Security Policy Management & Compliance Flashcards

A FortiGate administrator needs to ensure that firewall policies are only applied during business hours (8 AM–6 PM). Which FortiGate feature enables time-based policy enforcement?

Answer: Policy scheduling using schedule objects

FortiGate schedule objects (recurring or one-time) can be attached to firewall policies to restrict when they are active.

Under NIST 800-53, which control family is most directly addressed by FortiGate's firewall policy logging and FortiAnalyzer audit trails?

Answer: Audit and Accountability (AU)

The AU control family covers audit logging and accountability, which aligns with FortiGate's traffic logging and FortiAnalyzer's audit trail capabilities.

An organization wants to prevent shadow IT by blocking unsanctioned SaaS applications. Which FortiGate feature provides application-level policy control for this use case?

Answer: Application control profiles

Application control profiles classify and block specific applications (including SaaS) at the policy level using deep packet inspection.

Which FortiManager feature allows administrators to deploy a consistent baseline security policy across 50 FortiGate devices simultaneously?

Answer: Policy packages with installation targets

FortiManager policy packages can be assigned to multiple FortiGate devices as installation targets, enabling centralized consistent policy deployment.

A compliance audit requires proof that no firewall rules have been modified without change control approval. Which FortiManager capability best satisfies this requirement?

Answer: FortiManager revision history and audit log

FortiManager maintains a revision history of all policy changes with timestamps and administrator identity, satisfying change control audit requirements.

Which FortiGate security profile type inspects outbound traffic to detect and block data exfiltration of sensitive files such as credit card numbers?

Answer: DLP (Data Loss Prevention) profile

DLP profiles inspect traffic content for sensitive data patterns (PII, financial data) and can block or log matching transfers.

A PCI DSS assessment requires that cardholder data environments be network-segmented from other zones. Which FortiGate concept is the primary enforcement mechanism?

Answer: VDOMs (Virtual Domains) with inter-VDOM routing policies

VDOMs create logically separated firewall instances, and inter-VDOM routing policies strictly control traffic between the CDE and other network segments.