11
Which of the following are purposes of NAT traversal in IPsec? (Choose two.)
Refer to the exhibit.
The exhibit shows the output of a diagnose command.
What does the output reveal about the policy route?
Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).
Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?
Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)
55
In which two ways can RPF checking be disabled? (Choose two )
87
Which of the following are valid actions for FortiGuard category based filter in a web filter profile ui proxy-based inspection mode? (Choose two.)
Which statement correctly describes the use of reliable logging on FortiGate?
73
If Internet Service is already selected as Source in a firewall policy, which other configuration objects can be added to the Source filed of a firewall policy?
What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?
Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up. but phase 2 fails to come up.
Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?
Which statement about video filtering on FortiGate is true?
Refer to the exhibit.
The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device.
Which two actions does FortiGate take on internet traffic sourced from the subscribers? (Choose two.)
An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings.
What is true about the DNS connection to a FortiGuard server?
32
When configuring a firewall virtual wire pair policy, which following statement is true?
99
An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken. Each site has a FortiGate VPN gateway. What must an administrator do to achieve this objective?
View the exhibit.
Which of the following statements are correct? (Choose two.)
An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check?
An administrator configures outgoing interface any in a firewall policy.
What is the result of the policy list view?
Refer to the exhibit.
Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)
51
Which of the following statements about central NAT are true? (Choose two.)
Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?
FortiGate is operating in NAT mode and is configured with two virtual LAN (VLAN) subinterfaces added to the same physical interface.
In this scenario, what are two requirements for the VLAN ID? (Choose two.)
106
Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)
7
Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)
What are two characteristics of FortiGate HA cluster virtual IP addresses? (Choose two.)
Refer to the exhibit.
The exhibit shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)
94
An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)
Refer to the FortiGuard connection debug output.
Based on the output shown in the exhibit, which two statements are correct? (Choose two.)
An administrator has configured the following settings:
What are the two results of this configuration? (Choose two.)
Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)
Which scanning technique on FortiGate can be enabled only on the CLI?
Which two statements about FortiGate FSSO agentless polling mode are true? (Choose two.)
Refer to the exhibit.
Based on the raw log, which two statements are correct? (Choose two.)
Refer to the exhibit.
The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.
The WAN (port1) interface has the IP address 10.200. 1. 1/24.
The LAN (port3) interface has the IP address 10 .0.1.254. /24.
The first firewall policy has NAT enabled using IP Pool.
The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0. 1. 10?
On FortiGate, which type of logs record information about traffic directly to and from the FortiGate management IP addresses?
Examine this FortiGate configuration:
How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?
Which two statements ate true about the Security Fabric rating? (Choose two.)
82
Consider the topology:
Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server.
An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.
The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.
What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)
7
An administrator has a requirement to keep an application session from timing out on port 80. What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)
109
Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides
(client and server) have terminated the session?
Which statement describes a characteristic of automation stitches?
You have enabled logging on a FortiGate device for event logs and all security logs, and you have set up logging to use the FortiGate local disk.
What is the default behavior when the local disk is full?
An organization requires remote users to send external application data running on their PCs and access FTP resources through an SSL/TLS connection.
Which FortiGate configuration can achieve this goal?
An employee needs to connect to the office through a high-latency internet connection.
Which SSL VPN setting should the administrator adjust to prevent SSL VPN negotiation failure?
What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?
84
Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?
20
Which two statements are true about the RPF check? (Choose two.)
53
Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?