I85PREP
⌘ K
Fortinet NSE 7 study materials
Fortinet NSE 7 study resources

Fortinet NSE 7 practice questions

One question at a time. Build your Fortinet NSE 7 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Routing and FortiOS networking

Which administrative distance does FortiOS assign to a static route by default?

  1. 200
  2. 20
  3. 10 Correct answer.
  4. 110

Explanation

FortiOS ranks route sources by administrative distance, and static routes are trusted with a default distance of 10, which beats routes learned by dynamic protocols. Only connected routes, at distance 0, are preferred over static routes.

Question 2Routing and FortiOS networking

A FortiGate has a route to 10.1.0.0/16 and another to 10.1.5.0/24. How is a packet destined to 10.1.5.20 forwarded?

  1. It follows the most recently installed route in the routing table
  2. It follows the route with the highest priority value on the outgoing interface
  3. It follows the longest matching prefix, before administrative distance is considered Correct answer.
  4. It follows the route with the lowest administrative distance regardless of prefix length

Explanation

FortiOS performs a longest-prefix-match lookup first, and only routes with an identical prefix length are then compared by administrative distance and metric. The /24 therefore wins for 10.1.5.20 even if the /16 carries a lower distance.

Question 3Routing and FortiOS networking

The same prefix is learned from an eBGP peer and from an OSPF neighbor. Which route does FortiOS install by default?

  1. The OSPF route, because link-state protocols are preferred
  2. Neither route until an administrative distance is set manually
  3. Both routes, because they were learned from different routing protocols
  4. The eBGP route, because its administrative distance is lower Correct answer.

Explanation

eBGP carries a default distance of 20 while OSPF carries 110, so the eBGP path is preferred when both protocols describe the same prefix. Manual distance changes are optional, not required.

Question 4Routing and FortiOS networking

Which CLI command displays the complete installed routing table on a FortiGate?

  1. show system interface
  2. diagnose ip address list
  3. config router static → show full-configuration
  4. get router info routing-table all Correct answer.

Explanation

The get router info routing-table command family queries the routing table itself, and the all keyword lists every installed route with protocol, distance, metric and next hop.

Question 5Routing and FortiOS networking

When does FortiOS evaluate policy routes for a forwarded packet?

  1. Before the destination-based routing table lookup Correct answer.
  2. Only after a firewall policy has applied source NAT
  3. After the routing table lookup fails to find a match
  4. Only for traffic that is destined to the FortiGate itself

Explanation

Policy routes are consulted ahead of the routing table, so a matching policy route overrides the normal destination lookup. If no policy route matches, the FortiGate falls back to the routing table.

Question 6Routing and FortiOS networking

Which condition must be met for two static routes to be used for ECMP load balancing on a FortiGate?

  1. They must have the same destination prefix and the same distance Correct answer.
  2. They must point to the same next-hop gateway address
  3. They must use different outgoing interfaces and different distances
  4. They must be redistributed into a dynamic routing protocol

Explanation

ECMP requires several routes to the same destination that are equal in distance; the FortiGate then keeps them all and hashes sessions across the paths. Routes with different distances are unequal, so only the best one is installed.

Question 7Routing and FortiOS networking

Which destination prefix represents the default route in a FortiOS routing table?

  1. 255.255.255.255/32
  2. 0.0.0.0/0 Correct answer.
  3. 0.0.0.0/32
  4. 127.0.0.0/8

Explanation

A prefix of 0.0.0.0 with a mask length of zero matches every destination address, which makes it the gateway of last resort. A /32 would match only one specific address.

Question 8Routing and FortiOS networking

How does FortiOS handle routing tables across VDOMs?

  1. VDOMs copy their routes from the management VDOM by default
  2. Each VDOM maintains its own independent routing table Correct answer.
  3. Only the root VDOM maintains a routing table of its own
  4. All VDOMs share a single global routing table owned by the root VDOM

Explanation

A VDOM is a separate virtual instance with its own interfaces, firewall policies and routing table. Traffic between VDOMs must be routed through inter-VDOM links, because there is no shared table.

Question 9Routing and FortiOS networking

Two iBGP paths to 172.16.0.0/16 have identical weight and local preference. Which attribute does FortiOS compare next in the BGP best-path selection?

  1. The neighbor router ID
  2. The AS-path length Correct answer.
  3. The MED value
  4. The origin type

Explanation

The BGP decision process compares weight, then local preference, then whether the route was locally originated, then AS-path length. Origin, MED and router ID are all evaluated later in the sequence.

Question 10Routing and FortiOS networking

Policy route 2 and policy route 10 both match a packet. Which one is applied?

  1. Policy route 10, because the higher sequence number wins
  2. Both, and the traffic is load balanced across their gateways
  3. Neither; the main routing table takes over when two policy routes match
  4. Policy route 2, because policy routes are evaluated in sequence order Correct answer.

Explanation

Policy routes are stored in a sequence-ordered list and the first match is used, so the lowest matching sequence number wins. Higher-numbered entries are never reached for that traffic.

Question 11Routing and FortiOS networking

A static default route exists on the FortiGate and must be advertised to OSPF neighbors. Which configuration accomplishes this?

  1. config router ospf → config area with stub enabled
  2. config router ospf → config redistribute static Correct answer.
  3. config router ospf → set default-metric 0
  4. config router ospf → config network with prefix 0.0.0.0 0.0.0.0

Explanation

Redistributing static routes into OSPF injects the existing static default route as an external LSA, which neighbors then install. Merely defining an OSPF network statement does not advertise a default route.

Question 12Routing and FortiOS networking

Two routes to the same prefix have equal administrative distance but different metrics, and no multipath option is enabled. Which route is installed?

  1. The route with the higher metric, because it is more specific
  2. The route that was learned most recently
  3. The route with the lower metric Correct answer.
  4. Both routes, with traffic load balanced between them

Explanation

After administrative distance, FortiOS compares metric and installs the lower-metric path. Multiple entries survive only when distance and metric are both equal, which enables ECMP.

Question 13Routing and FortiOS networking

Area 2 reaches Area 0 only through Area 1, which is a normal transit area. What must be configured so Area 2 receives inter-area routes from the backbone?

  1. Area 2 assigned a second router ID
  2. The Area 1 interfaces changed to point-to-point network type
  3. Area 2 configured as a totally stubby area
  4. A virtual link across Area 1 between the two area border routers Correct answer.

Explanation

OSPF requires every non-backbone area to attach to the backbone through area border routers. When the path to Area 0 crosses a transit area, a virtual link through that transit area provides the logical backbone attachment.

Question 14Routing and FortiOS networking

Hosts on a VLAN interface must lease addresses from a DHCP server located in another subnet. Which setting on the VLAN interface is required?

  1. A policy route that matches UDP source port 68 and forwards it
  2. dhcp-relay-service enabled with the server address specified Correct answer.
  3. A DHCP server with a relay scope defined
  4. An IP helper configured under the OSPF area

Explanation

Enabling the DHCP relay service on the interface and listing the remote server address makes the FortiGate forward client requests to that server. The server then needs a scope matching the VLAN subnet.

Question 15Routing and FortiOS networking

Which statement about secondary IP addresses on a FortiOS interface is true?

  1. Each secondary address must belong to the primary address subnet
  2. Secondary addresses may belong to a different subnet Correct answer.
  3. An interface supports at most one secondary address
  4. Secondary addresses serve only as source addresses for management traffic

Explanation

FortiOS allows several secondary addresses per interface and they do not need to share the primary subnet, which lets one interface serve multiple customer or legacy networks. They are usable for normal traffic like any other interface address.

Question 16Routing and FortiOS networking

iBGP peers receive eBGP-learned routes with the external next hop, which is unreachable inside the AS. Which neighbor setting corrects this?

  1. set soft-reconfiguration enable
  2. set next-hop-unchanged enable
  3. set route-reflector-client enable
  4. set next-hop-self enable Correct answer.

Explanation

The next-hop-self option rewrites the next hop of advertised routes to the advertising router's own address. Internal peers then resolve the next hop through the IGP instead of an unreachable external address.

Question 17Routing and FortiOS networking

How can a FortiGate forward traffic from one VDOM to another?

  1. By assigning the same physical interface to both VDOMs so they share its connected routes
  2. By enabling asymmetric routing in the global system settings
  3. By configuring the same router ID in both VDOMs
  4. By connecting the VDOMs with an inter-VDOM link and adding routes in each VDOM Correct answer.

Explanation

Inter-VDOM links act as virtual point-to-point interfaces with one end in each VDOM, and each side needs a route pointing across the link. Firewall policies on both VDOMs then permit the traffic.

Question 18Routing and FortiOS networking

Which statement describes an SD-WAN zone on FortiOS?

  1. A routing area used by OSPF to exchange routes between the SD-WAN members
  2. A VRF instance that isolates member routing tables
  3. A firewall policy group used to steer member traffic
  4. A logical grouping of interfaces that SD-WAN rules can reference Correct answer.

Explanation

A zone groups SD-WAN member interfaces so that a service rule can treat them as one logical set, for example all members sharing a link type. Individual members can still be referenced by their own rules.

Question 19Routing and FortiOS networking

Which elements can a FortiOS static route use to define where traffic is sent?

  1. Only the outgoing interface name of a physical or VLAN interface
  2. Either a next-hop gateway address or an outgoing interface Correct answer.
  3. Either a next-hop gateway address or an OSPF area ID
  4. Only a next-hop gateway address

Explanation

A static route can specify a gateway address, an outgoing interface, or both; specifying the interface alone creates a directly connected style route over that link. OSPF areas have no meaning in a static route.

Question 20Routing and FortiOS networking

Two OSPF routers on a broadcast segment never form an adjacency. Which timers must match on both routers?

  1. The LSA aging timers
  2. The SPF throttle timers
  3. The hello and dead intervals Correct answer.
  4. The redistribution metric values

Explanation

OSPF neighbors must agree on the hello and dead intervals, otherwise received hellos are rejected and the adjacency never leaves the init state. Other timers such as SPF throttle affect convergence speed, not adjacency formation.

Question 21Routing and FortiOS networking

Several SD-WAN service rules could match the same traffic. How does FortiOS decide which rule is applied?

  1. The rules are evaluated in order and the first matching rule is applied Correct answer.
  2. The last matching rule in the list takes precedence
  3. All matching rules are merged and their members are load balanced
  4. The rule whose members have the lowest measured latency is always applied

Explanation

SD-WAN service rules are an ordered list evaluated top to bottom, and the first rule whose match criteria are satisfied is used. This is why broad rules belong lower in the list than specific ones.

Question 22Routing and FortiOS networking

Which CLI path sets the DNS servers that the FortiGate itself uses for system lookups?

  1. config firewall profile-protocol-options → set dns
  2. config system dhcp server → set dns-service
  3. config system interface → set dns-server
  4. config system dns → set primary and set secondary Correct answer.

Explanation

The system DNS settings define the resolvers the FortiGate queries for its own name resolution, such as FortiGuard lookups and local CLI resolution. Interfaces carry a DNS protocol option only for allowed services.

Question 23Routing and FortiOS networking

Which administrative distance does FortiOS apply by default to routes learned from an iBGP peer?

  1. 120
  2. 200 Correct answer.
  3. 110
  4. 20

Explanation

iBGP routes are considered least trustworthy among the common sources, so FortiOS assigns them a default distance of 200. eBGP is 20, OSPF is 110 and RIP is 120.

Question 24Routing and FortiOS networking

Traffic to 10.10.10.0/24 must be silently discarded by the FortiGate. Which configuration accomplishes this?

  1. A policy route for 10.10.10.0/24 with the action set to permit and no gateway
  2. A static route for 10.10.10.0/24 with distance 255 and a WAN gateway
  3. A firewall address object of type geography for 10.10.10.0/24
  4. A static route for 10.10.10.0/24 with blackhole enabled Correct answer.

Explanation

A blackhole static route installs the prefix in the routing table with a discard action, so matching packets are dropped without being forwarded and without generating ICMP unreachables. Distance 255 marks a route as unusable rather than discard.

Question 25Routing and FortiOS networking

An autonomous system border router inside an OSPF not-so-stubby area injects an external route. How does that route reach other areas?

  1. It is advertised in a Type 3 summary LSA generated by the ASBR
  2. It is flooded unchanged as a Type 5 LSA throughout the backbone area and all other areas
  3. It is carried in a Type 7 LSA and translated to a Type 5 LSA by the area border router Correct answer.
  4. It stays inside the NSSA and cannot reach other areas

Explanation

Inside an NSSA, external information travels in Type 7 LSAs because Type 5 LSAs are blocked. The area border router translates those Type 7 LSAs into Type 5 LSAs so the rest of the OSPF domain can learn the routes.

Question 26Routing and FortiOS networking

In RIP, which metric value marks a destination as unreachable?

  1. 0
  2. 15
  3. 255
  4. 16 Correct answer.

Explanation

RIP measures reachability in hop counts and treats any count above 15 as infinite, so 16 means the network cannot be reached. A count of 15 is the largest value that still describes a usable route.

Question 27Routing and FortiOS networking

A FortiGate has three routes to overlapping destinations: 10.0.0.0/8 through port1, 10.1.0.0/16 through port2, and 10.1.1.0/24 through port3. Which route carries a packet destined for 10.1.1.5?

  1. The 10.1.0.0/16 route through port2
  2. The packet is dropped because three routes overlap
  3. The 10.1.1.0/24 route through port3 Correct answer.
  4. The 10.0.0.0/8 route through port1

Explanation

When several routes match a destination, the longest prefix match wins because it is the most specific description of the destination. All three routes match 10.1.1.5, so the /24 is selected.

Question 28Routing and FortiOS networking

How does FortiOS derive the default OSPF cost of an interface?

  1. Reference bandwidth divided by interface bandwidth Correct answer.
  2. A fixed value of ten that applies to every interface regardless of speed
  3. It reads the cost value that the neighboring router advertises in its hello packet.
  4. It adds one for every neighbor that has formed a full adjacency on the link.

Explanation

OSPF cost is calculated as the reference bandwidth (100 Mbps by default) divided by the interface bandwidth, with a minimum result of 1. A faster link therefore yields a lower cost, which biases the shortest-path calculation toward higher-capacity paths.

Question 29Routing and FortiOS networking

Two OSPF routers on the same broadcast segment are configured with equal interface priority. How is the designated router determined?

  1. The router with the highest router ID becomes the designated router. Correct answer.
  2. Both routers become designated router and share the segment.
  3. The router whose interface has been in the up state the longest becomes the designated router.
  4. The router with the higher interface IP address becomes the designated router.

Explanation

The DR election first compares interface priority; when priorities are equal, the highest router ID wins. Uptime and interface IP address are not part of the comparison.

Question 30Routing and FortiOS networking

Which BGP attribute is used for route selection only on the local router and is never included in updates sent to peers?

  1. Local preference
  2. AS path
  3. Weight Correct answer.
  4. Multi-exit discriminator

Explanation

Weight is a local, router-specific value that is compared before any other BGP attribute and is not propagated in updates. Local preference is carried to all iBGP peers inside the AS, while AS path and MED are also advertised.

Question 31Routing and FortiOS networking

An OSPF interface must advertise its connected subnet while forming no adjacencies with routers reachable through that link. Which configuration accomplishes this?

  1. Disable OSPF on the interface until a neighbor is detected.
  2. Remove the subnet from OSPF and cover it with a static route that is redistributed.
  3. Set the OSPF priority of the interface to 0.
  4. Set the interface to passive in the OSPF configuration. Correct answer.

Explanation

A passive OSPF interface still has its connected network placed into the link-state database but suppresses hello packets, so no neighbor relationship can form. This is the standard way to advertise stub-side or user-facing subnets.

Question 32Routing and FortiOS networking

A large autonomous system cannot scale the full mesh of iBGP sessions between all internal routers. Which feature solves this problem?

  1. Configuring next-hop-self on every iBGP neighbor
  2. Reducing the AS path length with an outbound route map
  3. Establishing eBGP multihop sessions between every pair of routers
  4. Route reflection Correct answer.

Explanation

A route reflector re-advertises routes learned from one iBGP client to its other clients, which replaces the need for a full mesh. The clients peer only with the reflector instead of with every other router in the AS.

Question 33Routing and FortiOS networking

Packets arriving on port2 with source addresses in 192.168.50.0/24 are dropped, although a firewall policy would permit them and the routing table sends 192.168.50.0/24 out port1. What is the most likely cause?

  1. The source addresses fall inside a reserved range that FortiOS blocks.
  2. NAT is enabled on the policy that permits the traffic.
  3. The session table is full and new sessions are being rejected.
  4. The reverse path forwarding check failed. Correct answer.

Explanation

FortiOS performs a reverse path check on ingress packets by default, looking up the source address and verifying that the return path points back out the receiving interface. Because the route to the source subnet points out port1 rather than port2, the packets are treated as spoofed and dropped.

Question 34Routing and FortiOS networking

A FortiGate has a default route through port1 with distance 10 and another default route through port2 with distance 20. Port1 goes down and its route leaves the routing table. What happens to traffic that matches the default route?

  1. The route through port2 is installed and used. Correct answer.
  2. The route through port2 stays inactive because its distance is higher.
  3. Traffic is dropped until port1 recovers.
  4. Both default routes are used for load balancing.

Explanation

Administrative distance is used only to choose among competing routes to the same prefix. With the lower-distance route gone, the remaining route becomes the best candidate and is installed in the routing table.

Question 35Routing and FortiOS networking

When redistributing a static route into OSPF, which external metric type adds the internal OSPF cost of each link to the redistributed cost?

  1. Metric type 2, which keeps the redistributed cost unchanged across the AS
  2. Metric type 1, which adds the internal cost of each link Correct answer.
  3. Metric type 7, which carries external routes inside an NSSA
  4. Metric type 5, which floods the route as an external LSA

Explanation

Type 1 external metrics are cumulative: the redistributed cost is added to the internal cost of each link along the path. Type 2 external metrics keep the redistributed cost constant regardless of distance from the ASBR.

Question 36Routing and FortiOS networking

Two FortiGates in different autonomous systems must maintain an eBGP session even though several routers sit between them. Which setting must be enabled on both peers?

  1. Configure next-hop-self on both peers.
  2. Enable ebgp-enforce-multihop on both peers. Correct answer.
  3. Enable soft reconfiguration inbound on both peers.
  4. Configure a route reflector between the two peers.

Explanation

By default eBGP assumes the peer is directly connected and sends updates with a TTL of 1. Enabling ebgp-enforce-multihop allows the session and its updates to traverse intermediate routers.

Question 37Routing and FortiOS networking

An administrator needs to see every route candidate for a prefix, including routes that were not selected for the routing table. Which command provides this view on a FortiGate?

  1. diagnose ip route list
  2. get router info routing-table all, which lists only the selected route per prefix
  3. get system arp
  4. get router info routing-table database Correct answer.

Explanation

The routing-table database view shows all candidate routes held by the routing process, marking which ones are active and which lost the selection process. The standard routing-table view lists only the routes actually installed.

Question 38Routing and FortiOS networking

A FortiGate receives an eBGP update whose AS path already contains the FortiGate's own AS number. How is the update handled?

  1. It accepts the route and sets its weight to zero.
  2. It removes its own AS number from the path and accepts the route.
  3. It accepts the route but marks it as stale.
  4. It discards the update because of the AS path loop. Correct answer.

Explanation

BGP uses the AS path as its loop-prevention mechanism. A router that sees its own AS number in the path concludes the route has already traversed its autonomous system and rejects the update.

Question 39Routing and FortiOS networking

An interface on a FortiGate is assigned to VRF 10 while all other interfaces remain in the global VRF. A packet arrives on the VRF 10 interface for a destination reachable only through a global-VRF interface. What determines whether the packet is forwarded?

  1. The lookup uses the VRF 10 table. Correct answer.
  2. The FortiGate falls back to the VRF of the previous hop.
  3. The global table is consulted first, so the packet is forwarded normally.
  4. All global routes are automatically leaked into every VRF, so forwarding succeeds.

Explanation

Each VRF maintains its own independent routing table, and the interface a packet arrives on determines which table is used for the lookup. A destination with no entry in that table is unreachable unless a route is added or leaked into the VRF.

Question 40Routing and FortiOS networking

A FortiGate runs OSPF and BGP and redistributes routes in both directions. Which mechanism prevents a route redistributed from BGP into OSPF from being injected back into BGP on another router?

  1. Split horizon prevents a route from being advertised back out the interface it was learned on.
  2. Tagging redistributed routes and filtering on the tag in the reverse direction Correct answer.
  3. Making every OSPF interface passive stops the re-injection.
  4. Setting both protocols to the same administrative distance prevents re-injection.

Explanation

Mutual redistribution can cause feedback loops because each protocol treats routes from the other as new information. Applying a tag at the point of redistribution and denying that tag when redistributing in the opposite direction keeps each route inside the protocol that originated it.

Question 41Firewall policy, NAT, and authentication

A FortiGate evaluates a new session whose source, destination, and service match the criteria of several enabled firewall policies. How does the FortiGate decide which policy governs the session?

  1. The most specific policy, based on the narrowest address objects, is applied.
  2. The policy with the fewest security profiles attached is applied.
  3. The policy with the lowest numeric ID in the configuration is applied.
  4. The first matching policy from the top of the policy list is applied. Correct answer.

Explanation

FortiGate evaluates policies in the order they appear in the policy list and stops at the first full match of source, destination, service, and the remaining criteria. Because evaluation stops at that match, moving a policy changes behaviour far more than its ID number does.

Question 42Firewall policy, NAT, and authentication

In the default configuration, what does a FortiGate do with a new session that matches no firewall policy?

  1. It forwards the session using the best matching route.
  2. It applies a default security profile and logs the session.
  3. It drops the session because of the implicit deny at the end of the policy list. Correct answer.
  4. It returns the session to the client with a reset and logs it.

Explanation

The policy list ends with an implicit deny that drops traffic not matched by any explicit policy. Administrators normally add an explicit deny policy with logging at the bottom so such traffic is recorded.

Question 43Firewall policy, NAT, and authentication

A firewall policy has NAT enabled and no IP pool is selected. Which address does the FortiGate use as the translated source address?

  1. The primary address of the policy's outgoing interface. Correct answer.
  2. The primary address of the policy's destination interface.
  3. The address of the client's default gateway.
  4. The address of the FortiGate's management interface.

Explanation

When NAT is enabled and no pool is specified, the policy translates the source address to the primary address of the outgoing interface. This is the most common hide-NAT configuration for internet access.

Question 44Firewall policy, NAT, and authentication

What is the primary function of a virtual IP (VIP) in a FortiGate configuration?

  1. To translate the source address of outbound sessions.
  2. To translate the destination address of inbound sessions. Correct answer.
  3. To balance sessions across several FortiGate units.
  4. To authenticate users before they reach a protected server.

Explanation

A VIP maps an external destination address, and optionally a port, to an internal server address, so it performs destination NAT for inbound traffic. Source NAT is configured separately, either on the policy or in the central SNAT table.

Question 45Firewall policy, NAT, and authentication

Which statement correctly compares TACACS+ and RADIUS as remote authentication servers on a FortiGate?

  1. TACACS+ supports only authentication, while RADIUS supports authentication, authorization, and accounting.
  2. TACACS+ uses UDP port 49, while RADIUS uses TCP ports 1812 and 1813.
  3. TACACS+ uses TCP port 49, while RADIUS uses UDP ports 1812 and 1813. Correct answer.
  4. TACACS+ encrypts only the password, while RADIUS encrypts the entire packet body.

Explanation

TACACS+ runs over TCP port 49 and separates authentication, authorization, and accounting. RADIUS uses UDP ports 1812 and 1813 and obscures only the password field, leaving the rest of the packet readable.

Question 46Firewall policy, NAT, and authentication

Which feature supplies a time-based one-time password as a second authentication factor for a locally defined FortiGate user?

  1. A client certificate validated by the FortiGate's certificate authority.
  2. A FortiToken soft or hard token assigned to the user. Correct answer.
  3. An LDAP simple bind against the user's directory entry.
  4. A RADIUS accounting start message from the client.

Explanation

FortiToken delivers a one-time password that the user submits together with the password, providing two-factor authentication for local users. The token can be a hardware device or a mobile app instance.

Question 47Firewall policy, NAT, and authentication

How are security profiles such as antivirus and web filtering enforced on traffic that passes through a FortiGate?

  1. They are attached to the firewall policy that accepts the traffic. Correct answer.
  2. They are configured in a global profile table that applies to all traffic.
  3. They are applied by proxy settings configured on the client.
  4. They are bound to the incoming interface of the traffic.

Explanation

Security profiles are selected inside the firewall policy, so only traffic accepted by that policy is inspected by its antivirus, IPS, or web-filter profiles. Traffic accepted by a different policy receives only that policy's profiles.

Question 48Firewall policy, NAT, and authentication

An administrator needs to confirm which firewall policy accepted a specific live connection. Which tool provides this information?

  1. The ARP table of the outgoing interface.
  2. The policy route monitor.
  3. The routing table entry for the destination network.
  4. The session table, which lists the policy ID for each session. Correct answer.

Explanation

Each entry in the session table records the policy ID that created it, along with any NAT translations and timeout values. The routing and ARP tables contain no policy information at all.

Question 49Firewall policy, NAT, and authentication

Which IP pool type lets many internal hosts share one external address by using different source ports?

  1. Fixed port range
  2. Port block allocation
  3. One-to-one
  4. Overload Correct answer.

Explanation

An overload pool shares a single external address across many hosts and separates the sessions by source port. One-to-one pools instead reserve a dedicated address for each internal host.

Question 50Firewall policy, NAT, and authentication

An administrator enables central NAT on a FortiGate. Where is source NAT for outbound traffic then defined?

  1. In the static route that covers the destination network of the traffic.
  2. In the central SNAT table, which maps source and destination to an address. Correct answer.
  3. In the IP pool object that is attached to each individual firewall policy.
  4. In the virtual IP object that is attached to each individual firewall policy.

Explanation

With central NAT enabled, source NAT is defined in the central SNAT table instead of inside each policy, and the NAT option is removed from firewall policies. This lets NAT be managed separately from security policy.