Question bank
Fortinet Certified Professional - FortiGate
42 Fortinet Certified Professional - FortiGate questions with the correct answer and a written explanation, organised across 5 exam domains.
- 42 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Content Inspection
12 questions in this domain
- Question 1Single Choice
In a routed deployment, what must be configured before a FortiGate can forward internet-bound traffic to a next-hop device?
- AA default route to the ISP gatewayCorrect answer
- BA DNS server address
- CA DHCP scope on port1
- DA hostname for the device
Why this is the answer
A routed deployment requires a default route toward the ISP or next hop. Once this route exists, the FortiGate can forward inspected traffic to the internet.
- Question 2Multiple Select
Which two CLI configuration blocks are used to set a hostname and configure DNS servers on a FortiGate?
- Aconfig system globalCorrect answer
- Bconfig system dnsCorrect answer
- Cconfig firewall policy
- Dconfig router static
Why this is the answer
The hostname is set under config system global, and DNS server addresses are configured under config system dns. Both are part of initial deployment and system configuration.
- Question 3Interactive
View the CLI code block and identify which FortiGate system global parameter is being configured.
- AHostnameCorrect answer
- BAdmin timeout
- CTimezone
- DDNS server
Why this is the answer
The code block contains a system global section that sets the hostname. The other listed settings are not modified by the configuration shown.
- Question 4Single Choice
Out of the box, which FortiGate interface is normally used to open the web-based setup wizard?
- Aport1Correct answer
- Bport2
- Cmodem
- Ddmz
Why this is the answer
The factory-default FortiGate places the setup IP address on port1, allowing the administrator to access the web-based configuration wizard.
- Question 5Multiple Select
Which two secure management protocols can be enabled on a FortiGate interface for administration purposes?
- AHTTPSCorrect answer
- BSSHCorrect answer
- CTelnet
- DRDP
Why this is the answer
HTTPS and SSH are encrypted management protocols used for FortiGate GUI and CLI access. Telnet is unencrypted, and RDP is not a supported FortiGate administrative access option.
- Question 6Interactive
Refer to the code block. Which address is configured as the system DNS primary server?
- A208.91.112.53Correct answer
- B208.91.112.52
- C192.168.1.99
- D203.0.113.1
Why this is the answer
The code block sets the primary DNS server to 208.91.112.53 and the secondary DNS server to 208.91.112.52.
- Question 7Single Choice
Where must a FortiGate content-inspection profile be referenced so that traffic is actually inspected during FortiGate deployment?
- AFirewall policyCorrect answer
- BDNS server
- CDHCP server
- DStatic route
Why this is the answer
Content-inspection profiles are attached to firewall policies. Without that attachment, matching traffic is forwarded without security-profile inspection.
- Question 8Multiple Select
Which two types of FortiGate security profiles are used to inspect network content in a firewall policy?
- AAntivirusCorrect answer
- BWeb filterCorrect answer
- CDHCP server
- DRouting table
Why this is the answer
Antivirus profiles scan file content and malware patterns, while web filter profiles inspect HTTP and HTTPS content. DHCP and routing are not security profiles.
- Question 9Interactive
Review the firewall policy in the code block. Which two content-inspection profiles are referenced by the policy?
- AAntivirus profileCorrect answer
- BWeb filter profileCorrect answer
- CIntrusion prevention profile
- DApplication control profile
Why this is the answer
The firewall policy in the code block references antivirus and web filter profiles. No IPS or application control profile is included in the policy.
- Question 10Single Choice
When a FortiGate is running in transparent mode, how does it forward frames between its bridge interfaces?
- ALayer 2 MAC addressesCorrect answer
- BLayer 3 IP addresses
- CDNS names
- DApplication port numbers
Why this is the answer
In transparent mode, the FortiGate operates as a Layer 2 bridge. Traffic is forwarded using MAC addresses rather than IP routing.
- Question 11Multiple Select
Which two inspection modes can be configured on a FortiGate antivirus profile during content-inspection deployment?
- AFlow-based inspectionCorrect answer
- BProxy-based inspectionCorrect answer
- CKernel-based inspection
- DRoute-based inspection
Why this is the answer
FortiGate supports flow-based and proxy-based security profiling. The selected inspection mode determines how the antivirus engine inspects traffic.
- Question 12Interactive
Refer to the SSL/SSH profile shown in the code block. For which protocol is deep inspection enabled?
- AHTTPSCorrect answer
- BSSH
- CTelnet
- DFTP
Why this is the answer
The SSL/SSH profile has an HTTPS section set to deep-inspection, which means encrypted web traffic is inspected by this profile.
Deployment and System Configuration
9 questions in this domain
- Question 13Single Choice
In which FortiGate operation mode does the device perform NAT and act as a gateway/router?
- ATransparent mode
- BNAT modeCorrect answer
- CReplay mode
- DSniffer mode
Why this is the answer
NAT mode makes FortiGate a routed gateway: it performs NAT on traffic crossing its interfaces. Transparent mode works as an invisible Layer 2 bridge.
- Question 14Multiple Select
Which two CLI commands can you use to back up the FortiGate configuration?
- Aexecute backup config tftp <server> <filename>Correct answer
- Bexecute backup config disk <filename>Correct answer
- Cexecute restore config tftp <server> <filename>
- Dexecute factoryreset
Why this is the answer
execute backup config stores a configuration copy to TFTP or local disk. Restore and factory reset do not create a backup file.
- Question 15Interactive
View the output from the FortiGate command in the exhibit. What does Operation Mode: NAT indicate about the deployment?
- ARouted device with NAT.Correct answer
- BLayer 2 transparent bridge.
- CFactory default state.
- DTraffic inspection only.
Why this is the answer
Operation Mode: NAT confirms FortiGate is a routed deployment with NAT enabled. Transparent mode would report Transparent instead.
- Question 16Single Choice
Which FortiGate configuration object makes it possible for one physical port to carry multiple 802.1Q VLANs?
- AHardware switch
- BVLAN subinterfaceCorrect answer
- CSoftware switch
- DLoopback interface
Why this is the answer
A VLAN subinterface is configured with the logical VLAN ID and allows one physical port to carry multiple tagged VLANs.
- Question 17Multiple Select
When securing administrative access with trusted hosts, which two statements are correct?
- ARestricts access to defined source addresses.Correct answer
- BNo remote administration is allowed by default.
- CMisconfiguration can lock out the administrator.Correct answer
- DUsed only for FortiManager registration.
Why this is the answer
Trusted host restrictions limit administrative source addresses and can lock out admins if misconfigured. Leaving the list empty permits remote access from any source.
- Question 18Interactive
Review the FortiGate interface configuration in the exhibit. Which two statements are true?
- AIP address is manually configured.Correct answer
- BSubnet mask is 255.255.255.0.Correct answer
- CHTTPS access is disabled.
- DIP address is obtained from DHCP.
Why this is the answer
Static mode with an IP address means manual configuration. The netmask is /24 and allowaccess permits HTTPS and SSH.
- Question 19Single Choice
What is the main purpose of the HA heartbeat link between two FortiGate units?
- ASynchronizes configuration and detects failures.Correct answer
- BIncreases the pool of WAN IP addresses.
- CCarries ordinary user data traffic.
- DConnects the unit to the ISP.
Why this is the answer
The heartbeat link is dedicated to cluster synchronization and health detection. Normal user data is forwarded through data interfaces.
- Question 20Multiple Select
Which two elements are stored in a normal FortiGate configuration backup file?
- AAdmin accounts and settings.Correct answer
- BDNS and NTP server settings.Correct answer
- CCurrent logged-on user sessions.
- DVolatile diagnostic counters.
Why this is the answer
Backup files contain persistent configuration such as admin accounts plus DNS and NTP settings. Sessions and counters are temporary runtime information.
- Question 21Interactive
The exhibit shows a global configuration applied at deployment time. Which statement correctly describes its effect?
- AChange hostname and idle timeout.Correct answer
- BSets interface IP to 30.0.0.1.
- CChanges domain and enables SNMP.
- DReloads the backup configuration.
Why this is the answer
The commands set the FortiGate hostname to FGT-EDGE and configure a 30-minute idle administrator logout. They do not set an IP address.
Firewall Policies and Authentication
9 questions in this domain
- Question 22Single Choice
Which FortiGate CLI configuration mode is used to create and edit IPv4 firewall policies?
- Aconfig firewall policyCorrect answer
- Bconfig firewall address
- Cconfig system interface
- Dconfig system admin
Why this is the answer
Firewall security policies are configured under config firewall policy. Address objects, interfaces, and administrators have separate CLI contexts.
- Question 23Multiple Select
Which two valid actions can be configured for a FortiGate firewall security policy?
- AACCEPTCorrect answer
- BDENYCorrect answer
- CTRUST
- DREDIRECT
Why this is the answer
A FortiGate firewall policy allows traffic with the ACCEPT action or blocks traffic with the DENY action. TRUST and REDIRECT are not standard policy action values.
- Question 24Interactive
Review the FortiGate CLI policy configuration in the code block. Which traffic classification is permitted by this rule?
- AICMP echo requests from the inside interface to the outside interfaceCorrect answer
- BHTTP requests from the inside interface to the outside interface
- CTelnet sessions from the outside interface to the inside interface
- DDNS queries from the outside interface to the inside interface
Why this is the answer
The policy uses the PING service and the action accept, so ICMP traffic from inside to outside is explicitly allowed. Other services are not matched by the policy.
- Question 25Single Choice
How does FortiGate decide which security policy applies when multiple policies match the same packet?
- AThe first matching policy in the ordered policy listCorrect answer
- BThe policy with the highest internal ID
- CThe most specific policy regardless of its position
- DEvery matching policy is evaluated alternately
Why this is the answer
FortiGate searches the policy list from top to bottom and applies the action of the first matching policy. The policy ID does not determine the matching order.
- Question 26Multiple Select
Which two policy objects are required so a FortiGate deny rule applies only to Engineering-to-HR traffic?
- ASource address objectCorrect answer
- BDestination address objectCorrect answer
- CTraffic-shaping policy
- DLog severity level
Why this is the answer
A firewall policy uses source and destination address objects to identify the networks it applies to. Traffic shaping and log settings do not define which traffic matches the rule.
- Question 27Interactive
Review the code block. What type of remote authentication server is represented by the objects being defined?
- ALDAP serverCorrect answer
- BRADIUS server
- CTACACS+ server
- DLocal user database
Why this is the answer
The FortiGate CLI context config user ldap configures LDAP directory authentication. RADIUS, TACACS+, and local users use different configuration contexts.
- Question 28Single Choice
Which FortiGate security policy stores user and group information to enforce identity-based access?
- AIdentity-based security policyCorrect answer
- BCentral NAT policy
- CDoS policy
- DAddress-based security policy
Why this is the answer
An identity-based firewall policy uses users and groups, which requires authentication before traffic is allowed. NAT, DoS, and pure address policies do not require user identity.
- Question 29Multiple Select
Select the three types of user databases that FortiGate can query when a firewall policy requires authentication.
- ALocal user databaseCorrect answer
- BLDAP serverCorrect answer
- CRADIUS serverCorrect answer
- DSNMP server
Why this is the answer
FortiGate supports authentication through local user accounts, LDAP, and RADIUS. SNMP is a monitoring protocol and is not used for firewall user authentication.
- Question 30Interactive
Review the firewall policy snippet in the code block. Which traffic is explicitly blocked?
- ADNS requests from the inside interface to the wan1 interfaceCorrect answer
- BDNS requests from the wan1 interface to the inside interface
- CHTTPS traffic from the inside interface to the Google_DNS address
- DAll traffic between any interfaces
Why this is the answer
The policy matches traffic from the inside interface to the wan1 interface, with Google_DNS as the destination and DNS as the service. The deny action blocks these DNS requests.
Routing
6 questions in this domain
- Question 31Single Choice
When FortiGate receives multiple routes with the same prefix length to one destination, which characteristic makes one route preferred?
- ALower administrative distanceCorrect answer
- BHigher administrative distance
- CShorter prefix length
- DOlder route age
Why this is the answer
FortiGate uses administrative distance to rank route sources. A lower administrative distance makes a route more preferred when the destination prefix is the same.
- Question 32Multiple Select
Which two methods can populate the FortiGate routing table after directly connected routes are created?
- AStatic route definitionsCorrect answer
- BDynamic routing protocolsCorrect answer
- CAccess policy configuration
- DFirewall address objects
Why this is the answer
FortiGate learns non-connected routes by static route definitions or by dynamic routing protocols such as OSPF and BGP. Firewall objects and policies do not create routing entries.
- Question 33Interactive
According to the routing table output, which route type is used for the default gateway entry?
- AStatic routeCorrect answer
- BConnected route
- COSPF route
- DKernel route
Why this is the answer
The route table code block shows a static default entry with the S flag and default-route marker. A static default route sends traffic to the configured gateway.
- Question 34Single Choice
In the IPv4 routing table, which destination network is matched by a FortiGate default route when no more-specific route exists?
- A0.0.0.0/0Correct answer
- B0.0.0.0/32
- C255.255.255.255/0
- D127.0.0.0/8
Why this is the answer
A default route is the IPv4 prefix 0.0.0.0/0. It matches every destination and is used only when FortiGate has no more-specific prefix.
- Question 35Multiple Select
Which two items are required in a basic FortiGate static route configuration for IPv4 traffic?
- ADestination prefixCorrect answer
- BGateway or outgoing interfaceCorrect answer
- CSource IP address
- DService port
Why this is the answer
A static route defines the prefix to reach and a forwarding instruction, such as a gateway or an outgoing interface. It does not depend on source IP or service.
- Question 36Interactive
Which two statements correctly describe the static route created in the configuration output shown above?
- AIt defines a default routeCorrect answer
- BIt points to a next-hop gatewayCorrect answer
- CIt was learned from OSPF
- DIt is a connected interface route
Why this is the answer
The configuration is a static route with destination 0.0.0.0/0 and a gateway. It is not learned by OSPF and is not a connected route.
VPN
6 questions in this domain
- Question 37Single Choice
What is the default operation mode of a FortiGate when it is deployed as an IPsec VPN gateway?
- ANAT modeCorrect answer
- BTransparent mode
- COffline mode
- DProxy mode
Why this is the answer
FortiGate defaults to NAT mode, which allows routes and firewall policies to control VPN traffic. Transparent mode is selected for layer-2 deployments.
- Question 38Multiple Select
Which two system configuration items are essential before a FortiGate site-to-site IPsec VPN can forward data?
- AAddressing on the WAN interfaceCorrect answer
- BFirewall policy permitting VPN trafficCorrect answer
- CDHCP service on the LAN interface
- DPhone extension registration
Why this is the answer
A reachable public address and a firewall policy permitting VPN traffic are required. DHCP and phone registration are unrelated optional services.
- Question 39Interactive
According to the command output provided in the code block, what is the current state of the FortiGate IPsec gateway?
- AThe gateway is up and activeCorrect answer
- BThe gateway is down and unreachable
- CThe gateway is administratively disabled
- DThe gateway is in factory reset mode
Why this is the answer
The code block shows state UP, so the VPN gateway is established and can process tunnel traffic.
- Question 40Single Choice
What is the VPN deployment called when only corporate-network traffic enters the tunnel and other traffic uses the local Internet connection?
- ASplit tunnelingCorrect answer
- BFull tunneling
- CNAT mode VPN
- DTransparent VPN
Why this is the answer
Split tunneling sends only corporate-destined traffic through the VPN tunnel; general Internet traffic exits through the local gateway.
- Question 41Multiple Select
Before a FortiGate VPN gateway starts its first IKE negotiation, which two system configuration items should be checked?
- AAddressing on the WAN interfacesCorrect answer
- BSystem time synchronized with NTPCorrect answer
- CVoIP call routing profiles
- DEmail address lists
Why this is the answer
Correct addressing allows peer reachability, while accurate time supports IKE and certificates. VoIP and email list settings are unrelated.
- Question 42Interactive
Consider the FortiGate phase1 snippet in the code block. What does the remote-gw value represent in this IPsec configuration?
- AThe public IP address of the remote peerCorrect answer
- BThe local FortiGate interface IP address
- CThe IP pool assigned to VPN clients
- DThe IP address of the certificate server
Why this is the answer
In FortiGate phase1, remote-gw defines the public IP address of the peer that terminates the VPN tunnel.
Frequently asked questions
Everything about the Fortinet Certified Professional - FortiGate question bank and how to use it.