Fortinet Certified Expert (FCX) - Cybersecurity Free Sample Questions

To achieve deterministic session handling and steer specific traffic to a designated FIM, policy-based session affinity is required. The set affinity-group command within a firewall policy allows an administrator to bind traffic matching that policy to a specific FIM, overriding the default load balancing behavior. This ensures high-priority traffic is handled by the preferred module, providing predictable performance and failover behavior.

In a dual-hub ADVPN setup, spokes connected to Hub A need to learn the routes for spokes connected to Hub B to trigger shortcut tunnel creation. The most effective way to achieve this is by establishing an iBGP peering between the two hubs. This allows each hub to share the routes learned from its connected spokes with the other hub, providing all spokes with a complete routing table of the entire ADVPN domain.

When nat is enabled on the firewall policy that handles the SD-WAN traffic, existing sessions are tied to the specific NAT IP of the outgoing interface (MPLS in this case). By default, FortiOS will not move an existing, NATed session to a new interface even if the SD-WAN rules dictate a path change. This is to prevent breaking the session, as the source IP would change mid-session. New sessions are not affected and will correctly choose the better-performing link. To allow existing sessions to fail over, set session-snat-route-change enable must be configured in the system settings.

ZTNA relies on client certificates to cryptographically identify and authenticate the connecting device. If the user's FortiClient does not present a valid certificate that is trusted by the FortiGate ZTNA server, the connection will be denied at the policy level.

ZTNA policies enforce access based on both device identity (certificate) and user identity. If the authenticated user is not part of the user group authorized in the ZTNA policy's source field, the traffic will be denied, resulting in a 'Permission Denied' error.

For a FortiGate automation stitch to react promptly to an event detected on FortiAnalyzer (such as a specific log pattern or IOC), the FortiGate must be configured to upload logs in real-time. If logs are sent in store-and-upload mode, there will be a delay between the event occurrence and its detection on FortiAnalyzer, which would prevent the stitch from executing in a timely manner.

The correct, non-disruptive procedure for upgrading an MCLAG pair is to upgrade one switch at a time. The recommended practice is to first set the secondary (passive) peer to standalone mode, which isolates it from the MCLAG domain. After upgrading and rebooting the secondary switch, you can fail over traffic to it (by shutting down links on the primary or rebooting it) and then proceed with upgrading the original primary switch. This rolling upgrade process ensures that at least one switch is always active and forwarding traffic.

This solution leverages the existing central management infrastructure to create a scalable, automated, and fabric-wide response. FortiAnalyzer acts as the central detection point. The FortiAnalyzer-FortiManager webhook integration provides the trigger mechanism. FortiManager's automation stitch and scripting capabilities can then update a dynamic address group (like an IP list or threat feed) that is already part of a shared policy package. When this object is updated on FortiManager, the change is automatically pushed to all managed FortiGates, effectively quarantining the host across the entire organization in a synchronized and efficient manner.

Traffic shaping is a feature that requires CPU processing to manage queues and enforce bandwidth limits. When a traffic shaper is applied to a firewall policy, sessions matching that policy are sent to the CPU and cannot be offloaded to NP7 processors.

Proxy-based inspection mode requires the FortiGate to terminate and re-initiate connections to perform in-depth analysis. This process is handled by the CPU and the content processors (CPs), not the network processors (NPs). Therefore, traffic subject to proxy-based inspection cannot be offloaded to NP7.

Within the config user saml CLI context, the set group-claim parameter is used to define the name of the SAML attribute that the IdP will send to convey group membership. The FortiGate will parse the SAML assertion for this attribute (in this case, memberOf) to identify the user's groups and match them against FortiGate user groups for authorization.

FortiMail's Full HA mode provides the highest level of redundancy. In this mode, both configuration and mail data (including mail queues, user data, and archives) are continuously synchronized between the primary and secondary units. If the primary unit fails, the secondary unit has an identical, up-to-date copy of all data and can take over processing immediately, ensuring no emails are lost and service interruption is minimized.