I85PREP
⌘ K
Fortinet NSE 6 study materials
Fortinet NSE 6 study resources

Fortinet NSE 6 practice questions

One question at a time. Build your Fortinet NSE 6 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security

In a FortiGate security profile, which inspection mode must be selected for a firewall policy so that FortiOS can perform full content scanning, including antivirus file scanning and SSL inspection of encrypted traffic?

  1. Flow-based inspection
  2. Virtual wire pair inspection
  3. Monitor-only inspection
  4. Proxy-based inspection Correct answer.

Explanation

FortiOS performs full content inspection, such as antivirus file scanning and deep SSL content inspection, only when the policy uses proxy-based inspection. Flow-based inspection uses a fast-path engine that offers limited scanning and cannot buffer whole files for AV scanning. The inspection mode is configured per firewall policy and applies to the profiles attached to that policy.

Question 2Network Security

An administrator wants FortiGate to block traffic matching a specific application signature while still allowing all other traffic on the same policy. Which Security Fabric component should be enabled on the policy?

  1. Email filter
  2. Application control Correct answer.
  3. DNS filter
  4. Web filter

Explanation

Application control profiles identify applications by signature regardless of port or protocol and can block or allow each application individually within a policy. Web filtering classifies URLs and categories, DNS filtering acts on domain lookups, and email filtering inspects mail protocols. Only application control provides per-application allow/block decisions for general traffic.

Question 3Network Security

Which FortiGate interface mode allows a single physical interface to carry multiple VLANs while keeping each VLAN in a separate broadcast domain with its own IP address?

  1. Loopback interface
  2. Aggregate interface
  3. Redundant interface
  4. VLAN sub-interface Correct answer.

Explanation

A VLAN sub-interface is created on a parent physical interface and tags traffic with an 802.1Q VLAN ID, giving each VLAN its own IP address and broadcast domain. Aggregate interfaces bond links for bandwidth and redundancy, redundant interfaces provide failover between two ports, and loopback interfaces are logical always-up addresses. Only VLAN sub-interfaces provide 802.1Q segmentation.

Question 4Network Security

A FortiGate has two equal-cost routes to 10.10.0.0/16, one through port1 and one through port2. Which FortiOS feature causes traffic to be distributed across both paths?

  1. Static route distance
  2. Policy routes
  3. Reverse path forwarding
  4. Equal-cost multi-path routing Correct answer.

Explanation

When multiple routes to the same destination have equal distance and priority, FortiOS installs them as equal-cost multi-path (ECMP) routes and load-balances sessions across the next hops. Policy routes override the routing table for matching traffic but do not balance equal-cost entries. Distance and priority select preferred routes rather than distributing traffic.

Question 5Network Security

Which FortiGate feature lets an administrator define a set of IP addresses or geography-based locations and then reference that object in multiple firewall policies?

  1. Address object Correct answer.
  2. Service object
  3. Schedule object
  4. Virtual IP

Explanation

Address objects group IP addresses, ranges, FQDNs, or geographic regions and can be reused across many policies, which simplifies administration. Service objects define ports and protocols, schedules define time windows, and virtual IPs perform destination NAT. Only address objects represent the source or destination hosts and locations used in policy matching.

Question 6Network Security

Which protocol does FortiGate use by default to synchronize sessions and configuration between members of a high availability cluster?

  1. OSPF
  2. BFD
  3. FGCP Correct answer.
  4. VRRP

Explanation

The FortiGate Clustering Protocol (FGCP) is the proprietary protocol FortiOS uses for HA heartbeat, session synchronization, and configuration consistency between cluster members. VRRP is used by other vendors for gateway failover, BFD is a fast failure-detection protocol, and OSPF is a routing protocol. FGCP is specific to FortiGate HA.

Question 7Network Security

Which IPS action in a FortiGate protection profile silently logs matching traffic without dropping the packet?

  1. Reset
  2. Block
  3. Monitor Correct answer.
  4. Quarantine

Explanation

The Monitor action in an IPS sensor logs matching traffic while allowing it to pass, which is useful for tuning signatures before enforcing. Block drops the matching packet, Reset sends a TCP reset to terminate the session, and Quarantine applies to source addresses rather than individual signature matches.

Question 8Network Security

Which FortiGate security profile is designed to stop clients from resolving known malicious or disallowed domains before a connection is ever made?

  1. SSL inspection
  2. Antivirus
  3. Application control
  4. DNS filter Correct answer.

Explanation

DNS filter profiles evaluate DNS queries and responses against FortiGuard categories and botnet lists, blocking resolution of malicious domains at lookup time. Antivirus scans transferred files, SSL inspection decrypts traffic for other engines, and application control classifies sessions after they are established. Blocking at DNS resolution is the earliest enforcement point.

Question 9Network Security

A firewall policy has NAT enabled and no IP pool assigned. Which source address does FortiGate use for translated outbound traffic?

  1. The address of the incoming interface
  2. The address of the outgoing interface Correct answer.
  3. The client's original address
  4. The FortiGuard server address

Explanation

When NAT is enabled on a policy without an IP pool, FortiOS performs interface NAT and uses the IP address of the egress interface as the translated source. The ingress interface address is unrelated to outbound translation, the client address would mean no NAT, and FortiGuard servers are never used for local NAT.

Question 10Network Security

An administrator needs internal users to reach an internal web server through the FortiGate's public IP address. Which FortiGate object type performs this destination translation?

  1. IP pool
  2. Virtual IP Correct answer.
  3. Address group
  4. Policy route

Explanation

A virtual IP (VIP) maps an external address and port to an internal server address and port, providing destination NAT for inbound connections. IP pools are used for source NAT, address groups only bundle addresses for matching, and policy routes change the next hop. Destination translation requires a VIP.

Question 11Network Security

Users report that HTTPS sites with pinned certificates fail after SSL deep inspection is enabled. What is the most appropriate remediation in the FortiGate configuration?

  1. Add the sites to the SSL inspection exemption list Correct answer.
  2. Disable the antivirus profile on the policy
  3. Lower the certificate key size in the profile
  4. Switch the policy to flow-based inspection

Explanation

Certificate pinning causes clients to reject the FortiGate re-signing certificate, so the affected destinations must be exempted from deep inspection and handled with certificate inspection instead. Changing the inspection mode or removing antivirus does not resolve the pinning mismatch, and key size is unrelated. Exemptions preserve inspection for other traffic.

Question 12Network Security

Which FortiGate HA setting determines whether a cluster member actively processes traffic or stays on standby?

  1. Monitor interfaces
  2. Override
  3. Heartbeat interval
  4. HA mode (active-passive or active-active) Correct answer.

Explanation

The HA mode selects active-passive, where one member handles traffic and others stand by, or active-active, where multiple members process sessions. Heartbeat interval controls failure detection timing, Override influences primary election, and monitored interfaces trigger failover. Only the HA mode defines whether members actively forward traffic.

Question 13Network Security

A FortiGate policy uses a web filter profile in flow-based inspection mode. Which behavior should the administrator expect?

  1. No web filtering is applied at all
  2. Only HTTPS traffic is filtered
  3. Blocked categories are enforced, but some advanced content checks are limited Correct answer.
  4. The policy is automatically converted to proxy mode

Explanation

In flow-based mode the web filter still enforces category blocks and rate limits, but features that require buffering, such as some content and file checks, are reduced. Web filtering is not disabled, HTTPS is not the only filtered protocol, and FortiOS never silently converts a policy to proxy mode. Administrators must choose the mode that matches required features.

Question 14Network Security

An administrator configures a static route to 192.168.50.0/24 with distance 10 and another to the same network with distance 20. Which route is installed in the routing table?

  1. Both routes as equal-cost paths
  2. The route with distance 20
  3. The route with distance 10 Correct answer.
  4. Neither route until priorities match

Explanation

FortiOS prefers the route with the lower administrative distance when multiple routes match the same destination. The higher-distance route stays inactive unless the preferred route is withdrawn. Equal-cost multi-path requires equal distance and priority, and routes are not withheld merely because distances differ.

Question 15Network Security

Which FortiGate feature verifies that return traffic for a session would be routed back through the interface on which the request arrived?

  1. Policy route lookup
  2. Reverse path forwarding check Correct answer.
  3. Source NAT
  4. Session helper

Explanation

The reverse path forwarding (RPF) check compares the ingress interface with the route back to the source address, dropping traffic that fails the check to mitigate spoofing. Source NAT rewrites addresses, policy routes override next-hop selection, and session helpers manage application-layer inspection. Only RPF validates the return path.

Question 16Network Security

A FortiGate must inspect traffic between two VLANs on the same physical interface. What is required for the FortiGate to route and inspect this inter-VLAN traffic?

  1. A virtual wire pair between the VLANs
  2. An aggregate interface combining both VLANs
  3. A single policy using the physical interface only
  4. VLAN sub-interfaces with IP addresses and a policy between them Correct answer.

Explanation

Inter-VLAN routing requires separate VLAN sub-interfaces with IP addresses acting as gateways, plus a firewall policy permitting traffic between the two subnets so profiles can inspect it. A virtual wire pair forwards traffic without routing, an aggregate bonds links rather than separating VLANs, and a policy on the physical interface alone cannot match both VLAN subnets.

Question 17Network Security

Which statement describes how a FortiGate IP pool with overload (PAT) enabled translates multiple internal hosts?

  1. Internal addresses are translated only for inbound traffic
  2. Each internal host receives a dedicated external address
  3. Many internal hosts share one external address using different source ports Correct answer.
  4. Translation occurs only when the destination is on the internet

Explanation

An overloaded IP pool performs port address translation so many internal hosts share a small number of external addresses, distinguished by source port. One-to-one mapping describes a non-overloaded pool, inbound translation is handled by virtual IPs, and pool translation applies to any matching outbound policy regardless of destination location.

Question 18Network Security

An IPS sensor is configured with a signature set to Block, but matching traffic still passes. Which condition most likely explains this?

  1. The policy has no antivirus profile attached
  2. The traffic is unencrypted HTTP
  3. The signature is disabled in the sensor Correct answer.
  4. The policy uses flow-based inspection, which cannot drop IPS matches

Explanation

A signature that is disabled in the sensor is not evaluated, so traffic passes even if the action would otherwise be Block. Flow-based inspection can still drop IPS matches, an antivirus profile is unrelated to IPS enforcement, and unencrypted HTTP is fully inspectable. The action only applies to enabled signatures.

Question 19Network Security

Which FortiGate component provides a single management console for FortiGate, FortiSwitch, and FortiAP devices in a Security Fabric deployment?

  1. FortiAnalyzer
  2. FortiAuthenticator
  3. FortiGate acting as Fabric root Correct answer.
  4. FortiManager

Explanation

In a Security Fabric, the root FortiGate provides the central topology view and can manage downstream FortiSwitch and FortiAP devices through the FortiLink interface. FortiManager manages policies centrally, FortiAnalyzer collects logs and reports, and FortiAuthenticator handles authentication. The root FortiGate is the Fabric management point for the connected devices.

Question 20Network Security

An administrator wants to allow only members of an Active Directory group to reach a server through a FortiGate policy. Which configuration approach accomplishes this?

  1. Use an address group containing the server subnet
  2. Use an LDAP or FSSO user group as the policy source Correct answer.
  3. Use a virtual IP for the server
  4. Use a service group containing the server ports

Explanation

Firewall policies can match identity by referencing a user group populated from LDAP or FSSO, so only members of the specified AD group are permitted. Address groups match IP addresses, service groups match ports, and virtual IPs perform destination NAT. Identity-based matching requires a user or FSSO group as the source.

Question 21Network Security

Which FortiGate setting must be configured on an interface for a DHCP client to receive an address from an external DHCP server?

  1. A DHCP relay configured on the interface
  2. The interface addressing mode set to DHCP Correct answer.
  3. The interface addressing mode set to manual
  4. A secondary IP address on the interface

Explanation

Setting the interface addressing mode to DHCP makes FortiGate act as a DHCP client and request a lease from an upstream server. Manual mode requires a static address, DHCP relay forwards client requests from other hosts, and a secondary IP address adds another static address. Only client mode obtains a lease.

Question 22Network Security

In a FortiGate HA active-passive cluster, which statement about session synchronization is accurate?

  1. Only sessions handled by the primary are synchronized to the standby Correct answer.
  2. Sessions are never synchronized and all users must reconnect after failover
  3. Sessions are synchronized only for traffic that matches no policy
  4. Sessions are synchronized only when the cluster is in active-active mode

Explanation

In active-passive HA the primary processes traffic and synchronizes session and NAT tables to the standby so established connections survive a failover. Synchronization is not limited to active-active mode, sessions are not skipped entirely, and traffic matching no policy is denied rather than synchronized. This behavior minimizes disruption during a primary failure.

Question 23Network Security

A FortiGate policy uses proxy-based inspection with SSL deep inspection, antivirus, and web filtering. Users report slow downloads of large files. Which explanation best fits?

  1. SSL deep inspection disables the antivirus engine
  2. Flow-based inspection is required for any HTTPS traffic
  3. Proxy-based inspection buffers content for scanning, which adds latency Correct answer.
  4. Web filtering blocks all file downloads

Explanation

Proxy-based inspection buffers and scans content before forwarding it, which can add latency and reduce throughput for large files. Flow-based inspection is not required for HTTPS, deep inspection does not disable antivirus, and web filtering does not block all downloads. Administrators weigh inspection depth against performance when choosing the mode.

Question 24Network Security

An administrator creates a policy route for traffic from 10.0.0.0/24 to use gateway 203.0.113.1, but traffic still follows the routing table. Which condition most likely explains this?

  1. The firewall policy has NAT disabled
  2. The source address is a private range
  3. The static route has a lower distance than the policy route
  4. The policy route is disabled or its sequence places it after a matching route Correct answer.

Explanation

Policy routes are evaluated in sequence and only take effect when enabled and matched before any conflicting entry, so a disabled or misordered policy route is bypassed. Static route distance does not override an enabled matching policy route, NAT state is irrelevant to route selection, and private source ranges are normal. Ordering and status are the usual causes.

Question 25Network Security

A FortiGate cluster fails over, but users with long-lived TCP sessions must reconnect while short web sessions recover. Which factor best explains the difference?

  1. Long-lived sessions are blocked by the IPS profile
  2. Only sessions in the synchronization table at the time of failover are preserved Correct answer.
  3. Web sessions are exempt from HA synchronization
  4. Failover always resets all TCP sessions regardless of state

Explanation

HA session synchronization maintains a session table on the standby, but only sessions already synchronized when the failure occurs can continue. Sessions not yet synchronized, or state changes not yet replicated, are lost and clients must reconnect. Failover does not reset every session, web traffic is not exempt, and IPS does not selectively block long-lived sessions.

Question 26Network Security

In a FortiGate HA cluster, which protocol and port are used by default for session and configuration synchronization between the primary and secondary units?

  1. TCP port 703 Correct answer.
  2. TCP port 22
  3. UDP port 500
  4. TCP port 443

Explanation

FortiGate HA uses TCP port 703 for synchronization of sessions and configuration between cluster members. This is the default port for HA control and data synchronization. It is not the same as the management or administrative ports.

Question 27Network Security

Which FortiGate inspection mode is required for SSL deep inspection to function?

  1. Proxy-based inspection Correct answer.
  2. Certificate inspection
  3. Full SSL offloading
  4. Flow-based inspection

Explanation

SSL deep inspection requires proxy-based inspection because it must terminate and re-sign SSL sessions to inspect the payload. Flow-based inspection can perform certificate inspection but does not decrypt and inspect the content. Therefore, deep inspection is only available in proxy mode.

Question 28Network Security

Which FortiGate feature allows an administrator to apply a different security profile to traffic based on the user's identity, even when the traffic is encrypted?

  1. IPsec VPN with IKEv2
  2. Authentication rule in a proxy policy Correct answer.
  3. Virtual IP with port forwarding
  4. Policy route with a gateway

Explanation

In proxy-based policies, authentication rules can identify users before applying security profiles, allowing identity-based inspection even for encrypted traffic. Virtual IPs, IPsec VPNs, and policy routes do not provide user identity-based profile selection. This is a key advantage of proxy-based inspection.

Question 29Network Security

An administrator wants to block access to a specific category of websites for all users, but allow access to a few sites within that category. Which FortiGate configuration achieves this?

  1. Create a web filter profile with the category set to monitor and add the allowed sites to a static URL filter with action allow.
  2. Create a web filter profile with the category set to block and add the allowed sites to a static URL filter with action allow. Correct answer.
  3. Create a web filter profile with the category set to block and add the allowed sites to a static URL filter with action block.
  4. Create a web filter profile with the category set to allow and add the allowed sites to a static URL filter with action block.

Explanation

To block a category but allow exceptions, set the category to block and create static URL filter entries with action allow for the specific sites. Static URL filter entries are evaluated before category-based actions. This provides granular control over exceptions.

Question 30Network Security

Which FortiGate feature is used to inspect and control traffic between virtual domains (VDOMs) on the same physical FortiGate?

  1. Virtual router
  2. Policy route
  3. Inter-VDOM link Correct answer.
  4. Zone

Explanation

Inter-VDOM links are virtual interfaces that connect two VDOMs, allowing traffic to be inspected and controlled by firewall policies. They are required for communication between VDOMs. Virtual routers, policy routes, and zones do not provide inter-VDOM connectivity.

Question 31Network Security

Which FortiGate feature allows the device to act as a DNS server for internal clients, resolving queries for internal domains and forwarding others?

  1. DNS database Correct answer.
  2. DNS filter
  3. DHCP server
  4. Recursive DNS

Explanation

The DNS database feature on FortiGate allows the device to answer DNS queries for configured domains, acting as an authoritative DNS server for internal names. It can also forward other queries. DNS filter is for security filtering, DHCP is for address assignment, and recursive DNS is a mode, not a database.

Question 32Network Security

When configuring an IPsec VPN with IKEv2, which parameter must match on both peers for the Phase 1 negotiation to succeed?

  1. Remote gateway
  2. Pre-shared key Correct answer.
  3. Local ID
  4. DPD retry count

Explanation

The pre-shared key must match on both IPsec peers for authentication in IKEv2. Local ID and remote gateway are peer-specific and do not need to match. DPD retry count is a local setting and does not affect negotiation.

Question 33Network Security

Which FortiGate routing feature allows the device to forward traffic based on the source IP address instead of the destination IP address?

  1. Dynamic route
  2. Equal-cost multi-path
  3. Static route
  4. Policy route Correct answer.

Explanation

Policy routes can match on source IP address, among other criteria, to override the routing table and forward traffic to a specific gateway or interface. Static and dynamic routes are destination-based. ECMP is for load balancing across multiple paths.

Question 34Network Security

An administrator configures a FortiGate in NAT mode with a single public IP address and wants to allow multiple internal users to access the Internet simultaneously. Which NAT configuration should be used?

  1. Use a virtual IP with port forwarding.
  2. Use a one-to-one IP pool.
  3. Use a fixed port range IP pool.
  4. Use a central NAT policy with overload enabled. Correct answer.

Explanation

Central NAT with overload (PAT) allows multiple internal users to share a single public IP address by translating both IP addresses and ports. A virtual IP with port forwarding is for inbound access. One-to-one and fixed port range pools are for specific mappings and do not allow many-to-one translation.

Question 35Network Security

Which FortiGate feature prevents users from accessing known malicious websites by checking DNS queries against a threat intelligence database?

  1. Application control
  2. DNS filter Correct answer.
  3. Web filter
  4. Antivirus

Explanation

DNS filter examines DNS queries and responses to block domains associated with malicious activity, using FortiGuard DNS threat intelligence. Web filter inspects HTTP/HTTPS traffic, application control manages applications, and antivirus scans files. DNS filter acts before a connection is made.

Question 36Network Security

An administrator wants to apply a security profile only to traffic from a specific user group. Which FortiGate configuration is required?

  1. A firewall policy with a user group as the source and the security profile applied. Correct answer.
  2. A firewall policy with the security profile applied in the action field.
  3. A firewall policy with a schedule as the source and the security profile applied.
  4. A firewall policy with an IP address as the source and the security profile applied.

Explanation

To apply a security profile based on user group, the firewall policy must have the user group as the source and the profile in the security profiles section. Using an IP address does not provide user identity. The action field is for accept/deny, and schedule is for time-based control.

Question 37Network Security

Which FortiGate HA setting determines whether a cluster member actively processes traffic or remains on standby?

  1. HA mode Correct answer.
  2. HA heartbeat interval
  3. HA priority
  4. HA group name

Explanation

The HA mode (active-passive or active-active) determines whether cluster members actively process traffic or stay on standby. HA priority influences primary election but does not define active/standby behavior. Group name and heartbeat interval are for cluster identification and communication.

Question 38Network Security

An administrator configures a FortiGate to perform antivirus scanning on HTTP traffic. Which inspection mode provides the best performance while still scanning files?

  1. Full content inspection
  2. Proxy-based inspection
  3. Certificate inspection
  4. Flow-based inspection Correct answer.

Explanation

Flow-based inspection scans files as they pass through, providing better performance than proxy-based inspection, which buffers and reconstructs files. Certificate inspection does not scan content. Full content inspection is not a standard FortiGate mode.

Question 39Network Security

Which FortiGate feature allows an administrator to define a custom application signature to detect and control a proprietary application?

  1. Application control with custom signatures Correct answer.
  2. Web filter with custom categories
  3. DNS filter with custom entries
  4. IPS with custom signatures

Explanation

Application control supports custom signatures to detect and control applications that are not recognized by the default signature database. Web filter custom categories are for URL filtering, IPS custom signatures are for intrusion detection, and DNS filter custom entries are for domain filtering.

Question 40Network Security

An administrator wants to ensure that only traffic from specific geographic locations can access a web server behind a FortiGate. Which feature should be used?

  1. DNS filter with geo-restricted domains
  2. Web filter with geographic categories
  3. Geo IP blocking in a firewall policy Correct answer.
  4. IPsec VPN with geo-restricted peers

Explanation

Geo IP blocking allows firewall policies to match on the geographic location of source IP addresses, restricting access based on country. Web filter categories are for web content, not source geography. IPsec VPN and DNS filter do not provide geo-based access control for general traffic.

Question 41Network Security

Which FortiGate feature allows inspection of encrypted traffic without installing a certificate on client devices by using the server's certificate?

  1. Full decryption
  2. Certificate inspection Correct answer.
  3. SSL offloading
  4. Deep inspection

Explanation

Certificate inspection examines the server certificate during the SSL handshake without decrypting the payload, so no client certificate is needed. Deep inspection requires a certificate on clients to decrypt traffic. SSL offloading and full decryption are not standard FortiGate terms for this function.

Question 42Network Security

Which FortiGate feature allows an administrator to limit the bandwidth available to a specific application, such as streaming video, without blocking it?

  1. Application control
  2. Traffic shaping Correct answer.
  3. Web filter
  4. QoS

Explanation

Traffic shaping policies can limit bandwidth for specific applications or traffic types. Web filter blocks or allows web content, application control identifies applications but does not shape bandwidth, and QoS prioritizes traffic but does not specifically limit application bandwidth.

Question 43Network Security

An administrator configures a FortiGate to authenticate users via LDAP. Which server object type should be created?

  1. RADIUS server
  2. TACACS+ server
  3. LDAP server Correct answer.
  4. Local user database

Explanation

To authenticate users via LDAP, an LDAP server object must be created in FortiGate, specifying the server IP, port, and bind credentials. RADIUS and TACACS+ are different protocols, and local user database is for users defined on the FortiGate itself.

Question 44Network Security

Which FortiGate feature provides a graphical representation of network traffic and top applications, helping administrators identify anomalies?

  1. SNMP monitoring
  2. Dashboard widgets
  3. FortiView Correct answer.
  4. Log & Report

Explanation

FortiView provides visual dashboards and drill-down views of traffic, applications, and threats, helping identify anomalies. Log & Report provides detailed logs, dashboard widgets show summary information, and SNMP is for external monitoring.

Question 45Network Security

An administrator wants to ensure that a FortiGate blocks traffic from known malicious IP addresses using a threat intelligence feed. Which feature should be configured?

  1. Web filter with a custom category
  2. DNS filter with a custom blocklist
  3. External threat feed connector Correct answer.
  4. IPS with a custom signature

Explanation

External threat feed connectors allow FortiGate to ingest IP addresses, domains, or URLs from external threat intelligence sources and use them in firewall policies or security profiles. Web filter custom categories are for URLs, DNS filter for domains, and IPS signatures for traffic patterns.

Question 46Network Security

A FortiGate is configured with two WAN links and an SD-WAN rule that selects the best link based on latency. Which SD-WAN component is responsible for measuring link quality?

  1. Health check Correct answer.
  2. Priority
  3. Service rule
  4. SLA target

Explanation

SD-WAN health checks monitor link quality by sending probes and measuring latency, jitter, and packet loss. SLA targets define the thresholds, service rules define traffic steering, and priority sets the order of preference.

Question 47Network Security

Which FortiGate feature allows an administrator to inspect and control traffic between virtual machines on the same host without routing it through a physical network?

  1. Virtual switch
  2. Transparent mode
  3. Virtual domain (VDOM)
  4. Virtual wire pair Correct answer.

Explanation

A virtual wire pair allows two interfaces to be connected as a pair, inspecting traffic between them without changing IP addresses, often used for inline inspection between virtual switches or hosts. VDOMs segment the FortiGate, virtual switches are internal, and transparent mode is a broader operating mode.

Question 48Network Security

An administrator configures a FortiGate in transparent mode. Which statement about firewall policies in transparent mode is accurate?

  1. Policies are applied based on the source and destination interfaces. Correct answer.
  2. Policies are applied based on the source IP address only.
  3. Policies are applied based on the destination IP address only.
  4. Policies are applied based on the MAC address only.

Explanation

In transparent mode, FortiGate acts as a Layer 2 bridge, and firewall policies are applied based on the source and destination interfaces. IP addresses can be used for matching but are not the primary criteria. MAC address filtering is not the basis for policies.

Question 49Network Security

Which FortiGate feature allows an administrator to define a custom Internet service and apply a firewall policy to it?

  1. Custom Internet service Correct answer.
  2. Internet service database
  3. Application control signature
  4. Web filter category

Explanation

Custom Internet services allow administrators to define their own IP address and port combinations that are not in the built-in Internet service database, and then use them in firewall policies. The Internet service database is built-in, application control signatures are for applications, and web filter categories are for URLs.

Question 50Network Security

Which FortiGate feature allows an administrator to configure a policy that applies only during specific times of day?

  1. Schedule Correct answer.
  2. Timeout
  3. Session timer
  4. Expiry

Explanation

Schedules can be applied to firewall policies to control when the policy is active, such as during business hours. Timeout, session timer, and expiry are related to session management, not policy activation times.