FCP Security Policy Management & Compliance 5

Question 1

An organization's compliance policy requires all remote access VPN connections to use certificate-based authentication. Which FortiGate configuration enforces this?

Accepted Answer

SSL-VPN or IPsec VPN configured with PKI peer certificate authentication

Answer

Configuring SSL-VPN or IPsec VPN with PKI peer (certificate) authentication ensures only clients with valid certificates can establish remote access sessions.

Question 2

Which FortiGate feature detects when a managed device's running configuration diverges from the approved baseline stored in FortiManager?

Accepted Answer

Configuration drift detection via FortiManager's 'retrieve' and diff comparison

Answer

FortiManager can retrieve the current running configuration from a managed device and compare it to the stored revision, highlighting any configuration drift.

Question 3

Under the CIS Controls framework, which control is most directly satisfied by maintaining an up-to-date inventory of FortiGate firewall rules and reviewing unused policies?

Accepted Answer

CIS Control 12: Network Infrastructure Management

Answer

CIS Control 12 covers network infrastructure management including maintaining and reviewing firewall rules, making it the closest match for firewall policy hygiene.

Question 4

A security policy requires blocking access to social media during work hours but allowing it after 6 PM on weekdays and all day on weekends. Which combination of FortiGate features achieves this?

Accepted Answer

Two web filter policies with different schedule objects attached

Answer

Two separate web filter policies—one blocking social media with a business-hours schedule and one allowing it with an after-hours schedule—achieves this requirement.

Question 5

Which FortiGate diagnostic command helps verify whether a specific traffic flow matches the intended security policy before it reaches the network?

Accepted Answer

diagnose debug flow filter

Answer

The 'diagnose debug flow filter' command with flow trace enables real-time policy lookup debugging, showing which policy matches a specific traffic flow.

(FCP) Fortinet Certified Professional Security Operations Practice Test

(FCP) Fortinet Certified Professional Security Operations Practice Test

FCP Security Policy Management & Compliance 5