Fortinet NSE 4 - FortiGate Network Security Professional — Questions and Answers

Question 1: An organization experiences a supply chain compromise where a trusted software vendor's update was trojanized. Which IR phase would include revoking trust in all software from that vendor?

Eradication (Correct answer)
Preparation
Detection and Analysis
Post-Incident Activity

Correct answer: Eradication

Eradication involves removing all components of the threat, including revoking trust in compromised software sources to prevent reinfection.

Question 2: What is the primary purpose of a Wireless Intrusion Prevention System (WIPS)?

To assign IP addresses to wireless clients via DHCP
To encrypt all wireless traffic using AES-256
To detect and prevent unauthorized access points and wireless attacks (Correct answer)
To amplify wireless signal strength across the facility

Correct answer: To detect and prevent unauthorized access points and wireless attacks

WIPS continuously monitors the RF spectrum to detect rogue access points, unauthorized clients, and wireless attacks, and can automatically contain or block threats.

Question 3: Which statement BEST describes the relationship between Network Security Expert certification and industry evolution?

Changes only occur when government mandates them
Requirements become less stringent over time
Requirements evolve periodically to reflect advances in knowledge and practice (Correct answer)
Certification requirements never change

Correct answer: Requirements evolve periodically to reflect advances in knowledge and practice

Certification requirements evolve to keep pace with professional and technological advances.

Question 4: When documenting assessment findings in NSE practice, which approach is MOST appropriate?

Use jargon only experts understand
Record objective findings, measurements, and observations factually (Correct answer)
Include only positive findings
Summarize verbally without written documentation

Correct answer: Record objective findings, measurements, and observations factually

Assessment documentation must be objective, factual, and comprehensive.

Question 5: Which artifact is MOST useful for establishing the timeline of attacker activity on a compromised Windows endpoint?

The system's hosts file
Windows Event Log entries combined with $MFT (Master File Table) timestamps (Correct answer)
Active Directory group membership records
The browser's saved passwords

Correct answer: Windows Event Log entries combined with $MFT (Master File Table) timestamps

Combining Windows Event Logs with NTFS MFT timestamps provides a detailed chronological record of file system changes and security events tied to attacker actions.

Question 6: During a tabletop exercise simulating a data breach, participants realize the IR plan does not specify who is authorized to communicate with law enforcement. What is the PRIMARY risk of this gap?

Employees may not be notified promptly
Forensic evidence may be collected incorrectly
The recovery timeline will exceed the RTO
Unauthorized disclosures could compromise the investigation or violate legal obligations (Correct answer)

Correct answer: Unauthorized disclosures could compromise the investigation or violate legal obligations

Unauthorized or improper law enforcement communication can prejudice investigations, create legal liability, or result in premature disclosure of sensitive breach details.

Question 7: When assessment results for a Network Security Expert evaluation are inconclusive, the BEST practice is to:

Report the results as definitive anyway
Conduct additional assessment using alternative methods (Correct answer)
Discard the results and start over
Delay reporting until results are favorable

Correct answer: Conduct additional assessment using alternative methods

Inconclusive results require additional assessment using alternative methods for triangulation.

Question 8: Which protocol uses port 443 by default?

FTP
HTTPS (Correct answer)
Telnet
HTTP

Correct answer: HTTPS

HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP, which uses SSL/TLS for encryption. It operates over port 443 by default, distinguishing it from standard HTTP which uses port 80. This port assignment is a standard convention that allows web browsers and servers to establish secure, encrypted communication channels for sensitive web traffic.

Question 9: What type of wireless attack involves setting up a rogue access point that mimics a legitimate one to intercept traffic?

Jamming attack
Wardriving
Deauthentication flood attack
Evil Twin attack (Correct answer)

Correct answer: Evil Twin attack

An Evil Twin attack creates a malicious access point with the same SSID and similar characteristics as a legitimate AP, tricking clients into connecting so traffic can be intercepted.

Question 10: Which database provides vulnerability information?

FDA
CISA
NVD (Correct answer)
WHO

Correct answer: NVD

The National Vulnerability Database (NVD) is a U.S. government repository that provides detailed information about known software vulnerabilities. It integrates all publicly available U.S. government vulnerability information, making it a primary and authoritative source for security professionals to research and understand security flaws. Other options like CISA, FDA, and WHO are not primarily vulnerability databases.

Question 11: What is the PRIMARY benefit of data-driven decision making in Network Security Expert?

It guarantees positive results
It provides objective evidence to support decisions, reduce bias, and track outcomes (Correct answer)
It eliminates need for professional judgment
It simplifies decisions to one approach

Correct answer: It provides objective evidence to support decisions, reduce bias, and track outcomes

Data-driven decisions provide objective evidence that reduces bias and enables outcome tracking.

Question 12: What distinguishes a Network Security Expert certified professional from a non-certified practitioner?

Certified professionals only work in larger organizations
There is no meaningful difference
Certification validates competency through standardized assessment against benchmarks (Correct answer)
Certified professionals always have more experience

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 13: In Network Security Expert, what is the PRIMARY purpose of conducting an initial assessment?

To fulfill administrative requirements
To demonstrate the assessor's expertise
To establish a baseline and identify needs for appropriate action (Correct answer)
To generate documentation for billing

Correct answer: To establish a baseline and identify needs for appropriate action

The initial assessment establishes a baseline and identifies specific needs to guide subsequent decisions.

Question 14: What does a transparent (or bridged) firewall do differently from a routed firewall?

It inspects traffic without changing IP addresses or requiring routing changes to the network (Correct answer)
It decrypts all VPN tunnels automatically
It only filters broadcast traffic
It operates only on wireless networks

Correct answer: It inspects traffic without changing IP addresses or requiring routing changes to the network

A transparent firewall operates at Layer 2, inserting itself inline between segments without needing IP addresses on its interfaces or network topology changes.

Question 15: Which wireless security protocol is considered critically vulnerable and must never be used in modern networks?

WPA2-Enterprise with EAP-TLS
WPA2-Personal with AES
WEP (Wired Equivalent Privacy) (Correct answer)
WPA3-Enterprise

Correct answer: WEP (Wired Equivalent Privacy)

WEP uses weak RC4 encryption with static keys and flawed IV implementation, allowing an attacker to crack the key by capturing as few as 50,000 packets.

Question 16: When documenting assessment findings in NSE practice, which approach is MOST appropriate?

Include only positive findings
Use jargon only experts understand
Summarize verbally without written documentation
Record objective findings, measurements, and observations factually (Correct answer)

Correct answer: Record objective findings, measurements, and observations factually

Assessment documentation must be objective, factual, and comprehensive.

Question 17: Which firewall rule action BEST follows a deny-by-default (implicit deny) security posture?

Allow inbound and block outbound
Block UDP and allow TCP by default
Allow all traffic unless explicitly denied
Block all traffic unless explicitly permitted (Correct answer)

Correct answer: Block all traffic unless explicitly permitted

A deny-by-default policy blocks all traffic unless a specific allow rule matches, minimizing attack surface by rejecting unlisted traffic.

Question 18: Which type of analysis examines malware by executing it in a controlled environment to observe behavior?

Code review
Dynamic analysis (Correct answer)
Signature matching
Static analysis

Correct answer: Dynamic analysis

Dynamic analysis executes malware in an isolated sandbox environment and observes its runtime behavior, including file system changes, network connections, and registry modifications.

Question 19: What is the primary function of the SSL/TLS protocol?

Provides IP addressing
Filters email spam
Encrypts data to ensure secure communication (Correct answer)
Ensures file transfer speeds are maximized

Correct answer: Encrypts data to ensure secure communication

The SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocol is fundamental for securing internet communications. Its primary function is to encrypt data exchanged between a web server and a client, protecting it from eavesdropping and tampering. This encryption ensures the confidentiality and integrity of sensitive information, such as login credentials and financial data, during transmission.

Question 20: Which field in the IPv6 header provides a similar security function to IPsec AH's integrity check over the fixed header fields?

Flow Label
There is no such field; IPv6 relies entirely on IPsec AH (Correct answer)
Next Header
Traffic Class

Correct answer: There is no such field; IPv6 relies entirely on IPsec AH

IPv6 itself does not natively provide integrity protection over header fields; that capability requires IPsec AH to be applied.

Question 21: Which encryption approach is most appropriate when an organization needs to protect data confidentiality without the ability to inspect encrypted traffic for threats?

TLS inspection at the perimeter
Asymmetric encryption only
IPsec transport mode
End-to-end encryption (Correct answer)

Correct answer: End-to-end encryption

End-to-end encryption protects data from sender to recipient, but prevents intermediary inspection for threats.

Question 22: What mechanism does SSH use to protect against man-in-the-middle attacks during the initial key exchange?

Mutual TLS authentication
Host key fingerprint verification (Correct answer)
HMAC validation of the session ID
Certificate pinning via a CA

Correct answer: Host key fingerprint verification

SSH relies on the client verifying the server's host key fingerprint against a known-hosts database to detect impersonation.

Question 23: Which technique allows malware to hide its network communication by encoding traffic within legitimate protocols like DNS or HTTP?

Port scanning
SQL injection
Covert channel / protocol tunneling (Correct answer)
ARP poisoning

Correct answer: Covert channel / protocol tunneling

Covert channels and protocol tunneling embed malicious C2 communications within legitimate protocols like DNS queries or HTTP requests to evade detection.

Question 24: Which CVSS v3 metric indicates whether a vulnerability can be exploited without any authentication?

User Interaction: None
Privileges Required: None (Correct answer)
Attack Vector: Network
Scope: Changed

Correct answer: Privileges Required: None

The Privileges Required metric set to None means the attacker requires no authentication to exploit the vulnerability.

Question 25: Which security architecture principle ensures that a compromised component cannot expose the entire system by limiting access between internal zones?

Zero trust
Defense in depth
Segmentation (Correct answer)
Least privilege

Correct answer: Segmentation

Segmentation isolates network zones so a breach in one segment cannot directly propagate to others.

Question 26: When designing SD-WAN security, which FortiGate feature allows traffic steering based on application identity rather than just IP and port?

ISDB-based application steering (Correct answer)
OSPF cost metrics
VLAN tagging
BGP route policy

Correct answer: ISDB-based application steering

FortiGate's Internet Service Database (ISDB) enables SD-WAN rules to steer traffic based on recognized application or service identity.

Question 27: In firewall policy, what does the term 'rule shadowing' mean?

Duplicating rules for redundancy
Applying rules only during off-hours
Hiding rules from unauthorized administrators
A rule that can never be matched because a preceding rule already matches that traffic (Correct answer)

Correct answer: A rule that can never be matched because a preceding rule already matches that traffic

Rule shadowing occurs when a broader rule earlier in the policy matches all traffic intended for a more specific rule, making the specific rule unreachable.

Question 28: Which of the following is a recommended best practice when managing firewall rule bases over time?

Disable logging to improve firewall throughput
Keep all historical rules to avoid accidental blocking
Regularly audit and remove unused or redundant rules to reduce attack surface (Correct answer)
Allow all internal-to-internal traffic by default

Correct answer: Regularly audit and remove unused or redundant rules to reduce attack surface

Periodic rule base audits identify and remove stale, shadowed, or unnecessary rules, reducing complexity and potential security gaps.

Question 29: A post-incident review reveals that the mean time to detect (MTTD) a breach was 120 days. Which improvement would most directly reduce MTTD?

Increasing the number of incident responders on staff
Expanding the backup retention period to 180 days
Implementing stronger password policies across the organization
Deploying user and entity behavior analytics (UEBA) with anomaly detection (Correct answer)

Correct answer: Deploying user and entity behavior analytics (UEBA) with anomaly detection

UEBA with anomaly detection identifies unusual behavior patterns automatically, enabling much faster detection of threats that evade signature-based tools.

Question 30: In a secure network design, what is the purpose of a DMZ (demilitarized zone)?

To store encrypted backups
To host public-facing services isolated from the internal network (Correct answer)
To aggregate all VPN tunnels
To house internal HR systems

Correct answer: To host public-facing services isolated from the internal network

A DMZ places public-facing servers between two firewalls, limiting exposure to the internal trusted network.

Question 31: In NSE exam context, what does 'fail-open' mean for a perimeter security device?

The device blocks all traffic upon hardware failure
The device requires manual restart after failure
The device sends alerts but continues blocking
If the device fails, traffic continues to flow without inspection (Correct answer)

Correct answer: If the device fails, traffic continues to flow without inspection

A fail-open device allows traffic to pass unfiltered upon failure, prioritizing availability over security — the opposite of fail-closed.

Question 32: Which architecture concept describes evaluating every access request as if it originates from an untrusted network, regardless of the user's physical location?

Defense in depth
Zero Trust Network Access (ZTNA) (Correct answer)
Network segmentation
Perimeter-based security

Correct answer: Zero Trust Network Access (ZTNA)

ZTNA enforces 'never trust, always verify' for every access request, treating internal and external networks with the same scrutiny.

Question 33: In the context of WPA3-Enterprise, what key exchange method replaces the Pre-Shared Key to provide forward secrecy?

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) (Correct answer)
Diffie-Hellman Ephemeral (DHE)
RSA key exchange
Simultaneous Authentication of Equals (SAE)

Correct answer: Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)

WPA3-Enterprise mandates ECDHE-based cipher suites to ensure perfect forward secrecy for each session.

Question 34: In a Fortinet Security Fabric deployment, what is the primary role of FortiAnalyzer?

Endpoint detection and response
Firewall policy enforcement
SD-WAN orchestration
Centralized log management and analytics (Correct answer)

Correct answer: Centralized log management and analytics

FortiAnalyzer aggregates logs from Fabric devices and provides centralized analytics and reporting.

Question 35: During incident response, the legal team requests that all IR communications be routed through them. What is the primary reason for this requirement?

To protect communications under attorney-client privilege (Correct answer)
To coordinate with cyber insurance underwriters
To ensure technical accuracy of all communications
To comply with mandatory breach notification timelines

Correct answer: To protect communications under attorney-client privilege

Routing IR communications through legal counsel can establish attorney-client privilege, shielding sensitive incident details from disclosure in litigation.

Question 36: What is the first step in the incident response process?

Identification (Correct answer)
Containment
Eradication
Recovery

Correct answer: Identification

The incident response process typically begins with identification, where an organization detects and confirms a security incident. This initial phase involves monitoring systems, analyzing alerts, and determining if an actual breach or security event has occurred. Accurate identification is crucial for initiating the subsequent response steps.

Question 37: Which type of network address translation (NAT) is commonly used to allow many internal hosts to share a single public IP address?

PAT / NAT overload (many-to-one) (Correct answer)
Static NAT (one-to-one)
Twice NAT (bidirectional)
Dynamic NAT (pool-based)

Correct answer: PAT / NAT overload (many-to-one)

PAT (Port Address Translation), also called NAT overload, maps multiple internal IP:port pairs to a single public IP using different source ports.

Question 38: How frequently should ongoing assessments be conducted in Network Security Expert practice?

Once annually regardless of circumstances
Only when required by external auditors
Only when problems are reported
At regular intervals and as conditions change (Correct answer)

Correct answer: At regular intervals and as conditions change

Ongoing assessments should follow established protocols and also respond to changing conditions.

Question 39: Which method is used by administrators to securely manage firewall devices without exposing management traffic to production networks?

Routing management traffic through the DMZ
Disabling authentication on the management console
Using Telnet on the production interface
Configuring an out-of-band (OOB) management network (Correct answer)

Correct answer: Configuring an out-of-band (OOB) management network

Out-of-band management networks physically separate management traffic from production traffic, preventing attackers with production network access from reaching management interfaces.

Question 40: Which security framework is specifically designed to address adversary tactics and techniques targeting cloud environments?

NIST SP 800-53
ISO 27001
MITRE ATT&CK for Cloud (Correct answer)
OWASP Top 10

Correct answer: MITRE ATT&CK for Cloud

MITRE ATT&CK for Cloud maps specific adversary tactics and techniques observed against cloud platforms like AWS, Azure, and GCP to help defenders detect and respond.

Question 41: Which cryptographic concept ensures that a sender cannot later deny having sent a message?

Confidentiality
Non-repudiation (Correct answer)
Availability
Integrity

Correct answer: Non-repudiation

Non-repudiation, typically enforced via digital signatures, prevents a sender from denying authorship of a message.

Question 42: An enterprise architect wants to ensure business continuity if the primary data center fails. What is the recommended RTO-focused design?

Manual failover to a secondary site within 72 hours
Single data center with RAID storage
Cold site backup with weekly tape restore
Hot standby site with real-time synchronization and automated failover (Correct answer)

Correct answer: Hot standby site with real-time synchronization and automated failover

A hot standby with real-time sync and automated failover minimizes Recovery Time Objective (RTO) to near-zero.

Question 43: What is the primary security advantage of using certificate pinning in mobile applications?

It reduces TLS handshake latency
It prevents the app from trusting rogue CA-signed certificates (Correct answer)
It encrypts all traffic with a stronger cipher
It enables perfect forward secrecy

Correct answer: It prevents the app from trusting rogue CA-signed certificates

Certificate pinning hardcodes the expected certificate or public key, so the app rejects connections even if a trusted CA issues a fraudulent cert.

Question 44: A security architect must protect against insider threats accessing sensitive databases. Which control is most effective at the database layer?

Network firewall between users and DB servers
Endpoint antivirus on workstations
Database Activity Monitoring (DAM) with privileged user controls (Correct answer)
Email filtering

Correct answer: Database Activity Monitoring (DAM) with privileged user controls

DAM monitors and alerts on suspicious database queries, including those from privileged insiders, providing audit trails and anomaly detection.

Question 45: What is the MOST important leadership quality for a NSE certified professional managing a team?

Demonstrating integrity, clear communication, and ability to develop team members (Correct answer)
Avoiding all conflict
Achieving highest personal metrics
Maintaining strict control over all decisions

Correct answer: Demonstrating integrity, clear communication, and ability to develop team members

Effective leadership requires integrity, clear communication, and developing team members.

Question 46: In an enterprise wireless deployment, what is the primary role of a RADIUS server?

To provide DHCP addresses to wireless clients
To authenticate wireless users and authorize network access (Correct answer)
To encrypt wireless traffic using AES encryption
To manage wireless channel and power allocation

Correct answer: To authenticate wireless users and authorize network access

A RADIUS server centralizes Authentication, Authorization, and Accounting (AAA) for 802.1X wireless deployments, validating credentials and enforcing access policies.

Question 47: What distinguishes a vulnerability assessment from a penetration test?

Vulnerability assessments identify and report weaknesses; pen tests attempt to exploit them to demonstrate impact (Correct answer)
Penetration tests use automated scanners; vulnerability assessments are manual only
Vulnerability assessments actively exploit weaknesses; pen tests only report them
They are identical in methodology and scope

Correct answer: Vulnerability assessments identify and report weaknesses; pen tests attempt to exploit them to demonstrate impact

A vulnerability assessment enumerates and ranks weaknesses without exploitation, while a penetration test actively exploits vulnerabilities to demonstrate real-world impact.

Question 48: A next-generation firewall (NGFW) differentiates itself from a traditional stateful firewall primarily by:

Blocking all encrypted traffic
Adding deep packet inspection and application awareness (Correct answer)
Filtering only UDP traffic
Operating only on inbound traffic

Correct answer: Adding deep packet inspection and application awareness

NGFWs incorporate deep packet inspection, application identification, user-identity awareness, and integrated IPS capabilities beyond traditional stateful inspection.

Question 49: Which cloud security principle recommends distributing workloads across multiple availability zones?

Zero trust networking
Defense in depth
High availability and resilience (Correct answer)
Least privilege

Correct answer: High availability and resilience

Deploying across multiple availability zones ensures that a failure in one physical data center location does not render the entire application unavailable.

Question 50: During triage, an analyst classifies an alert as a 'false positive.' What does this classification mean, and what is the appropriate next action?

A real attack occurred but was blocked; escalate to containment
Malicious activity was correctly identified; begin eradication
A real attack was missed; update signatures immediately
Benign activity was flagged as malicious; tune detection rules to reduce noise (Correct answer)

Correct answer: Benign activity was flagged as malicious; tune detection rules to reduce noise

A false positive is a benign event incorrectly flagged as malicious; the proper response is to document it and tune detection logic to prevent recurrence.

Question 51: Which standard provides a structured language for describing cyber threat intelligence, commonly used with TAXII for automated sharing?

OVAL
OpenIOC
STIX (Structured Threat Information eXpression) (Correct answer)
SCAP

Correct answer: STIX (Structured Threat Information eXpression)

STIX is a standardized language for representing CTI objects such as threat actors, campaigns, and indicators, and is typically transported via the TAXII protocol for automated sharing.

Question 52: During eradication, investigators confirm a threat actor maintained persistence via a scheduled task. Which action is MOST important before removing the persistence mechanism?

Patch the vulnerability that allowed initial access
Update endpoint detection and response (EDR) signatures
Notify affected users to change their passwords
Document and preserve forensic artifacts related to the scheduled task (Correct answer)

Correct answer: Document and preserve forensic artifacts related to the scheduled task

Preserving forensic artifacts before removal ensures evidence integrity for legal proceedings and root cause analysis.

Question 53: Which perimeter security control is BEST suited to detecting and blocking known exploit signatures in real time?

VLAN segmentation
Intrusion Prevention System (IPS) (Correct answer)
Stateful firewall
AAA server

Correct answer: Intrusion Prevention System (IPS)

An inline IPS inspects traffic against a signature database and actively drops packets that match known exploit patterns before they reach targets.

Question 54: Which attack specifically targets the firewall's connection state table to exhaust its resources?

Pass-the-hash attack
SYN flood attack (Correct answer)
Phishing
SQL injection

Correct answer: SYN flood attack

A SYN flood sends large numbers of half-open TCP connection requests to fill the stateful firewall's connection table, causing denial of service.

Question 55: What is the purpose of egress filtering on a perimeter firewall?

To block inbound attacks from external networks
To inspect traffic between VLANs internally
To perform NAT on inbound connections
To restrict unauthorized outbound traffic leaving the internal network (Correct answer)

Correct answer: To restrict unauthorized outbound traffic leaving the internal network

Egress filtering prevents compromised internal hosts from exfiltrating data or communicating with command-and-control servers on the internet.

Question 56: What does a 'trust but verify' model differ from a Zero Trust model in practical network design?

Zero Trust eliminates the need for firewalls
Trust but verify grants implicit internal network trust; Zero Trust requires continuous verification (Correct answer)
Trust but verify uses MFA while Zero Trust does not
Zero Trust requires biometric authentication for all users

Correct answer: Trust but verify grants implicit internal network trust; Zero Trust requires continuous verification

Traditional 'trust but verify' implicitly trusts internal users, whereas Zero Trust continuously validates every access request regardless of location.

Question 57: When analyzing a suspicious email attachment, an analyst submits it to a sandbox. The sandbox shows the sample sleeping for 5 minutes before executing. This behavior is an example of:

Buffer overflow exploitation
Living-off-the-land technique
Sandbox evasion through timing delay (Correct answer)
Polymorphic code

Correct answer: Sandbox evasion through timing delay

Malware uses timing delays to evade sandboxes, which often have short analysis windows and will report the sample as benign if no malicious behavior is observed quickly.

Question 58: What is the security risk associated with allowing 'any-to-any' rules in a firewall policy?

It eliminates all traffic restrictions, maximizing the attack surface across the network (Correct answer)
It disables NAT functionality
It increases firewall CPU usage only
It forces traffic to be re-routed through a proxy

Correct answer: It eliminates all traffic restrictions, maximizing the attack surface across the network

Any-to-any rules permit all traffic between zones, effectively disabling the firewall's protective function and exposing all services to potential attack.

Question 59: What is the primary goal of threat intelligence sharing communities such as ISACs?

Providing penetration testing services to members
Replacing national CERTs in incident response
Selling vulnerability data to government agencies
Enabling sector-specific organizations to share threat data to improve collective defenses (Correct answer)

Correct answer: Enabling sector-specific organizations to share threat data to improve collective defenses

Information Sharing and Analysis Centers (ISACs) allow organizations within the same industry sector to share threat intelligence, enabling faster collective response to emerging threats.

Question 60: Which stakeholder engagement strategy is MOST effective for NSE professionals?

Limit engagement to senior leadership
Inform stakeholders only after decisions are made
Identify stakeholders early, understand their interests, and maintain regular communication (Correct answer)
Engage only when approval is needed

Correct answer: Identify stakeholders early, understand their interests, and maintain regular communication

Early stakeholder identification with regular communication builds support and prevents surprises.

Fortinet NSE 4 - FortiGate Network Security Professional

This exam certifies the ability to configure, install, and monitor the FortiGate device to support specific network security policies.

Questions

120 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds