Virtual server<\/span><\/li>\n<\/ol>\nAnswer: 1. Trusted hosts<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Trusted hosts allow administrators to restrict management access to specific source IP addresses or networks. When trusted hosts are configured for an administrator account, FortiGate accepts management authentication only from the permitted addresses. This provides an additional security layer because possession of valid administrator credentials alone is not sufficient when the connection originates from an unauthorized location. Trusted hosts can be especially useful for limiting management access to dedicated administration networks or jump hosts. They should be configured carefully so that legitimate administrative access is not accidentally blocked. This control complements authentication, administrative profiles, and secure management protocols.<\/span><\/p>\nQuestion 202. Which FortiGate feature can identify the physical device type connecting to the network?<\/b><\/h3>\n\n- <\/b> Static route<\/span>
\n<\/span>2.<\/b> Device identification<\/span>
\n<\/span>3.<\/b> IPsec phase 2<\/span>
\n<\/span>4.<\/b> Traffic shaper<\/span><\/li>\n<\/ol>\nAnswer: 2. Device identification<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Device identification allows FortiGate to gather information that can help determine what type of endpoint is connected to the network. The firewall can use available network characteristics and identification mechanisms to classify devices such as computers, mobile devices, printers, or other endpoints. This information can then support monitoring and policy decisions. Device identification is different from user authentication because it focuses on the endpoint rather than proving the identity of a particular user. Accurate device information can improve visibility and help administrators create more appropriate security controls for different types of network-connected equipment.<\/span><\/p>\nQuestion 203. What is the primary purpose of a firewall address group?<\/b><\/h3>\n\n- <\/b> Encrypt VPN traffic<\/span>
\n<\/span>2.<\/b> Monitor CPU usage<\/span>
\n<\/span>3.<\/b> Combine multiple address objects for policy use<\/span>
\n<\/span>4.<\/b> Assign administrator privileges<\/span><\/li>\n<\/ol>\nAnswer: 3. Combine multiple address objects for policy use<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A firewall address group combines multiple address objects into a single logical object that can be referenced by security policies. This simplifies policy administration because administrators do not need to repeatedly add individual addresses to every applicable rule. For example, several internal application servers can be placed into one address group and then referenced as a destination in a firewall policy. Changes to group membership can also be easier to manage than modifying many separate policies. Address groups do not perform encryption or authentication; they primarily provide an organized way to represent multiple network addresses in firewall configuration.<\/span><\/p>\nQuestion 204. Which configuration helps prevent unauthorized users from accessing FortiGate management services from the Internet?<\/b><\/h3>\n\n- <\/b> Restrict management access to trusted interfaces and sources<\/span>
\n<\/span>2.<\/b> Increase the DHCP lease time<\/span>
\n<\/span>3.<\/b> Disable all firewall logging<\/span>
\n<\/span>4.<\/b> Add more DNS records<\/span><\/li>\n<\/ol>\nAnswer: 1. Restrict management access to trusted interfaces and sources<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Management services such as HTTPS and SSH should be exposed only where administrative access is required. FortiGate allows administrators to control which interfaces provide management services and can further restrict access using trusted hosts or related controls. Limiting management exposure reduces the number of potential entry points available to unauthorized users. Strong authentication and multi-factor authentication can provide additional protection. Simply increasing DHCP lease duration or changing DNS records does not secure administrative services. A properly designed management configuration should follow least-privilege principles and permit administrative access only from approved networks, interfaces, and users.<\/span><\/p>\nQuestion 205. Which IPsec setting can allow FortiGate to authenticate a remote peer based on its configured identifier?<\/b><\/h3>\n\n- <\/b> Service group<\/span>
\n<\/span>2.<\/b> Interface zone<\/span>
\n<\/span>3.<\/b> Peer ID<\/span>
\n<\/span>4.<\/b> DNS filter<\/span><\/li>\n<\/ol>\nAnswer: 3. Peer ID<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Peer ID provides an identity value that can be used to distinguish an IPsec peer during VPN negotiation. This is particularly useful in dial-up or dynamic peer scenarios where the remote peer’s IP address may not provide a reliable method of identification. FortiGate can use the peer identity as part of the phase 1 matching and authentication process. Correct configuration ensures that the connecting device matches the intended VPN settings. Peer ID should not be confused with an IP address, because the identity is an authentication or matching attribute rather than simply a network location.<\/span><\/p>\nQuestion 206. Which IPv6 feature allows a host to automatically configure an address using information advertised by a router?<\/b><\/h3>\n\n- <\/b> Static NAT<\/span>
\n<\/span>2.<\/b> SLAAC<\/span>
\n<\/span>3.<\/b> DHCP relay<\/span>
\n<\/span>4.<\/b> VIP<\/span><\/li>\n<\/ol>\nAnswer: 2. SLAAC<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Stateless Address Autoconfiguration, or SLAAC, allows IPv6 hosts to automatically configure their addresses using information provided through Router Advertisements. The router communicates network-prefix information, enabling hosts to construct IPv6 addresses without requiring a traditional stateful DHCP service for address assignment. SLAAC is an important part of IPv6 network configuration and works with Neighbor Discovery mechanisms. Administrators should ensure that required IPv6 control traffic is permitted and that router advertisements are properly configured. Depending on the environment, DHCPv6 can also provide additional configuration information. SLAAC therefore provides a flexible method for automatically configuring IPv6 hosts.<\/span><\/p>\nQuestion 207. What is the purpose of a DNS filter category rating in FortiGate?<\/b><\/h3>\n\n- <\/b> Determine the security category associated with a domain<\/span>
\n<\/span>2.<\/b> Assign an IPsec tunnel address<\/span>
\n<\/span>3.<\/b> Configure administrator profiles<\/span>
\n<\/span>4.<\/b> Create VLAN interfaces<\/span><\/li>\n<\/ol>\nAnswer: 1. Determine the security category associated with a domain<\/b><\/p>\n
Explanation:<\/b><\/p>\n
DNS filtering can use domain-category information to determine whether a requested domain belongs to a category that should be permitted, monitored, or blocked. Category-based filtering allows administrators to apply broad controls without manually entering every individual website address. When a client requests a domain, FortiGate can evaluate the domain against configured filtering rules and category information before allowing or denying resolution according to policy. This can simplify web-access management for organizations. DNS filtering operates at the domain-resolution level and therefore differs from deeper inspection methods that analyze web content or encrypted application traffic.<\/span><\/p>\nQuestion 208. Which DLP action can prevent a detected sensitive file or data pattern from being transmitted?<\/b><\/h3>\n\n- <\/b> Allow<\/span>
\n<\/span>2.<\/b> Block<\/span>
\n<\/span>3.<\/b> Monitor route<\/span>
\n<\/span>4.<\/b> Establish VPN<\/span><\/li>\n<\/ol>\nAnswer: 2. Block<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A DLP block action prevents traffic or content matching a configured sensitive-data condition from being transmitted when the relevant inspection and policy conditions are satisfied. This provides an enforcement mechanism for protecting confidential information from unauthorized transfer. DLP policies can be designed around specific data patterns, file characteristics, or other criteria depending on the deployment. Administrators should test DLP rules carefully because overly broad patterns can generate false positives and disrupt legitimate business activity. Logging and monitoring can help verify that the configured rule identifies the intended information before stronger enforcement actions are applied.<\/span><\/p>\nQuestion 209. What does a per-IP traffic shaper primarily control?<\/b><\/h3>\n\n- <\/b> Certificate validation<\/span>
\n<\/span>2.<\/b> Routing protocol updates<\/span>
\n<\/span>3.<\/b> Bandwidth allocated to individual IP addresses<\/span>
\n<\/span>4.<\/b> DNS record creation<\/span><\/li>\n<\/ol>\nAnswer: 3. Bandwidth allocated to individual IP addresses<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A per-IP traffic shaper controls bandwidth independently for individual IP addresses. This can help distribute network capacity more fairly when many clients share an Internet connection. Instead of applying one combined limit to all traffic, the configured rate can be enforced separately for each identified IP address. This is useful in environments where administrators want to prevent a single endpoint from consuming an excessive amount of available bandwidth. Traffic shaping does not determine certificate trust, routing relationships, or DNS records. Its primary function is controlling network traffic rates according to the configured shaping policy.<\/span><\/p>\nQuestion 210. Which FortiGate component provides detailed visibility into applications, users, destinations, and traffic activity?<\/b><\/h3>\n\n- <\/b> FortiView<\/span>
\n<\/span>2.<\/b> DHCP server<\/span>
\n<\/span>3.<\/b> Certificate store<\/span>
\n<\/span>4.<\/b> IPsec peer ID<\/span><\/li>\n<\/ol>\nAnswer: 1. FortiView<\/b><\/p>\n
Explanation:<\/b><\/p>\n
FortiView provides graphical visibility into network and security activity. Administrators can use it to examine information such as applications, users, destinations, traffic volume, and other session-related details, depending on the available logs and configuration. This makes FortiView useful for operational monitoring and investigation. Instead of examining every individual firewall rule manually, an administrator can use FortiView to identify traffic patterns and then investigate areas of interest. FortiView is primarily a visibility and analysis capability; policy enforcement remains the responsibility of firewall policies and associated security profiles.<\/span><\/p>\nQuestion 211. Which feature can protect an administrator account by requiring a certificate in addition to other authentication information?<\/b><\/h3>\n\n- <\/b> Certificate-based authentication<\/span>
\n<\/span>2.<\/b> ECMP<\/span>
\n<\/span>3.<\/b> DHCP relay<\/span>
\n<\/span>4.<\/b> IP pool<\/span><\/li>\n<\/ol>\nAnswer: 1. Certificate-based authentication<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Certificate-based authentication uses a digital certificate as an identity credential. When configured for an appropriate authentication scenario, FortiGate can validate the certificate against a trusted certificate authority and use it as part of the authentication process. This can provide stronger identity verification than relying solely on a password. Administrators must maintain the certificate infrastructure carefully, including trusted CA certificates and certificate validity. Certificate-based authentication is particularly useful where organizations already operate a public key infrastructure. It is separate from routing, DHCP, and NAT functions, which have different purposes within the FortiGate configuration.<\/span><\/p>\nQuestion 212. What is the main benefit of using a security profile group in a firewall policy?<\/b><\/h3>\n\n- <\/b> It replaces the routing table<\/span>
\n<\/span>2.<\/b> It groups multiple security profiles for easier policy assignment<\/span>
\n<\/span>3.<\/b> It assigns public IP addresses<\/span>
\n<\/span>4.<\/b> It creates VPN tunnels automatically<\/span><\/li>\n<\/ol>\nAnswer: 2. It groups multiple security profiles for easier policy assignment<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A security profile group allows several security profiles to be associated and applied together through a firewall policy. Instead of selecting each individual security profile separately whenever similar protection is required, administrators can use the group as a convenient policy-level configuration. Depending on the profiles included, the group can provide protections such as antivirus, web filtering, application control, or intrusion prevention. This improves consistency and simplifies administration across policies that require the same security controls. Security profile groups do not replace routing, NAT, or VPN configuration; they organize security inspection settings for policy enforcement.<\/span><\/p>\nQuestion 213. Which method can help identify whether a firewall policy is matching the intended source and destination addresses?<\/b><\/h3>\n\n- <\/b> Policy lookup or matching diagnostics<\/span>
\n<\/span>2.<\/b> DHCP lease renewal<\/span>
\n<\/span>3.<\/b> Certificate renewal<\/span>
\n<\/span>4.<\/b> DNS zone transfer<\/span><\/li>\n<\/ol>\nAnswer: 1. Policy lookup or matching diagnostics<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Policy lookup and matching diagnostics help administrators determine which firewall policy would apply to specific traffic. When traffic is unexpectedly allowed or denied, checking the source interface, destination interface, source address, destination address, service, schedule, and other policy criteria can reveal why a particular rule was selected. This is useful because FortiGate evaluates policies according to their configured matching conditions and order. A policy lookup can reduce troubleshooting time by showing whether the intended rule actually matches the traffic. DHCP, certificate, and DNS operations do not directly determine firewall policy selection.<\/span><\/p>\nQuestion 214. Which FortiGate feature can automatically send an alert when a predefined security event occurs?<\/b><\/h3>\n\n- <\/b> Static route<\/span>
\n<\/span>2.<\/b> Automation stitch<\/span>
\n<\/span>3.<\/b> VLAN interface<\/span>
\n<\/span>4.<\/b> IP pool<\/span><\/li>\n<\/ol>\nAnswer: 2. Automation stitch<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An automation stitch can connect a defined event trigger with one or more automated actions. When the configured event occurs, FortiGate can execute actions such as sending notifications or performing another supported response. This allows administrators to reduce manual intervention for recurring operational or security events. The trigger determines when the workflow starts, while the configured action determines what FortiGate does in response. Automation stitches should be tested carefully because an incorrectly configured trigger can generate excessive notifications or unwanted responses. They provide an event-driven mechanism for extending FortiGate’s built-in operational automation capabilities.<\/span><\/p>\nQuestion 215. Which virtual server load-balancing method generally distributes new connections sequentially among available servers?<\/b><\/h3>\n\n- <\/b> Source-IP-only<\/span>
\n<\/span>2.<\/b> Certificate matching<\/span>
\n<\/span>3.<\/b> Round robin<\/span>