I85PREP
⌘ K
NSE 8 study materials
NSE 8 study resources

NSE 8 practice questions

One question at a time. Build your NSE 8 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network security design for complex networks

An enterprise is designing segmentation for a large campus with a collapsed core. Which FortiGate deployment model inspects inter-VLAN traffic while keeping the core switches as the Layer 3 gateways for endpoints?

  1. Interface mode with each VLAN as a separate FortiGate interface
  2. Virtual wire pair between the core and the distribution layer
  3. One-arm sniffer connected to a SPAN port on the core
  4. Transparent mode inserted as a Layer 2 hop on the inter-VLAN path Correct answer.

Explanation

Transparent mode lets the FortiGate forward Layer 2 frames while applying security profiles, so the existing core switches remain the default gateways and endpoints keep their addressing. It sits inline, unlike a sniffer, so it can actually block traffic. Virtual wire pairs also forward transparently but are typically used for bump-in-the-wire between two points rather than for inspecting many VLANs on a shared trunk.

Question 2Network security design for complex networks

Which characteristic distinguishes a FortiGate security fabric design that uses FortiLink from one that relies on standalone managed switches?

  1. FortiLink switches are configured and monitored through the FortiGate, giving a single policy and topology view Correct answer.
  2. FortiLink switches must run a routing protocol with the FortiGate to exchange VLAN information
  3. FortiLink switches terminate IPsec tunnels from branch offices directly
  4. FortiLink switches perform all UTM inspection in hardware, removing load from the FortiGate

Explanation

FortiLink is a management and control channel that lets a FortiGate authorize, configure, and monitor connected FortiSwitch units, so VLANs, ports, and policies are administered from one place. The switches do not run routing adjacencies with the FortiGate for this purpose, and they do not perform the UTM inspection themselves.

Question 3Network security design for complex networks

A data center uses ECMP across two ISP links for outbound traffic. Which design element is required so that return traffic for stateful sessions is not dropped by asymmetric routing?

  1. Disable stateful inspection on the outbound policy
  2. Enable asymmetric routing support so the FortiGate accepts packets on a different interface Correct answer.
  3. Enable NAT on both links and rely on session helpers
  4. Configure the two links as a redundant interface

Explanation

When ECMP causes a reply to arrive on a different interface than the one that carried the original packet, the FortiGate must be allowed to accept that packet; the asymmetric routing option permits this while keeping sessions alive. Disabling inspection removes the security value, and a redundant interface collapses the links into one logical interface rather than preserving ECMP.

Question 4Network security design for complex networks

In a large hub-and-spoke topology using ADVPN, what is the primary benefit of shortcut tunnels between spokes?

  1. They let spoke-to-spoke traffic bypass the hub, reducing latency and hub load Correct answer.
  2. They encrypt traffic twice to increase confidentiality
  3. They automatically provide Quality of Service guarantees end to end
  4. They replace the need for IPsec on the hub-to-spoke links

Explanation

ADVPN uses the hub to exchange routing information and then lets spokes establish direct shortcuts, so traffic between branches no longer hairpins through the hub. This lowers latency and reduces bandwidth and session load on the hub. Shortcuts do not double-encrypt traffic or provide QoS guarantees.

Question 5Network security design for complex networks

A security architect must place a FortiGate in a data center where the requirement is to inspect traffic between two Layer 3 segments without changing any IP addressing or routing. Which approach satisfies this with the least design change?

  1. Deploy in NAT mode with VDOMs and inter-VDOM links
  2. Deploy in transparent mode inline between the two segments Correct answer.
  3. Deploy as a sniffer on a mirrored port
  4. Deploy in NAT mode and re-address both segments

Explanation

Transparent mode forwards traffic at Layer 2 and applies security profiles without requiring new subnets or routing changes, which matches the requirement to leave addressing untouched. NAT mode would force re-addressing or routing changes, and a sniffer cannot block traffic.

Question 6Network security design for complex networks

Which statement correctly describes how VDOMs support a multi-tenant security design on a single FortiGate?

  1. Each VDOM has its own routing table, policies, and administrators, isolating tenants logically Correct answer.
  2. All VDOMs share a single routing table but have separate firewall policies
  3. VDOMs can only be used with transparent mode
  4. VDOMs require separate physical interfaces and cannot share a physical port

Explanation

VDOMs provide logical separation of routing, firewall policy, VPN, and administrative access, so multiple tenants or functions can share one appliance. They can share physical interfaces through VLANs and inter-VDOM links, and they support both NAT and transparent modes.

Question 7Network security design for complex networks

A network uses a FortiGate cluster in active-passive HA. Which design consideration ensures that a failure of the primary unit does not break sessions that traverse the cluster?

  1. Session pickup must be enabled so the secondary has the session table Correct answer.
  2. The secondary must use a different HA priority than the primary
  3. The cluster must run in transparent mode
  4. The heartbeat interfaces must be on different subnets

Explanation

HA session pickup synchronizes session state to the secondary so that established flows continue after a failover. Without it, existing sessions would be dropped and clients would need to re-establish them. Priority and heartbeat addressing affect election and communication but not session continuity.

Question 8Network security design for complex networks

In a complex network with many internal segments, which design choice best limits lateral movement if a workstation is compromised?

  1. Micro-segmentation with policies that allow only required inter-segment flows Correct answer.
  2. Relying on endpoint antivirus as the only control
  3. A single flat VLAN for all internal users with one broad policy
  4. Placing all servers and users behind one perimeter firewall policy

Explanation

Micro-segmentation restricts traffic between segments to the specific flows each workload or user group needs, so a compromised host cannot freely reach other segments. A flat network or a single broad policy allows unrestricted lateral movement. Endpoint protection alone does not enforce network-level segmentation.

Question 9Network security design for complex networks

A FortiGate is deployed at the edge of a large network and must forward traffic to multiple internal next hops based on destination. Which feature allows policy-based selection among several equal-cost paths while preserving per-session consistency?

  1. Policy routes with ECMP enabled Correct answer.
  2. DNS-based load balancing
  3. Virtual wire pairs
  4. Static routes with administrative distance tuning

Explanation

Policy routes can specify multiple gateways and use ECMP so that sessions are distributed across equal-cost paths while each session stays on one path. Static routes with differing distances select a single best path rather than balancing, and virtual wire pairs are Layer 2 constructs.

Question 10Network security design for complex networks

Which design practice best supports scaling a FortiGate configuration across many branch sites with consistent policy?

  1. Disabling logging on branches to reduce overhead
  2. Configuring each branch as a standalone VDOM on the hub
  3. Using central management with templates and policy packages Correct answer.
  4. Manually replicating policy on each branch FortiGate

Explanation

Central management with templates and policy packages lets an administrator define policy once and deploy it consistently to many devices, which reduces drift and operational effort. Manual replication is error-prone, and disabling logging removes visibility needed to validate the design.

Question 11Network security design for complex networks

A company runs a FortiGate in a segment where it must inspect traffic but cannot be the default gateway, and the design must still allow the firewall to block malicious flows. Which deployment satisfies both constraints?

  1. Sniffer mode with a SPAN port
  2. Virtual wire pair used only for monitoring
  3. Transparent mode inline with the segment Correct answer.
  4. NAT mode with the FortiGate as the gateway

Explanation

Transparent mode forwards traffic inline at Layer 2, so the FortiGate can enforce policy and block flows without becoming the default gateway. Sniffer mode only observes mirrored traffic and cannot block, while NAT mode would require the FortiGate to be the gateway.

Question 12Network security design for complex networks

Which statement about using link aggregation between a FortiGate and a core switch is correct?

  1. Link aggregation requires each member link to be in a different VDOM
  2. Link aggregation eliminates the need for HA between two FortiGates
  3. LACP bundles multiple physical links into one logical interface for redundancy and throughput Correct answer.
  4. Link aggregation provides stateful failover of sessions between member links

Explanation

LACP combines member links into a single logical interface, providing link redundancy and increased aggregate bandwidth. It does not provide stateful session failover between firewalls, and member links belong to the same interface and VDOM rather than different ones.

Question 13Network security design for complex networks

In a design where a FortiGate protects both north-south and east-west traffic, which feature allows different security profiles and routing for different internal communities while using shared physical infrastructure?

  1. A single global policy applied to all interfaces
  2. Virtual wire pairs for every community
  3. VDOMs with inter-VDOM links and VLAN sub-interfaces Correct answer.
  4. One VDOM with policy ordered by interface

Explanation

VDOMs separate routing and policy per community, and VLAN sub-interfaces plus inter-VDOM links let those communities share physical ports and cabling. A single global policy cannot differentiate communities, and virtual wire pairs do not provide per-community routing separation.

Question 14Network security design for complex networks

A FortiGate must advertise internal routes to a core router and receive a default route in return. Which configuration supports this design?

  1. OSPF or BGP on the FortiGate interface facing the core Correct answer.
  2. Policy routes on the core router
  3. Virtual wire pairs between the FortiGate and the core
  4. Static routes only, with no dynamic protocol

Explanation

Dynamic routing protocols such as OSPF or BGP let the FortiGate exchange internal routes with the core and learn a default route, which is typical in large designs. Static routes alone cannot dynamically exchange reachability, and policy routes on another device do not establish an adjacency.

Question 15Network security design for complex networks

A security team wants to inspect encrypted outbound traffic from managed endpoints without breaking certificate validation on unmanaged devices. Which design is appropriate?

  1. Certificate inspection for unmanaged devices and deep inspection for managed endpoints with the CA installed Correct answer.
  2. Disable SSL inspection entirely to avoid errors
  3. Full SSL inspection applied to all users and devices
  4. Inspect only inbound traffic from the internet

Explanation

Deep inspection requires the FortiGate CA to be trusted on the endpoint, so it is appropriate for managed devices where the certificate can be installed. Unmanaged devices should use certificate inspection to avoid trust errors. Applying deep inspection to all devices or disabling inspection entirely does not meet both goals.

Question 16Network security design for complex networks

Which design element is required for a FortiGate to participate in a dynamic routing topology with multiple areas and summarize routes between them?

  1. A single static default route to the core
  2. A sniffer interface on the core link
  3. A virtual wire pair to the core router
  4. An OSPF configuration with area assignments and route summarization on area border interfaces Correct answer.

Explanation

OSPF area design allows the FortiGate to act at area boundaries and summarize routes, which keeps large topologies stable and reduces table size. A static default route does not participate in the dynamic topology, and Layer 2 or sniffer constructs do not run OSPF.

Question 17Network security design for complex networks

A hub FortiGate terminates IPsec tunnels from many branches. Which design reduces the risk of a single branch saturating the hub's tunnel bandwidth?

  1. Disable IPsec and use GRE without encryption
  2. Assign each branch a separate tunnel interface with per-tunnel bandwidth limits and QoS shaping Correct answer.
  3. Rely on the branch ISP to enforce bandwidth
  4. Aggregate all branches into one tunnel interface without limits

Explanation

Per-tunnel interfaces with bandwidth limits and QoS shaping let the hub enforce fair use so one branch cannot consume all hub capacity. A single shared tunnel provides no per-branch control, and relying on the ISP or removing encryption does not protect hub capacity or security.

Question 18Network security design for complex networks

Which statement describes the role of a virtual wire pair in a complex network design?

  1. It forwards all frames between two ports without MAC learning or IP addressing on those ports Correct answer.
  2. It requires each port to be in a different VDOM
  3. It performs NAT between the two ports
  4. It provides Layer 3 routing between the two ports

Explanation

A virtual wire pair transparently forwards frames between two interfaces and does not require IP addresses or MAC learning on those ports, making it useful for inline insertion. It does not route, perform NAT, or require the ports to be in separate VDOMs.

Question 19Network security design for complex networks

A network architect is designing a FortiGate deployment for a large hospital with clinical, guest, and medical-device networks. Which design best isolates medical devices that cannot run endpoint agents?

  1. Place medical devices on the guest network to simplify access
  2. Place medical devices on a dedicated segment with strict allow-list policies and limited internet access Correct answer.
  3. Apply the same policy to all three networks to reduce complexity
  4. Connect medical devices directly to the internet-facing interface

Explanation

Devices that cannot run agents should be contained on a dedicated segment governed by strict allow-lists and minimal internet access, which limits exposure and lateral movement. Merging them with guest or shared policy removes that containment, and exposing them directly to the internet is unsafe.

Question 20Network security design for complex networks

Which design consideration applies when deploying a FortiGate in a network that uses jumbo frames on the internal segments?

  1. Reduce the FortiGate MTU below 1500 to guarantee compatibility
  2. Use a virtual wire pair to bypass MTU limits
  3. Ensure all interfaces in the path, including the FortiGate, support the same MTU to avoid fragmentation Correct answer.
  4. Disable fragmentation on all policies

Explanation

Consistent MTU across every hop prevents fragmentation and dropped large frames when jumbo frames are in use. Lowering the MTU defeats the purpose of jumbo frames, and virtual wire pairs do not bypass MTU constraints.

Question 21Network security design for complex networks

In a design using SD-WAN on a FortiGate, what is the purpose of a service-level agreement health check?

  1. It monitors link quality such as latency and jitter to steer traffic to the best member Correct answer.
  2. It assigns IP addresses to SD-WAN members
  3. It encrypts traffic on each SD-WAN member link
  4. It replaces IPsec tunnels between sites

Explanation

SLA health checks probe member links and measure latency, jitter, and packet loss so SD-WAN rules can steer traffic to links that meet the required quality. They do not encrypt traffic, replace IPsec, or handle addressing.

Question 22Network security design for complex networks

A FortiGate cluster protects a network where some sessions must survive both a link failure and a device failure. Which combination of features addresses both requirements?

  1. Link aggregation for link failure and HA with session pickup for device failure Correct answer.
  2. Policy routes for link failure and VDOMs for device failure
  3. Virtual wire pairs for link failure and sniffer mode for device failure
  4. NAT for link failure and DNS load balancing for device failure

Explanation

Link aggregation provides redundancy against a member link failing, while HA with session pickup preserves sessions if a firewall unit fails. Policy routes, VDOMs, virtual wire pairs, and NAT do not provide device-level session failover.

Question 23Network security design for complex networks

Which design choice best supports consistent logging and analysis across many FortiGates in a large network?

  1. Disable logging on high-traffic interfaces
  2. Use different log formats per site
  3. Send logs to a central FortiAnalyzer and define consistent log settings Correct answer.
  4. Log only to local disk on each device

Explanation

Centralized logging with consistent settings lets analysts correlate events across devices and apply uniform retention and reporting. Local-only logging is hard to correlate and risks loss, and disabling logging removes visibility.

Question 24Network security design for complex networks

A FortiGate is placed between an internal core and a DMZ to inspect traffic in both directions. Which policy design is most appropriate?

  1. A policy that disables inspection for DMZ traffic to improve performance
  2. Separate policies for core-to-DMZ and DMZ-to-core with profiles applied to each direction Correct answer.
  3. A single policy from any to any with all profiles enabled
  4. Only a policy for core-to-DMZ, since return traffic is automatically trusted

Explanation

Direction-specific policies let the architect apply profiles suited to each flow, such as stricter inspection for inbound DMZ traffic and controlled egress from the core. An any-to-any policy is overly permissive, and relying on implicit return trust or disabling inspection weakens security.

Question 25Network security design for complex networks

Which statement describes how a FortiGate handles traffic when a policy route and a static route both match a destination?

  1. The static route always wins because it is in the routing table
  2. Both routes are used with ECMP automatically
  3. The policy route takes precedence over the static route for matching traffic Correct answer.
  4. The FortiGate drops the traffic due to the conflict

Explanation

Policy routes are evaluated before the routing table lookup, so matching traffic follows the policy route even when a static route also matches. The static route applies to traffic that does not match the policy route, and the device does not automatically load-balance or drop due to the overlap.

Question 26Network security design for complex networks

In a large enterprise, a FortiGate must inspect traffic between several internal VLANs while remaining invisible to the routing topology. Which deployment mode best fits this requirement?

  1. Virtual wire pair between each pair of VLANs
  2. Policy-based routing with multiple next-hop gateways
  3. NAT mode with each VLAN as a separate routed interface
  4. Transparent mode with VLAN sub-interfaces bound to a bridge Correct answer.

Explanation

Transparent mode lets the FortiGate forward and inspect traffic without being a routing hop, so the existing L3 topology stays unchanged. Binding VLAN sub-interfaces into a software bridge keeps all segments inspectable under one management IP. Routed NAT mode would change the topology, which the design wants to avoid.

Question 27Network security design for complex networks

A security architect must ensure that guest Wi-Fi users cannot reach internal server subnets even if a policy is misconfigured later. Which design principle best addresses this?

  1. Default-deny inter-VDOM links with explicit allow policies Correct answer.
  2. Logging all denied traffic on the guest interface
  3. Enabling DoS policies on the guest interface
  4. Applying a web filter profile to the guest policy

Explanation

Segmenting guests into their own VDOM and denying inter-VDOM traffic by default enforces isolation at the architecture level, not just through one policy. Explicit allow policies then document the only permitted paths. Logging, web filtering, and DoS policies add visibility or protection but do not structurally prevent reachability.

Question 28Network security design for complex networks

Which FortiGate feature allows a single physical interface to carry traffic for multiple customer segments while keeping each segment's policies separate?

  1. VLAN sub-interfaces combined with multiple VDOMs Correct answer.
  2. An aggregate interface with LACP
  3. A redundant interface pair
  4. A single VDOM with one global policy set

Explanation

VLAN sub-interfaces let one physical port carry 802.1Q-tagged traffic for multiple segments, and VDOMs give each segment its own routing table and policy set. Together they provide per-customer separation on shared hardware. Aggregates and redundant interfaces address link resilience, not policy separation.

Question 29Network security design for complex networks

A FortiGate will inspect traffic between two routers on the same subnet without changing IP addressing. Which design element keeps the FortiGate transparent to those routers?

  1. NAT mode with a routed transit subnet
  2. A dedicated loopback interface for routing
  3. Transparent mode with the management IP on the same subnet Correct answer.
  4. OSPF adjacency with both routers

Explanation

In transparent mode the FortiGate forwards frames at Layer 2, so the routers keep their existing addresses and gateway settings. The management IP only serves administration and does not become a routing hop. Routed transit subnets, loopbacks, and dynamic routing all require the device to participate in Layer 3.

Question 30Network security design for complex networks

Which statement describes the purpose of a security fabric in a multi-site FortiGate deployment?

  1. It shares threat intelligence and enables coordinated response across devices Correct answer.
  2. It replaces the need for routing protocols between sites
  3. It load-balances sessions across all FortiGates in every site
  4. It encrypts all inter-site traffic with a single shared key

Explanation

The security fabric links FortiGate and other Fortinet devices so they exchange threat intelligence, share device visibility, and can automate a coordinated response. It does not perform session load balancing, replace routing, or provide a single shared encryption key for site traffic.

Question 31Network security design for complex networks

A FortiGate must inspect traffic for a segment where the Layer 3 gateway is an external router. Which configuration allows inspection without the FortiGate answering ARP for that gateway?

  1. Virtual wire pair with the FortiGate as the gateway
  2. Policy route directing traffic to the external router
  3. Transparent mode with the external router as the gateway Correct answer.
  4. NAT mode with a secondary IP on the segment

Explanation

Transparent mode forwards frames using the existing gateway, so the FortiGate never answers ARP for the segment gateway. The external router remains the default gateway for hosts. NAT mode, virtual wire pairs configured as a gateway, and policy routes all make the FortiGate a routing participant.

Question 32Network security design for complex networks

Which design practice ensures that a FortiGate HA pair remains reachable for management during a failover?

  1. Assign the management address only to the primary unit
  2. Configure a dedicated out-of-band management interface with its own address Correct answer.
  3. Rely on the HA virtual IP for all administrative access
  4. Use the heartbeat interfaces for management access

Explanation

A dedicated out-of-band management interface with a stable address keeps administrative access available regardless of which unit is primary. Relying on the HA virtual IP or heartbeat links ties management to cluster state. Assigning the address only to the primary loses access after failover.

Question 33Network security design for complex networks

In a design with many FortiGates, which element centralizes policy and object management while allowing local enforcement?

  1. FortiAnalyzer for log collection and reporting
  2. FortiManager for policy packages and device provisioning Correct answer.
  3. FortiMail for email security enforcement
  4. FortiAuthenticator for user identity services

Explanation

FortiManager provides centralized policy packages, objects, and device provisioning so many FortiGates can share consistent configuration. FortiAnalyzer handles logging and reporting, FortiAuthenticator handles identity, and FortiMail handles email security. Only FortiManager centralizes policy management.

Question 34Network security design for complex networks

A FortiGate protects a data center where application servers must reach each other on specific ports only. Which policy design most tightly enforces this requirement?

  1. Policies with explicit source, destination, and service objects between server segments Correct answer.
  2. Policies matching the server subnet as destination with any source
  3. Policies based only on source subnet with any service
  4. One broad policy allowing all traffic between server subnets

Explanation

Explicit source, destination, and service objects in each policy enforce least privilege between server segments. Broad allow policies, source-only matching, or destination-only matching leave many ports reachable and widen the attack surface. Precise objects also make later audits and changes safer.

Question 35Network security design for complex networks

A network uses OSPF internally and BGP at the edge. A FortiGate must exchange routes with both. Which design consideration is most important?

  1. Controlling route redistribution between OSPF and BGP to prevent loops and suboptimal paths Correct answer.
  2. Disabling HA so routing adjacencies stay stable
  3. Enabling NAT on all interfaces that run routing protocols
  4. Using only static routes for the internal network

Explanation

When a FortiGate runs both OSPF and BGP, redistribution must be controlled with route maps and filters to avoid feedback loops and suboptimal path selection. NAT, HA, and static-only routing do not solve the redistribution problem. Careful redistribution also keeps path selection predictable.

Question 36Network security design for complex networks

A FortiGate sits between an internal core and a DMZ. Which design ensures that return traffic from DMZ servers reaches internal clients without opening unnecessary inbound policies?

  1. A virtual wire pair between core and DMZ
  2. Stateful policies that allow the internal-to-DMZ direction and rely on session state for return traffic Correct answer.
  3. A policy route that bypasses inspection for return traffic
  4. Bidirectional policies allowing any service in both directions

Explanation

Stateful inspection tracks the session, so a policy permitting the internal-to-DMZ flow allows the reply without a separate inbound policy. Bidirectional any-service policies widen exposure, and bypassing inspection defeats the purpose of the FortiGate. A virtual wire pair changes the deployment model rather than the policy logic.

Question 37Network security design for complex networks

A FortiGate must inspect east-west traffic between hypervisor hosts carrying many VLANs. Which design choice reduces the number of physical links while preserving per-VLAN policy?

  1. A virtual wire pair per VLAN
  2. 802.1Q trunk with VLAN sub-interfaces and per-VLAN policies Correct answer.
  3. A single aggregate interface with one policy for all VLANs
  4. One untagged physical link per VLAN

Explanation

A trunk carrying 802.1Q tags lets many VLANs share one physical link, and VLAN sub-interfaces allow distinct policies per segment. One link per VLAN does not scale, and a single policy for all VLANs loses per-segment control. Virtual wire pairs per VLAN would multiply physical connections.

Question 38Network security design for complex networks

An architect must design a FortiGate deployment where a compromised branch cannot reach other branches directly. Which design best achieves this?

  1. Hub-and-spoke IPsec with inter-spoke traffic denied at the hub Correct answer.
  2. Dynamic routing that advertises all branch subnets to every branch
  3. Full-mesh IPsec with broad inter-branch allow policies
  4. A single VDOM shared by all branches

Explanation

Hub-and-spoke tunnels concentrate inter-branch traffic at the hub, where policies can deny spoke-to-spoke flows by default. Full mesh with broad allow policies, dynamic routing of all subnets, and a shared VDOM all make direct branch-to-branch reachability easier, which conflicts with the requirement.

Question 39Network security design for complex networks

A FortiGate must forward traffic from one internal segment to different next hops based on the source address. Which feature supports this design?

  1. Static routes with equal distance
  2. OSPF with multiple areas
  3. Policy routes with source-based criteria Correct answer.
  4. Virtual wire pairs

Explanation

Policy routes can match source address, destination, and service to steer traffic to a chosen gateway, which static routes and OSPF cannot do by source. Static routes and OSPF select paths by destination only. Virtual wire pairs forward at Layer 2 and do not choose next hops.

Question 40Network security design for complex networks

A design requires that a FortiGate inspect traffic for a server farm while allowing the servers to keep their existing default gateway on a core switch. Which approach preserves the gateway while still inspecting traffic?

  1. A policy route on the core switch to the FortiGate
  2. A virtual wire pair with the FortiGate as the gateway
  3. Transparent mode between the core and the server farm Correct answer.
  4. NAT mode with the FortiGate as the server gateway

Explanation

Transparent mode forwards traffic at Layer 2 without changing the servers' default gateway, so inspection happens inline. NAT mode or a virtual wire pair acting as gateway would change the gateway. A policy route on the core switch would bypass the FortiGate entirely for return traffic.

Question 41Network security design for complex networks

A FortiGate cluster must support sessions that survive a single member failure without dropping established flows. Which HA mode best fits?

  1. Virtual wire pairs between members
  2. Active-passive with session synchronization enabled Correct answer.
  3. Active-active with no session synchronization
  4. Standalone units with VRRP

Explanation

Active-passive HA with session synchronization lets the secondary take over established sessions after a member failure. Active-active without synchronization loses session state, standalone units with VRRP do not share state, and virtual wire pairs do not provide cluster failover.

Question 42Network security design for complex networks

A FortiGate must advertise a summary route to a core router while keeping individual subnets internal. Which design element accomplishes this?

  1. Advertising every subnet individually to the core
  2. Using a default route only toward the core
  3. Disabling routing protocols on the core link
  4. Route summarization on the FortiGate with an outbound filter to the core Correct answer.

Explanation

Route summarization lets the FortiGate advertise one aggregate prefix while keeping specific subnets internal, and an outbound filter hides the specifics. Advertising every subnet exposes internal detail, a default route does not summarize, and disabling routing protocols stops the advertisement entirely.

Question 43Network security design for complex networks

A FortiGate is deployed in a segment where it must inspect traffic but cannot be the default gateway. Which design element allows it to see traffic without changing host gateway settings?

  1. A policy route on the hosts
  2. Transparent mode with the management IP on the same subnet Correct answer.
  3. NAT mode with a secondary IP on the segment
  4. A virtual wire pair with the FortiGate as the gateway

Explanation

Transparent mode forwards frames inline while hosts keep their existing gateway, so inspection happens without changing host settings. NAT mode and a gateway virtual wire pair would make the FortiGate the gateway. A policy route on the hosts is not a practical design element.

Question 44Network security design for complex networks

A company wants to inspect encrypted outbound traffic from managed endpoints while preserving end-to-end trust. Which design element is required?

  1. A self-signed certificate installed on the FortiGate only
  2. A trusted CA certificate installed on managed endpoints for SSL inspection Correct answer.
  3. Using a virtual wire pair for outbound traffic
  4. Disabling certificate validation on the endpoints

Explanation

SSL inspection requires the FortiGate to re-sign traffic, so endpoints must trust the FortiGate's CA certificate to avoid validation errors. Installing a self-signed certificate only on the FortiGate does not establish endpoint trust. Disabling validation weakens security, and virtual wire pairs do not provide inspection trust.

Question 45Network security design for complex networks

A FortiGate must support jumbo frames on internal segments while inspecting traffic between them. Which design consideration is most important?

  1. Disabling hardware acceleration on all interfaces
  2. Ensuring all interfaces in the path, including the FortiGate, support the same MTU Correct answer.
  3. Enabling NAT on all internal interfaces
  4. Using only virtual wire pairs between segments

Explanation

Jumbo frames require consistent MTU support across every interface and device in the path, including the FortiGate, or frames are dropped or fragmented. NAT, disabling acceleration, and virtual wire pairs do not address MTU consistency. Mismatched MTU is the most common cause of silent jumbo frame failures.

Question 46Network security design for complex networks

A hub FortiGate terminates many branch IPsec tunnels. Which design reduces the impact of one branch flooding the hub?

  1. A single shared tunnel for all branches
  2. Disabling DPD on all tunnels
  3. Per-tunnel bandwidth limits and QoS shaping at the hub Correct answer.
  4. Using a single VDOM for all branches

Explanation

Per-tunnel bandwidth limits and QoS shaping prevent one branch from consuming all hub resources. A shared tunnel removes per-branch control, disabling DPD reduces failure detection, and a single VDOM removes policy separation. Shaping at the hub keeps other branches responsive during a flood.

Question 47Network security design for complex networks

A FortiGate must handle asymmetric routing where return traffic arrives on a different interface than the outbound flow. Which design element best addresses this?

  1. Using a virtual wire pair between the interfaces
  2. Forcing all traffic through one interface
  3. Disabling strict anti-replay checks and enabling asymmetric routing support Correct answer.
  4. Enabling NAT on both interfaces

Explanation

Asymmetric routing breaks stateful inspection when strict anti-replay or reverse-path checks drop return traffic. Enabling asymmetric routing support and relaxing strict checks lets return traffic be accepted. NAT, virtual wire pairs, and forcing one interface do not solve the asymmetry itself.

Question 48Network security design for complex networks

A design requires that a FortiGate support multiple routing tables for separate tenants while sharing physical infrastructure. Which feature best fits?

  1. VDOMs with per-VDOM routing tables Correct answer.
  2. Policy routes with per-tenant criteria
  3. Virtual wire pairs per tenant
  4. Static routes with different distances

Explanation

VDOMs provide separate routing tables, policies, and administrative domains on shared hardware, which is the standard multi-tenant design. Policy routes, static route distances, and virtual wire pairs do not create independent routing tables. VDOMs also isolate failures between tenants.

Question 49Network security design for complex networks

A FortiGate must inspect traffic between two segments that use overlapping IP address ranges. Which design element enables this?

  1. Separate VDOMs with NAT between them to translate overlapping addresses Correct answer.
  2. A single VDOM with overlapping interfaces
  3. A virtual wire pair between the segments
  4. Policy routes that match both overlapping subnets

Explanation

Overlapping address ranges cannot coexist in one routing table, so each segment must live in its own VDOM with NAT translating addresses at the boundary. A single VDOM, policy routes, and virtual wire pairs all rely on one routing context and cannot resolve the overlap.

Question 50Network security design for complex networks

A security architect must design inspection for traffic that leaves through an SD-WAN with multiple WAN links while preserving session continuity during link failover. Which design element is most important?

  1. SD-WAN rules with health checks and session persistence across member links Correct answer.
  2. Disabling session synchronization in HA
  3. Static routes with equal distance on all WAN links
  4. A single WAN link with no health checks

Explanation

SD-WAN rules with SLA health checks steer traffic to healthy links, and session persistence keeps flows alive during failover. A single link has no failover, equal-distance static routes do not react to link health, and disabling session synchronization breaks continuity. Together these elements preserve sessions across WAN changes.