IPsec selector<\/span><\/li>\n<\/ol>\nAnswer: 2. Device identification<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Device identification helps FortiGate determine information about endpoints connected to the network. The firewall can use available network characteristics and observed traffic to identify devices or device categories. This information can improve visibility and can also be used in supported security policies and monitoring functions. Device identification is particularly useful in environments where administrators need to understand what types of systems are accessing network resources. It should not be confused with user authentication, because identifying a device does not necessarily identify the person using it. Combining device information with authentication and policy controls can provide more precise access management.<\/span><\/p>\nQuestion 282. What is the purpose of a FortiGate security policy using a device group?<\/b><\/h3>\n\n- <\/b> To define routing protocol neighbors<\/span>
\n<\/span>2.<\/b> To configure DNS forwarding<\/span>
\n<\/span>3.<\/b> To apply policy controls based on identified endpoint devices<\/span>
\n<\/span>4.<\/b> To create an HA heartbeat<\/span><\/li>\n<\/ol>\nAnswer: 3. To apply policy controls based on identified endpoint devices<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A device-based firewall policy can use identified endpoint information to apply specific security controls to particular device types or groups. This can help administrators distinguish between different classes of endpoints when designing access policies. For example, an organization may want different controls for managed workstations, printers, or other network devices. Device-based matching should be combined with appropriate source, destination, service, and security-profile requirements. Device identification is not the same as user authentication, so administrators should select the appropriate matching method for the security requirement. Proper policy ordering remains important when multiple policies could match the same traffic.<\/span><\/p>\nQuestion 283. Which FortiGate feature allows a firewall policy to authenticate users through an external identity source?<\/b><\/h3>\n\n- <\/b> Identity-based policy with an authentication server<\/span>
\n<\/span>2.<\/b> IP pool<\/span>
\n<\/span>3.<\/b> Interface zone<\/span>
\n<\/span>4.<\/b> Traffic shaper<\/span><\/li>\n<\/ol>\nAnswer: 1. Identity-based policy with an authentication server<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An identity-based firewall policy can associate network access decisions with authenticated users or groups. FortiGate can integrate with supported external identity services so that users can be authenticated and matched against appropriate groups. This allows policies to distinguish access based on user identity instead of relying only on source IP addresses. Identity-based controls are useful in environments where multiple users share network segments or where access requirements differ by organizational role. Administrators should ensure that authentication, group membership, and policy matching are correctly configured so that users receive the intended access.<\/span><\/p>\nQuestion 284. What is the main purpose of a firewall address group?<\/b><\/h3>\n\n- <\/b> To combine multiple address objects for easier policy management<\/span>
\n<\/span>2.<\/b> To create an IPsec tunnel<\/span>
\n<\/span>3.<\/b> To monitor CPU usage<\/span>
\n<\/span>4.<\/b> To assign DHCP reservations<\/span><\/li>\n<\/ol>\nAnswer: 1. To combine multiple address objects for easier policy management<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A firewall address group allows multiple address objects to be referenced as a logical collection. This simplifies policy configuration when the same group of networks or hosts needs to appear in multiple policies. Instead of adding every individual address object repeatedly, administrators can reference the group as a single policy object. Address groups can make configurations easier to read and maintain, especially in environments with many internal networks or application servers. The group does not itself perform routing or NAT. It is primarily an object-management feature used to simplify the definition of policy sources and destinations.<\/span><\/p>\nQuestion 285. Which FortiGate feature can restrict access to management services based on the interface through which the connection arrives?<\/b><\/h3>\n\n- <\/b> Antivirus profile<\/span>
\n<\/span>2.<\/b> Local-in policy<\/span>
\n<\/span>3.<\/b> IP pool<\/span>
\n<\/span>4.<\/b> SD-WAN rule<\/span><\/li>\n<\/ol>\nAnswer: 2. Local-in policy<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Local-in policies control traffic destined for services running directly on the FortiGate itself. This can include administrative access and other local services depending on the configuration. Administrators can use local-in policies to restrict which sources, interfaces, services, or other supported criteria may reach the device. This is different from normal firewall policies, which primarily control traffic passing through the FortiGate between networks. Proper local-in policy design can reduce the exposure of management services and other device-local functions. Administrators should carefully review the policies to avoid unintentionally blocking required administrative or network services.<\/span><\/p>\nQuestion 286. What is the purpose of a firewall policy schedule?<\/b><\/h3>\n\n- <\/b> To determine when a policy is active<\/span>
\n<\/span>2.<\/b> To configure BGP neighbors<\/span>
\n<\/span>3.<\/b> To monitor certificate expiration<\/span>
\n<\/span>4.<\/b> To create VLAN tags<\/span><\/li>\n<\/ol>\nAnswer: 1. To determine when a policy is active<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A firewall policy schedule defines the time period during which a policy can be used to process matching traffic. This allows administrators to create time-based access controls instead of keeping a policy active continuously. For example, an organization can permit certain traffic only during business hours or restrict access outside approved periods. Schedules can improve policy precision and reduce unnecessary exposure. Administrators should ensure that the schedule uses the correct time settings and that overlapping policies are considered. A schedule controls policy availability; it does not replace the source, destination, service, or security conditions defined in the policy.<\/span><\/p>\nQuestion 287. What is the primary purpose of a firewall policy comment?<\/b><\/h3>\n\n- <\/b> To change packet forwarding behavior<\/span>
\n<\/span>2.<\/b> To provide administrative documentation about the policy<\/span>
\n<\/span>3.<\/b> To create an IPsec tunnel<\/span>
\n<\/span>4.<\/b> To enable DHCP relay<\/span><\/li>\n<\/ol>\nAnswer: 2. To provide administrative documentation about the policy<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A firewall policy comment provides descriptive information for administrators about why a policy exists or what it is intended to control. Comments can document business purposes, application dependencies, change references, or other useful operational details. Clear documentation becomes increasingly valuable as firewall configurations grow and are managed by multiple administrators. A comment does not affect packet forwarding, authentication, or security inspection. Instead, it improves maintainability and helps administrators understand configuration intent during troubleshooting or review. Good policy documentation can also make future audits and configuration changes more efficient.<\/span><\/p>\nQuestion 288. Which FortiGate feature can limit bandwidth consumed by an individual source IP address?<\/b><\/h3>\n\n- <\/b> Per-IP traffic shaper<\/span>
\n<\/span>2.<\/b> Certificate inspection<\/span>
\n<\/span>3.<\/b> DNS Filter<\/span>
\n<\/span>4.<\/b> OSPF<\/span><\/li>\n<\/ol>\nAnswer: 1. Per-IP traffic shaper<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A per-IP traffic shaper controls bandwidth usage based on individual source IP addresses. This can prevent one host from consuming a disproportionate amount of available network capacity. It is useful in environments where administrators need to distribute bandwidth more fairly among users or devices. Traffic shaping is different from security inspection because its primary purpose is controlling traffic rates rather than detecting malicious content. Administrators should select appropriate limits based on available bandwidth and application requirements. Proper monitoring is useful after deployment because overly restrictive shaping can negatively affect legitimate applications that require higher throughput.<\/span><\/p>\nQuestion 289. What is the purpose of an application control sensor on FortiGate?<\/b><\/h3>\n\n- <\/b> To define IPsec Phase 1 authentication<\/span>
\n<\/span>2.<\/b> To identify and control applications in network traffic<\/span>
\n<\/span>3.<\/b> To assign DNS addresses<\/span>
\n<\/span>4.<\/b> To create HA heartbeat interfaces<\/span><\/li>\n<\/ol>\nAnswer: 2. To identify and control applications in network traffic<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Application Control identifies applications within network traffic and allows administrators to apply actions based on the detected applications or application categories. This provides more granular control than relying solely on IP addresses and ports. Administrators can use application control to monitor, allow, or restrict applications according to the organization’s security requirements. Detection depends on the traffic characteristics and available FortiGuard application signatures or related mechanisms. Application Control is commonly applied through firewall policies using a security profile. It should be configured carefully so that legitimate applications are not unintentionally blocked.<\/span><\/p>\nQuestion 290. Which FortiGate feature helps prevent sensitive information from leaving the organization through inspected traffic?<\/b><\/h3>\n\n- <\/b> OSPF<\/span>
\n<\/span>2.<\/b> DLP<\/span>
\n<\/span>3.<\/b> DHCP relay<\/span>
\n<\/span>4.<\/b> Link aggregation<\/span><\/li>\n<\/ol>\nAnswer: 2. DLP<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Data Loss Prevention, or DLP, is designed to identify and control sensitive information as it moves through monitored traffic. Administrators can define data patterns or rules that help detect information requiring special handling. Depending on the configured policy and supported inspection methods, FortiGate can log, block, or otherwise respond when matching content is identified. DLP is useful for protecting information such as confidential business data or regulated records. Effective DLP configuration requires carefully designed patterns and actions because overly broad rules can generate unnecessary alerts, while overly narrow rules may fail to detect relevant information.<\/span><\/p>\nQuestion 291. What is the purpose of a FortiGate IPS sensor?<\/b><\/h3>\n\n- <\/b> To assign IP addresses<\/span>
\n<\/span>2.<\/b> To configure DNS records<\/span>
\n<\/span>3.<\/b> To define intrusion prevention signatures and actions<\/span>
\n<\/span>4.<\/b> To create SD-WAN zones<\/span><\/li>\n<\/ol>\nAnswer: 3. To define intrusion prevention signatures and actions<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An IPS sensor defines how FortiGate handles intrusion prevention signatures detected in inspected traffic. Administrators can select relevant signatures or signature categories and configure actions according to the security requirements. Depending on the configuration, detected traffic may be logged, blocked, or handled through another supported action. IPS helps identify attempts to exploit vulnerabilities or perform other malicious activities. Administrators should keep signatures updated and review IPS events to identify false positives or emerging threats. Carefully tuning the sensor helps maintain security while reducing unnecessary disruption to legitimate traffic.<\/span><\/p>\nQuestion 292. What is the main purpose of an antivirus profile on FortiGate?<\/b><\/h3>\n\n- <\/b> To inspect traffic for malware and unwanted files<\/span>
\n<\/span>2.<\/b> To establish BGP sessions<\/span>
\n<\/span>3.<\/b> To create VLAN interfaces<\/span>
\n<\/span>4.<\/b> To assign administrator privileges<\/span><\/li>\n<\/ol>\nAnswer: 1. To inspect traffic for malware and unwanted files<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A FortiGate antivirus profile defines how the firewall handles supported traffic when scanning for malicious files or malware. The profile can be applied through a firewall policy so that matching traffic receives antivirus inspection according to the configured settings. Depending on the traffic type and inspection method, FortiGate can identify suspicious or malicious content and take an appropriate action. Antivirus protection relies on current detection information and correct policy placement. Administrators should also consider performance and inspection requirements when enabling antivirus scanning because deeper inspection can require additional system resources.<\/span><\/p>\nQuestion 293. What is the purpose of a Web Filter static URL filter?<\/b><\/h3>\n\n- <\/b> To configure OSPF areas<\/span>
\n<\/span>2.<\/b> To define specific URLs or domains that should receive a configured filtering action<\/span>
\n<\/span>3.<\/b> To assign DHCP addresses<\/span>
\n<\/span>4.<\/b> To synchronize HA sessions<\/span><\/li>\n<\/ol>\nAnswer: 2. To define specific URLs or domains that should receive a configured filtering action<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A static URL filter allows administrators to define specific web addresses or domains and assign an appropriate filtering action. This can provide more direct control than relying solely on category-based web filtering. For example, an organization may need to explicitly block or allow a particular website regardless of its broader category classification. Static URL filters are useful for implementing organization-specific web access requirements. Administrators should review these entries periodically because websites can change domains, URLs, or content. The configured action should also be tested to ensure that it produces the intended behavior.<\/span><\/p>\nQuestion 294. What is the purpose of a DNS Filter on FortiGate?<\/b><\/h3>\n\n- <\/b> To control DNS requests based on configured security and filtering criteria<\/span>
\n<\/span>2.<\/b> To increase physical interface speed<\/span>
\n<\/span>3.<\/b> To configure HA priorities<\/span>
\n<\/span>4.<\/b> To create firewall address groups<\/span><\/li>\n<\/ol>\nAnswer: 1. To control DNS requests based on configured security and filtering criteria<\/b><\/p>\n
Explanation:<\/b><\/p>\n
DNS filtering allows FortiGate to evaluate DNS requests and apply security or access-control decisions based on configured filtering mechanisms. It can help prevent users from resolving domains associated with unwanted or potentially harmful content. DNS filtering can work with category information and other supported controls to improve visibility and policy enforcement at the domain-resolution level. Administrators should ensure that client DNS traffic is actually passing through the intended FortiGate service; otherwise, filtering may not be applied. DNS filtering complements, rather than replaces, other controls such as Web Filter, Application Control, and IPS.<\/span><\/p>\nQuestion 295. What is the primary purpose of FortiGate IP reputation information?<\/b><\/h3>\n\n- <\/b> To determine administrator password length<\/span>
\n<\/span>2.<\/b> To identify IP addresses associated with known malicious or suspicious activity<\/span>
\n<\/span>3.<\/b> To configure DHCP reservations<\/span>