Fortinet Secure Networking (FortiGate) Practice Exam

What the Fortinet Secure Networking (FortiGate) exam covers

• System Troubleshooting165 questions
• Authentication134 questions
• Security Profiles165 questions
• Routing175 questions
• VPN174 questions

Free Fortinet Secure Networking (FortiGate) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 813.

1. Question 1Authentication

   An administrator needs to create a local firewall user named jsmith who authenticates with a static password stored on the FortiGate. Which CLI path creates this user?

   • Aconfig user local, set type password, set passwdCorrect
   • Bconfig user peer, set ca, set subject
   • Cconfig user radius, set server, set secret
   • Dconfig system admin, set accprofile, set password
   ✓ Correct answer: A

   `config user local`, `edit jsmith`, `set type password`, `set passwd <value>` creates a local entry authenticated against a static password stored on the FortiGate itself, matching the requirement. `user peer` binds identity to a certificate instead, `user radius` points to an external server instead of storing credentials locally, and `system admin` creates an administrator login, not a firewall identity policies can reference.

   Why the other options are wrong

   • B`config user peer` defines a certificate-based identity, not a password user, so it cannot create jsmith.
   • C`config user radius` only defines a remote server and shared secret; it stores no local password.
   • D`config system admin` creates an administrator login for managing the FortiGate, not a firewall identity for policy Source.
2. Question 2Authentication

   What is the purpose of configuring Group Filters in the FSSO Collector Agent?

   • ATo restrict which AD security groups are monitored and reportedCorrect
   • BTo encrypt traffic between the Collector Agent and FortiGate
   • CTo assign static IP addresses to workstations
   • DTo load-balance sessions across multiple FortiGates
   ✓ Correct answer: A

   The Collector Agent's Group Filters setting lets an admin specify which AD security groups are tracked for FSSO; logons from users outside the filtered groups are never processed or forwarded to FortiGate. This cuts processing load on the Collector Agent and shrinks the FSSO entry list FortiGate holds, which matters in large AD forests with many irrelevant groups. It has no effect on encryption, IP assignment, or FortiGate load balancing.

   Why the other options are wrong

   • BEncryption between the Collector Agent and FortiGate is a separate connection setting, not Group Filters.
   • CGroup Filters do not assign IP addresses; that is a DHCP server function.
   • DGroup Filters have no role in load-balancing sessions across FortiGates; that is unrelated to group scoping.
3. Question 3Routing

   How does a blackhole static route differ from a firewall policy with action deny for the same destination subnet?

   • AA blackhole route drops traffic at the routing stage, before policy lookupCorrect
   • BThey are functionally identical in every respect
   • CA blackhole route only applies to IPv6 traffic
   • DA deny policy requires a corresponding static route, while a blackhole route does not
   ✓ Correct answer: A

   FortiOS evaluates routing before firewall policy matching, so a blackhole static route discards matching traffic at the routing stage, before the packet reaches the policy table. A deny policy still requires routing, session setup, and policy evaluation before rejecting the packet. The two act at different stages and are not interchangeable. Blackhole routes apply to both IPv4 and IPv6, and a deny policy works independently of any static route for its destination.

   Why the other options are wrong

   • BThe two mechanisms differ in processing stage, so they are not functionally identical.
   • CBlackhole routes apply to both IPv4 and IPv6, not just one address family.
   • DA deny policy works without any accompanying static route for its destination.
4. Question 4Routing

   An engineer wants to change an inbound route-map on a BGP neighbor and see the effect without resetting the session, without requiring the peer to resend its full table on demand. Which neighbor setting must be enabled ahead of time to store the unfiltered inbound routes for this?

   • Aset next-hop-self enable
   • Bset soft-reconfiguration enableCorrect
   • Cset ebgp-enforce-multihop enable
   • Dset graceful-restart enable
   ✓ Correct answer: B

   B is correct. `set soft-reconfiguration enable` on the neighbor stores a full, unfiltered copy of every route received before the inbound route-map applies. After editing the route-map, `execute router clear bgp ip <neighbor> soft in` reprocesses that stored copy against the new policy and updates the BGP table, without a hard reset or asking the peer to resend anything at all.

   Why the other options are wrong

   • Anext-hop-self only rewrites outbound iBGP next-hop advertisements; it does not store inbound routes.
   • Cebgp-enforce-multihop only affects TTL handling for multihop eBGP sessions.
   • Dgraceful-restart preserves forwarding across a restart, unrelated to storing routes for policy changes.
5. Question 5Security ProfilesSelect all that apply

   Which TWO are appropriate uses of a web rating override in FortiOS 7.6? (Choose TWO)

   • ARedirecting AV/IPS update traffic to a FortiManager
   • BCorrecting a miscategorized business siteCorrect
   • CAdjusting the FGCP HA priority of a cluster member
   • DReclassifying a URL locally without a global updateCorrect
   • EAdjusting the administrative distance of a default route
   ✓ Correct answer: B, D

   B and D are correct: a web rating override reassigns a specific URL's category, designed for exactly these two cases: correcting a legitimate business site FortiGuard has miscategorized, and reclassifying a URL locally without waiting for a global FortiGuard database update. Redirecting AV/IPS updates uses a separate autoupdate override-server feature, HA priority is a cluster setting, and administrative distance is a routing parameter.

   Why the other options are wrong

   • ARedirecting AV/IPS updates uses the separate autoupdate override-server feature, not a rating override.
   • CFGCP HA priority is a cluster setting under config system ha, unrelated to URL categorization.
   • EAdministrative distance is a routing preference value, unrelated to reassigning a URL's category.
6. Question 6Security Profiles

   Where is the maximum disk space allotted for IPS packet logs (captured packets attached to IPS log entries) configured?

   • Aconfig log disk setting, field diskfull
   • Bconfig ips sensor, field rate-duration
   • Cconfig ips settings, field ips-packet-quotaCorrect
   • Dconfig system global, field admin-https-ssl-versions
   ✓ Correct answer: C

   config ips settings includes ips-packet-quota, which sets the maximum disk space, in bytes, the FortiGate reserves for packets captured through IPS packet logging (packet-log enabled on sensor entries). Once captures reach that quota, the FortiGate purges older packet logs to make room for new ones, preventing captures from consuming unbounded disk space over time. This differs from diskfull under config log disk setting, which governs overall log-disk-full behavior in general, not the packet-log feature tied to individual IPS matches.

   Why the other options are wrong

   • Adiskfull controls overall log-disk-full behavior, not IPS packet-log storage specifically.
   • Brate-duration is a rate-based signature timing field, unrelated to disk space.
   • DThat field controls admin HTTPS TLS versions, unrelated to IPS logging.
7. Question 7System TroubleshootingSelect all that apply

   Which two items should an engineer check when a fabric connector to a cloud provider fails to authenticate? (Choose TWO)

   • AWhether the connector's region or endpoint setting is correctCorrect
   • BThe API credentials or IAM role assigned to the connectorCorrect
   • CWhether IPS is enabled on all policies
   • DWhether the FortiGate is in transparent mode
   • EWhether the HA heartbeat interface is up
   ✓ Correct answer: A, B

   A public-cloud fabric connector authenticates outbound to the provider's API using a credential set - an access key, IAM role, or service principal - and calls a specific regional endpoint. The two most common failure causes are an invalid, expired, or under-permissioned credential/IAM role, and a region or endpoint value that does not match where the queried resources actually live. Checking both rules out the connector's own auth path first.

   Why the other options are wrong

   • CIPS status affects local traffic inspection only, not the connector's outbound API authentication.
   • DNAT versus transparent mode does not block a connector's outbound API call.
   • EHA heartbeat status governs cluster sync, unrelated to outbound cloud API authentication.
8. Question 8System TroubleshootingSelect all that apply

   Which two pieces of information appear in a diagnose sys session list entry for a NATed session? (Choose TWO)

   • AThe translated NAT source or destination address and portCorrect
   • BThe IPS sensor name applied to the matching policy
   • CThe hook and direction fields, such as hook=post dir=org act=snatCorrect
   • DThe administrative distance of the route used
   • EThe FortiGuard web category of the destination
   ✓ Correct answer: A, C

   A NATed session entry shows the translated source or destination address and port actually used, letting an engineer confirm exactly how the original address was rewritten. The same entry also includes hook, direction, and action fields, such as `hook=post dir=org act=snat` or `act=dnat`, describing at what stage and direction the translation applied. Together these fields give a full picture of how and where addressing was rewritten, without consulting the policy configuration separately.

   Why the other options are wrong

   • BThe IPS sensor name is not part of the session entry; it lives in policy configuration and logs.
   • DAdministrative distance is a routing attribute used for route selection, never shown in a session entry.
   • EThe FortiGuard web category is recorded in web filter logs, not the session table entry.
9. Question 9VPN

   What is the purpose of `set peerid` under an IKEv1 phase1-interface using aggressive mode with pre-shared keys?

   • AIt sets the DH group the peer must use
   • BIt requires a matching ID payload from the peerCorrect
   • CIt defines the phase 2 selector for the tunnel
   • DIt forces the tunnel to use NAT-T port 4500
   ✓ Correct answer: B

   `set peerid` under aggressive mode with PSK tells the FortiGate what identifier it expects in the remote peer's ID payload, which arrives in cleartext in aggressive mode's first message; if the received ID does not match the configured peerid, phase 1 fails even if the PSK is correct and DH completed. This is separate from the DH group (`set dhgrp`), phase 2 selectors (under phase2-interface), and NAT-T behavior (`set nattraversal`), each governing a distinct part of negotiation.

   Why the other options are wrong

   • ADH group is a separate proposal parameter (`set dhgrp`), unrelated to peerid identity matching.
   • CPhase 2 selectors are configured under phase2-interface, entirely separate from peerid.
   • DNAT-T port usage is controlled by `set nattraversal`, unrelated to peer identity checking.
10. Question 10VPNSelect all that apply

    Which two ADVPN messages are exchanged directly between a SPOKE and the HUB during shortcut negotiation, as opposed to being sent directly between the two spokes? (Choose TWO)

    • Ashortcut-queryCorrect
    • Bshortcut-offer
    • Cshortcut-replyCorrect
    • Dshortcut-ack
    • Eshortcut-teardown
    ✓ Correct answer: A, C

    A and C are correct: shortcut-query is what a spoke sends the hub requesting another spoke's connection details, and shortcut-reply is the hub's response containing those details; both travel directly with the hub, the only device with live phase1 relationships to every spoke. The trap is shortcut-offer, which sounds like it belongs in this exchange but is actually sent directly between the two spokes once the reply is received, bypassing the hub entirely.

    Why the other options are wrong

    • Bshortcut-offer goes directly between the two spokes after they learn each other's details.
    • Dshortcut-ack is not a defined ADVPN message between a spoke and the hub.
    • Eshortcut-teardown is not defined; tearing down a shortcut uses standard IKE delete notifications.

Who this Fortinet Secure Networking (FortiGate) practice exam is for

This practice set is for anyone preparing for the Fortinet Secure Networking (FortiGate) exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Fortinet Secure Networking (FortiGate) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Fortinet Secure Networking (FortiGate) exam.

Related Security resources

• Fortinet Secure Networking (FortiGate) study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• CompTIA SecurityX (CAS-005, formerly CASP+) practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated

Fortinet Secure Networking (FortiGate) practice exam FAQ