Fortinet NSE 4 (Security) - 02. Firewall Policies

When utilizing the Policy Lookup function in the GUI, how is a disabled policy handled?

Disabled policies are skipped

What is the policy type that checks for the anomalous patterns in the network traffic that arrives at a FortiGate interface?

DoS Policy

True/False? It is ok if a firewall policy does not have a destination interface configured as long as the source interface is configured?

False. Each policy must set a source and destination interface, even if one or both are set to any

True/False? When moving a policy up/down in the list, the Policy ID changes to match the policies position within the policy list.

False. The Policy ID does not change

True/False? When configuring a firewall policy, the Name field is required regardless of whether the policy is being configured in the GUI or the CLI?

False. The field is only required when configuring a policy in the GUI

True/False? It is possible to configure a user for the destination of a firewall policy.

False. The user identification is determined at the ingress interface

True/False? It is possible to configure both an Internet Service Object and a Service in a firewall policy?

False. These have an either/or relationship. Note: Internet Service Objects and Addresses also have an either/or relationship and cannot be configured on the same policy

True/False? When configuring schedules for firewall policies, the Pre-expiration event log setting is available for either of the Recurring or One-Time types?

False. This setting is only available when the type is set to One Time

What is the policy type that controls traffic flow through FortiGate?

Firewall Policy

What is the policy type that controls the traffic between the interfaces in a virtual wire pair?

Firewall Virtual Wire Pair Policy

Is it possible to enable unnamed policies on the GUI? If so, how?

It is possible by enabling the Allow Unnamed Policies setting on the Feature Visibility page

What does it mean if the GUI Firewall Policy option Generate Logs when Session Starts is not displayed?

It means your FortiGate does not have internal storage. Note: This setting is available in the CLI regardless

What is the policy type that controls the traffic to a FortiGate interface and can be used to restrict administrative access?

Local In Policy

What is the policy type that allows multicast packets to pass from one interface to another?

Multicast Policy

When configuring schedules for firewall policies, where are the schedules configured?

Policy & Objects > Schedules

When configuring new Internet Service Database (ISDB) Objects, what are the two types of objects available for configuration?

Predefined or Geographic Based

What are the two types of traffic shapers?

Shared and Per IP

If you configure a firewall policy with the any interface, you can view the firewall policy list only in which view?

The By Sequence view

What setting must be enabled to allow you to select multiple interfaces in a firewall policy?

The Multiple Interface Policies setting under the Feature Visibility page

When configuring schedules for firewall policies, what will happen if a schedule is configured as Recurring and the Start Time and Stop Time are identical?

The schedule will run for 24 hours

When configuring schedules for firewall policies, what will happen if a schedule is configured as Recurring and the Stop Time is earlier than the Start Time?

The stop time will occur the next day

What types of object is used to configure groups of geographical regions?

These are configured as an ISDB (Internet Service Database) Object

What is the purpose of the following commands? config system fortiguard set update-ffdb [enable | disable]

This disables ISDB updates so that they only occur during a change control window

What is the purpose of the policy lookup feature on FortiGate?

To find a matching policy based on input criteria

When configuring schedules for firewall policies, what will happen if a schedule is configured as Recurring and the All Day option is enabled?

Traffic will be allowed for 24 hours on the days selected

True/False? When configuring schedules for firewall policies schedules as One Time, the Start Date/Time must be earlier than the Stop Date/Time.

True

What are the first six traffic match criteria that FortiGate analyzes before determining if it matches a policy and further evaluation is needed?

1. Incoming interface 2. Outgoing interface 3. Source (IP address, user, internet services) 4. Destination (IP address or internet services) 5. Service (IP protocol and port number) 6. Schedule

What are the two available Firewall Policy views? Which one is the default?

1. Interface Pair View (default) 2. By Sequence

What are the three methods that a user can be authenticated when added to the source of a firewall policy?

1. Local - configured locally on FortiGate 2. Remote - LDAP, RADIUS, etc. 3. FortiGate Single Sign-On (FSSO) - retrieved from domain controller

What are the supported characters in a firewall object name?

1. Numbers 2. Letters 3. Special characters: hyphen and underscore 4. Spaces (although these should be avoided because it can make editing policies in the CLI difficult)

What are the three types of traffic shaping policies?

1. Shared policy shaping - Bandwidth management of security policies 2. Per-IP shaping - Bandwidth management of user IP addresses 3. Application control shaping - Bandwidth management by application

When creating IPv4/IPv6 consolidated firewall policies, what are the fields that cannot be shared between IPv4 and IPv6?

1. Source addresses 2. Destination addresses 3. IP pools

True/False? There is an either/or relationship between internet service objects and source address objects in firewall policies.

True. You can select either a source address or an internet service, but not both

When configuring schedules for firewall policies, what is the purpose of the Pre-expiration event log setting, which is only available for One Time types of schedules?

Turning this setting on will generate an event N number of days before the schedule expires. Note: N can be configured from 1 to 100 days using the Number of days before field