Security Policy Management & Compliance Flashcards

Which FortiGate feature allows an administrator to define acceptable use policies by displaying a disclaimer page to users before granting internet access?

Answer: Captive portal with disclaimer

FortiGate captive portal can require users to acknowledge an acceptable use policy disclaimer before traffic is permitted through the policy.

An administrator wants to enforce that all SSL/TLS connections to external sites use a minimum of TLS 1.2. Which FortiGate feature enforces this requirement?

Answer: SSL/SSH inspection profile with minimum TLS version setting

SSL/SSH inspection profiles allow administrators to configure minimum and maximum TLS version requirements, blocking connections that don't meet the threshold.

When implementing a least-privilege firewall policy, which FortiGate practice best represents this principle?

Answer: Creating specific source/destination/service policies and ending with an implicit deny

Least privilege requires explicitly allowing only necessary traffic with specific criteria, with all other traffic denied by the implicit deny rule at the bottom.

FortiAnalyzer's compliance reports map log data to which framework when generating SOX compliance evidence?

Answer: COBIT control objectives

FortiAnalyzer includes built-in SOX compliance reports that map collected log data to COBIT control objectives for financial system audit evidence.

An administrator must ensure FortiGate policies are reviewed quarterly. Which FortiManager workflow feature helps enforce this review process?

Answer: Approval workflow requiring dual administrator sign-off

FortiManager's approval workflow requires designated administrators to review and approve policy changes before installation, supporting periodic review processes.

Which FortiGate object type enables policy matching based on a user's Active Directory group membership rather than IP address?

Answer: Dynamic address object with FSSO tag

FSSO (Fortinet Single Sign-On) tags IP addresses with AD group membership, allowing FortiGate policies to match traffic based on user identity.

Under HIPAA Security Rule requirements, which FortiGate capability helps meet the Audit Controls standard (§164.312(b))?

Answer: Traffic logging with FortiAnalyzer retention and reporting

HIPAA §164.312(b) requires audit controls to record and examine activity in systems containing ePHI, which FortiGate logging sent to FortiAnalyzer satisfies.