Fortinet FCP_FGT_AD-7.4 Exam Notes

A specific type of NAT used in large-scale networks like carrier networks. It allows multiple users to share a smaller number of public IP addresses.

A security feature that checks the source IP address of incoming traffic and verifies that the best route back to the source uses the same interface as the incoming packet.

A configuration setting in FortiGate that creates a session for traffic that is denied by the firewall policy, allowing administrators to log and monitor these sessions even though they are blocked. It is not enabled by default.

A method of connecting to a network over the internet using a secure connection. SSL VPN is often used by remote users who need to access internal resources.

A configuration option in FortiGate's Security Fabric that allows downstream FortiGate devices to access the fabric objects and configuration from the root FortiGate.

A mode on FortiGate devices where the system reduces resource usage to maintain stability. It may disable non-essential services or reduce the system load to prevent crashes.

This is the method used by a firewall to inspect traffic based on metadata without actively buffering or reprocessing the complete content. Flow-based inspection is generally more performance-efficient.

A method of NAT where the source IP address of outgoing traffic is translated to another IP address, usually a public IP address within the NATted network. This is useful for allowing multiple devices on a private network to share a single public IP address.

A feature in FortiGate that allows administrators to identify which firewall policies match specific criteria by entering details like source, destination, service, or time.

A protocol used in a FortiGate High Availability (HA) cluster to elect the primary device, synchronize configuration and status, and manage operations.

This is a method of inspecting traffic by proxying connections through the firewall, examining and processing the entire content of each connection. Proxy-based inspection is often more thorough but resource-intensive.

This feature in FortiGate allows administrators to specify a range of IP addresses that the device will use for SNAT when traffic from a private network is sent to the internet.

FortiGate Security Fabric is a technology that connects multiple FortiGate devices into a hierarchical network. It allows for centralized management and control of security policies and objects. The root device is the primary management point.

FortiGate can be configured to respond to Address Resolution Protocol (ARP) requests for the Virtual IP address. This helps ensure that external networks can communicate with the FortiGate's VIP.

A feature in FortiGate that enables the device to detect when a VPN tunnel is no longer working correctly (a dead tunnel). It allows for faster failover by making the device aware of the failed tunnel sooner.

This is a feature in FortiGate's application control that allows administrators to define different actions (allow, block, monitor) for parent and child applications. It provides fine-grained control over different components of a web application.

This is a type of timeout setting in the SSL VPN configuration that controls how long a session can remain idle before being terminated. If a user connected over SSL VPN does not send any data for a defined time, the session will be closed.

This is a configuration setting that enables a firewall to inspect traffic based on the URL of a website rather than its broader category.

This is a type of remote gateway configuration in FortiGate's IPsec VPN setup. It allows for dynamic IP addresses, with FortiGate managing the connections without requiring a fixed remote IP address.

This is a type of antivirus profile used by FortiGate that scans traffic without buffering the entire file. It generally performs better than proxy-based antivirus but may not be as thorough.

This is a type of security model that assumes no user or device can be trusted by default. It focuses on verifying and controlling access based on identity, security posture, and context. It ensures that access to resources is strictly limited based on the user's needs.

This is a type of authentication used in IPsec VPN setups that involves using a pre-shared secret key that must be configured on both endpoints of the VPN tunnel. This key is used to verify the authenticity of both endpoints.

This is a type of configuration setting that can be used in an SSL inspection profile that enables FortiGate to examine the certificates presented by websites during the SSL handshake process.

This is a type of SSL inspection profile that enables FortiGate to decrypt and inspect the entire content of SSL traffic. It provides the highest level of security but may affect performance.

This is a type of configuration setting in a static URL filter that allows you to specify that an entire URL (inclusive of subpages) be exempt from the filtering policy.

This is a type of configuration setting in a static URL filter that allows you to specify that an entire URL (inclusive of subpages) be monitored for traffic. The traffic would be allowed, but the firewall would log and report on it.

This is a method of configuring a VPN connection where each site's configuration includes the network subnets that are part of the tunnel, allowing traffic to transit between those specific subnets.

A security mechanism that allows users to access network resources only after their security posture has been verified, based on their identity, device type, and location. It is applied to both internal and external users.

This is a type of IPsec VPN configuration where the remote peer's IP address is defined as a static IP. The FortiGate will always connect to the VPN using this specific IP address.

This is a type of remote gateway configuration in IPsec VPN. It utilizes a dynamic DNS service where the remote peer's IP address can change and is automatically updated on the FortiGate.

This is a configuration setting in FortiGate that allows you to configure a static route to a specific network, overriding normal routing paths. Static routes are often used to control traffic flow or to reach networks that might not be reachable using normal dynamic routing protocols.