The diagnostic output in the exhibit, specifically the lines IPS session count: 0 and IPS VDOM with ips-sensor: 0, provides the key information. IPS VDOM with ips-sensor: 0 indicates that zero Virtual Domains (VDOMs) have an IPS sensor (profile) applied to a firewall policy. For the IPS engine to inspect traffic and for the session count to be greater than zero, an IPS profile must be applied to a firewall policy that is actively processing traffic. The output confirms the IPS engine is running (IPS Engine state: enabled), but it is not inspecting any traffic because it has not been assigned to any policy.

B. FortiGate entered into IPS fail open state.

This is incorrect. The output explicitly states IPS fail-open: disabled, meaning the feature is not enabled and the device could not have entered this state.

C. Administrator entered the command diagnose test application ipsmonitor 5.

This is incorrect. The exhibit clearly shows the command entered was diagnose test application ipsmonitor 1, which is used to display the IPS engine status.

D. Administrator entered the command diagnose test application ipsmonitor 99.

This is incorrect. The command shown is diagnose test application ipsmonitor 1. Furthermore, the 99 option is used to stop the IPS engine, but the output shows IPS Engine: running.

1. FortiOS Administration Guide 7.6.0

"Intrusion Prevention" section

"IPS configuration overview" subsection. It states

"To apply Intrusion Prevention to network traffic

you must enable it in a firewall policy." This confirms that without application to a policy

IPS will not function. The output IPS VDOM with ips-sensor: 0 directly reflects this missing configuration step.

2. FortiGate CLI Reference 7.6.0

diagnose test application ipsmonitor command description. The documentation explains that diagnose test application ipsmonitor 1 displays the IPS engine status. The output field IPS VDOM with ips-sensor is described as the number of VDOMs with at least one IPS sensor in a firewall policy. A value of 0 confirms no policy is using an IPS sensor.

3. FortiOS Handbook - Troubleshooting 7.6.0

"Troubleshooting IPS" section. A primary troubleshooting step is to verify that the IPS profile is applied to the correct firewall policy and that traffic is matching that policy. The command diagnose test application ipsmonitor 1 is used to check the engine's status

where a session count of zero points to a policy configuration issue.

To extend the GUI session inactivity timeout for a specific administrator profile, you must override the global idle timeout setting. This is configured within the administrator profile itself. The admintimeout parameter, configured under config system accprofile, sets the idle timeout in minutes for that specific profile. Increasing this value from its default (which uses the global setting) to a higher number will prevent the NOC team's sessions from disconnecting prematurely due to inactivity. The override must also be enabled for this value to take effect.

A. The order of administrator profiles in the configuration list has no bearing on how their individual settings are applied.

B. This option uses incorrect terminology ("offline value"). More importantly, simply increasing a value while the "Override Idle Timeout" feature is disabled (as shown in the exhibit) will have no effect.

C. Assigning the superadmin role affects permissions and access rights; it does not control the session idle timeout duration.

1. FortiOS 7.6.1 Administration Guide

Page 611

Section: "System > Admin Profiles".

The guide states: "Override Idle Timeout: Enable to override the global idle timeout for administrators using this profile. Enter the number of minutes that an administrator can be idle before they are logged out." This confirms the feature's existence and function in the GUI.

2. FortiOS 7.6.1 CLI Reference

Page 2511

Section: config system accprofile.

The reference details the relevant CLI parameters:

set admintimeout-override {enable | disable}: "Enable/disable overriding the global administrator idle timeout."

set admintimeout : "Administrator idle timeout in minutes (0 - 480

default = 0). A value of 0 means it uses the global timeout."

This directly supports that admintimeout is the correct parameter to modify for the profile-specific timeout duration.

FortiGate SSL VPN can use DTLS (Datagram Transport Layer Security) over UDP to improve performance. However, DTLS is sensitive to network conditions like high latency and packet loss, which are characteristic of "poor internet connectivity." When DTLS packets are delayed, the connection may time out and attempt to re-establish or fall back to TLS over TCP, causing performance degradation and perceived disconnections. By increasing the DTLS timeout value, the FortiGate will wait longer for responses, making the VPN tunnel more resilient to high-latency connections and reducing the frequency of disconnections for users on unstable networks.

A. Enable split tunneling to reduce VPN traffic.

This reduces the volume of traffic over the VPN, which can improve performance by saving bandwidth, but it does not directly address connection instability caused by high latency or packet loss.

B. Change the SSL VPN port to a non-standard port.

This is a technique to bypass port-blocking or throttling by an ISP or local network firewall. It does not improve the VPN's tolerance to poor network quality like high latency.

C. Increase the session timeout for inactive sessions.

This setting (idle-timeout) applies to sessions with no activity. The user is actively using the VPN and experiencing disconnections, so this setting is not relevant to the problem.

1. FortiOS 7.6.0 CLI Reference:

Under the config vpn ssl settings command context

the dtls-hello-timeout option is described. The purpose of this timer is to manage the initial DTLS handshake. The documentation notes its range and default value

and adjusting it is a standard procedure for accommodating slow or high-latency networks. (See config vpn ssl settings section).

2. FortiOS 7.6.0 Administration Guide:

In the "SSL VPN" chapter

the guide discusses the use of DTLS for tunneling. It explains that DTLS runs over UDP for better performance but can be impacted by unreliable networks. The guide implicitly supports tuning related parameters to stabilize connections in such environments. (See "SSL VPN best practices" and "Troubleshooting" sections).

Network Protocol Enforcement, a feature within the Application Control profile, determines the action for traffic on standard ports when no specific application signature is matched. If peer-to-peer traffic on its known port is not identified by a signature, this setting acts as a fallback. If protocol enforcement for P2P is not configured to block, the FortiGate may permit the traffic based on the firewall policy's allowed service/port, thus bypassing the intended category block. This is a common reason for application control rules failing to block traffic that uses well-known ports.

A. FortiGuard category ratings classify applications. The issue described is a failure to enforce a block action, not an incorrect application classification.

B. Application and Filter Overrides are used to change the action for specific, named applications, whereas the problem described affects a general category of traffic.

D. Replacement Messages are displayed for traffic that has already been successfully blocked; they do not influence the block or allow decision itself.

1. FortiOS 7.6.0 Administration Guide

Security Profiles > Application Control > Protocol enforcement. The guide states

"You can configure protocol enforcement to block traffic for specific protocols that use standard destination ports

even if the traffic does not match any application signatures." This section details how to configure the setting to block protocols like P2P that are not identified by a signature but are using their standard ports.

2. Fortinet Certified Professional - Network Security 7.6 Study Guide

Chapter: Application Control. The study guide explains that protocol enforcement is a necessary check when traffic on well-known ports is bypassing application control rules. It clarifies that this feature provides a default action for traffic on standard ports that the application signature engine fails to identify.

Statement B is correct because interface monitoring is a primary mechanism for triggering an HA failover. If a monitored interface on the primary device fails, including being administratively set to down, the cluster detects this as a link failure and initiates a failover to a secondary unit to maintain network connectivity.

Statement D is correct as the FortiGate Cluster Protocol (FGCP) is designed to provide stateful failover. To achieve this, it synchronizes critical runtime data between cluster members. This data includes the Forwarding Information Base (FIB) for routing and IPsec Security Associations (SAs) for VPN tunnels, ensuring that sessions and tunnels are not interrupted during a failover.

A. An HA cluster can have both in-band and out-of-band management interfaces. Out-of-band management can be configured on dedicated ports while in-band management remains active on data interfaces.

C. The IP address 169.254.0.2 is assigned to the secondary unit with the highest device priority. A different secondary unit would use 169.254.0.3, so this IP is not guaranteed to be seen in all sniffs.

1. FortiOS 7.6 Administration Guide

"High Availability" chapter

section "HA failover triggers".

This section states

"If a link on a monitored interface on a cluster unit fails

the cluster unit is considered to have failed." An administrative shutdown of an interface is considered a link failure

which supports answer B.

2. FortiOS 7.6 Administration Guide

"High Availability" chapter

section "Information synchronized by the FGCP".

This section details the data synchronized by the cluster. It explicitly mentions

"The FGCP synchronizes the routing table..." and "The FGCP synchronizes IPsec security associations (SAs). This means that active IPsec tunnels are not interrupted by a failover." This directly supports answer D.

3. FortiOS 7.6 Administration Guide

"High Availability" chapter

section "Heartbeat packets and interfaces".

This section explains the IP addressing for heartbeat communication: "The primary unit has the heartbeat IP address 169.254.0.1. The subordinate unit with the highest device priority has the heartbeat IP address 169.254.0.2." This shows that 169.254.0.2 is specific to one subordinate

not a universally present IP

making statement C incorrect.

4. FortiOS 7.6 Administration Guide

"High Availability" chapter

section "Management access to a cluster".

This section describes configuring dedicated management interfaces and using ha-direct for out-of-band access

which can coexist with standard in-band management

proving statement A is incorrect.

The FortiOS SD-WAN routing mechanism follows a specific order of operations and logic. First, FortiOS evaluates traditional policy routes; if a match is found, that route is used, and SD-WAN rules are bypassed. If no policy route matches, FortiOS performs a standard route lookup in the Forwarding Information Base (FIB). By default, if the best route found is not through an SD-WAN member interface, the SD-WAN rules are skipped entirely. Finally, for an SD-WAN rule to be applied, at least one of its member interfaces must have a valid, active route to the traffic's destination. If none of the members can reach the destination, the rule is skipped, and the system proceeds to the next step in the routing logic.

B. SD-WAN rules do not have the highest precedence; regular policy routes are evaluated first in the FortiOS packet flow.

D. SD-WAN rules are not skipped if only one route is available. SD-WAN can be used for application steering and SLA monitoring even on a single link.

1. FortiOS 7.6.0 SD-WAN Administration Guide

Page 10

"SD-WAN rules":

"FortiGate first performs a route lookup for the destination IP address. If the best route is not an SD-WAN member

FortiGate does not use the SD-WAN rules and forwards the traffic using the best route." (Supports option E)

"If none of the members selected by the SD-WAN rule have a valid route to the destination

the SD-WAN rule is skipped." (Supports option A)

2. FortiOS 7.6.0 Networking Guide

Page 29

"Packet flow and session processing"

"Routing" section:

The packet flow diagram and description clearly show that "Policy Route" lookup occurs before "SD-WAN Rule" lookup. This confirms that regular policy routes have precedence over SD-WAN rules. (Supports option C

refutes option B)

When a FortiGate attempts to join a Security Fabric as a member, its status will remain "Pending" for two primary reasons. First, the join request may not have reached the root FortiGate due to a network connectivity issue or a misconfiguration, such as an incorrect Upstream FortiGate IP. Option A suggests the configured upstream IP is incorrect, which would prevent the join request from being sent to the right device. Second, even if the request is successfully received by the root FortiGate, the member device will not be fully joined until an administrator manually authorizes it on the root FortiGate. If this authorization step is not completed, the member's status will remain "Pending".

B. SAML Single Sign-On must be set to Manual. SAML SSO settings relate to administrator login synchronization across the fabric and do not impact the initial device authorization and join process. D. Management IP must be set to 10.0.13.254. The Management IP is the address of the local device (HQ-ISFW-2). An incorrect Management IP affects how the root manages the device after it joins, not the initial join request itself.

1. Fortinet FortiOS 7.6.0 Administration Guide, Chapter: "Security Fabric", Section: "Building the Security Fabric".

Reference for A: The guide states, "On the downstream FortiGate, go to Security Fabric > Fabric Connectors and edit the FortiGate connector. Set Upstream FortiGate IP to the IP address of the root FortiGate that the downstream FortiGate will connect to." This highlights that a correct Upstream FortiGate IP is required for the connection to be established. An incorrect IP, as implied by option A, is a valid reason for failure.

Reference for C: The guide details the authorization step: "On the root FortiGate... Go to Security Fabric > Fabric Connectors. The downstream FortiGate is listed with a status of Pending. Select the downstream FortiGate and select Authorize." This confirms that lack of authorization leaves the device in a pending state.

The 'On Idle' mode for Dead Peer Detection (DPD) on FortiGate is designed to send probes when the IPsec tunnel is idle. This means that if no inbound traffic is received from the VPN peer for a specified period, FortiGate will begin sending DPD probes to verify the peer's availability. This behavior directly matches the administrator's requirement to send probes only when there is no inbound traffic, ensuring that a dead tunnel is detected even during periods of inactivity without waiting for new outbound traffic to trigger the check.

A. Enabled: This is a general term and not a specific DPD mode in the FortiOS CLI. The specific operational modes are 'On Idle' and 'On Demand', making 'On Idle' the more precise and correct answer.

C. Disabled: This option completely deactivates the DPD mechanism, meaning no probes would be sent under any circumstances to detect a dead peer.

D. On Demand: This mode sends DPD probes only when FortiGate attempts to send outbound traffic over a tunnel that has not seen any recent inbound traffic. The trigger is outbound traffic, not simply the absence of inbound traffic.

1. Fortinet FortiOS 7.6.0 Administration Guide:

In the "IPsec VPN" chapter

under the "Dead Peer Detection" section

the modes are described.

On Idle: "The FortiGate sends DPD probes at regular intervals if no traffic is received from the peer." This directly supports the correct answer.

On Demand: "The FortiGate sends a DPD probe when it sends a packet to the peer but has not received any traffic from the peer in the last five seconds." This clarifies why option D is incorrect.

2. Fortinet FortiOS 7.6.0 CLI Reference:

Under the config vpn ipsec phase1-interface command context

the set dpd parameter options are defined.

set dpd {disable | on-idle | on-demand}

The description for on-idle states: "Dial-on-demand

DPD every ." This mode is triggered by idleness

aligning with the question's scenario.

For an SSL VPN connection to be established, the incoming traffic from the user must be explicitly permitted by a firewall policy. This policy's source must include the user, their user group, and/or their source IP address, with the destination interface being the SSL VPN interface (e.g., ssl.root). If some users can connect while others cannot, a common cause is that the failing users are not included in the source definition of the allowing firewall policy. Therefore, the first logical step is to check the firewall traffic logs to verify if the connection attempts from the affected users are matching the correct policy or are being denied.

A. Ensure that the affected users are using the correct port number.

This is a client-side setting. While possible, it's less likely to be the root cause for a group of users, and checking server-side policy is a more efficient first step for the administrator.

C. Ensure that forced tunneling is enabled to reroute all traffic through the SSL VPN.

Tunneling mode (split vs. forced) affects traffic routing after a successful VPN connection is established. It does not impact the ability to establish the initial connection.

D. Ensure that the HTTPS service is enabled on SSL VPN tunnel interface.

The HTTPS service must be enabled on the public-facing (WAN) interface to accept incoming connections, not on the virtual SSL VPN tunnel interface, which represents the tunnel post-establishment.

1. FortiOS 7.6 Administration Guide

"SSL VPN" chapter

section "Firewall policy".

Reference Detail: The guide states

"You must configure a security policy to allow access to the network through the SSL VPN tunnel." It details that the policy must have the SSL VPN interface as the destination and the remote user/user group as the source. This confirms that a policy mismatch is a primary reason for connection failure.

2. FortiOS 7.6 Administration Guide

"Troubleshooting" chapter

section "Diagnosing and solving common problems".

Reference Detail: This section outlines standard troubleshooting methodology

which prioritizes checking logs to see if traffic is being blocked by a firewall policy. For SSL VPN

this involves verifying that the user's connection attempt is hitting the intended policy and not an implicit or explicit deny rule.

3. Fortinet Cookbook

"SSL VPN for remote users" recipe for FortiOS 7.6.

Reference Detail: The recipe explicitly shows the creation of a firewall policy from the WAN interface to the ssl.root interface

with the Source field containing the user group created for SSL VPN users. This highlights the direct link between user group membership and the policy that permits the connection.

This configuration creates a FortiGate user group named Training. It links this group to a RADIUS server named FAC-RADIUS. The config match stanza is the key component; it instructs the FortiGate to place a user into the Training group only if two conditions are met upon authentication:

1. The user authenticates against the FAC-RADIUS server.

2. The RADIUS server returns an attribute (specified by group-override-attr-type, which is filter-id in this case) with a value that exactly matches the group-name, which is "Training".

Therefore, the entire configuration's purpose is to authenticate users who belong to the "Training" group as defined on the RADIUS server.

A. To set up a RADIUS server Secret.

Setting the secret is only one part of the RADIUS server definition, not the overall purpose of the entire configuration, which includes specific group matching logic.

B. To authenticate Any FortiGate user groups.

This is incorrect. The config match section with set group-name "Training" makes the configuration highly specific to matching only the "Training" group, not any group.

C. To authenticate and match the Training OU on the RADIUS server.

This is incorrect. The configuration matches on a RADIUS attribute (filter-id), not an Organizational Unit (OU), which is an object type specific to LDAP/Active Directory.

1. FortiOS 7.6.0 Administration Guide

User & Device > User > User Groups > RADIUS user groups. The guide explains: "You can configure a user group for RADIUS users that allows you to match users to the group based on attributes returned by the RADIUS server in its Access-Accept response... When a user authenticates

FortiOS checks the attributes in the RADIUS Access-Accept packet. If the attributes match the user group configuration

the user is considered a member of the group." This directly supports the explanation for answer D.

2. FortiOS 7.6.0 CLI Reference

config user group. The documentation for the config match stanza under config user group specifies the parameters set server-name and set group-name. It states group-name is the "Group name to match." This confirms that the configuration is designed to match a specific group name returned from the RADIUS server

making options B and C incorrect.

3. FortiOS 7.6.0 CLI Reference

config user radius. The documentation for set group-override-attr-type specifies that this setting determines which "RADIUS attribute type to override user group membership." The default is filter-id. This confirms that the mechanism for matching is based on a standard RADIUS attribute

not an LDAP-specific structure like an OU.