I85PREP
⌘ K
Fortinet NSE 5 study materials
Fortinet NSE 5 study resources

Fortinet NSE 5 practice questions

One question at a time. Build your Fortinet NSE 5 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1FortiGate Security

On a FortiGate, which firewall policy match criterion is evaluated first when determining whether a packet belongs to a policy?

  1. The action configured on the policy (accept or deny)
  2. The security profiles attached to the policy
  3. The schedule object assigned to the policy
  4. The destination interface and source address Correct answer.

Explanation

FortiGate evaluates policies in top-down order and matches on the incoming interface, source address, outgoing interface, and destination address before the service and schedule. Action and security profiles are consequences of a match, not matching criteria, so they cannot decide policy selection.

Question 2FortiGate Security

A FortiGate has two policies that both match a given session, one above the other. Which statement describes FortiGate policy behavior?

  1. The lower policy is used because it is the most recently edited
  2. Both policies are applied and their actions merged
  3. The first matching policy from the top is used and evaluation stops Correct answer.
  4. The policy with the more specific source address always wins

Explanation

FortiGate uses first-match logic: policies are checked from the top of the list downward, and the first policy whose criteria match handles the traffic. Specificity and edit order do not override list position, so administrators must order policies deliberately.

Question 3FortiGate Security

Which zone configuration allows a single firewall policy to reference multiple physical interfaces as one logical source?

  1. A zone containing the member interfaces Correct answer.
  2. A switch interface in hardware-switch mode
  3. A VLAN interface with multiple secondary IP addresses
  4. A redundant (aggregate) interface in 802.3ad mode

Explanation

A zone groups several interfaces so that policies and profiles can be written once against the zone name rather than per interface. Aggregate and switch interfaces combine links at Layer 2 for bandwidth or redundancy, not as a policy-matching abstraction.

Question 4FortiGate Security

What is the purpose of the implicit deny at the bottom of the FortiGate policy table?

  1. It drops only traffic from the untrusted zone
  2. It applies antivirus scanning to unmatched traffic
  3. It logs all denied traffic to disk by default
  4. It blocks traffic that matched no explicit policy Correct answer.

Explanation

FortiGate ends the policy list with an implicit deny that silently drops any session not matched by an explicit policy above it. Because it is implicit, it generates no log entries unless you add an explicit deny policy with logging enabled.

Question 5FortiGate Security

An administrator wants policy lookups to resolve users by their Active Directory group. Which two elements must be in place for user-based policies to match? (Choose the best answer.)

  1. A RADIUS server plus a policy with an address object in the destination field
  2. A certificate authority plus a policy with a client certificate in the source field
  3. A local user database plus a policy using a schedule object
  4. A configured LDAP or FSSO connector plus a policy with a user or group in the source field Correct answer.

Explanation

User and group matching requires an identity source that FortiGate can query, such as LDAP or FSSO, and a policy that names the user or group as the source. Address, schedule, and certificate objects affect matching only after identity has been resolved by such a source.

Question 6FortiGate Security

Which NAT configuration allows internal users to reach an internet server while hiding their private addresses behind the FortiGate's external IP?

  1. Central SNAT policy translating the internal subnet to the external interface address Correct answer.
  2. Virtual IP with port forwarding on the external interface
  3. IP pool with fixed-port allocation for each internal host
  4. Destination NAT applied to the internal interface

Explanation

Outbound hiding is source NAT, so a central SNAT policy (or policy NAT with dynamic IP pool/use outgoing interface address) rewrites the source to the external address. Virtual IPs and destination NAT serve inbound publishing, which is the opposite direction.

Question 7FortiGate Security

A policy uses a virtual IP (VIP) to publish an internal web server. Where must the VIP object be referenced?

  1. In the destination address field of the inbound policy Correct answer.
  2. In the source address field of the inbound policy
  3. In the service field of the inbound policy
  4. In the source address field of the outbound policy

Explanation

A VIP represents the external address that maps to an internal server, so it is placed in the destination field of the policy accepting inbound connections. FortiGate then performs destination NAT to the mapped internal address and port.

Question 8FortiGate Security

Which statement about FortiGate policy routes is accurate?

  1. They only affect traffic that matches no firewall policy
  2. They replace the need for static routes in all scenarios
  3. They are evaluated after the routing table lookup fails
  4. They override the routing table for matching traffic and can also apply NAT Correct answer.

Explanation

Policy routes are checked before the routing table for traffic that matches their criteria and can set the next hop, outgoing interface, and even NAT behavior. They are a targeted override, not a replacement for the routing table, and they are evaluated before normal destination-based routing.

Question 9FortiGate Security

A FortiGate is deployed in NAT/route mode. What does this mode mean for traffic passing between its interfaces?

  1. It bridges interfaces at Layer 2 without inspecting traffic
  2. It operates only as a transparent inline sensor
  3. It routes between subnets and can apply NAT and security profiles Correct answer.
  4. It forwards all traffic without address translation

Explanation

In NAT/route mode the FortiGate acts as a Layer 3 router between its interfaces, applying firewall policies, NAT, and security profiles to traversing traffic. Transparent mode is the Layer 2 bridging deployment where management IPs are used for administration.

Question 10FortiGate Security

Which FortiGate feature lets an administrator publish an internal server on a non-standard external port while translating to a different internal port?

  1. A VIP with port forwarding configured Correct answer.
  2. An IPsec tunnel with a static route
  3. A central SNAT policy with an IP pool
  4. A DHCP reservation on the external interface

Explanation

A virtual IP with port forwarding maps an external address and port to an internal address and port, which is how non-standard external ports are published. SNAT policies and tunnels do not perform this inbound port translation.

Question 11FortiGate Security

Which object type should be used in a policy when the requirement is to permit only DNS queries to two specific external resolvers?

  1. An application control profile set to block all categories
  2. A service group containing only DNS, referenced with an all-address destination
  3. A schedule object limiting traffic to business hours
  4. An address group containing the resolvers, referenced in the destination with service DNS Correct answer.

Explanation

Combining an address group of the two resolvers in the destination field with the DNS service restricts the policy to DNS traffic toward exactly those hosts. Using an all-address destination or an application profile would not enforce the specific resolver restriction.

Question 12FortiGate Security

Which statement correctly describes the difference between a firewall address object and a firewall address group?

  1. An address group can contain only IPv4 host objects
  2. An address group stores services, while an address object stores schedules
  3. An address object can be referenced only by one policy at a time
  4. An address object holds a single subnet or range, while a group references multiple objects Correct answer.

Explanation

An address object defines one network entity such as a subnet, host, range, or FQDN, and an address group bundles several such objects for reuse in policies. Groups can mix object types, and objects may be referenced by many policies simultaneously.

Question 13FortiGate Security

Which action does a FortiGate take when a session matches a policy whose action is DENY?

  1. It resets the session and sends an ICMP unreachable to the client
  2. It silently drops the packet without notifying the sender Correct answer.
  3. It logs the packet and then accepts the session
  4. It forwards the session to the next matching policy

Explanation

A deny policy drops matching traffic silently; unlike a reject policy, it does not send a reset or ICMP message back to the client. Logging occurs only if logging is enabled on that deny policy.

Question 14FortiGate Security

An administrator needs to allow a specific set of users to reach a server only during business hours. Which combination of policy elements accomplishes this?

  1. A user group in the source and an application control profile for the destination
  2. A user group in the source, the server in the destination, and a schedule limited to business hours Correct answer.
  3. An address group in the source and a service group in the destination field
  4. A schedule in the source field and the server in the destination field

Explanation

Policy matching combines source identity, destination address, and schedule, so a user group as source plus the server as destination plus a business-hours schedule restricts access to those users in that window. Schedules and services are never placed in address fields.

Question 15FortiGate Security

What does enabling NAT on an IPv4 firewall policy with the default settings accomplish?

  1. It disables routing and forces traffic through a proxy
  2. It translates the source address to the outgoing interface address Correct answer.
  3. It translates both source and destination addresses simultaneously
  4. It translates the destination address to the policy's outgoing interface address

Explanation

With NAT enabled and no IP pool selected, FortiGate translates the source address of matching sessions to the address of the outgoing interface. Destination translation requires a VIP or IP pool with destination mapping, not the NAT checkbox alone.

Question 16FortiGate Security

Which statement about FortiGate interface roles is correct when configuring a WAN-facing interface?

  1. An interface in WAN role cannot host a DHCP server
  2. The interface role affects how the FortiGate treats the interface for routing and DHCP defaults Correct answer.
  3. An interface role changes the physical link speed negotiation
  4. The interface must be assigned to a zone before it can route

Explanation

Interface roles such as LAN and WAN guide default behaviors, including whether a DHCP server or client is expected, and influence routing-related defaults. Roles do not alter physical negotiation, and zoning is optional rather than a prerequisite for routing.

Question 17FortiGate Security

A FortiGate has a policy permitting LAN to WAN with NAT enabled, but users cannot reach the internet. The routing table shows a default route via the WAN interface. Which cause is most consistent with these facts?

  1. The policy lacks a schedule object
  2. The LAN interface has no DHCP server configured
  3. The implicit deny is blocking traffic that matched the policy
  4. DNS resolution is failing because no DNS server is configured on the clients or the interface Correct answer.

Explanation

If routing and policy both permit the session, a common remaining cause of failed internet access is name resolution, since clients or the interface may lack a usable DNS server. The other options either do not block an otherwise permitted session or contradict how policy matching works.

Question 18FortiGate Security

Which FortiGate feature provides a single policy entry point for traffic arriving from many branch tunnels while still allowing per-tunnel differentiation?

  1. A zone containing the tunnel interfaces, referenced in a policy Correct answer.
  2. A virtual IP mapping each tunnel to a public address
  3. A central SNAT policy applied to all tunnels
  4. An IPsec tunnel interface referenced directly in each policy

Explanation

Placing tunnel interfaces into a zone lets one policy cover traffic from all members, while per-tunnel policies can still be written when differentiation is required. VIPs and SNAT policies address translation rather than grouping tunnels for policy matching.

Question 19FortiGate Security

An administrator creates a policy with the source set to an FSSO user group. Which condition must be met for the policy to match a session?

  1. The policy must also reference a schedule object
  2. The user's workstation must be in the same subnet as the FortiGate
  3. The session must use a port listed in the predefined services
  4. The user must have authenticated and FortiGate must have learned the group membership Correct answer.

Explanation

FSSO-based policies match only after the user has authenticated against the monitored domain and FortiGate has received the resulting group information. Subnet placement, schedules, and service objects are independent of identity resolution.

Question 20FortiGate Security

A FortiGate policy uses a VIP for an inbound HTTPS service and also has NAT enabled with an IP pool. What translation does FortiGate perform?

  1. Only destination translation to the internal server
  2. No translation because VIP and NAT cannot be combined
  3. Only source translation to the external address
  4. Destination translation to the internal server and source translation via the IP pool Correct answer.

Explanation

A VIP in the destination field performs destination NAT to the internal server, while enabling NAT with an IP pool on the same policy additionally performs source NAT. Combining them is valid and is common when the internal server must see a translated client address.

Question 21FortiGate Security

Which statement best explains why a FortiGate policy with an application control profile may permit a session but still block specific application traffic within it?

  1. The implicit deny applies to individual applications inside permitted sessions
  2. The policy action is re-evaluated for each application flow
  3. Application control replaces the policy action for all traffic
  4. Application control inspects traffic after the policy match and can drop matching application signatures Correct answer.

Explanation

The firewall policy decides whether the session is permitted, and the application control profile then inspects that permitted traffic and can drop flows matching blocked application signatures. Policy action is not re-evaluated per application, and the implicit deny applies to whole sessions, not to applications inside a permitted session.

Question 22FortiGate Security

Which two policy settings together determine whether return traffic for an outbound session is permitted without an explicit inbound policy? (Choose the best answer.)

  1. The security profile and the SSL inspection setting
  2. NAT and the routing table default route
  3. Stateful inspection and the session table entry created by the outbound policy Correct answer.
  4. The schedule object and the service object

Explanation

FortiGate is stateful: when the outbound policy permits a session, a session table entry is created and return traffic matching that entry is allowed without a separate inbound policy. Routing and profiles influence handling but do not create the return-path permission.

Question 23FortiGate Security

An administrator wants to verify which policy matched a specific live session. Which approach is most direct on a FortiGate?

  1. Run a packet capture on all interfaces simultaneously
  2. Use the session table or policy lookup tools to see the matched policy ID Correct answer.
  3. Review the static routing table for the destination
  4. Check the DHCP lease table for the client address

Explanation

FortiGate tools such as the session table and policy lookup show which policy ID handled a flow, directly answering the question. Packet captures and routing or DHCP tables provide related context but do not identify the matched policy.

Question 24FortiGate Security

Which statement about FortiGate virtual IPs with multiple external IP mappings is correct?

  1. A VIP can map multiple external addresses to internal addresses, and port forwarding can be applied per mapping Correct answer.
  2. A VIP requires an IP pool to function
  3. A VIP cannot be used together with a policy that has NAT enabled
  4. Each VIP can map only one external address to one internal address

Explanation

A VIP can include several external-to-internal mappings, and port forwarding can be configured for individual mappings to translate ports as well as addresses. VIPs do not require an IP pool and can coexist with source NAT on the same policy.

Question 25FortiGate Security

Which FortiGate configuration element determines the outgoing interface for a packet when no policy route matches?

  1. The schedule object attached to the policy
  2. The routing table lookup for the packet's destination address Correct answer.
  3. The firewall policy's destination interface field
  4. The source interface's role setting

Explanation

After policy selection, FortiGate performs a route lookup for the destination address to choose the outgoing interface and next hop. The policy's destination interface must be consistent with that lookup, but the lookup itself determines the egress path.

Question 26FortiGate Security

On a FortiGate, which security fabric component is responsible for enforcing firewall policies on traffic that passes through the device?

  1. FortiManager, which pushes policies to the data plane
  2. FortiClient EMS, which tags endpoints
  3. FortiAnalyzer, which logs and blocks sessions
  4. The FortiGate itself, acting as the policy enforcement point Correct answer.

Explanation

A FortiGate is a stateful firewall that inspects and enforces security policies on transit traffic in real time. FortiManager is a management and provisioning tool, FortiAnalyzer is for logging and reporting, and FortiClient EMS handles endpoint management, so none of them enforce transit traffic on the FortiGate.

Question 27FortiGate Security

Which FortiGate interface mode allows the interface to be used as a firewall policy source and destination while still permitting a management IP address?

  1. Switch mode as a member of a hardware switch
  2. Monitor mode
  3. Interface mode with an administrative access address Correct answer.
  4. Aggregate mode with LACP

Explanation

An interface configured in interface mode can carry routed traffic and can also hold an IP address used for administrative access such as HTTPS or SSH. Monitor mode is receive-only and cannot be a policy endpoint, and switch or aggregate modes are about link aggregation, not administrative addressing.

Question 28FortiGate Security

Which object should an administrator create to define a single reusable host entry that can be referenced by many policies?

  1. A firewall address object of type geography
  2. A firewall address object of type IP range
  3. A firewall address object of type FQDN Correct answer.
  4. A firewall address object of type subnet

Explanation

An FQDN address object resolves a hostname to its current address, so it is the appropriate choice when the target is identified by name rather than by a fixed IP. Subnet, range, and geography objects describe address blocks, numeric spans, or countries rather than a named host.

Question 29FortiGate Security

What is the effect of placing two interfaces in the same zone and referencing the zone in a policy?

  1. Each member interface must still be listed separately in the policy.
  2. Only the first interface added to the zone is matched.
  3. Traffic is automatically NATed between zone members.
  4. The policy applies to traffic entering any member interface of the zone. Correct answer.

Explanation

A zone groups interfaces so that a single policy can match traffic arriving on any member interface, which simplifies configuration when many ports share the same role. The members do not need to be listed separately, NAT is not implied, and all members are matched rather than only the first.

Question 30FortiGate Security

Which policy action silently discards a matching session without sending a reset or rejection to the client?

  1. DENY Correct answer.
  2. ACCEPT
  3. LEARN
  4. IPSEC

Explanation

The DENY action drops matching traffic; with logging disabled for that policy the client simply sees no response. ACCEPT permits the session, LEARN is used for dynamic address learning, and IPSEC applies to tunnel-mode traffic, so DENY is the only silent drop among these.

Question 31FortiGate Security

Which statement describes the function of the FortiGate session table?

  1. It stores only denied traffic for auditing.
  2. It holds the configuration backup of the device.
  3. It replaces the routing table for forwarded packets.
  4. It tracks active sessions so that return traffic is matched to the originating policy. Correct answer.

Explanation

The session table maintains state for established flows, allowing reply packets to be associated with the policy that permitted the original session. It is not a denial-only audit store, does not replace routing, and does not hold configuration backups.

Question 32FortiGate Security

Which FortiGate feature must be enabled on a policy for users to be authenticated against a remote LDAP server before the policy permits their traffic?

  1. Explicit web proxy
  2. Virtual IP
  3. User group as the policy source Correct answer.
  4. Traffic shaping

Explanation

Referencing a user group in the policy source makes the FortiGate require an authenticated identity that matches that group before permitting the session. Traffic shaping and virtual IPs affect bandwidth and address translation, and explicit proxy is a separate deployment model, so none of them enforce group membership.

Question 33FortiGate Security

Which log type on a FortiGate records the policy ID and NAT details for a permitted connection?

  1. Event log
  2. Config change log
  3. Antivirus log
  4. Traffic log Correct answer.

Explanation

Traffic logs record session-level details including the matched policy ID, source and destination, and translation information. Event logs cover system activity, antivirus logs cover malware detections, and config change logs record administrative configuration changes.

Question 34FortiGate Security

An administrator wants to block access to a category of websites for all users without deploying a proxy. Which FortiGate profile type should be applied to the outbound policy?

  1. IPS sensor
  2. DLP profile
  3. Web filter profile Correct answer.
  4. Application control profile

Explanation

A web filter profile inspects HTTP and HTTPS traffic on a policy and can block URL categories, so it fits the requirement without an explicit proxy. Application control targets applications, IPS targets vulnerabilities, and DLP targets data leakage, so none of them block web categories.

Question 35FortiGate Security

A FortiGate policy has NAT enabled with the default settings and no IP pool. Which source address will outbound packets carry on the internet-facing interface?

  1. The original private source address
  2. The IP address of the outgoing interface Correct answer.
  3. The FortiGate's management address
  4. The next-hop router address

Explanation

With NAT enabled and no pool configured, the FortiGate translates the source address to the address of the egress interface. The original private address is not preserved, and neither the management address nor the next-hop router address is used as the translated source.

Question 36FortiGate Security

An administrator needs to allow only a specific set of users to reach a server only during business hours. Which combination of FortiGate settings achieves this?

  1. An FQDN address, a web filter profile, and a schedule
  2. A schedule object, a user group in the source, and the server address as the destination Correct answer.
  3. A virtual IP, an IP pool, and a traffic shaper
  4. A policy route, an IPS sensor, and a user group

Explanation

Time-based access is enforced by attaching a schedule object to the policy, while restricting the source to a user group limits access to the intended identities, and the destination identifies the server. Virtual IPs, pools, shapers, IPS sensors, and policy routes do not restrict access by identity and time together.

Question 37FortiGate Security

Which interface role should be assigned to the interface that connects a FortiGate to its internet service provider?

  1. DMZ
  2. LAN
  3. Undefined
  4. WAN Correct answer.

Explanation

The WAN role designates the interface facing an external network such as an ISP and enables features such as WAN-related link monitoring and default-route behavior. LAN and DMZ roles describe internal segments, and Undefined provides no role-specific behavior.

Question 38FortiGate Security

A policy permits LAN to WAN with NAT enabled, and the routing table contains a default route, yet users cannot browse the internet. Which cause should be investigated first?

  1. The WAN interface is in monitor mode.
  2. DNS resolution is not configured or reachable for clients. Correct answer.
  3. The session table is full.
  4. The LAN interface has no administrative access enabled.

Explanation

When routing and NAT are in place, a common cause of failed browsing is that clients cannot resolve names, so DNS settings and reachability should be checked first. Administrative access on the LAN interface affects management, not client browsing, and a full session table or monitor mode would present differently.

Question 39FortiGate Security

Which FortiGate feature allows many branch IPsec tunnels to terminate on one interface while a single policy matches traffic from all of them?

  1. A static route per tunnel
  2. A policy route per tunnel
  3. A virtual IP per tunnel
  4. A dial-up IPsec tunnel with an assigned interface address Correct answer.

Explanation

A dial-up IPsec tunnel can accept many remote peers, and traffic arriving from those peers can be matched by a policy referencing the tunnel interface. Per-tunnel policy routes, static routes, or virtual IPs multiply configuration and do not provide the single-entry-point behavior described.

Question 40FortiGate Security

Which two policy settings together determine whether return traffic for an outbound session is permitted without an explicit inbound policy?

  1. The logging setting and the comments field
  2. The web filter profile and the IPS sensor
  3. The schedule and the traffic shaper
  4. The NAT setting and the session table state Correct answer.

Explanation

Because the FortiGate is stateful, a session created by an outbound policy with source NAT is tracked in the session table, and reply packets match that existing state without a separate inbound policy. Schedules and shapers affect timing and bandwidth, profiles affect inspection, and logging or comments have no effect on return traffic.

Question 41FortiGate Security

Which action should an administrator take to identify the policy that matched a specific live session on a FortiGate?

  1. Check the session list filtered by the source and destination addresses Correct answer.
  2. Run a packet capture on the egress interface
  3. Inspect the routing table for the destination prefix
  4. Review the event log for the last hour

Explanation

The session list shows each active session along with the policy ID that matched it, so filtering by the relevant addresses identifies the policy directly. A packet capture shows packets but not the policy ID, event logs do not record per-session policy matches, and the routing table shows only the forwarding decision.

Question 42FortiGate Security

What does a FortiGate check first when a packet arrives and no existing session matches it?

  1. The traffic shaper assigned to the interface
  2. The firewall policy lookup based on source, destination, service, and incoming interface Correct answer.
  3. The web filter profile assigned to the interface
  4. The DLP sensor assigned to the policy

Explanation

For a new flow, the FortiGate performs a policy lookup using the incoming interface, source, destination, and service, along with any identity information, to select a matching policy. Profiles and shapers are applied only after a policy is selected, so they are not the first check.

Question 43FortiGate Security

Which statement about a FortiGate virtual IP that maps several external addresses to a single internal server is correct?

  1. Only the first external address in the object is used.
  2. The internal server must have a public address.
  3. The external addresses can be listed in one VIP object and are all translated to the internal server address. Correct answer.
  4. Each external address must use a different external port.

Explanation

A VIP object can include multiple external addresses that all map to the internal server address, which supports publishing the same service under several public addresses. Ports need not differ, only the first address is not exclusively used, and the internal server keeps its private address.

Question 44FortiGate Security

An inbound HTTPS policy uses a VIP and also enables NAT with an IP pool. What translation does the FortiGate perform on the return path?

  1. It translates the destination to the pool address.
  2. It performs no translation on the return path.
  3. It translates the server's source address back to the VIP external address using the pool. Correct answer.
  4. It translates the client's source address using the pool.

Explanation

For an inbound session, the VIP translates the destination to the internal server, and the enabled NAT with a pool causes the server's replies to be translated so they appear to come from the external address. The client source address is not translated by the pool, and translation does occur on the return path.

Question 45FortiGate Security

A FortiGate policy permits an application, but the application control profile is set to monitor. What is the resulting behavior for a session that matches a signature in that profile?

  1. The session is dropped silently.
  2. The session is permitted but the profile is ignored.
  3. The session is permitted and the match is logged. Correct answer.
  4. The session is blocked and reset.

Explanation

A monitor action in a security profile records the match in logs without blocking the session, so traffic continues while the event is recorded. Blocking or resetting requires a blocking action, the profile is still evaluated, and a silent drop is not what monitor does.

Question 46FortiGate Security

An administrator needs to allow DNS queries to two specific external resolvers only, while denying all other outbound DNS. Which policy design is most precise?

  1. One policy with the DNS service and no destination restriction
  2. One policy with an FQDN address for the resolvers and NAT disabled
  3. One policy with a service object for DNS and a destination address group of the two resolvers, placed above a deny policy for DNS Correct answer.
  4. One policy with a web filter profile that blocks DNS categories

Explanation

Restricting the destination to an address group of the two resolvers and matching the DNS service, with a deny policy for DNS below it, permits only those resolvers and blocks the rest. Omitting the destination restriction permits any resolver, disabling NAT does not restrict destinations, and a web filter profile does not precisely control DNS destinations.

Question 47FortiGate Security

A FortiGate has an FSSO user group as the source of a policy. Which condition must be satisfied for the policy to match a user's traffic?

  1. The user must authenticate through a captive portal on the FortiGate.
  2. The FortiGate must have current FSSO group information for the user from the collector agent. Correct answer.
  3. The policy must have NAT disabled.
  4. The user's traffic must be encrypted with IPsec.

Explanation

FSSO relies on a collector agent or similar source to supply current group membership, and the policy matches only when the FortiGate has that identity information for the user. Captive portal authentication is a different method, IPsec encryption is unrelated, and NAT does not affect identity matching.

Question 48FortiGate Security

Which statement best explains why a policy with an application control profile may permit a session while still flagging it in logs?

  1. The profile is applied only to denied sessions.
  2. The profile action for that signature is monitor, so the session continues and the event is logged. Correct answer.
  3. The session bypasses the profile because the policy has NAT enabled.
  4. The log entry is generated by the routing table.

Explanation

Security profiles apply per-signature actions, and a monitor action records the event without blocking the flow, which explains permitted traffic appearing in logs. NAT does not cause a profile to be bypassed, profiles apply to permitted sessions, and routing does not generate profile log entries.

Question 49FortiGate Security

An administrator configures a policy route that matches traffic destined for a specific subnet and sends it out a secondary interface. What happens to traffic that matches the policy route but whose next hop is unreachable?

  1. It is forwarded using the policy route regardless of next-hop reachability.
  2. It falls back to the routing table lookup for the destination. Correct answer.
  3. It is silently dropped by the policy route.
  4. It is translated by the policy route's NAT setting.

Explanation

A policy route is used only when its gateway is reachable; if the next hop is unreachable, the FortiGate falls back to the normal routing table lookup. It is not forwarded regardless of reachability, not silently dropped by the policy route, and the policy route does not itself perform NAT.

Question 50FortiGate Security

Which FortiGate behavior occurs when a policy with NAT enabled uses a fixed-port IP pool and the pool's ports are exhausted?

  1. The FortiGate automatically switches to the egress interface address.
  2. New sessions that cannot obtain a port from the pool are dropped. Correct answer.
  3. The FortiGate reuses the original source port for new sessions.
  4. The FortiGate disables NAT for the policy.

Explanation

A fixed-port pool limits the number of available port mappings, and when they are exhausted additional sessions cannot be translated and are dropped. The FortiGate does not reuse the original port, automatically fall back to the interface address, or disable NAT for the policy.