FCP Network Security Fundamentals & Fortinet Solutions 3 — Questions and Answers
Question 1: What is the primary function of FortiSandbox in the Fortinet Security Fabric?
- To enforce network access control policies
- To execute suspicious files in an isolated environment to detect zero-day threats (Correct answer)
- To aggregate logs from multiple FortiGate devices
- To manage SSL VPN user accounts
Correct answer: To execute suspicious files in an isolated environment to detect zero-day threats
FortiSandbox detonates suspicious files and URLs in a safe isolated environment to identify unknown or zero-day malware that signature-based tools miss.
Question 2: Which routing protocol is commonly used between FortiGate devices in an ADVPN (Auto-Discovery VPN) deployment to dynamically learn spoke routes?
- RIP
- OSPF or BGP (Correct answer)
- EIGRP
- IS-IS
Correct answer: OSPF or BGP
ADVPN deployments typically use OSPF or BGP as the overlay routing protocol so spokes can dynamically learn each other's routes and establish direct tunnels.
Question 3: In FortiGate high availability (HA), what is the role of the 'heartbeat interface'?
- It carries production user traffic during failover
- It synchronizes configuration and session tables between cluster members (Correct answer)
- It connects the HA cluster to FortiManager for management
- It provides out-of-band management access
Correct answer: It synchronizes configuration and session tables between cluster members
The HA heartbeat interface is a dedicated link used to synchronize configuration, session state, and routing tables between FortiGate cluster members.
Question 4: What does the 'Security Rating' feature in FortiGate's Security Fabric provide?
- A real-time threat score for incoming network traffic
- A compliance and best-practice score for the overall Security Fabric deployment (Correct answer)
- A certificate validity rating for SSL-inspected sites
- A risk score assigned to individual users
Correct answer: A compliance and best-practice score for the overall Security Fabric deployment
Security Rating evaluates the FortiGate and Security Fabric configuration against Fortinet best practices and compliance benchmarks, producing a scored report.
Question 5: Which FortiGate NAT mode translates many private IP addresses to a single public IP using port numbers to differentiate sessions?
- Static NAT (1-to-1 NAT)
- Dynamic NAT with PAT (IP masquerading) (Correct answer)
- Policy-based NAT
- Full-cone NAT
Correct answer: Dynamic NAT with PAT (IP masquerading)
Dynamic NAT with Port Address Translation (PAT/IP masquerading) maps many internal hosts to one public IP by assigning unique source port numbers to each session.
Question 6: In FortiOS, what is a 'Virtual Domain' (VDOM) used for?
- Creating virtual IP addresses for server load balancing
- Partitioning a single FortiGate into multiple independent logical firewall instances (Correct answer)
- Defining virtual routing and forwarding (VRF) tables
- Segmenting wireless SSIDs on FortiAP
Correct answer: Partitioning a single FortiGate into multiple independent logical firewall instances
VDOMs allow a single FortiGate appliance to be divided into multiple independent virtual firewall instances, each with its own policies, interfaces, and administrators.
Question 7: What is the purpose of FortiGate's 'Botnet C&C' detection under security profiles?
- To identify and block traffic communicating with known botnet command-and-control servers (Correct answer)
- To scan email attachments for bot-delivered malware
- To enforce two-factor authentication for admin logins
- To monitor CPU usage spikes caused by bot activity
Correct answer: To identify and block traffic communicating with known botnet command-and-control servers
Botnet C&C detection checks outbound connections against a database of known command-and-control server IPs/domains and blocks infected hosts from communicating with them.
FCP Network Security Fundamentals & Fortinet Solutions 3
What is the primary function of FortiSandbox in the Fortinet Security Fabric?