Security Policy Management & Compliance Flashcards

An organization's compliance policy requires all remote access VPN connections to use certificate-based authentication. Which FortiGate configuration enforces this?

Answer: SSL-VPN or IPsec VPN configured with PKI peer certificate authentication

Configuring SSL-VPN or IPsec VPN with PKI peer (certificate) authentication ensures only clients with valid certificates can establish remote access sessions.

Which FortiGate feature detects when a managed device's running configuration diverges from the approved baseline stored in FortiManager?

Answer: Configuration drift detection via FortiManager's 'retrieve' and diff comparison

FortiManager can retrieve the current running configuration from a managed device and compare it to the stored revision, highlighting any configuration drift.

Under the CIS Controls framework, which control is most directly satisfied by maintaining an up-to-date inventory of FortiGate firewall rules and reviewing unused policies?

Answer: CIS Control 12: Network Infrastructure Management

CIS Control 12 covers network infrastructure management including maintaining and reviewing firewall rules, making it the closest match for firewall policy hygiene.

A security policy requires blocking access to social media during work hours but allowing it after 6 PM on weekdays and all day on weekends. Which combination of FortiGate features achieves this?

Answer: Two web filter policies with different schedule objects attached

Two separate web filter policies—one blocking social media with a business-hours schedule and one allowing it with an after-hours schedule—achieves this requirement.

Which FortiGate diagnostic command helps verify whether a specific traffic flow matches the intended security policy before it reaches the network?

Answer: diagnose debug flow filter

The 'diagnose debug flow filter' command with flow trace enables real-time policy lookup debugging, showing which policy matches a specific traffic flow.

An administrator needs to ensure that firewall policy changes go through a formal approval process. Which FortiManager setting enables a mandatory review-before-install workflow?

Answer: Enabling workspace mode with approval workflow in ADOM settings

FortiManager workspace mode with approval workflow requires designated approvers to review and authorize policy changes before they can be installed on managed devices.

Which compliance regulation specifically mandates that organizations implement 'appropriate technical measures' for personal data protection, which FortiGate's encryption and access control policies help satisfy?

Answer: GDPR Article 32

GDPR Article 32 requires appropriate technical and organizational measures to protect personal data, which FortiGate's encryption enforcement and access control policies help satisfy.