nerdexam
Fortinet

NSE4_FGT-7.0 · Question #36

Which statement regarding the firewall policy authentication timeout is true?

The correct answer is A. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets. The firewall policy authentication timeout is an idle timeout, meaning the FortiGate considers a user idle and will time them out if no traffic originates from their device for the specified duration.

Firewall Policies

Question

Which statement regarding the firewall policy authentication timeout is true?

Options

  • AIt is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets
  • BIt is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address
  • CIt is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets
  • DIt is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address

How the community answered

(45 responses)
  • A
    91% (41)
  • B
    2% (1)
  • C
    7% (3)

Why each option

The firewall policy authentication timeout is an idle timeout, meaning the FortiGate considers a user idle and will time them out if no traffic originates from their device for the specified duration.

AIt is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packetsCorrect

The FortiGate's firewall policy authentication timeout is specifically an idle timeout. This means the countdown timer for a user's authenticated session resets with each new packet originating from that user. If no traffic is detected from the user's IP address within the configured timeout period, the user's session is considered idle and subsequently terminated.

BIt is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address

It is not a hard timeout; a hard timeout would expire after a fixed duration regardless of activity, which is not how this specific timeout functions.

CIt is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets

The idle timeout is primarily based on traffic from the user, not necessarily to the user as well, for determining user activity in the context of authentication.

DIt is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address

It is not a hard timeout and is primarily tied to the user's IP address for session tracking, not their MAC address in this context.

Concept tested: FortiGate firewall policy authentication idle timeout definition

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/466367/firewall-authentication-and-sslvpn-timeout

Topics

#Firewall policy#Authentication timeout#Idle timeout

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full NSE4_FGT-7.0 Practice