Explanation:

✅ Option A (Correct)

Reasoning: For active authentication (captive portal) to function correctly for web access, clients must first resolve website domain names. The firewall policy shown only allows ALL_ICMP, HTTPS, and HTTP services. Without explicitly permitting DNS (UDP/53 and TCP/53) in the policy, clients cannot resolve external hostnames. Consequently, they cannot initiate HTTP/HTTPS connections, preventing the FortiGate from intercepting traffic to display a login prompt.

❌ Why the other choices are incorrect:

• Option B is incorrect: The ‘Remote-users’ group is correctly placed in the Source, specifying which users require authentication. Adding it to the Destination, which is ‘all’ for internet access, would be illogical and not resolve the issue.
• Option C is incorrect: The question specifically refers to an “active authentication method” and a “login prompt.” FSSO (Fortinet Single Sign-On) is a passive authentication method that typically does not involve a login prompt for each web access. Therefore, FSSO configuration is irrelevant in this scenario.
• Option D is incorrect: If no matching user account existed, the user would still be presented with a login prompt (assuming the authentication realm is configured). The issue described is the *absence* of a login prompt, not a failed login attempt after a prompt.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/464817/configuring-an-active-authentication-firewall-policy

Explanation: The web filter profile is not listed because the firewall policy is in ‘no-inspection’ mode. This mode prevents any security profiles, including web filter profiles, from being applied or even displayed for selection. Web filtering features, especially advanced ones like daily category usage quotas, require traffic inspection (either flow-based or proxy-based). If the policy is set to ‘no-inspection’, security profiles are disabled for that policy. While ‘deep-inspection’ is required for comprehensive SSL/TLS inspection, the fundamental blocker here is the complete absence of any inspection mode.

Reference: https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/469440/firewall-policy

Explanation:

✅ Option A (Correct)Reasoning: Agentless FSSO relies solely on polling Domain Controllers for security event logs to detect user logins and logouts. It does not perform active workstation checks, as this would typically require an agent or direct endpoint interrogation.
✅ Option D (Correct)Reasoning: FortiGate in agentless FSSO mode uses protocols like SMB (Service Message Block) and WMI (Windows Management Instrumentation) to remotely access and read the security event logs from the Domain Controllers, extracting user authentication information.
❌ Why the other choices are incorrect:

• Option B is incorrect: In agentless polling, FortiGate directly performs the collection from DCs; there is no separate "collector agent" that FortiGate directs to an LDAP server for event collection.
• Option C is incorrect: The FortiGate is the entity performing the collection. The Active Directory (AD) server (specifically, Domain Controllers) is the source of the event logs, not a "collector agent" for the FortiGate.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/469493/ssop-agentless-polling

Explanation: The problem indicates an inability to access Google applications while other websites are accessible. The FortiGate firewall policy uses Proxy-based Inspection mode and certificate-inspection for SSL inspection. The application sensor has an override for ‘Google’ set to ‘Monitor’.

• ✅ D: Set SSL inspection to deep-content inspection. Certificate inspection only checks the certificate, not the encrypted content. Many modern applications, especially Google services, require full SSL decryption (deep-content inspection) for the FortiGate to accurately identify the specific applications and apply application control rules effectively. Without decryption, the traffic often remains unidentified, leading to implicit blocks.
• ✅ E: Move up Google in the Application and Filter Overrides section to set its priority to 1. In the application sensor, ‘Excessive-Bandwidth’ is at Priority 1 and set to ‘Block’, while ‘Google’ is at Priority 2 and set to ‘Monitor’. If Google application traffic matches the ‘Excessive-Bandwidth’ filter first, it will be blocked. Elevating ‘Google’ to Priority 1 ensures that its ‘Monitor’ (allow) action takes precedence over the ‘Excessive-Bandwidth’ block.

Why other choices are incorrect:

• ❌ A: Change the Inspection mode to Flow-based. Proxy-based inspection generally provides more granular control and is necessary for advanced features like deep SSL inspection and comprehensive application control. Changing to flow-based would reduce capabilities and is unlikely to resolve the issue.
• ❌ B: Set the action for Google in the Application and Filter Overrides section to Allow. The ‘Monitor’ action in application control overrides already allows traffic through while logging it. Changing it to ‘Allow’ would not functionally resolve a blocking issue if the underlying problem is identification (due to SSL inspection) or rule precedence.
• ❌ C: Add “Google”.com to the URL category in the security profile. The issue specifically relates to application control, which is distinct from URL filtering. While URL filtering might be applied, the configuration shown and the problem description point to an application control issue, not a URL category issue.

Reference: https://docs.fortinet.com/document/fortigate/7.6.0/fortios-handbook/325776/application-control

Explanation: An Active-Passive (A-P) HA cluster determines the primary based on device priority, then uptime, then serial number. However, failover conditions can override this. HQ-NGFW-1 has memory-based-failover enable with a memory-failover-threshold of 70%. Its current memory usage is 90%, which exceeds this threshold. This condition will trigger a failover, causing HQ-NGFW-1 to relinquish primary status and HQ-NGFW-2 to become the primary. The override disable setting on HQ-NGFW-1 prevents preemption by a higher-priority device but does not prevent failover due to monitored conditions. Therefore, HQ-NGFW-2 is the primary due to HQ-NGFW-1 exceeding its memory failover threshold.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/526715/ha-advanced-settings

Explanation:

✅ Option B (VPN policies) (Correct)The FortiClient agent, fundamental to FortiSASE’s agent-based mode, establishes a secure tunnel to the FortiSASE PoP. This connectivity relies directly on VPN policies, which define how the tunnel is created and managed, ensuring traffic is routed correctly for secure internet access.✅ Option D (FortiSASE Firewall-as-a-Service (FWaaS)) (Correct)Once the agent’s traffic is routed to FortiSASE via the VPN tunnel, it is processed by the cloud-native security services. FWaaS is a core component of FortiSASE, providing firewall capabilities, policy enforcement, and threat protection for all internet-bound traffic, thus delivering the "secure internet access" part of the service.❌ Why the other choices are incorrect:* Option A is incorrect: FortiExtender is a hardware device for extending network connectivity, typically via cellular or Wi-Fi, not a component of the agent-based software mode for traffic redirection or security enforcement.* Option C is incorrect: While PAC files can redirect traffic to proxies, the primary method for comprehensive secure internet access in FortiSASE’s agent-based mode (using FortiClient) is typically an SSL VPN tunnel. PAC files are more common for explicit proxy deployments, which can be agentless or agent-managed, but VPN policies are central to the agent-tunneling model.

Reference: https://docs.fortinet.com/document/fortisase/latest/admin-guide/708605/secure-internet-access-for-remote-users

Explanation: ✅ Option A (Correct)
Reasoning: The remote address on BR1-FGT (10.11.0.0/255.255.255.0) must match the local address on HQ-NGFW (10.0.11.0/255.255.255.0). Changing BR1-FGT’s remote address to 10.0.11.0/255.255.255.0 corrects this crucial proxy ID mismatch for Phase 2 negotiation.

✅ Option C (Correct)
Reasoning: HQ-NGFW’s encryption is set to AES128, while BR1-FGT’s is AES256. For Phase 2 to establish, encryption algorithms must match. Setting HQ-NGFW’s encryption to AES256 resolves this mismatch, aligning it with BR1-FGT’s configuration.

❌ Why the other choices are incorrect:

• Option B is incorrect: While changing the Key lifetime on BR1-FGT to 43200 seconds would resolve a mismatch with HQ-NGFW’s setting, other critical mismatches (proxy ID and encryption) must also be addressed for Phase 2 to come up. This option is a valid fix for a mismatch but not one of the two primary solutions chosen in this context.
• Option D is incorrect: The Diffie-Hellman Group 5 is already enabled and matched on both HQ-NGFW and BR1-FGT. Enabling Group 2 on HQ-NGFW would either create a new mismatch or is unnecessary, as PFS settings are already correctly aligned.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/202685/ipsec-phase-2-settings

Explanation: The firewall policy is configured for Proxy-based inspection mode. However, the web filter profile ‘default’ is configured with a Flow-based feature set. FortiGate requires the security profile’s feature set to match the firewall policy’s inspection mode for proper application. This mismatch prevents the web filter profile’s rules, including allowing ‘Social Networking’ and monitoring ‘www.facebook.com’, from being correctly applied. Consequently, traffic to www.facebook.com is blocked, likely by a fallback mechanism or miscategorization due to the profile not functioning as intended, leading to the ‘Malicious Websites’ block page.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/523193/firewall-policy-inspection-modes

Explanation:

✅ Option A (Correct)

Reasoning: FortiGuard server selection prioritizes servers with lower (more negative) weight values, indicating better performance. Fortinet documentation states that the weight value increases (becomes less negative or more positive) as round trip time (RTT) increases or the number of failed packets rises. Therefore, an increase in failed packets makes the server less preferred, resulting in an increased weight.

✅ Option B (Correct)

Reasoning: The exhibit clearly shows “Port : 8888” for FortiGuard communication. TCP port 8888 is a standard default port for FortiGuard services, especially for HTTPS-based web filtering and antivirus updates, alongside TCP 443.

❌ Why the other choices are incorrect:

• Option C is incorrect: The FortiGate is communicating with a private IP address (10.0.1.241) and the output states “Default servers: Not included”. This indicates a custom FortiGuard Distribution Server (FDS) setup. This IP could be statically configured, bypassing DNS lookup for its identification. The exhibit does not provide enough information to definitively conclude that DNS was used to identify this specific server.
• Option D is incorrect: The exhibit shows “Protocol : https”, which is a reliable protocol (TCP-based). While DNS (UDP) is used for FortiGuard server resolution, the core FortiGuard services like web filtering and antivirus updates primarily communicate via HTTPS (TCP 8888 or 443). You cannot configure these primary services to use unreliable protocols.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/862145/fortiguard-services

Explanation: The traffic from HQ-PC-1 (10.0.11.50) to BR-FGT (100.65.1.111) is a PING. Firewall policies are evaluated in order. Policy 3, named ‘PING traffic’, specifically matches traffic with the PING service. This policy is configured to use the ‘SNAT-Remote1’ IP pool for Source NAT. According to the NAT IP pool configuration, ‘SNAT-Remote1’ uses the external IP range 100.65.0.99 – 100.65.0.99. Therefore, 100.65.0.99 will be used as the SNAT IP.

Reference: https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/463836/ip-pools

Explanation:

✅ Option A (Correct)Reasoning: When FortiGate enters conserve mode, it prioritizes existing connections and critical processes. It explicitly stops accepting new configuration changes to prevent further memory allocation, ensuring system stability.✅ Option B (Correct)Reasoning: Conserve mode’s primary goal is to maintain core functionality. FortiGate continues to process existing sessions and run critical security actions like quarantining or inspecting active traffic, though new sessions might be denied.❌ Why the other choices are incorrect:* Option C is incorrect: Conserve mode is designed to prevent a complete system halt or crash by shedding non-essential functions, not to stop all operations. A reboot might resolve the memory issue, but it’s not a direct consequence of conserve mode itself.* Option D is incorrect: While IPS might be affected by memory constraints in conserve mode, traffic bypasses IPS inspection only if the IPS service fails and the fail-open global setting is enabled. This is a conditional behavior, not a universal one, and fail-open is a specific configuration choice, not a direct conserve mode effect.

Reference: https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/526710/conserve-mode

Explanation:

The Antivirus scan switch is grayed out because the FortiGate antivirus profile is configured for Flow-based inspection. For comprehensive antivirus scanning of protocols like FTP, FortiGate requires Proxy-based inspection. Flow-based inspection typically performs a lighter scan and does not support full file buffering necessary for deep AV inspection on all protocols. Switching the feature set to Proxy-based would enable the Antivirus scan option.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/403814/inspection-modes-flow-based-and-proxy-based

Explanation:

✅ Option D (Correct)

When an application override action is set to Allow, FortiGate’s Application Control typically permits the traffic without generating specific security logs for the ‘allow’ event itself. Application control logs are primarily generated for actions like Block, Monitor, or Quarantine. While firewall policy session logs will record the connection, specific application security logs for the allowed application will not be created by default.

❌ Why the other choices are incorrect:

• Option A is incorrect: The ABC.Com override (Priority 1) has an Allow action. Even if ABC.Com traffic was related to ‘Excessive-Bandwidth’ (Priority 2, Block), the higher-priority explicit override for ABC.Com would take precedence. Furthermore, if it were blocked, logs would be generated, contradicting the problem statement of ‘no logs’.
• Option B is incorrect: Application Control and Web Filtering are distinct security features. An application override in an application control profile does not require the configuration to be a web filter profile to enable logging for application events.
• Option C is incorrect: The ‘Type’ being ‘Application’ is correct for an application signature. Changing it to ‘Filter’ would alter its matching behavior, not resolve a logging issue related to an ‘Allow’ action.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/526715/application-control

Explanation:

✅ Option A (Correct)

Reasoning: The command output diagnose test application ipsmonitor 1 shows engine count = 0 (+1). This indicates that no IPS engine is actively processing traffic. The most common reason for IPS not inspecting traffic is that no firewall policies have an IPS security profile applied, hence no traffic is being offloaded to the IPS engine.

❌ Why the other choices are incorrect:

• Option B is incorrect: The exhibit clearly shows the command diagnose test application ipsmonitor 1, not 5.
• Option C is incorrect: IPS fail-open usually means traffic bypasses the IPS engine due to a failure, but the output engine count = 0 directly points to a lack of active processing, most often due to configuration, not necessarily a fail-open state.
• Option D is incorrect: The exhibit clearly shows the command diagnose test application ipsmonitor 1, not 99.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/fortios-handbook/472661/diagnose-commands-and-debugging

Explanation:

✅

Option D (Correct)

HQ-NGFW-2 is configured with override enable and a higher priority (110) than HQ-NGFW-1 (90). When override enable is active on any HA member, the unit with the highest priority assumes the primary role. This configuration will trigger an election, causing HQ-NGFW-2 to become the new primary.

❌

Why the other choices are incorrect:

• Option A is incorrect: The override setting does not need to match across HA members; it is part of the election logic. Differing settings define HA behavior.
• Option B is incorrect: HA synchronization primarily applies to general configuration, not election-specific parameters like override and priority, which are used to determine roles.
• Option C is incorrect: HQ-NGFW-2 has a priority of 110, which is higher than HQ-NGFW-1’s priority of 90, making this statement factually incorrect.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/463286/ha-settings

Explanation:

✅ Option A (Correct)
Once a firewall policy is created, its unique policy ID is assigned by the FortiGate system and cannot be directly modified by the user. While policies can be reordered, the numerical ID associated with the policy object itself remains static.
✅ Option B (Correct)
FortiGate processes firewall policies in a top-down manner, evaluating them sequentially based on their policy ID, from lowest to highest. The first policy that matches the traffic criteria is applied, determining the order of execution.
❌ Why the other choices are incorrect:

• Option C is incorrect: It is not mandatory to provide a policy ID when creating a firewall policy. The FortiGate system automatically assigns the next available sequential ID, whether created via GUI or CLI.
• Option D is incorrect: FortiGate firewall policy IDs start from 1. Policy ID 0 is reserved or invalid for user-created firewall policies.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/469049/firewall-policies

Explanation: The administrator can achieve the objective by configuring the specific IPS signatures with the rate-mode periodical option. This allows defining a rate-count (number of triggers) and a rate-duration (time period) for the signature. When the signature triggers the specified number of times within the duration, the configured action (e.g., block) will be taken against the tracked packets. This directly addresses blocking traffic that triggers a signature a set number of times during a specific period.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/526760/configuring-ips-signatures

Explanation:

✅ Option D (Correct)

Reasoning: When traffic does not match any explicit, user-defined SD-WAN rule, FortiGate processes it using the implicit (default) SD-WAN rule. This implicit rule does not have a configurable name, hence the “SD-WAN Rule Name” column in the traffic logs will appear empty, accurately reflecting that no specific named rule was matched for steering.

❌ Why the other choices are incorrect:

• Option A is incorrect: The traffic log clearly displays “Application Name” (e.g., YouTube, Facebook, CNN), indicating that application identification and feature visibility are enabled and functional. The problem is the missing SD-WAN rule name, not application detection.
• Option B is incorrect: Refreshing the page addresses temporary display glitches, not a consistent absence of data in a log column when the underlying mechanism (SD-WAN rule matching) is the issue.
• Option C is incorrect: The log shows identified applications and “Accept (UTM Allowed)” status, which implies an application control profile (or deep inspection) is indeed applied and successfully identifying traffic.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/526715/sd-wan-implicit-rules

Explanation:

The Gateway Load Balancer Endpoint (GWLBe) is deployed in the customer’s VPC as a crucial part of the FortiGate CNF integration. Its purpose is to redirect traffic from the EC2 instance to the FortiGate Cloud-Native Firewall’s Gateway Load Balancer (GWLB) for inspection. While the GWLB itself is created by the FortiGate CNF service in its own VPC, the GWLBe is the specific component within the customer’s VPC that enables traffic originating from EC2 to be steered towards the CNF for handling. Other options include components not created by FortiGate CNF (e.g., Customer VPC, Internet Gateway) or are incomplete.

Reference: https://docs.fortinet.com/document/fortigate-cnf/latest/deployment-guide/469443/introduction-to-fortigate-cnf-on-aws