Fortinet Technical Introduction to Cybersecurity Quiz Answers with Explanations (FCF)

Related Articles

Fit India Common Wealth Quiz Certificate- My Gov

November 30, 2025

Financial Modelling & Analysis Exam Answers – Itronix Solutions

September 15, 2025

SEBI Investor Certification Exam Answers | SEBI Investor Awareness Test

August 23, 2025

Fortinet – Technical Introduction to Cybersecurity Exam Quiz Answers

Technical Introduction to Cybersecurity is a free, self-paced course from the Fortinet Training Institute for people heading into technical IT or security roles. Passing it together with Introduction to the Threat Landscape earns the Fortinet Certified Fundamentals (FCF) in Cybersecurity certification. Below are the answers to all 104 questions from the seven module quizzes, each with a short explanation so you understand the concept rather than just memorising an option.

Course at a glance

• Provider: Fortinet Training Institute
• Cost: Free
• Format: Self-paced, 7 modules with a quiz each
• Counts toward: FCF in Cybersecurity (with Introduction to the Threat Landscape)
• Certification validity: 2 years
• Official course: training.fortinet.com
• Answers reviewed: November 2026

Fortinet updates its question banks from time to time. If you see a question that isn’t listed here, leave a comment with the question and we’ll add it.

Module 1: Cryptography and the Public Key Infrastructure Quiz Answers

Question 1: Identify two symmetric algorithms. (Choose two.)

• AES
• DSA
• IDEA
• RSA

Why: AES and IDEA are symmetric: the same secret key encrypts and decrypts. DSA and RSA are asymmetric (public/private key pairs).

Question 2: During the encryption process, where symmetric and asymmetric cryptography are used, which key is used to encrypt the session (symmetric) key?

• The sender’s private key
• The receiver’s private key
• The sender’s public key
• The receiver’s public key

Why: The session key is encrypted with the receiver’s public key, so only the receiver’s matching private key can decrypt it.

Question 3: Which cipher type is used by computers to encrypt data?

• Hashing
• Geyser
• Block-and-tackle
• Stream

Why: Of these options only “stream” is a real cipher type. Hashing is one-way and can’t be decrypted, and the other two are not cipher types.

Question 4: What ingredient is added during the BCRYPT key stretching process to increase entropy?

• Verification code
• A static known value
• Salt
• MAC

Why: Bcrypt adds a random salt to each password before hashing, so identical passwords produce different hashes and precomputed rainbow tables stop working.

Question 5: Which statement best describes hashing?

• The process of converting plaintext to ciphertext
• The process of converting data of an arbitrary size to a unique value of a fixed size
• The art of writing or solving codes
• The process of generating a unique value that can be tied legally to an entity

Why: A hash function maps input of any size to a fixed-size output (a digest) that changes completely if the input changes.

Question 6: Which two entities are necessary components of a PKI? (Choose two.)

• Microsoft CAPI
• RA
• CA
• Firewall

Why: A PKI needs a certificate authority (CA) to issue and sign certificates and a registration authority (RA) to verify identities before certificates are issued.

Question 7: In a PKI, what is the ultimate source of trust?

• The registration authority
• The private key of the root CA
• PKI policy and procedures
• Local municipal laws in which the CA resides

Why: Every certificate chain leads back to the root CA’s signature, so trust ultimately depends on the root CA’s private key staying protected.

Question 8: Which two features are characteristics of hashing? (Choose two.)

• Non-reversible process
• Random output value
• Obfuscation data process
• Fixed-length output value

Why: Hashing is one-way (you can’t recover the input) and always produces an output of the same length.

Question 9: Which security requirement does encryption satisfy?

• Data integrity
• Authentication
• Non-repudiation
• Confidentiality

Why: Encryption hides data from anyone without the key, which is confidentiality. Integrity and authentication come from hashes and signatures.

Question 10: Which statement best describes encryption?

• The art of writing or solving codes
• The process of converting an arbitrary-sized value to a fixed-size value
• The process of converting plaintext to ciphertext
• An entity disguised as something else

Why: Encryption converts readable plaintext into unreadable ciphertext using an algorithm and a key.

Question 11: Which two security requirements are satisfied by a digital signature? (Choose two.)

• Confidentiality
• Authorization
• Data integrity
• Authentication

Why: A digital signature proves who signed (authentication) and that the content hasn’t changed since signing (integrity). It does not hide the content.

Question 12: Which statement best describes cryptography?

• A method for ensuring network safety
• The study of writing or solving codes
• A secure session between a web browser and a web server
• The process of converting plaintext to ciphertext

Why: Cryptography is the study and practice of writing and solving codes; encryption is only one process within it.

Question 13: Identify three cipher method types. (Choose three.)

• Bletchley Park
• Transpositional
• One-time pad
• Substitution
• Abacus

Why: Substitution, transposition and the one-time pad are classic cipher methods. Bletchley Park is a place and an abacus is a counting tool.

Module 2: Secure Network Quiz Answers

Question 1: Why should a user prefer a security protocol over a non secured one?

• It provides Quality of Service (QoS).
• it adds segmentation.
• It adds confidentiality.
• It provides lower latency.

Why: Secure protocols such as HTTPS and SSH encrypt traffic, which adds confidentiality. They don’t improve QoS or latency.

Question 2: What was missing in the early sandbox generation? (Choose two.)

• An integration with other security devices
• Automation and artificial intelligence
• An isolated environment to test unknown files
• A zero-day attacks detection

Why: Early sandboxes tested files in isolation but worked alone: they didn’t share results with other security devices and had no automation or AI.

Question 3: How can a security engineer secure switching and ports?

• By configuring an application layer gateway
• By configuring firewall policies
• By configuring Network Address Translation (NAT) filtering
• By configuring static or sticky Media Access Control (MAC) address entries in the Content Addressable Memory (CAM) table

Why: Static or sticky MAC entries tie specific devices to specific switch ports, so unknown devices can’t simply plug in.

Question 4: Why is Fortinet Security Fabric an example of centralized security network management? (Choose two.)

• It can operate only locally.
• It has a broad view of the security with an end to end visibility.
• It can communicate with other devices through Application Programming Interfaces (APIs) or fabric connectors.
• All tasks and configurations are manual.

Why: The Security Fabric gives end-to-end visibility and links devices through APIs and fabric connectors, so they are managed from one place.

Question 5: Which network is enclosed by the security perimeter?

• The Demilitarized Zone (DMZ)
• The trusted network
• The Local Area Network (LAN) only
• The Wide Area Network (WAN)

Why: The security perimeter protects the trusted internal network; the DMZ and WAN sit at or outside the edge.

Question 6: how can a security architect better control and protect the east-west traffic in a DeMilitarized Zone (DMZ)?

• Through Simple Network Management Protocol (SNMP)
• Through centralized security management
• Through micro-segmentation
• Through traffic shaping

Why: Micro-segmentation applies policies between individual workloads, so sideways (east-west) traffic between servers can be controlled.

Question 7: Why would a security architect segment a network? (Choose two.)

• To reduce the network congestions and broadcasts
• To limit the attacks to the specific segment without contaminating all the network
• To facilitate the management access through a connection to each device in the network
• To increase the scope of compliance to the complete network

Why: Segmentation shrinks broadcast domains (less congestion) and keeps an attack contained within one segment.

Question 8: What are objectives of Software Defined Wide Area Network (SD-WAN)? (Choose two.)

• Lower latency
• Increase data protection
• Greater reliability
• Lower Quality of Service (QoS)

Why: SD-WAN steers traffic over the best available links, giving lower latency and better reliability than a single WAN link.

Question 9: Which principles are part of the Zero-Trust security model? (Choose two.)

• Assume that your network is breached
• Implement least privilege
• Reduce DeMilitarized Zone (DMZ) surface
• Trust only your Local Area Network (LAN)

Why: Zero trust assumes the network may already be breached and gives each user or device only the access it needs (least privilege).

Question 10: Why knowing the source IPs of an attack may not be relevant? (Choose two.)

• Source IPs can be forked.
• Attackers can use zero-day attacks.
• Source IPs can be spoofed.
• Attackers can use botnets.

Why: Attackers can spoof source IPs or attack through botnets of hijacked machines, so the source IPs often don’t identify the real attacker.

Question 11: When implementing Zero-Trust security, which benefits do you expect? (Choose two.)

• A defined trusted zone
• Tighter restrictions to access resources
• Proofs of trust
• No micro-segmentation

Why: Zero trust enforces tighter, per-request access to resources and asks for continuous proof of trust instead of trusting a zone.

Question 12: Which challenges brought the evolution from a network model with a single, dedicated service provider to Software Defined Wide Area Network (SD-WAN)? (Choose two.)

• Reliability
• Demand for more cloud applications and services
• Data protection
• Compliance requirements

Why: Businesses moved to SD-WAN because one provider link wasn’t reliable enough and cloud apps needed direct, flexible internet access.

Question 13: Which implementation should be done by a security architect to limit network threats in a network? (Choose two.)

• Zero trust
• Centralized network management
• Network segmentation
• Software Defined Wide Area Network (SD-WAN)

Why: Zero trust limits what any user or device can reach, and segmentation limits how far a threat can spread.

Question 14: What does Secure Multipurpose Internet Mail Extensions (S/MIME) bring over MIME? (Choose two.)

• Integrity with remote access
• repudiation with private connection
• Confidentiality with encryption
• Authentication with digital signature

Why: S/MIME adds encryption (confidentiality) and digital signatures (authentication) to standard MIME email.

Question 15: Why may a security architect add a sandbox in a network? (Choose two.)

• To share threat intelligence with other security devices
• To stop known threats like a honeypot
• To provide authentication
• To detect zero day attacks

Why: A sandbox runs unknown files to catch zero-day threats and shares the resulting threat intelligence with other security devices.

Question 16: When implementing a data fabric architecture, which benefits do you expect?  (Choose two.)

• The monitoring and data management is centrally governed.
• The attack surface is reduced.
• The different parts of the security network are linked.
• The authentication is enforced.

Why: A fabric architecture links the different parts of the security network and governs monitoring and data management centrally.

Question 17: What are two core capabilities of Secure Access Service Edge (SASE)? (Choose two.)

• Simple Network Management Protocol (SNMP)
• Zero-Trust network access
• Traffic shaping
• Data loss prevention

Why: SASE combines networking with cloud-delivered security services such as zero-trust network access and data loss prevention.

Question 18: View the following exhibit:In this SD-WAN environment, what does the red line represent?

• An overlay network
• An underlay network
• A physical network
• A Wide Area Network (WAN)

Why: In SD-WAN diagrams the overlay is the virtual network of tunnels built on top of the physical underlay links.

Question 19: A security compliance audit must take place. Which implementation can simplify it?

• Centralized security management
• Simple Network Management Protocol (SNMP)
• Application Programming Interface (API)
• Artificial Intelligence

Why: Central management keeps configurations, logs and policies in one place, which makes it much easier to show auditors that you comply.

Question 20: Which application could provide the list of open ports to a security engineer, so the unnecessary ones can be closed?

• Syslog
• Machine Learning
• Sandbox
• Network mapper (nmap)

Why: Nmap scans hosts and reports open ports and services, so unneeded ones can be closed.

Question 21: View the following exhibit: What will be at least checked by the firewall upon receiving the server reply packet?

• The packet five-tuple
• The firewall session table
• If the implicit firewall policy is set to allow
• Nothing when the packet is encrypted

Why: A stateful firewall matches the reply against its session table using the packet’s five-tuple: source and destination IP, source and destination port, and protocol.

Question 22: Which required capabilities are included in Secure Access Service Edge (SASE)? (Choose two.)

• Network-as-a-Service
• Software-as-a-Service
• Security-as-a-Service
• Platform-as-a-Service

Why: SASE is delivered as two cloud services: networking (Network-as-a-Service) and security (Security-as-a-Service).

Question 23: What are the benefits for a bank in taking a Next Generation FireWall (NGFW) to secure its network? (Choose two.)

• Further analysis can be performed with a sandbox.
• An artificial intelligence performs all the security checkpoints.
• Malicious content is checked through Deep Packet Inspection (DPI).
• Machine learning configures automatically micro-segmentation.

Why: An NGFW inspects content with deep packet inspection and can send suspicious files to a sandbox for further analysis.

Question 24: A security architect would like to add in a network a device able to understand the application layers protocols. Which device should be added?

• A Next Generation FireWall (NGFW)
• A packet filter firewall
• A stateful firewall
• A stateless firewall

Why: Only an NGFW understands application-layer (Layer 7) protocols; packet-filter, stateful and stateless firewalls work at lower layers.

Question 25: How could the traffic be filtered at the security perimeter? (Choose two.)

• By performing traffic shaping
• By acting as an application layer gateway
• By logging the incoming traffic
• By performing packet filtering at transport layer

Why: Perimeter firewalls filter traffic with transport-layer packet filtering and by acting as application-layer gateways (proxies).

Question 26: A network architect must implement security in a network including Internet of Things (IoT), Bring your own Device (ByoD), and cloud-based workstations. Which model should the architect put in place?

• Packet filtering
• Security perimeter
• Network Address Translation (NAT) filtering
• Zero trust

Why: With IoT, BYOD and cloud workstations there is no clear perimeter, so zero trust verifies every user and device wherever it is.

Question 27: Why should a security engineer secure a switch? (Choose two.)

• The management access is only available through the default Virtual Local Area Networks (VLAN).
• The management access is only available through the default Media Access Control (MAC) address.
• By default, a switch is vulnerable to broadcast storms.
• By default, port authentication is not configured.

Why: A switch with default settings has no port authentication and is exposed to broadcast storms, so it must be hardened.

Question 28: What does Secure Access Service Edge (SASE) offer to remote off-net users compared to on-net?

• Different login credentials to access different systems
• Better software upgrades including security patches
• Real-time analysis of security alerts
• The same security policies no matter their location

Why: SASE applies the same security policies to users whether they are in the office or working remotely.

Question 29: how can a security architect segment a network? (Choose two.)

• Through Virtual Local Area Networks (VLANs)
• Through Software Defined Wide Area Network (SD-WAN)
• Through a bastion host
• Through a jump box

Why: VLANs segment a local network logically, and SD-WAN can segment traffic across WAN links.

Question 30: Which type of attack is handled only by the latest sandbox generation?

• AI-driven attacks
• Zero-day attacks
• Attacks exploiting known vulnerabilities
• Fraggle attacks

Why: According to the course, the newest sandbox generation adds AI to handle AI-driven attacks; earlier generations already handled zero-days.

Question 31: Which protocols should a security engineer disable for management access? (Choose two.)

• Secure Shell protocol (SSH)
• HyperText Transfer Protocol Secure (HTTPS)
• HyperText Transfer Protocol (HTTP)
• Telnet

Why: HTTP and Telnet send credentials in plain text, so management access should use HTTPS and SSH instead.

Question 32: A security architect must put in place the Zero-Trust model in a network. Which methods could the architect implement? (Choose two.)

• Traffic shaping
• Privilege access management
• The Kipling method
• The Kubernetes method

Why: Privileged access management and the Kipling method (who, what, when, where, why, how) are both used to design zero-trust policies.

Question 33: View the following exhibit: How can a security architect secure the switch to reduce a Media Access Control (MAC) flooding attack performed by the device D?

• By grouping the devices in the same Virtual Local Area Network (VLAN)
• By limiting the number of MAC address entries per switch port
• By grouping the switch ports in the same VLAN
• By limiting the number of IP address entries per VLAN

Why: Limiting MAC address entries per port (port security) stops one device from flooding the switch’s CAM table with fake MAC addresses.

Module 3: Authentication and Access Control Quiz Answers

Question 1: Which is an example of a possession-based authentication method?

• Texting a one-time code through SMS
• Using your eye to pass a biometric lock
• Having your password written down in a secure location
• Carrying your laptop home

Why: This is “something you have”: a code sent to your phone proves you possess that phone. A biometric is “something you are”.

Question 2: Which two are aspects of the principle of least privilege? (Choose two.)

• Allowing easy, baseline access for all
• Allowing only what users and devices need
• Allowing access until proven otherwise
• Reducing error by minimizing access

Why: Least privilege means granting only the access users and devices need, which also limits mistakes and damage.

Question 3: Which two are the responsibilities of an authentication governing body? (Choose two.)

• Creating disaster recovery policies
• User onboarding
• Reviewing the password strength policy
• User certification

Why: In the course, an authentication governing body sets policy, such as password-strength rules and disaster recovery policies, rather than handling day-to-day onboarding.

Question 4: What type of access control allows the device or person performing the authentication the ability to allow or deny access?

• Lattice-based access control
• Discretionary access control
• Role-based access control
• Mandatory access control

Why: In discretionary access control, the owner of the resource decides who is allowed access.

Question 5: Which two should be selected to create secure multi-factor authentication to access a computer system? (Choose two.)

• Smart Card
• Voice identification
• Height sensor
• Password

Why: A smart card (something you have) and a password (something you know) are two different factors, which is what makes it multi-factor.

Question 6: Which two are performed by the supplicant in 802.1x authentication? (Choose two.)

• Verifying identity
• Providing identity
• Connecting to a network
• Sending an accept message to the intermediary

Why: In 802.1X the supplicant (the client device) connects to the network and provides its identity; the authentication server verifies it.

Question 7: What does a NAC use to identify attached devices and allow access?

• Retinal pattern
• Device memory size
• Username
• Device profile

Why: NAC builds a device profile (type, OS, MAC address, behaviour) to identify each device and decide what access it gets.

Question 8: Which one makes the allow or deny decision in the authentication process?

• Authentication server
• Supplicant
• Access point
• Intermediary

Why: The authentication server (for example RADIUS) makes the allow or deny decision; the supplicant and access point only pass information along.

Question 9: Which protocol can perform SSO?

• TCP
• DNS
• CHAP
• Kerberos

Why: Kerberos issues tickets so a user logs in once and can then use several services: single sign-on.

Question 10: Which type of access control scheme does a NAC apply?

• Mandatory access control
• Attribute-based access control
• Lattice-based access control
• Discretionary access control

Why: NAC grants access based on attributes such as device type, user, location and time, which is attribute-based access control.

Question 11: In SSO authentication, which two entities know the unhashed credentials? (Choose two.)

• Service provider
• User
• Internet service provider
• Identify provider

Why: Only the user and the identity provider handle the actual credentials; the service provider receives a token, not the password.

Question 12: Which three can be used as attributes in attribute-based access control? (Choose three.)

• MAC address
• DHCP IP address
• Hours in a day
• Time of day

Why: MAC address, DHCP-assigned IP address and time of day are all attributes an access policy can check.

Module 4: Secure Remote Access Quiz Answers

Question 1: Which statement best describes secure remote access?

• Secure remote access allows personal devices (BYOD) to connect to the computer network.
• Secure remote access securely connects two or more local area networks (LANs).
• Secure remote access transmits smart device information to an outside computer network.
• Secure remote access allows outside end entities to connect securely to a computer network.

Why: Secure remote access lets users and devices outside the network connect to it safely, usually through a VPN or ZTNA.

Question 2: Which characteristic differentiates ZTNA from VPN?

• Encryption algorithms
• Security due to key lengths
• Data integrity checks
• The zero trust concept

Why: A VPN trusts a user once the tunnel is up, while ZTNA verifies the user and device for every application session. That zero trust concept is the difference.

Question 3: Which statement best describes the zero trust approach that is the basis for ZTNA design?

• Nothing can be trusted inside or outside the network.
• Remote devices and users cannot be trusted.
• Once devices are authenticated, they are always trusted.
• Internet-of-Things (IoTs) and BYOD must be authenticated before they are trusted.

Why: Zero trust means nothing is trusted by default, whether it is inside or outside the network.

Question 4: In SSL VPN, what is used to authenticate the web server to the browser?

• A one-time password
• Doman name identification
• IP address identification
• The web server’s digital certificate

Why: As with HTTPS, the web server presents a digital certificate that the browser checks.

Question 5: In which part of a packet is the readable message to the recipient written?

• Data (payload)
• ESP trailer
• AH header
• TCP header

Why: The readable message travels in the data (payload); headers and trailers carry delivery and security information.

Question 6: Which two security features can be implemented by IPsec VPN? (Choose two.)

• Corrupt packet blocking
• Malicious packet detection
• Packet encryption
• Packet authentication

Why: IPsec can encrypt packets and authenticate them (integrity and origin checks).

Question 7: Which two traits differentiate SSL VPN from IPsec VPN? (Choose two).

• It establishes an encrypted session between two or more points.
• User identification permits more granular authorization.
• It protects against replay attacks.
• It secures the transport layer of the OSI model.

Why: SSL VPN works at the transport layer and can identify individual users, which allows more granular access rules.

Question 8: Which characteristic differentiates SSL VPN from IPsec VPN and ZTNA?

• SSL VPN does not secure the transport layer in the OSI model.
• SSL VPN does not require specialized client software.
• SSL VPN does not use TCP.
• SSL VPN does not use digital certificates to secure sessions.

Why: SSL VPN can run in an ordinary web browser (clientless), while IPsec VPN and ZTNA usually need client software.

Module 5: Endpoint Security Quiz Answers

Question 1: Which item would be considered part of the Internet of Things (IoT)?

• Company laptop computer
• Wi-Fi Baby Monitor
• Printer connected to a laptop through USB
• Database server

Why: A Wi-Fi baby monitor is a network-connected smart device, a typical IoT endpoint.

Question 2: What is the best tool to help counter polymorphic malware?

• Data loss prevention (DLP)
• Endpoint detection and response (EDR)
• BIOS secured with a password
• Web filtering

Why: Polymorphic malware keeps changing its signature, so behaviour-based EDR catches it better than signature-based tools.

Question 3: What should you always do before allowing IoT and BYOD endpoints to connect to a secure network?

• Deny access to the secure network until the device is identified.
• Allow the device access to all networks to make it easier to integrate.
• Connect the device to the internal network to allow administrators to log in.
• Disable remote access to the device.

Why: Unknown IoT and BYOD devices should be kept off the secure network until they are identified and classified.

Question 4: What is the first step in securing IoT devices in a company or home?

• Segment all IoT devices on an isolated network.
• Purchase only approved laptops and servers.
• Register IoT devices in a database.
• Identify new and existing endpoints in your network.

Why: You can’t secure devices you don’t know about, so the first step is identifying every new and existing endpoint.

Question 5: What are the two most common communication protocols used by IoT devices? (Choose two.)

• Wi-Fi
• Ethernet
• Bluetooth
• Token Ring

Why: Most IoT devices communicate over Wi-Fi or Bluetooth.

Question 6: What is usually performed by the endpoint detection and response (EDR) client and not by the endpoint protection platform (EPP) client?

• Software updates
• Antivirus scanning
• Automatic threat response
• Data loss prevention (DLP)

Why: EPP prevents known threats; EDR adds detection of active threats and automatic response to them.

Question 7: What is the primary concern about endpoint detection and response (EDR)?

• Inability to protect against web-based threats
• Ease of installation and configuration compared to endpoint protection platforms
• Speed at which it detects and handles polymorphic malware threats
• Inability to scan removable media

Why: The course stresses that EDR has to detect and respond to fast-changing polymorphic threats quickly, so speed is the key concern.

Question 8: Which three things should you use on all connected devices, if available? (Choose three.)

• Full disk encryption (FDE)
• Manufacturer default password
• Auto-updates
• Endpoint protection platform client (EPP)
• BIOS
• Allow USB devices to copy files

Why: Full disk encryption, automatic updates and an EPP client protect a device’s data, keep it patched and defend it against malware.

Module 6: Secure Data and Applications Quiz Answers

Question 1: Which two recommendations should you make to a chief security officer in order to block phishing attempts and their effects? (Choose two.)

• Audit the network.
• Install a web application firewall (WAF).
• Implement email content filters.
• Provide security awareness training to users.

Why: Email content filters stop most phishing emails reaching inboxes, and awareness training helps users spot the ones that get through.

Question 2: A security engineer would like to create a browsing group policy for application hardening. Which two features should the policy include? (Choose two.)

• Disable auto-update
• Enable password saving
• Enable pop-up blocker
• Clear cookies on exit

Why: Pop-up blockers and clearing cookies on exit cut down malicious pop-ups and stored session data that attackers can abuse.

Question 3: Which characteristic could a digital signature lend to a document?

• Non-repudiation
• Storage
• Encryption
• Clarity

Why: A digital signature proves who signed a document, so the signer can’t later deny it: non-repudiation.

Question 4: Which tool could be denying access to the page?

• Real-time blackhole list (RBL)
• Web filter
• Pop-up blocker
• Search engine filter

Why: A web filter blocks pages by URL category or reputation, which is where “access denied” pages usually come from.

Question 5: Which two security features are included only in the latest generation WAF? (Choose two.)

• Signature detection
• IP reputation
• Ports allow list
• Data loss prevention (DLP)

Why: Latest-generation WAFs add IP reputation and data loss prevention on top of signature detection.

Question 6: In a school, which safeguards could a security architect implement to help protect children from inappropriate content?

• Web filter
• Sandbox
• Virtual private network (VPN)
• Real-time blackhole list (RBL)

Why: A web filter blocks whole categories of inappropriate websites for students.

Question 7: The best position for a WAF is in front of which network component?

• The wireless access points
• The web servers
• The mail servers
• The edge firewall

Why: A WAF protects web applications, so it sits in front of the web servers.

Question 8: Which two measures should a company take to prevent doxwares and leakwares? (Choose two.)

• Cloud storage
• Security awareness training
• Segmentation
• Data loss prevention (DLP)

Why: Doxware and leakware threaten to publish stolen data; DLP blocks data from leaving and training reduces the infections that start it.

Question 9: Which factors should a security engineer verify to ensure an organization’s data comply with data sovereignty laws and policies?

• The compliance of the organization’s in-use data.
• The laws of the nation where the data are collected.
• The risks involved in data destruction.
• The audit performed on data at rest.

Why: Data sovereignty means data is subject to the laws of the country where it is collected.

Question 10: Which two tasks should a security engineer perform to protect private data for an organization? (Choose two.)

• Encrypt all the documents in the organization.
• Configure Simple Network Management Protocol (SNMP) on all the switches.
• Identify sensitive data and classify them.
• Identify authorized roles, users, and policies.

Why: First identify and classify sensitive data, then define which roles and users may access it and under which policies.

Question 11: Which product should a security architect use first to prevent zero-day attacks?

• Web application firewall (WAF)
• Network access control (NAC)
• Sandbox
• Firewall

Why: A sandbox runs unknown files in isolation to catch threats that have no signature yet, which is what zero-day attacks are.

Question 12: For which reason could a data center have a separate disaster recovery center?

• For perfectibility
• For confidentiality
• For integrity
• For high availability

Why: A separate disaster recovery site keeps services running if the main data center fails: high availability.

Question 13: A security engineer must manage the devices of a large company. Which measures should they implement as part of application hardening?

• An underlay network
• A patch management system
• A switch audit
• Access only through virtual private networks (VPNs)

Why: A patch management system keeps applications updated and closes known vulnerabilities, a core part of application hardening.

Question 14: Which component should a company implement to secure sensitive data in their internal servers?

• Real-time blackhole list (RBL)
• Web application firewall (WAF)
• Data loss prevention (DLP)
• Virtual private network (VPN)

Why: DLP detects and blocks unauthorised movement of sensitive data out of internal servers.

Question 15: A chief security officer would like to prevent ransomware in their organization. Which two techniques should you recommend? (Choose two.)

• Use only third-party applications
• Encrypt all sensitive data
• Apply regular patch maintenances and auto-updates
• Provide security awareness training to users

Why: Regular patching closes the holes ransomware exploits, and training reduces clicks on malicious links and attachments.

Module 7: Cloud Security and Virtualization Quiz Answers

Question 1: Why is it important to secure all virtual machines (VMs) on a hypervisor?

• To reduce resource usage for all VMs
• To prevent privilege escalation and VM escape
• To improve the performance of all VMs
• To simplify administration

Why: A compromised VM could escape to the hypervisor or escalate privileges and reach every other VM on the same host.

Question 2: What is the advantage of using a cloud access security broker (CASB) to make application programming interface (API) connections to cloud providers?

• It increases throughput.
• It minimizes points of configuration.
• It prevents denial of service (DoS) attacks.
• It allows for instant updates of cloud applications.

Why: A CASB connects to many cloud providers through their APIs from one place, so you configure security in fewer places.

Question 3: What is an example of Infrastructure-as-a-Service (IaaS)?

• Microsoft Office 365
• A VMWare player
• A virtual machine (VM)
• Netflix

Why: A virtual machine is raw computing infrastructure rented from a provider, which is IaaS. Office 365 and Netflix are SaaS.

Question 4: Which two security services can be performed as Security-as-a-Service (SECaaS)? (Choose two.)

• Local confidential data protection
• Security information and event management (SIEM)
• Hardware forensics
• Intrusion detection and prevention (IDP)
• User deployment

Why: SIEM and intrusion detection and prevention can both be delivered from the cloud as a service.

Question 5: Which type of proxy sits in front of the protected server and brokers connections before allowing traffic to pass to its destination?

• Reverse proxy
• Router proxy
• Forward proxy
• Broker proxy

Why: A reverse proxy sits in front of servers and handles incoming connections; a forward proxy sits in front of clients.

Question 6: Which two roles are responsible for securing cloud applications? (Choose two.)

• Cloud provider
• Application end user
• End user local machine
• Application developer

Why: Under the shared responsibility model, both the cloud provider and the application developer must secure cloud applications.

Question 7: Which two actions should you take to secure your data in the cloud? (Choose two.)

• Secure access to data with authentication.
• Keep a local tape backup.
• Implement data loss prevention (DLP).
• Use only Hyper Text Transfer Protocol (HTTP) to transfer data.
• Always back up to a secure universal serial bus (USB) device.

Why: Strong authentication controls who can reach cloud data, and DLP stops it leaking out.

Question 8: Which three security devices are hosted in the cloud? (Choose three.)

• An email gateway
• A file share server
• An antivirus scanner
• A firewall
• A web server
• A network accelerator

Why: Email gateways, antivirus scanning and firewalls are commonly delivered as cloud-hosted security services.

Question 9: Which two protocols can you use as a single sign-on (SSO) protocol for cloud applications? (Choose two.)

• Secure Assertion Markup Language (SAML)
• Remote Authentication Dial-In User Service (RADIUS)
• Lightweight Directory Access Protocol (LDAP)
• Open Authorization (OAuth)
• Hyper Text Transfer Protocol Secure (HTTPS)

Why: SAML and OAuth are the standard web protocols for cloud single sign-on; RADIUS and LDAP are mostly used inside internal networks.

Question 10: What is a common threat to cloud environments?

• Shoulder surfing
• Malware on infected universal serial bus (USB) sticks
• Data loss
• Tailgating

Why: Misconfiguration, weak access control and accidental deletion make data loss one of the most common cloud threats.

Question 11: What is a multi-cloud environment?

• An environment that uses multiple operating systems in the cloud
• An environment that uses local and cloud-based virtual machines
• An environment that uses multiple virtual machines in the cloud
• An environment that has applications hosted on different cloud platforms and vendors

Why: Multi-cloud means using applications and services from more than one cloud provider, for example AWS and Azure together. (We corrected this answer in November 2026; earlier versions of this page marked a different option.)

Question 12: Which security product allows visibility into a cloud environment and examines it for risk, threats, and compliance?

• Intrusion Detection
• Data Loss Prevention
• Cloud Native Protection
• Packet Capture and Sniffing

Why: Cloud-native protection tools scan a cloud environment for risky configuration, threats and compliance gaps.

Question 13: Why do virtual machines (VMs) increase the potential attack surface?

• More computers increase the risk of compromise.
• More data used increases risk of corruption.
• More resources used increases power consumption.
• More network traffic increases bandwidth usage.

Why: Each VM is another system that can be compromised, so more VMs mean a bigger attack surface.

Question 14: What would you install in front of a protected cloud network to partition it from the internet?

• A cloud access security broker (CASB)
• A router
• A cloud native firewall
• A web gateway
• A security information and event management (SIEM) system

Why: A cloud-native firewall separates the protected cloud network from the internet, like an edge firewall on premises.

Question 15: What runs on a laptop, desktop, or server, and allows you to create a virtual machine (VM)?

• A hypervisor
• Random access memory (RAM)
• A virtual disk
• A basic input/output system (BIOS)

Why: A hypervisor (for example VirtualBox, VMware Workstation or Hyper-V) runs on a computer and creates and runs virtual machines.

Frequently asked questions

Is the Fortinet FCF certification free?

Yes. The FCF in Cybersecurity courses are free on the Fortinet Training Institute website. You need a free account to enrol.

How do I get the FCF in Cybersecurity certification?

Complete Introduction to the Threat Landscape, plus either Getting Started in Cybersecurity or Technical Introduction to Cybersecurity. Choose the technical course if you want a career in IT or network security.

How long is the FCF certification valid?

The certification is valid for two years from when you complete the second course.

Getting Started or Technical Introduction: which should I take?

Getting Started in Cybersecurity is aimed at sales and non-technical roles. Technical Introduction to Cybersecurity goes deeper into cryptography, network security, authentication, remote access, endpoints and cloud, so it suits anyone aiming for a technical role.

Related Fortinet guides

• Fortinet Introduction to the Threat Landscape quiz answers
• Fortinet Getting Started in Cybersecurity quiz answers