Security Policy Management & Compliance Flashcards

A FortiGate policy is configured with action 'accept' but traffic is still being blocked. After checking all explicit deny rules, what should the administrator investigate next?

Answer: Policy order—a higher-priority deny rule may match first

FortiGate evaluates policies top-to-bottom; a deny rule earlier in the list that also matches the traffic will take effect before the accept rule is reached.

Which security compliance framework requires organizations to maintain a formal risk management program, which FortiGate's Security Rating and FortiAnalyzer reports help document?

Answer: NIST CSF Identify/Protect functions

NIST CSF's Identify and Protect functions require risk assessments and security controls documentation, which Security Rating scores and FortiAnalyzer reports provide evidence for.

An administrator wants to automatically quarantine a FortiClient endpoint that fails a posture check. Which integration achieves this?

Answer: FortiClient EMS with compliance enforcement and quarantine VLAN

FortiClient EMS enforces endpoint compliance policies and can place non-compliant endpoints into a quarantine VLAN until they meet posture requirements.

Which FortiGate feature allows writing custom traffic-matching criteria using Boolean logic for scenarios where standard policy fields are insufficient?

Answer: FortiGate scripting with custom match conditions via CLI

FortiGate CLI scripting and custom match conditions allow administrators to craft complex Boolean logic for traffic selection beyond standard GUI policy fields.

A SOC manager needs to demonstrate that security policies are enforced 24/7. Which FortiAnalyzer report type provides continuous policy compliance evidence?

Answer: Traffic summary reports with policy hit counts over time

FortiAnalyzer traffic summary reports showing policy hit counts over time demonstrate that security policies are actively enforcing traffic continuously.

When FortiGate's implicit deny rule drops a packet, where is this event recorded by default?

Answer: It is not logged unless explicit logging is enabled on the implicit deny policy

The implicit deny policy does not log by default; administrators must explicitly enable logging on it to capture denied traffic for compliance purposes.

Which FortiGate object is used to group multiple firewall policies into a logical unit for easier management and consistent application across sites?

Answer: Policy package

FortiManager policy packages group sets of firewall policies that can be assigned and deployed consistently across multiple FortiGate devices.