Traffic shaping<\/span><\/li>\n<\/ol>\nAnswer: 2. High Availability (HA.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
FortiGate High Availability (HA. allows multiple FortiGate devices to operate together as a cluster to improve availability and provide redundancy. In an HA configuration, devices can coordinate their roles and share relevant state information depending on the selected HA mode and configuration. If one device becomes unavailable, another cluster member can continue providing firewall services. HA is particularly useful for environments where uninterrupted network security services are important. Proper heartbeat connectivity, device configuration, and HA parameters are essential for reliable cluster operation.<\/span><\/p>\nQuestion 42. What is the primary purpose of FortiGate session synchronization in an HA cluster?<\/b><\/h3>\n\n- <\/b> To synchronize active session information between cluster members<\/span>
\n<\/span>2.<\/b> To assign IP addresses to users<\/span>
\n<\/span>3.<\/b> To classify websites<\/span>
\n<\/span>4.<\/b> To update antivirus signatures<\/span><\/li>\n<\/ol>\nAnswer: 1. To synchronize active session information between cluster members<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Session synchronization allows relevant active connection information to be shared between FortiGate devices in an HA environment. Maintaining session information can help reduce disruption when traffic processing moves between cluster members after a failover. The exact information synchronized depends on the HA configuration and supported features. Session synchronization is different from configuration synchronization, although both can be important in an HA deployment. Administrators should verify that HA links and synchronization settings are properly configured so the cluster can operate as intended during normal operation and failover events.<\/span><\/p>\nQuestion 43. Which FortiGate component determines the next hop for traffic based on the destination IP address?<\/b><\/h3>\n\n- <\/b> Antivirus<\/span>
\n<\/span>2.<\/b> Web Filter<\/span>
\n<\/span>3.<\/b> Routing table<\/span>
\n<\/span>4.<\/b> Application Control<\/span><\/li>\n<\/ol>\nAnswer: 3. Routing table<\/b><\/p>\n
Explanation:<\/b><\/p>\n
The routing table contains information FortiGate uses to determine where packets should be forwarded based on their destination addresses. When traffic arrives, FortiGate evaluates available routes and selects an appropriate matching route according to its routing logic. The selected route identifies the next hop or outgoing interface required to forward the packet. Routing and firewall policy processing are separate functions. A correct route does not automatically permit traffic; a suitable firewall policy may also be required. Troubleshooting should therefore consider both routing and security-policy decisions.<\/span><\/p>\nQuestion 44. Which FortiGate feature can protect users from domains associated with known malicious activity?<\/b><\/h3>\n\n- <\/b> DNS Filter<\/span>
\n<\/span>2.<\/b> Link aggregation<\/span>
\n<\/span>3.<\/b> DHCP Server<\/span>
\n<\/span>4.<\/b> Static routing<\/span><\/li>\n<\/ol>\nAnswer: 1. DNS Filter<\/b><\/p>\n
Explanation:<\/b><\/p>\n
DNS filtering can help protect users by applying controls to domain-name queries and identifying domains associated with unwanted or malicious activity. Depending on the configured service and policies, FortiGate can block or otherwise handle requests for domains that match defined security categories or filtering rules. DNS filtering provides an additional security layer because it can prevent access attempts before a connection to the destination is established. Administrators should combine DNS filtering with other controls because no single security mechanism provides complete protection against all threats.<\/span><\/p>\nQuestion 45. What is the purpose of a FortiGate firewall policy action set to DENY?<\/b><\/h3>\n\n- <\/b> It creates a VPN tunnel<\/span>
\n<\/span>2.<\/b> It blocks traffic matching the policy<\/span>
\n<\/span>3.<\/b> It assigns a DHCP address<\/span>
\n<\/span>4.<\/b> It enables application inspection<\/span><\/li>\n<\/ol>\nAnswer: 2. It blocks traffic matching the policy<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A firewall policy configured with a deny action prevents traffic that matches the policy conditions from being allowed through the FortiGate. Matching conditions can include source and destination addresses, interfaces, services, users, schedules, and other supported criteria. Deny policies can be useful for explicitly blocking specific traffic when the security design requires it. Administrators should also consider policy order because an earlier matching policy may process traffic before a later deny rule is evaluated. Regular policy reviews help ensure that intended restrictions remain effective.<\/span><\/p>\nQuestion 46. Which feature allows FortiGate to inspect files for malicious content as traffic passes through the firewall?<\/b><\/h3>\n\n- <\/b> Static routing<\/span>
\n<\/span>2.<\/b> VLAN configuration<\/span>
\n<\/span>3.<\/b> Antivirus inspection<\/span>
\n<\/span>4.<\/b> DHCP relay<\/span><\/li>\n<\/ol>\nAnswer: 3. Antivirus inspection<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Antivirus inspection examines supported network traffic and files for signs of malicious software according to the configured FortiGate security profile. When malicious content is detected, the configured action can be applied to the traffic or file. Antivirus inspection is normally enabled through a firewall policy that has an appropriate security profile attached. Inspection capabilities can depend on traffic type, protocol, and configuration. Administrators should maintain current security information and review inspection results to ensure the profile provides appropriate protection without unnecessarily disrupting legitimate business traffic.<\/span><\/p>\nQuestion 47. What is the purpose of an administrative profile on FortiGate?<\/b><\/h3>\n\n- <\/b> To define permissions available to an administrator<\/span>
\n<\/span>2.<\/b> To create VPN encryption keys<\/span>
\n<\/span>3.<\/b> To assign network addresses<\/span>
\n<\/span>4.<\/b> To control web categories<\/span><\/li>\n<\/ol>\nAnswer: 1. To define permissions available to an administrator<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An administrative profile determines what areas and functions of the FortiGate configuration an administrator can access or modify. This supports role-based administration and the principle of least privilege. For example, an administrator may be permitted to view certain configuration areas while another authorized administrator may have broader modification privileges. Using appropriate administrative profiles reduces the risk of unnecessary configuration changes. Organizations should assign permissions according to job responsibilities and periodically review administrator privileges to remove access that is no longer required.<\/span><\/p>\nQuestion 48. Which FortiGate protocol is commonly used to synchronize time with a reliable time source?<\/b><\/h3>\n\n- <\/b> FTP<\/span>
\n<\/span>2.<\/b> NTP<\/span>
\n<\/span>3.<\/b> SMTP<\/span>
\n<\/span>4.<\/b> TFTP<\/span><\/li>\n<\/ol>\nAnswer: 2. NTP<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Network Time Protocol (NTP. is used to synchronize system clocks with configured time sources. Accurate time is important for FortiGate because timestamps are used in logs, security events, troubleshooting, authentication processes, and other operational functions. Consistent timestamps across network devices also make event correlation easier when investigating incidents. Administrators should configure reliable NTP sources and verify that the FortiGate can reach them. Time synchronization does not replace other security controls, but it provides an important foundation for accurate monitoring and reliable event analysis.<\/span><\/p>\nQuestion 49. Which FortiGate feature can identify suspicious network activity by comparing traffic against known attack signatures?<\/b><\/h3>\n\n- <\/b> IPS<\/span>
\n<\/span>2.<\/b> DHCP<\/span>
\n<\/span>3.<\/b> NAT<\/span>
\n<\/span>4.<\/b> Static routing<\/span><\/li>\n<\/ol>\nAnswer: 1. IPS<\/b><\/p>\n
Explanation:<\/b><\/p>\n
The Intrusion Prevention System (IPS. uses signatures and inspection techniques to identify traffic patterns associated with known attacks and suspicious activity. When a matching event is detected, FortiGate can apply the action configured in the IPS profile, such as allowing, monitoring, or blocking the traffic depending on the policy. IPS should be configured according to the organization\u2019s security requirements and supported traffic types. Regular updates to security signatures are important because new vulnerabilities and attack techniques continue to emerge. IPS works alongside firewall policies and other security controls.<\/span><\/p>\nQuestion 50. What is the primary purpose of a FortiGate policy-based routing rule?<\/b><\/h3>\n\n- <\/b> To select a route based on additional traffic characteristics<\/span>
\n<\/span>2.<\/b> To create administrator accounts<\/span>
\n<\/span>3.<\/b> To scan files for malware<\/span>
\n<\/span>4.<\/b> To manage web categories<\/span><\/li>\n<\/ol>\nAnswer: 1. To select a route based on additional traffic characteristics<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Policy-based routing allows routing decisions to consider criteria beyond the destination address used by conventional routing. Depending on configuration, administrators can direct traffic according to characteristics such as source addresses, destination addresses, interfaces, or other supported matching conditions. This can be useful when different types of traffic need to use different paths. Policy-based routing should be designed carefully because incorrect rules can send traffic through an unintended interface or gateway. Administrators should validate routing behavior after changes and monitor the resulting traffic paths.<\/span><\/p>\nQuestion 51. Which FortiGate feature provides protection by identifying malicious URLs and web destinations?<\/b><\/h3>\n\n- <\/b> Web Filter<\/span>
\n<\/span>2.<\/b> DHCP<\/span>
\n<\/span>3.<\/b> HA<\/span>
\n<\/span>4.<\/b> VLAN<\/span><\/li>\n<\/ol>\nAnswer: 1. Web Filter<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Web Filter helps administrators control access to web destinations based on configured rules, categories, and reputation information. It can be used to prevent users from reaching websites associated with malicious activity, inappropriate content, or other prohibited categories. Web filtering is applied through appropriate firewall policies and can work alongside other inspection features. Administrators should review filtering decisions because websites can change classification and legitimate services may occasionally be affected by broad restrictions. Combining web filtering with DNS security, antivirus, and other controls provides layered protection.<\/span><\/p>\nQuestion 52. What does FortiGate central NAT provide?<\/b><\/h3>\n\n- <\/b> A centralized method for managing NAT rules separately from firewall policies<\/span>
\n<\/span>2.<\/b> Automatic firmware upgrades<\/span>
\n<\/span>3.<\/b> User password synchronization<\/span>
\n<\/span>4.<\/b> Application signature updates<\/span><\/li>\n<\/ol>\nAnswer: 1. A centralized method for managing NAT rules separately from firewall policies<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Central NAT provides a separate framework for configuring network address translation rules rather than defining source NAT behavior directly within individual firewall policies. This can be useful in environments where administrators need more centralized control over NAT mappings. The exact configuration depends on the FortiGate operating mode and network requirements. Administrators should understand how central NAT interacts with firewall policies and routing before enabling or modifying it. Careful planning is important because incorrect NAT rules can cause unexpected address translation or connectivity problems.<\/span><\/p>\nQuestion 53. Which FortiGate feature can inspect traffic for known vulnerabilities being exploited against systems?<\/b><\/h3>\n\n- <\/b> IPS<\/span>
\n<\/span>2.<\/b> DHCP Server<\/span>
\n<\/span>3.<\/b> DNS Forwarding<\/span>
\n<\/span>4.<\/b> Traffic Shaping<\/span><\/li>\n<\/ol>\nAnswer: 1. IPS<\/b><\/p>\n
Explanation:<\/b><\/p>\n
FortiGate IPS can inspect network traffic for patterns associated with known exploits and vulnerabilities. IPS signatures are designed to identify malicious traffic that may attempt to exploit weaknesses in applications, operating systems, or network services. When a matching signature is detected, FortiGate can apply the configured response. IPS can therefore provide a layer of protection while systems are being patched or when immediate network-level controls are required. Administrators should keep signatures current and ensure that IPS policies are appropriate for the systems and applications being protected.<\/span><\/p>\nQuestion 54. What is the purpose of a FortiGate address group?<\/b><\/h3>\n\n- <\/b> To combine multiple address objects for use in policies<\/span>
\n<\/span>2.<\/b> To synchronize device clocks<\/span>
\n<\/span>3.<\/b> To create VPN certificates<\/span>
\n<\/span>4.<\/b> To configure administrator authentication<\/span><\/li>\n<\/ol>\nAnswer: 1. To combine multiple address objects for use in policies<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An address group combines multiple address objects into a single logical group that can be referenced by firewall policies and other supported configurations. This can simplify administration when several networks or hosts require the same security treatment. Instead of repeatedly selecting individual address objects, an administrator can reference the group. Address groups are especially useful in larger configurations where many related destinations or sources must be managed consistently. Administrators should use meaningful names and periodically review group membership to ensure policies continue to represent current network requirements.<\/span><\/p>\nQuestion 55. Which security profile is used to control application behavior on a FortiGate firewall?<\/b><\/h3>\n\n- <\/b> Application Control<\/span>
\n<\/span>2.<\/b> DHCP<\/span>
\n<\/span>3.<\/b> Static Route<\/span>