A compliance auditor asks the NOC to confirm that configuration backups for control-center FortiGates cannot be read by anyone who happens to find the exported file on a USB drive left in a drawer. What should the NOC verify is enabled on those backups?
Select an answer to reveal the explanation.
Short Explanation
An unencrypted configuration export is basically a plain-text copy of the firewall's secrets, so anyone who finds the file can read it. Encrypting the backup with a password turns that same file into something useless without the passphrase, which is exactly what the auditor's worried about.
Full Explanation
A FortiGate configuration export can contain sensitive material such as pre-shared keys and hashed credentials, so Fortinet supports encrypting the exported file with a password; without that option enabled, anyone who obtains the file, on a USB stick or in an email attachment, can open it and read configuration details in plain text. Scheduling backups for off-peak hours affects when the export runs and how much it might disrupt operations, not whether the resulting file is protected once it exists. Keeping backups only on internal disk actually makes the auditor's concern worse, since it removes the offsite copy needed for real disaster recovery while doing nothing about file confidentiality. Renaming the file to hide the hostname is security by obscurity, trivial to defeat by simply opening the file, and doesn't address the underlying readability problem. The operational check: attempt to open a recent backup file without supplying the passphrase and confirm it can't be read in plain text, which verifies encryption is actually active rather than just configured and forgotten.