To assign IP addresses<\/span><\/li>\n<\/ol>\nAnswer: 1. To store and restore previous configuration states<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Configuration revisions allow administrators to preserve different versions of the FortiGate configuration. This can be useful before or after major changes because an administrator can compare configurations and, where supported, restore an earlier configuration state. Revision management provides an additional safeguard when modifying firewall policies, routing, interfaces, or security settings. It is particularly valuable during troubleshooting because administrators can determine what changed between configuration versions. Configuration revisions are different from traffic logs because they focus on configuration states rather than network activity. Maintaining appropriate configuration backups and revisions helps reduce the impact of configuration errors.<\/span><\/p>\nQuestion 262. Which FortiGate feature can automatically save configuration changes at scheduled intervals?<\/b><\/h3>\n\n- <\/b> Application Control<\/span>
\n<\/span>2.<\/b> Automatic configuration backup<\/span>
\n<\/span>3.<\/b> Web Filter<\/span>
\n<\/span>4.<\/b> IP reputation<\/span><\/li>\n<\/ol>\nAnswer: 2. Automatic configuration backup<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Automatic configuration backup helps protect the FortiGate configuration by periodically creating copies according to the configured backup process. Regular backups can be important because firewall configurations may contain extensive policy, routing, interface, authentication, and security-profile settings. If a device fails or a configuration change causes unexpected behavior, a recent backup can provide a recovery option. Administrators should store backups securely and protect them because configuration files can contain sensitive information. Automatic backups complement, rather than replace, configuration revisions and manual backup procedures. A documented backup strategy is an important part of reliable firewall administration.<\/span><\/p>\nQuestion 263. Which FortiGate feature provides a logical interface that can be used as a stable endpoint for routing protocols?<\/b><\/h3>\n\n- <\/b> VLAN interface<\/span>
\n<\/span>2.<\/b> Physical interface<\/span>
\n<\/span>3.<\/b> Loopback interface<\/span>
\n<\/span>4.<\/b> FortiLink interface<\/span><\/li>\n<\/ol>\nAnswer: 3. Loopback interface<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A loopback interface is a logical interface that remains independent of a particular physical network port. This makes it useful as a stable endpoint for routing protocols, management, monitoring, or other services that benefit from a consistent IP address. If a physical interface fails while another path remains available, the loopback address can continue to represent the FortiGate. Routing protocols can therefore use the loopback address for identification or peering where appropriate. Because the interface is logical rather than tied directly to a cable or physical port, it can improve the stability of network designs.<\/span><\/p>\nQuestion 264. What is the purpose of DHCP IP reservation on FortiGate?<\/b><\/h3>\n\n- <\/b> To encrypt DHCP traffic<\/span>
\n<\/span>2.<\/b> To disable dynamic addressing<\/span>
\n<\/span>3.<\/b> To create a VPN tunnel<\/span>
\n<\/span>4.<\/b> To assign a predictable IP address to a specific DHCP client<\/span><\/li>\n<\/ol>\nAnswer: 4. To assign a predictable IP address to a specific DHCP client<\/b><\/p>\n
Explanation:<\/b><\/p>\n
DHCP IP reservation allows an administrator to associate a particular client with a specific IP address so that the client receives a predictable address through DHCP. The association is generally based on an identifying attribute such as the client’s MAC address. This is useful for devices that should maintain consistent addressing while still being managed through DHCP. Examples can include printers, monitoring systems, or other infrastructure devices. DHCP reservation differs from manually configuring a static IP on the endpoint because the address assignment remains controlled by the DHCP server. Proper reservation management also helps prevent address conflicts.<\/span><\/p>\nQuestion 265. Which FortiGate feature can store local DNS host records for selected names?<\/b><\/h3>\n\n- <\/b> Local DNS database<\/span>
\n<\/span>2.<\/b> Traffic shaping<\/span>
\n<\/span>3.<\/b> IPS sensor<\/span>
\n<\/span>4.<\/b> Session helper<\/span><\/li>\n<\/ol>\nAnswer: 1. Local DNS database<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A local DNS database can allow FortiGate to provide DNS responses for locally defined host records. This can be useful when internal clients need to resolve specific names to internal IP addresses without relying on an external DNS service for those records. Administrators can use local DNS information for selected internal services or network resources. The feature should be configured carefully to ensure that names and addresses remain accurate. Local DNS functionality is different from DNS filtering, which focuses on controlling or categorizing DNS requests. Both can operate as part of a broader DNS security and network-management design.<\/span><\/p>\nQuestion 266. What is the purpose of DHCP conflict detection?<\/b><\/h3>\n\n- <\/b> To encrypt DHCP messages<\/span>
\n<\/span>2.<\/b> To help identify whether an address is already in use before assigning it<\/span>
\n<\/span>3.<\/b> To create VLANs automatically<\/span>
\n<\/span>4.<\/b> To perform antivirus scanning<\/span><\/li>\n<\/ol>\nAnswer: 2. To help identify whether an address is already in use before assigning it<\/b><\/p>\n
Explanation:<\/b><\/p>\n
DHCP conflict detection helps reduce the possibility of assigning an IP address that is already being used by another device. Detecting address conflicts is important because duplicate IP addresses can cause intermittent connectivity, unreachable hosts, and other difficult-to-diagnose network problems. When conflict detection is available and configured, the DHCP process can check address usage according to the supported mechanism before completing an assignment. This capability does not replace good IP address management, but it provides an additional safeguard. Administrators should also investigate recurring conflicts because they may indicate unauthorized static addressing or incorrect DHCP configurations.<\/span><\/p>\nQuestion 267. What is the purpose of an OSPF router ID?<\/b><\/h3>\n\n- <\/b> To identify an OSPF router uniquely within the OSPF domain<\/span>
\n<\/span>2.<\/b> To define a firewall policy<\/span>
\n<\/span>3.<\/b> To select an antivirus profile<\/span>
\n<\/span>4.<\/b> To assign DHCP addresses<\/span><\/li>\n<\/ol>\nAnswer: 1. To identify an OSPF router uniquely within the OSPF domain<\/b><\/p>\n
Explanation:<\/b><\/p>\n
The OSPF router ID provides a unique identifier for an OSPF router within the routing domain. It is used in OSPF operations such as neighbor relationships and link-state information. Selecting a stable router ID is important because changes to the identifier can affect OSPF behavior and may require the routing process to restart or reconverge. Administrators commonly use a suitable stable address or explicitly configure the router ID according to the network design. The router ID is not a firewall policy identifier and does not control DHCP or antivirus processing. Properly planned OSPF identification supports predictable routing behavior.<\/span><\/p>\nQuestion 268. What is the main purpose of OSPF route summarization?<\/b><\/h3>\n\n- <\/b> To increase packet inspection depth<\/span>
\n<\/span>2.<\/b> To disable route advertisements<\/span>
\n<\/span>3.<\/b> To reduce the number of routes represented in routing information<\/span>
\n<\/span>4.<\/b> To replace static NAT<\/span><\/li>\n<\/ol>\nAnswer: 3. To reduce the number of routes represented in routing information<\/b><\/p>\n
Explanation:<\/b><\/p>\n
OSPF route summarization combines multiple more-specific network routes into a broader summarized route where the network design allows it. Reducing the number of routes can make routing tables more manageable and can reduce the amount of routing information exchanged between areas or routing boundaries. Summarization can also help limit the propagation of individual route changes. However, the address ranges being summarized must be planned carefully so that valid destinations remain reachable and unintended traffic is not attracted toward an incorrect path. Route summarization is therefore primarily a routing scalability and stability technique.<\/span><\/p>\nQuestion 269. What is the purpose of a BGP route filter?<\/b><\/h3>\n\n- <\/b> To inspect antivirus signatures<\/span>
\n<\/span>2.<\/b> To control which BGP routes are accepted or advertised<\/span>
\n<\/span>3.<\/b> To assign DHCP reservations<\/span>
\n<\/span>4.<\/b> To create security certificates<\/span><\/li>\n<\/ol>\nAnswer: 2. To control which BGP routes are accepted or advertised<\/b><\/p>\n
Explanation:<\/b><\/p>\n
BGP route filtering allows administrators to control which routes are accepted from or advertised to BGP neighbors. This is important because uncontrolled route exchange can introduce incorrect, unwanted, or excessive routing information. Filtering can be based on supported route attributes and matching criteria, allowing administrators to define routing policies appropriate to their network design. Proper BGP filtering is particularly important when exchanging routes with external networks or multiple routing domains. Administrators should test filters carefully because an overly restrictive rule can remove legitimate routes, while an overly broad rule can permit unintended advertisements.<\/span><\/p>\nQuestion 270. Which FortiGate feature allows an administrator to define different behavior for traffic entering through different SD-WAN zones?<\/b><\/h3>\n\n- <\/b> Certificate authority<\/span>
\n<\/span>2.<\/b> Antivirus quarantine<\/span>
\n<\/span>3.<\/b> SD-WAN zone<\/span>
\n<\/span>4.<\/b> Local DNS database<\/span><\/li>\n<\/ol>\nAnswer: 3. SD-WAN zone<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An SD-WAN zone provides a logical grouping of SD-WAN members that can be referenced in policies and routing-related configurations. Instead of treating every individual WAN member as a completely separate destination, administrators can use logical zones to simplify configuration and traffic management. The zone concept can be useful when multiple links provide similar connectivity but have different physical interfaces or characteristics. SD-WAN rules and performance measurements can then determine how traffic is handled among available members. Proper zone design helps simplify policies while retaining the ability to manage multiple WAN paths through SD-WAN functionality.<\/span><\/p>\nQuestion 271. What is the primary purpose of an SD-WAN zone?<\/b><\/h3>\n\n- <\/b> To logically group SD-WAN members for configuration and policy use<\/span>
\n<\/span>2.<\/b> To replace all firewall policies<\/span>
\n<\/span>3.<\/b> To encrypt DNS queries<\/span>
\n<\/span>4.<\/b> To store antivirus signatures<\/span><\/li>\n<\/ol>\nAnswer: 1. To logically group SD-WAN members for configuration and policy use<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An SD-WAN zone provides a logical grouping of one or more SD-WAN members. This abstraction can simplify firewall policy and routing configuration because administrators can reference the logical zone rather than repeatedly managing individual member interfaces. The actual SD-WAN members may use different WAN links, gateways, or physical interfaces, while the zone provides a common logical reference. SD-WAN rules and health checks can still determine which member should carry traffic. Zones therefore improve configuration organization without eliminating the underlying member-specific settings that control link availability and path selection.<\/span><\/p>\nQuestion 272. Which HA setting can influence which FortiGate unit becomes the primary unit after an HA event?<\/b><\/h3>\n\n- <\/b> Web Filter profile<\/span>
\n<\/span>2.<\/b> HA device priority<\/span>
\n<\/span>3.<\/b> DNS filter category<\/span>
\n<\/span>4.<\/b> IP pool configuration<\/span><\/li>\n<\/ol>\nAnswer: 2. HA device priority<\/b><\/p>\n
Explanation:<\/b><\/p>\n
In a FortiGate high-availability cluster, device priority can influence the election of the primary unit when the HA conditions require a new election. Administrators can use priority as part of a planned HA design so that a preferred unit can become primary when the relevant election rules are satisfied. HA election behavior also depends on other configuration and operational conditions, so priority should not be considered in isolation. Understanding HA election parameters is important when designing predictable failover behavior. The setting does not affect Web Filter categories, DNS filtering, or NAT IP pools.<\/span><\/p>\nQuestion 273. What is the purpose of monitored interfaces in a FortiGate HA configuration?<\/b><\/h3>\n\n- <\/b> To automatically create firewall policies<\/span>
\n<\/span>2.<\/b> To increase the number of VDOMs<\/span>
\n<\/span>3.<\/b> To detect important interface failures that may influence HA behavior<\/span>
\n<\/span>4.<\/b> To perform DNS filtering<\/span><\/li>\n<\/ol>\nAnswer: 3. To detect important interface failures that may influence HA behavior<\/b><\/p>\n
Explanation:<\/b><\/p>\n
HA interface monitoring allows the cluster to consider the operational state of selected network interfaces when determining whether a unit remains suitable to perform its role. If a monitored interface fails, the HA system can respond according to its configured failover behavior and election rules. This is useful because a FortiGate might still be powered on and communicating through heartbeat links while an important production interface is unavailable. Monitoring critical interfaces therefore provides additional awareness of actual network availability. Administrators should select interfaces carefully so that temporary or noncritical failures do not cause unnecessary failovers.<\/span><\/p>\nQuestion 274. Which FortiGate feature can restrict administrative access based on the source IP address?<\/b><\/h3>\n\n- <\/b> Trusted hosts<\/span>
\n<\/span>2.<\/b> Application Control<\/span>
\n<\/span>3.<\/b> IP pool<\/span>
\n<\/span>4.<\/b> Traffic shaping<\/span><\/li>\n<\/ol>\nAnswer: 1. Trusted hosts<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Trusted hosts allow administrators to restrict where an administrative account can log in from by specifying permitted source IP addresses or networks. This provides an additional security layer for management access because possession of valid credentials alone may not be sufficient when the connection originates outside the defined trusted range. Trusted hosts should be configured carefully to include legitimate management networks while avoiding unnecessarily broad ranges. They work alongside other protections such as strong authentication, HTTPS administration, and appropriate administrator profiles. This feature controls management access rather than ordinary transit traffic passing through the firewall.<\/span><\/p>\nQuestion 275. What is the purpose of an administrator profile on FortiGate?<\/b><\/h3>\n\n- <\/b> To define the permissions available to an administrator account<\/span>
\n<\/span>2.<\/b> To assign client DHCP addresses<\/span>
\n<\/span>3.<\/b> To select an IPsec peer<\/span>