SD-WAN rules reference performance SLAs (health checks) and select members based on measured latency, jitter, and packet loss. A rule using a manual or lowest-cost strategy tied to an SLA can prefer MPLS and fail over when the threshold is breached. Static routes and ECMP do not react to live latency measurements.

Question 43Secure Networking (NGFW, SD-WAN, Switching, Wireless LAN)

Which FortiSwitch feature allows a FortiGate to manage the switch through the security fabric and push VLAN and policy configuration automatically?

  1. Spanning Tree Protocol
  2. Link Aggregation Control Protocol
  3. FortiLink Correct answer.
  4. 802.1X port authentication

Explanation

FortiLink is the management protocol that lets a FortiGate act as the controller for FortiSwitch units, enabling centralized VLAN, port, and policy configuration. STP, LACP, and 802.1X are standard switching protocols that operate independently of the FortiGate controller relationship.

Question 44Secure Networking (NGFW, SD-WAN, Switching, Wireless LAN)

A wireless deployment requires that guest clients be isolated from the corporate subnet while still reaching the internet through the FortiGate. Which configuration achieves this on a FortiAP managed by FortiGate?

  1. Bridge the guest SSID to the corporate VLAN and rely on client isolation only
  2. Place the guest SSID in tunnel mode with a dedicated VLAN and a firewall policy allowing only outbound internet Correct answer.
  3. Use a pre-shared key on the guest SSID and enable intra-VLAN blocking
  4. Assign the guest SSID to the same VLAN as corporate but disable broadcast forwarding

Explanation

Tunnel-mode SSIDs map client traffic to a FortiGate interface, where a separate VLAN and firewall policy can restrict guests to internet-only access. This keeps guest traffic off the corporate subnet while still routing through the firewall for inspection. Client isolation alone does not prevent access to corporate resources.

Question 45Secure Networking (NGFW, SD-WAN, Switching, Wireless LAN)

Which statement correctly describes how a FortiGate uses hardware acceleration (NPU) for firewall sessions?

  1. Offloaded sessions bypass the CPU for forwarding but can be returned to the CPU for UTM inspection Correct answer.
  2. NPUs replace the need for security profiles on accelerated traffic
  3. All sessions are processed in software; NPUs only accelerate logging
  4. Hardware acceleration disables session table lookups

Explanation

FortiGate NPUs offload established sessions so forwarding occurs in hardware, but traffic requiring inspection can be sent back to the CPU for UTM processing. The session table still tracks accelerated flows. Acceleration improves throughput rather than replacing security profiles.

Question 46Secure Networking (NGFW, SD-WAN, Switching, Wireless LAN)

In an SD-WAN rule, what is the effect of enabling the 'passive' health check mode?

  1. The FortiGate sends active probes continuously regardless of traffic
  2. The FortiGate disables SLA monitoring for the member
  3. The FortiGate uses ICMP only and ignores application traffic
  4. The FortiGate sends probes only when traffic exists and infers SLA status from that traffic Correct answer.

Explanation

Passive health checks derive SLA measurements from existing session traffic rather than dedicated probes. This reduces probe overhead and reflects real application experience. Active mode, by contrast, sends continuous probes independent of user traffic.

Question 47Secure Networking (NGFW, SD-WAN, Switching, Wireless LAN)

Which FortiGate interface mode is required for a WAN link that receives its IP address from an upstream DHCP server?

  1. PPPoE
  2. DHCP client Correct answer.
  3. Static
  4. Manual

Explanation

Setting the interface addressing mode to DHCP client makes the FortiGate request a lease from the upstream server and install a default route. Static and manual modes require an administrator-supplied address, and PPPoE is used for DSL-style sessions with credentials.

Question 48Secure Networking (NGFW, SD-WAN, Switching, Wireless LAN)

A network engineer needs to verify which SD-WAN member is currently selected for a specific application. Which FortiGate command or view provides this information?

  1. diagnose sys sdwan member listing interface status only
  2. get system interface physical
  3. diagnose hardware deviceinfo nic
  4. diagnose sys session list filtered by the application Correct answer.

Explanation

Inspecting the session table for the application's flows shows the egress interface and SD-WAN member chosen for that traffic. Member status listings show link health but not the per-flow selection decision. Interface and NIC commands report hardware and link state, not policy outcomes.

Question 49Secure Networking (NGFW, SD-WAN, Switching, Wireless LAN)

Which component of FortiGate wireless configuration maps an SSID to a VLAN and security policy when the FortiAP operates in tunnel mode?

  1. The FortiAP local bridge configuration
  2. The FortiGate SSID interface and its associated firewall policy Correct answer.
  3. The FortiSwitch native VLAN on the AP port
  4. The DHCP relay on the AP management interface

Explanation

In tunnel mode the FortiAP encapsulates client traffic to the FortiGate, where an SSID interface tied to a VLAN and firewall policy governs access. The AP does not locally bridge client traffic in this mode. Switch VLAN and DHCP relay settings do not define the SSID-to-policy mapping.

Question 50Secure Networking (NGFW, SD-WAN, Switching, Wireless LAN)

Which statement about FortiGate virtual wire pairs is accurate?

  1. They require each interface to have a unique IP address
  2. They perform NAT by default between the pair
  3. They operate only on switch interfaces
  4. They forward traffic between paired interfaces without changing IP addresses or TTL Correct answer.

Explanation

Virtual wire pairs bridge two interfaces transparently, preserving IP addresses and TTL so the device is invisible at Layer 3. Security profiles can still be applied to the forwarded traffic. No addressing or default NAT is required for the pair.