Fortinet NSE 6 flashcards
Fortinet NSE 6 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Implicit deny
- Rule at the bottom of a FortiGate policy table that drops all traffic not matched by an explicit policy; it cannot be deleted, only overridden by adding policies above it.
- Destination NAT
- Translation performed by a VIP or central NAT that rewrites the destination IP before routing and policy lookup; used to publish internal servers to external clients.
- Flow vs proxy inspection
- Flow-based inspection forwards packets on arrival and inspects at session end; proxy-based inspection buffers and reconstructs traffic for deeper content inspection at a performance cost.
- Security profile binding
- Attachment of AV, IPS, web filter, application control, or SSL inspection profiles to a firewall policy; only traffic accepted by that policy is inspected.
- FGCP HA primary
- In a FortiGate cluster, the primary node processes all traffic and syncs sessions; a failover promotes the standby when heartbeat or monitored interfaces fail.
- VDOM
- Virtual domain that partitions a single FortiGate into independent virtual firewalls, each with its own policies, routing table, and administrators.
- SSL deep inspection
- Decrypts TLS traffic using a FortiGate CA certificate installed on clients, allowing AV and IPS to inspect encrypted payloads; certificate inspection alone only reads metadata.
- Administrative distance
- Ranking that selects among routes to the same prefix from different sources; connected routes are most preferred, then static, then dynamic protocols unless distance is manually changed.
- FortiAnalyzer ADOM
- Administrative domain that logically separates logs, reports, and devices by tenant or region within one FortiAnalyzer appliance.
- FortiSIEM correlation rule
- Logic that matches event attributes across sources and generates an incident when conditions are satisfied; CMDB context enriches the resulting alert.
- FortiManager policy package
- Container of firewall policies and objects assigned to an ADOM and installed to managed devices; changes are staged, then pushed as a package.
- FortiSOAR playbook
- Automated sequence of tasks and connectors that performs response actions such as enrichment, notification, or containment when triggered by an incident.
- Syslog severity
- Numeric levels 0 through 7, where 0 is emergency and 7 is debug; FortiGate alert logs correspond to severity 1 and higher.
- Incident response phases
- Standard sequence of identify, contain, eradicate, recover, and lessons learned; evidence is preserved before remediation actions are taken.
- Endpoint isolation
- FortiEDR action that cuts a compromised host off from the network while keeping management connectivity, preventing lateral movement during investigation.
- Threat hunting
- Proactive search through telemetry for anomalies such as rare process execution or unusual outbound volume, rather than waiting for signature-based alerts.
- FortiGate VM BYOL
- Bring-your-own-license model where a license file bound to the VM serial and CPU count activates the virtual appliance; no per-hour cloud billing applies.
- Cloud-native firewall
- FortiGate CNF deployed in public clouds with auto-scaling and cloud load balancers, providing elastic inspection without managing individual VM instances.
- Cloud connector
- FortiGate or FortiManager feature that queries AWS, Azure, or GCP APIs to discover workloads and dynamically populate address objects used in policies.
- ZTNA
- Zero Trust Network Access verifies user identity and device posture for each application request instead of granting broad access to a network segment.
- Elastic IP failover
- In AWS, the active FortiGate maps the elastic IP; on failover the standby device reassociates the EIP so external clients keep the same public address.
- FortiCASB
- Cloud access security broker that applies DLP and access policies to SaaS application traffic and reports on sanctioned and unsanctioned cloud usage.
- Security group vs NSG
- AWS security groups and Azure network security groups are cloud-level packet filters; FortiGate policies add stateful, application-layer inspection above them.
- SD-WAN SLA target
- Threshold for latency, jitter, or packet loss that a path must meet; SD-WAN rules steer traffic to members that satisfy the target based on health-check probes.
- FortiLink
- Dedicated interface and protocol connecting FortiGate to FortiSwitch, enabling centralized VLAN, port, and policy management of the switch fabric.
- DHCP option 138
- Option used by FortiAP devices to discover the FortiGate wireless controller address during registration on the network.
- BGP Established state
- Final neighbor state after OpenSent and OpenConfirm, in which routers exchange UPDATE messages and install learned routes.
- OSPF DR election
- Selection of designated router on a multi-access segment by interface priority, then highest router ID; the winner reduces adjacency count.
- IPsec phase 2
- Negotiation of the IPsec SA using ESP parameters and optional perfect forward secrecy; phase 1 must already be established.
- 802.1Q trunk
- Port mode that carries multiple VLANs with tags, unlike an access port that carries one untagged VLAN.
- Longest prefix match
- Routing rule that prefers the most specific prefix; ties are broken by administrative distance, then metric.
- FortiExtender
- Cellular or broadband WAN extender that registers to a FortiGate and can serve as an SD-WAN member or backup link.