NSE 4 7.2 Flashcards
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up.
Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?
On HQ-FortiGate, sent Encryption to AES256.
The Encryption and authentication algorithm needs to match
Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)
- FortiSIEM
- FortiCloud
- FortiAnalyzer
Fortisandbox is not a logging solution.
Fortigate Security 7.0 pf 279
Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)
- Operating mode
- NGFW Mode
C: “Operating mode is per-VDOM setting. You can combine transparent mode VDOM’s with NAT mode VDOMs on the same physical Fortigate”.
D: “Inspection-mode selection has moved from VDOM to firewall policy, and the default inspection-mode is flow, so NGFW Mode can be changed from Profile-base (Default) to Policy-base directly in System > Settings from the VDOM”.
A and B are incorrect: “The firmware on your Fortigate and some settings, such as system time, apply to the entire device-they are not specific to each VDOM.
Review the Intrusion Prevention System (IPS) profile signature settings.
Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?
Traffic matching the signature will be silently dropped and logged.
“pass” is only default action.
The Pass action on the specific signature would only be chosen, if the Action (on the top) was set to Default. But instead its set to Block, se the action is will be to block and drop.
Which two statements are correct regarding FortiGate FSSO agentless polling mode? (Choose two.)
- FortiGate uses the SMB protocol to retrieve the event viewer logs from the DCs.
- FortGate queries AD by using LDAP to retrieve user group information.
Fortigate Infrastructure 7.0 Study Guide P.257-258, 272-273
Which type of logs on FortiGate record information about traffic directly to and from the FortiGate management IP addresses?
Local traffic logs
FortiGate_Security 7.0 page 263
Fortigate Security 7.0 page 268
Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)
- Proxy-based inspection
- Flow-based inspection
Profile based - Flow or proxy based.
Policy based - flow only.
Fortigate Security 7.0 pg 368
An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.
Which DPD mode on FortiGate will meet the above requirement?
On idle
Fortigate Infrastructure 7.0 Study Guide P.214
Fortigate Infrastructure 7.0 Study Guide P.228
The exhibit shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)
- The sensor will allow attackers matching the NTP.Spoofed.KoD.DoS signature.
- The sensor will block all attacks aimed at Windows servers.
An admin has configured an SLA, which failed to generate any traffic.
Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers? (Choose two.)
- Admin didn’t configure a gateway for the SD-WAN members, or configured gateway is not valid.
- The Enable probe packets setting is not enabled.
Which two statements about the debug flow output are correct? (Choose two.)
- The debug flow is of ICMP traffic.
- A new traffic session is created.
The client is pinging the GW in the same subnet, son firewall policy is needed to allow such communication.
Proto 1 is icmp.
Obviously a new session was created. The ping is being sent to the gateway from a local device so no policy is needed. “gw-10.0.1.250 via root”
Fortigate Infrastructure 7.0 pg 358-360
Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?
Intrusion prevention system engine
The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.
The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access the Internet. The To_Internet VDOM is the only VDOM with internet access and is directly connected to ISP modem.
Which two statements are true? (Choose two.)
- Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.
- Inter-VDOM links are required on the To-Internet VDOM to allow LAN users to access the Internet.
An administrator does not want to report the logon events of service accounts to FortiGate.
What setting on the collector agent is required to achieve this?
Add user accounts to the Ignore User list.
FortiGate_Infrastructure_7.0 page 278
FortiGate_Infrastructure_7.0 page 290
FortiGuard categories can be overridden and defined in different categories. To create a web rating override for example.com home page, the override must be configured using a specific syntax.
Which two syntaxes are correct to configure web rating for the home page? (Choose two.)
www.example.com
example.com
When using FortiGuard category filtering to allow or block access to a website, one option is to make a web rating override and define the website in a different category. Web ratings are only for host names— “no URLs or wildcard characters are allowed”.
Fortigate Security 7.0 pg 384
Which statement about the policy ID number of a firewall policy is true?
It is required to modify a firewall policy using the CLI.
How does FortiGate act when using SSL VPN in web mode?
FortiGate acts as an HTTP reverse proxy.
Fortigate security 7.0 Page 583
The exhibits show the SSL, auth policy, and security policy for FB
Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.
Which part of the policy configuration must you change to resolve the issue?
The SSL inspection needs to be a deep content inspection.
The lock logo behind Facebook_like.Button indicates that SSL Deep Inspection is Required.
Alle other Application Signatures Facebook and Facebook_Video. Play does not require SSL inspection. Hence that the users can play video content. If you look up the Application Signature for Facebook_like.Button it will say “Requires SSL Deep Inspection”.
Padlock = requires SSL Deep Inspection.
Which statement is correct regarding the inspection of some of the services available by web applications embedded in third-party websites?
FortiGate can inspect sub-application traffic regardless of where it was originated.
https://help.fortinet.com/fortiproxy/11/Content/Admin%20Guides/FPX-AdminGuide/300_System/303d_FortiGuard.htm
Which two statements about SSL VPN between two FortiGate devices are true? (Choose two.)
- The client FortiGate uses the SSL VPN tunnel interface type to connect SSL VPN.
- Server FortiGate requires a CA certificate to verify client FortiGate certificate.
A network administrator has enabled SSL certificate inspection and antivirus on FortiGate. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and the file can be downloaded.
What is the reason for the failed virus detection by FortiGate?
SSL/SSH Inspection profile is incorrect.
An administrator is configuring an Ipsec between site A and siteB. The Remotes Gateway setting in both sites has been configured as Static IP Address. For site
A, the local quick mode selector is 192.16.1.0/24 and the remote quick mode selector is 192.16.2.0/24.
How must the administrator configure the local quick mode selector for site B?
192.16.2.0/24
FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy.
Which two other security profiles can you apply to the security policy? (Choose two.)
- Antivirus scanning
- Intrusion prevention
Security policy: If the traffic is allowed as per the consolidated policy, FortiGate will then process it based on the security policy to analyze additional criteria, such as URL categories for web filtering and application control. Also, if enabled, the security policy further inspects traffic using security profiles such as IPS and AV.
Fortigate security 7.0 Page 451
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)
- The subject field in the server certificate
- The server name indication (SNI) extension in the client hello message
- The Subject Alternative Name (SAN) field in the server certificate
Fortigate firtsly uses SNI, if there is no SNI it uses Subject or Subject Alternatives.
FortiGate_Security_7.0 Study Guide .pdf page 326
An administrator is running a sniffer command as shown in the exhibit.
Which three pieces of information are included in the sniffer output? (Choose three.)
- Interface name
- IP header
- Packet payload
Fortigate Infrastructure 7.0 pg 58
To remember the order, think of the famous Architect I.M. Pei.
IPEI
IP Header
Packet Payload
Ethernet Header
Interface Name
- IP Header
- IP Header and Packet Payload
- IP Head, Packet Payload, and Ethernet Header
4-6 is the same - just add “Interface Name” to the end of each.
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=11186
To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?
FortiAnalyzer
All devices must be authorized on the root Fortigate, and then after this step all must be authorized on the FortiAnalyzer.
A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub interfaces added to the physical interface.
Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.
The two VLAN sub-interfaces must have different VLAN IDs.
Reference: https://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD31639
NGFW mode allows policy-based configuration for most inspection rules.
Which security profile’s configuration does not change when you enable policy-based inspection?
Antivirus
Antivirus and IPS is enhanced by the IPS Engine, so that is why B is the right answer.
Based on the configuration, what will happen to Apple FaceTime?
Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.
Facetime belongs to VoIP category which is monitored here and therefore should be allowed, however, because of the behavior of the facetime “Excessive-Bandwidth”, the custom filter Excessive-Bandwidth will block Facetime and the lookup won’t continue to the second filter.
Which two statements are true about collector agent standard access mode? (Choose two.)
- Standard mode uses Windows convention-NetBios: Domain\Username
- Standard mode security profiles apply to user groups
Standard Mode does not do OU, advanced mode does.
Standard Mode cannot do nested groups.
Fortigate Infra 7.0 Pg 280
Fortigate Infrastructure 7.0 Study Guide P.295
What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?
FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.
“Another benefit of enabling Auto-negotiate is that the tunnel comes up and stays up automatically, even when there is no interesting traffic”.
When IPsec SAs expire, FortiGate needs to negotiate new SAs to continue sending and receiving traffic over the IPsec tunnel. Technically, FortiGate deletes the expired SAs from the respective phase 2 selectors, and install new ones. If IPsec SA renegotiation takes too much time, then FortiGate may drop interesting traffic because of the absence of active SAs. To prevent this, you can enable Auto-negotiate. When you do this, FortiGate not only negotiates new SAs before the current SAs expire, but it also starts using the new SAs right away. The latter prevents traffic disruption by IPsec SA renegotiation.
Another benefit of enabling Auto-negotiate is that the tunnel comes up and stays up automatically, even when there is no interesting traffic. When you enable Autokey Keep Alive and keep Auto-negotiate disabled, tunnel will not come up automatically unless there is interesting traffic. However, after the tunnel is up, it stays that way because FortiGate periodically sends keep alive packets over the tunnel. Note that when you enable Auto-negotiate, Autokey Keep Alive is implicitly enabled.
Which two types of traffic are managed only by the management VDOM? (Choose two.)
- FortiGuard web filter queries
- DNS
“NTP, FortiGuard updated/queries, SNMP, DNS Filtering, Log settings and other mgmt related services”.
PKI is wrong because PKI stands for Public Key Infrastructure and is associated with VPNS
Traffic shaping is wrong because traffic shaping is configured on a ‘Traffic Shaping Policy’
FortiGuard web filter queries is correct because Fortigate will use Fortiguard for these queries
DNS is correct as the management VDOM (very similar to Palo Alto) can use DNS for DNS queries
Fortigate Infrastructure 7.0 Study Guide P.113
Fortigate Infrastructure 7.0 Book Pg. 122 says global settings for vdom’s are:
Hostname.
HA Settings.
Fortiguard Settings.
System time.
Administrative Accounts.
Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)
- udp-echo
- TWAMP
Fortigate Infrastructure 7.0 pg 81
In the GUI appears HTTP, DNS and Ping.
Which two VDOMs are the default VDOMs created when FortiGate is set up in split VDOM mode? (Choose two.)
- FG-traffic
- Root
Root VDOM is created by default when VDOMs are enabled.
FortiGate Infrastructure 7.0 Study Guide page 123
Which three methods are used by the collector agent for AD polling? (Choose three.)
- NetAPI
- WMI
- WinSecLog
Fortigate Infra SG 7.0 pg 255
If the Services field is configured in a Virtual IP (VIP), which of the following statements is true when central NAT is used?
The Services field removes the requirement of creating multiple VIPs for different services.
The Services option has been added to VIP objects. When services and port forward are configured, only a single mapped port can be configured. However, multiple external ports can be mapped to that single internal port.This configuration was made possible to allow for complex scenarios where multiple sources of traffic are using multiple services to connect to a single computer, while requiring a combination of source and destination NAT, and not requiring numerous VIPs to be bundled into VIP groups. VIPs with different services are considered non-overlapping.
An administrator needs to increase network bandwidth and provide redundancy.
What interface type must the administrator select to bind multiple FortiGate interfaces?
Aggregate interface
Link aggregation (IEEE 802.3ad) enables you to bind two or more physical interfaces together to form an aggregated (combined) link. This new link has the bandwidth of all the links combined. If a link in the group fails, traffic is transferred automatically to the remaining interfaces with the only noticeable effect being a reduced bandwidth.
Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?
Root VDOM
If you enable split-task VDOM mode on the upstream FGT device, it can allow downstream FGT devices to join the Security Fabric in the root and FG-Traffic VDOMs. If split-task VDOM mode is enabled on the downstream FortiGate, it can only connect to the upstream FortiGate through the downstream FortiGate interface on the root VDOM.
Which security feature does FortiGate provide to protect servers located in the internal networks from attacks such as SQL injections?
Web application firewall
Some FortiGate features are meant to protect clients, not servers. For example, FortiGuard web filtering blocks requests based on the category of the server’s web pages. Antivirus prevents clients from accidentally downloading spyware and worms. Neither protects a server (which doesn’t send requests—it receives them) from malicious scripts or SQL injections. Protecting web servers requires a different approach because they are subject to other kinds of attacks. This is where WAF applies. The WAF feature is available only in proxy inspection mode.
Examine the exhibit, a virtual IP and firewall policy configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address 10.0.1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?
10.200.1.1
We set up the scenario when we enable port forwarding in the vip leaves with the ip associated with the wan interface (10.200.1.1), if we disable port forwarding the outgoing ip is the one associated with the VIP (10.200.1.10).
The “set nat-source-vip enable” should be applied in the VIP Otherwise, the IP address of the physical interface will be used for NAT.
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD44529
Which two statements are true about collector agent advanced mode? (Choose two.)
- Advanced mode supports nested or inherited groups
- FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.
FortiGate Infra 7.0 page 280
Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?
By default, split tunneling is enabled
There is a Trap here… C and D have something right but the trick is the question…
Under SSL VPN settings you can see that port is 443 (same of https admin port)
BUT the question is about a SSL VPN Setting FOR A VPN PORTAL… so if you go to SSL VPN Portals and hit “Create new” you will see Tunnel Mode and Split Tunnel enabled by default… so, the correct answer is C.
Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)
- Log downloads from the GUI are limited to the current filter view.
- Log backups from the CLI cannot be restored to another FortiGate.
The question is about Backing up logs from CLI and Downloading logs from the GUI, therefore, C is incorrect because the question doesn’t say anything about uploading logs from CLI, but says backing up from CLI…
Consider the topology:
Application on a Windows machine <–{SSL VPN} –>FGT–> Telnet to Linux server.
An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.
The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.
What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)
- Create a new service object for TELNET and set the maximum session TTL.
- Create new firewall policy and place it above the existing SSL VPN policy for the SSL VPN traffic , and set the new TELNET servie object in the policy.
The key here is performing the task without affecting any of the other services.
- Not A - Changing the maximum TTL value for TELNET will affect every other policy that references the TELNET service
- Not B - Changing the session TTL on the SSLVPN policy will impact other services referenced in the policy.
Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?
Subject Key Identifier value
FortiGate can use the Subject Key Identifier and Authority Key Identifier values to determine the relationship between the issuer of the certificate (identified in the Issuer field) and the certificate.
Which two statements are true about the Security Fabric rating? (Choose two.)
- Many of the security issues can be fixed immediately by clicking Apply where available
- The Security Fabric rating must be on the root FortiGate device in the Security Fabric.
Fortigate Security 7.0 pg 96-97
What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?
It limits the scope of the application control to the browser-based technology category only.
The keyword is “browser-based” which we can find only in the Answer A.
Which of the following statements correctly describes FortiGates route lookup behavior when searching for a suitable gateway? (Choose two)
- Lookup is done on the trust packet from the session originator.
- Lookup is done on the trust reply packet from the responder.
B is a bogus response, checking the last packet is a bit too late to establish a connection. Whoever provided these answers failed this exam. Should also be “First” instead of “Trust”.
An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken. Each site has a FortiGate VPN gateway.
What must an administrator do to achieve this objective?
The admin must use a FortiAuthenticator device.
B is correct due to the FortiToken, a different OTP cannot use FortiToken. So we have to choose the fortiAuthenticator.
FortiGate_Security_7.0 pages 212, 216.
Which three statements about security associations (SA) in IPsec are correct? (Choose three.)
- Phase 2 SAs are used for encrypting and decrypting data exchanged through the tunnel.
- A phase 1 SA is bidirectional, while a phase 2 SA is directional.
- Phase 2 SDA expiration can be time-based, volume-based, or both.
Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)
- Uninterruptable upgrade is enabled by default.
- Traffic load-balancing is temporarily disabled while upgrading the firmware.
Reference: https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-high-availability-52/HA_operatingFirmUpgd.htm
Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)
- Shutdown/reboot a downstream FortiGate device.
- Disable FortiAnalyzer logging for a downstream FortiGate device.
Examine the two static routes shown in the exhibit.
Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?
FortiGate will use the port1 route as the primary candidate.
FortiGate will use the port1 route as the primary candidate.
What inspection mode does FortiGate use if it is configured as a policy-based next-generation firewall (NGFW)?
Flow-based inspection
Fortigate_Security_7.0 Page 368
View the firewall policy and the antivirus profile exibhits
Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?
The flow-based inspection is used, which resets the last packet to the user
Key to right answer is “unable to receive a block replacement message when downloading an infected file for the first time”.
- “ONLY” If the virus is detected at the “START” of the connection, the IPS engine sends the block replacement message immediately
- When a virus is detected on a TCP session (FIRST TIME), but where “SOME PACKETS” have been already forwarded to the receiver, FortiGate “resets the connection” and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can’t be opened. The IPS engine also caches the URL of the infected file, so that if a “SECOND ATTEMPT” to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.
Two possible scenarios can occur when a virus is detected:
- When a virus is detected on a TCP session where some packets have been already forwarded to the receiver, FG resets the connection and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can’t be opened. The IPS engine also caches the URL of the infected file, so that IF A SECOND ATTEMPT TO TRANSMIT THE FILE IS MADE, THE IPS ENGINE WILL SEND A BLOCK REPLACEMENT MESSAGE to the client instead of scanning the file again.
- If the virus is detected at the start of the connection, the IPS engine sends the block replacement message immediately.
Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)
- NTP
- DNS
Which statement about video filtering on FortiGate is true?
It is available only on a proxy-based firewall policy
Reference: https://docs.fortinet.com/document/fortigate/7.0.0/new-features/190873/video-filtering
An administrator has configured a strict RPF check on FortiGate.
Which statement is true about the strict RPF check?
Strict RPF checks the best route back too the source using the incoming interface.
Loose RPF checks for any route and Strict RPF check for best route
Fortigate Security 7.0 pg 39-40.
Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)
- The keyUsage extension must be set to keyCertSign
- The CA extension must be set to true
B is incorrect as It’s not madatory to have a wildcard certificate.
A is incorrect because certificate can be signed by any CA private or public.
FortiGate Security 7.0 pp 328:
“In order for FortiGate to act in these roles, its CA certificate must have the basic constraints extension set to cA=True and the value of the keyUsage extension set to keyCertSign.”
Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?
get system arp
D is correct. “If you suspect that there is an IP address conflict, or that an IP has been assigned to the wrong device, you may need to look at the ARP table.”
FortiGate Infrastructure 7.0 pg 353, 368
By default, FortiGate is configured to use HTTPS when performing live web filtering with FortiGuard servers.
Which two CLI commands will cause FortiGate to use an unreliable protocol to communicate with FortiGuard servers for live web filtering? (Choose two.)
- set protocol udp
- set fortiguard-anycast disable
Fortigate Security 7.0 pg 417, 422
Which two statements are true when FortiGate is in transparent mode? (Choose two.)
- By default, all interfaces are part of the same broadcast domain.
- FortiGate forwards frames without changing the MAC address.
Fortigate_Security_7.0 page 379
Which of the following are purposes of NAT traversal in IPsec? (Choose two.)
- To detect intermediary NAT devices in the tunnel path.
- To encapsulation ESP packets in UDP packets using port 4500.
When NAT-T is enabled on both ends, peers can detect any NAT device along the path. If NAT is found, then the following occurs:
- Both phase 2 and remaining phase 1 packets change to UDP port 4500.
- Both ends encapsulate ESP within UDP port 4500.
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD48755
You have enabled logging on your FortiGate device for Event logs and all Security logs, and you have set up logging to use the FortiGate local disk.
What is the default behavior when the local disk is full?
Logs are overwritten and the first warning is issued when the log disk usage reaches the threshold of 75%
Page 278 Fortigate Security 7.0
(New Version!!), only 75% of the disk is available to store logs, this is distributed in the existing vdoms.
Diagnose sys logdisk usage – CLI command to verify this.
If the Issuer and Subject values are the same in a digital certificate, to which type of entity was the certificate issued?
A root CA
An administrator has configured two-factor authentication to strengthen SSL VPN access.
Which additional best practice can an administrator implement?
Configure host check
For context, Host Check uses the FortiClient to check that certain conditions on the remote PC are met, such as having AV installed, that there is a specific file located on the PC, that a certain process is running on the PC, or that specific registry entries exist on the PC. Host Check basically ensures that the PC with the VPN Client installed is setup according to your organizations standards.
The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile.
What order must FortiGate use when the web filter profile has features enabled, such as safe search?
Static URL filter, FortiGuard category filter, and advanced filters
FortiGate_Security_7.0_Study_Guide-Online.pdf page 414 shows the HTTP Inspection Order (Static URL Filter -> FortiGuard Category Filter -> Advanced Filters)
Which two statements correctly describe auto discovery VPN (ADVPN)? (Choose two.)
- IPsec tunnels are negotiated dynamically between spokes.
- It recommends the use of dynamic routing protocols, so that spokes can learn the routes to other spokes.
Which of the following SD-WAN load –balancing method use interface weight value to distribute traffic? (Choose two.)
- Volume
- Session
Session is the name of a mode. Spillover is not the real name for SD-WAN that is in ECMP. Spillover is called Usage in SD-WAN.
Reference: https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-networking/SD-WAN/SD-WAN_load_balancing.htm
Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)
- Web-filter in flow-based inspection.
- Antivirus in flow-based inspection mode.
- Application control
It asks what uses the IPS system. And that is:
Application control
Anti-virus (flow-based)
Web filter (flow-based)
Email filter (flow-based)
Data leak prevention (flow-based in one armed sniffer mode)
Fortigate 7.0 Security pg 520, 525
Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)
- This is known as many-to-one NAT.
- Source IP is translated to the outgoing interface IP.
Because the fixed port is disabled (default). If it is enable, then the answer would be C&D.
Examine the IPS sensor and DoS policy configuration.
When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?
IMAP.Login.brute.Force
Anomalies can be zero-day or denial of service attack
Are Detected by behaivoral analysis:
Rate Based IPS Signatures.
DoS Policies.
Protocol Constraint Inspections.
DoS policy disabled in this scenario.
Which of the following are valid actions for FortiGuard category based filter in a web filter profile ui proxy-based inspection mode? (Choose two.)
- Warning
- Allow
Exempt is not FortiGuard category action.
Which three authentication timeout types are availability for selection on FortiGate? (Choose three.)
- Hard-timeout
- New-session
- Idle-timeout
Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explanation-of-auth-timeout-types-for-Firewall/ta-p/189423?externalID=FD37221
Which scanning technique on FortiGate can be enabled only on the CLI?
Machine learning (AI) scan
For FortiOS 7.0 the answer is Machine learning (AI) scan instead of Heuristics. See FortiGate Security 7.0 page 476
Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?
It is dropped
Because it exceeded the Extreme memory threshold.
“However, if the memory usage exceeds the extreme threshold, new sessions are ALWAYS DROPPED, regardless of the FortiGate configuration.”
Note: “Extreme threshold is when the memory usage goes above 95%, and all NEW sessions are dropped.
Which three statements are true regarding session-based authentication? (Choose three.)
- HTTP Sessions are treated as a single user.
- It can differentiate among multiple clients behind the same source IP address.
- It requires more resources.
For 1: Each session-based authenticated user is counted as a single user using their authentication membership (RADIUS, LDAP, FSSO, local database etc.) to match users in other sessions. So one authenticated user in multiple sessions is still one user.
Users who use Apple FaceTime video conferences are unable to set up meetings.
In this scenario, which statement is true?
Apple FaceTime belongs to the custom blocked filter.
FaceTime categorized (filtered) under “Excessive-Bandwidth” and custom filter override set to block this. Also we know that users can’t use FaceTime.
Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)
- Shutdown/reboot a dowwnstream FortiGate device.
- Disable FortiAnalyzer logging for a doownstream FortiGate device.
Which statement about the IP authentication header (AH) used by IPsec is true?
AH provides data integrity but no encryption
“IPsec is a suite of protocols that is used for authenticating and encrypting traffic between two peers. The three most used protocols in the suite are the following:
- Internet Key Exchange (IKE), which does the handshake, tunnel maintenance, and disconnection.
- Encapsulation Security Payload (ESP), which ensures data integrity and encryption.
- Authentication Header (AH), which offers only data integrity - not encryption.”
Exhibit A shows system performance output.
Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds.
Based on the system performance output, which two statements are correct?
- Administrators cannot change the configuration
- FortiGate has entered conserve mode
Fortigate Infrastructure 7.0 pg 367-368
Fortigate Infra 7.0 page 383: Not accept config changes, does not run quarantine action - forwarding files to SandBox.
An administrator wants to configure timeouts for users. Regardless of the user’s behavior, the timer should start as soon as the user authenticates and expire after the configured value.
Which timeout option should be configured on FortiGate?
hard-timeout
Fortigate Security 7.0 pg 254
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
- All traffic must be routed through the primary tunnel when both tunnels are up
- The secondary tunnel must be used only if the primary tunnel goes down
- In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover
Which two key configuration changes are needed on FortiGate to meet the design requirements?
- Enable Dead Peer detection.
- Configure a lower distance oon the static route for the primary tunnel, add a high distance on the static route for the secondary tunnel.
1 because the customer requires the tunnels to notify when a tunnel goes down. DPD is designed for that purpose. To send a packet over a firewall to determine a failover for the next tunnel after a specific amount of time of not receiving a response from its peer.
For 2, remember when it comes to choosing a route with regards to Administrative Distance. The route with the lowest distance for that particular route will be chosen. So, by configuring a lower routing distance on the primary tunnel, means that the primary tunnel will be chosen to route packets towards their destination.
Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?
To allow for out-of-order packets that could arrive after the FIN/ACK packets
TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.
The exhibit contains a network diagram, central SNAT policy, and IP pool configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
A firewall policy is configured to allow to destinations from LAN (port3) to WAN (port1).
Central NAT is enabled, so NAT settings from matching Central SNAT policies will be applied.
Which IP address will be used to source NAT the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?
10.200.1.99
Ping is ICMP protocol - protocol number = 1
=> SNAT policy ID 1 is policy that used.
=> Translated address is “SNAT-Remote1” that 10.200.1.99
Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)
- The port3 default route has the lowest metric.
- The port1 and port2 default routes are active in the routing table.
*> mean active routes
first square bracked mean administrative distance
second bracket square mean priority (valid only on static routes)
metric applies only in multiroutes with same administrative distance.
Refer to the web filter raw logs.
Based on the raw logs shown in the exhibit, which statement is correct?
Social networking web filter catesgory is configured with the action set to authenticate
1 is correct. We have two logs, first with action deny and second with passthrough.
A incorrect - second log shows: action=”passthrough”.
B incorrect - Firewall action can be allow or deny.
D incorrect - CLI don’t show policy name, only ID.
Remember … action=”passthrough” mean that authentication has occurred/
At first attempt from the same IP source connection is blocked, but a warning message is displayed. At the second attempt with the same IP source connection passtrough, so considering the first block and the second pass, the user must authenticate to be granted with access.
The global settings on a FortiGate device must be changed to align with company security policies.
What does the Administrator account need to access the FortiGate global settings?
Change Administrator profile
Fortigate security 7.0 pg 24
Prof_admin is only vdom admin not global.
Which two statements about the debug flow output are correct? (Choose two.)
- The debug flow is of ICMP traffic
- A new traffic session is created
Proto 1 is icmp.
Obviously a new session was created. The ping is being sent to the gateway from a local device so no policy is needed. “gw-10.0.1.250 via root”
Fortigate Infrastructure 7.0 pg 358-360
When configuring a firewall virtual wire pair policy, which following statement is true?
Any number of virtual wire pairs can be included in each policy, regardless of the policy traffic direction settings.
Based on the information shown in the exhibit, which statement is true?
One-to-one NAT IP pool is used in the firewall policy
In one-to-one, PAT is not required.
Which two statements are true about the FGCP protocol? (Choose two.)
- Runs only over the heartbeat links
- Elects the primary FortiGate device
Which statement is true about the session diagnostic output?
The session is in SYN_SENT state
In the first line “Session info: proto=6 proto_state=02”
Indicates TCP (proto=6) session in SYN_SENT state (proto=state=2)
FortiGate_Security_7.0 page 191.
0=None
1=Established
2=Syn_Sent
Reference:
https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-session-table-information/ta-p/196988#:~:text=the%20Reply%20direction-,State,-Value
Which two protocols are used to enable administrator access of a FortiGate device? (Choose two.)
- SSH
- HTTPS
What are the two results of this configuration? (Choose two.)
- A session for denied traffic is created
- The number of logs generated by denied traffic is reduced
ses-denied-traffic
Enable/disable including denied session in the session table.
https://docs.fortinet.com/document/fortigate/7.0.6/cli-reference/20620/config-system-settings
block-session-timer
Duration in seconds for blocked sessions .
integer
Minimum value: 1 Maximum value: 300
30
https://docs.fortinet.com/document/fortigate/7.0.6/cli-reference/1620/config-system-global
Examine the intrusion prevention system (IPS) diagnostic command.
Which statement is correct if option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?
The IPS engine was inspecting high volume traffic
“Option 5 enables IPS bypass mode. In this mode, the IPS engine is still running (answer B) , but it is not inspecting traffic. —-> If the CPU use decreases after that <—- , it usually indicates that the volume of traffic being inspected is too high for that FortiGate model.”
So D is correct to answer the question “decrease in CPU usage”
Fortigate Security 7.0 pg 567
Which contains a network diagram and routing table output. The Student is unable to access Webserver.
What is the cause of the problem and what is the solution for the problem?
The first reply packet for student failed the RPF check. This issue can be resolved by adding a static route to 203.0.114.24/32 through port3.
A user located behind the FortiGate device is trying to go to http://www.addictinggames.com (Addicting.Games). The exhibit shows the application detains and application control profile.
Based on this configuration, which statement is true?
Adicting.Games will be allowed, based on the Application Overrides configuration.
The exhibit contains a network diagram, firewall policies, and a firewall address object configuration.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-user2. Remote-user2 is still able to access Webserver.
Which two changes can the administrator make to deny Webserver access for Remote-User2? (Choose two.)
- Enable match-vip in the Deny policy.
- Set the Destination address as Web_server in the Deny policy.
By default does not match vip in deny policy for destination all. So 2 options we have:
- Enable match vip in the Deny policy.
- Add destination as webserver in deny policy.
In this scenario, which statement is true?
Session-based authentication is enabled
Fortigate Infrastructure 7.0 pg 264
NTLM authentication = session-based
The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.
Which two statements are true? (Choose two.)
- FortiGate SN FGVM010000065036 HA uptime has been reset.
- FortiGate SN FGVM010000064692 has the higher HA priority.
- Override is disable by default - OK
- “If the HA uptime of a device is AT LEAST FIVE MINUTES (300 seconds) MORE than the HA Uptime of the other FortiGate devices, it becomes the primary” The question here is : HA Uptime of FGVM01000006492 > 5 minutes? NO - 198 seconds < 300 seconds (5 minutes) Page 314 Infra Study Guide.
In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.
What should the administrator do next to troubleshoot the problem?
Execute a debug flow
Because sniffer shows the ingressing and egressing packets, but we cannot see dropped packets by fortigate in a sniffer. Debugging can show the packets are not entering for any reasons caused by fortigate. So, if a packed is reached to fortigate and dropped , debug will show us.
An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).
What must the administrator do to synchronize the address object?
Change the csf setting on the Local-FortiGate (root) to set fabric-object-unification default.
Based on the output shown in the exhibit, which two statements are correct? (Choose two.)
- One server was contacted to retrieve the contract information.
- FortiGate is using default FortiGuard communication settings.
Anycast is Enabled by default
The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme, users, and firewall address.
An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies.
The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a form-based authentication scheme for the FortiGate local user database. Users will be prompted for authentication.
How will FortiGate process the traffic when the HTTP request comes from a machine with the source IP 10.0.1.10 to the destination http:// www.fortinet.com? (Choose two.)
- If a Google Chrome browser is used with User-B credentials, the HTTP request will be allowed.
- If a Microsoft Internet Explorer browser is used with User-B credentials, the HTTS request will be allowed.
3 exibits are missing. They are:
- proxy custom address named “Browser CAT1” for local subnet and defined user agent “Chrome and IE”
- proxy custom address named “Browser CAT2” for local subnet and defined user agent “Firefox”
- proxy policy with 2 lines:
- Browser CAT2 & Local subnet & User B –> deny
- Browser CAT1 & Local subnet & User all –> accept
Beed on above exibits only users from Chrome and IE are allowed.
The exhibit shows a FortiGate configuration.
How does FortiGate handle web proxy traffic coming from the IP address 10.2.1.200, that requires authorization?
It Authenticates the traffic using the authentication scheme SCHEME1.
“What happens to traffic that requires authorization, but does not match any authentication rule? The active and passive SSO schemes to use for those cases is defined under config authentication setting”.
What are the two results of this configuration? (Choose two.)
- A session for denied traffic is created.
- The number of logs generated by denied traffic is reduce.
Reference:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD46328
Given the interfaces shown in the exhibit, which two statements are true? (Choose two.)
- port1-vlan1 and port2-vlan1 can be assigned in the same VDOM or different VDOMs.
- port1 is native VLAN.
Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose two.)
- For non-load balanced connections, packets forwarded by the clister to the server contain the virtual MAC address of port2 as source.
- For load balanced connections, the primary encapsulates TCP SYN packets before forwarding them to the secondary.
1: Non load balance: traffic enters port1 and go out port2 from FGT1. FGT2 is in primary mode
2: In proxy inspection mode, SYN packet goes to FGT1 port1. It is then forwarded to FGT2. the source MAC address of the packet is changed to the physical MAC address of port1 on the primary and the destination MAC address to the physical MAC address of port1 on the secondary. This is also known as MAC address rewrite. In addition, the primary encapsulates the packet in an Ethernet frame type 0x8891. The encapsulation is done only for the first packet of a load balanced session
Which of the following statements are true? (Choose two.)
- Browsers can be configured to retrieve this PAC file from the FortiGate.
- Any web request fortinet.com is allowed to bypass the proxy.
View the exhibit.
Addicting.Games is allowed based on the Application Overrides configuration.
Based on the raw log, which two statements are correct? (Choose two.)
- Traffic belongs to the root VDOM
- This is a security log
- “vd=root” which means vdom is root.
- “type=utm” which means security log event.
VDOM=root D.
Security=UTM
What does the configuration do? (Choose two.)
What does the configuration do? (Choose two.)
- Reduces the amount of logs generated by denied traffic.
- Creates session for traffic being denied.
1: because by keeping the denied sessions in the session table reduces the number of session denied events in the logs.
2: because you are keeping denied sessions in the session table.
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD46328
Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)
- There are 19 security recommendations for the security fabric.
- This security fabric topology is a logical topology view.
References:
https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/761085/results https://docs.fortinet.com/document/fortimanager/6.2.0/new-features/736125/security-fabric-topology
An administrator has configured the WINDOS_SERVERS IPS sensor in an attempt to determine whether the influx of HTTPS traffic is an attack attempt or not. After applying the IPS sensor, FortiGate is still not generating any IPS logs for the HTTPS traffic.
What is a possible reason for this?
The firewall policy is not using a full SSL inspection profile.
A ips sensor need a firewall policy to work… and need a policy with full inspection to inspect encripted traffic.
An administrator created a static route for Amazon Web Services.
What CLI command must the administrator use to view the route?
diagnose firewall proute list
Reference: https://www.fortinetguru.com/2019/09/troubleshooting-sd-wan-fortios-6-2/
The global settings on a FortiGate device must be changed to align with company security policies.
What does the Administrator account need to access the FortiGate global settings?
Change Administrator profile.
Study Guide – Introduction and Initial Configuration – Basic Administration – Administrator Profiles. When assigning permissions to an admin profile, you can specify rw, ro, or none to each area. By default, there is a special profile super_admin, which is used by the account named admin. It cannot be changed. It provides full access to everytihing, making the admin account similar to a root superuser account. The prof_admin is another default profile. It also provides full access, but unlike super_admin, it only applies to its virtual domain and not the global settings of FG. Also, its permissions can be changed.
Reference:
“If you want to grant access to all VDOMs and global settings, select super_admin as the access profile when configuring the administrator account. Similar to the account named admin, this account can configure all VDOMs.”
Fortigate Infrastructure Study Guide v7.0, Page 117
Based on the information shown in the exhibit, which statement is true?
One-to-one NAT IP pool is used in the firewall policy.
“one-to-one” is correct, See FortiGate Security 7.0 Study Guide P.164
“In one-to-one NAT, PAT is not required. Same source port is shown for both the ingress and egress address called also a single mapping of an internal to a external address”
The exhibit shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)
- The sensor will block all attacks aimed at Windows servers.
- The sensor will allow attackers matching the NTP.Spoofed.KoD.DoS signature.
Check on Fortigate Security Study Guide Page 532 ==> In the event of a false-positve outbreak, you can add the tiggered signature as an individual signature and set the action to monitor. This allows you to monitor the signature events using IPS log, while inbestigating the false-positive issue
Which policy will be highlighted, based on the input criteria?
Policy with ID 5.
It’s coming from port 3 - hits Facebook-Web (Application) from the screenshot it show that it allows http and https traffic (80, 443).
An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).
What must the administrator do to synchronize the address object?
Change the csf setting on both devices to set downstream-access enable.
Because D is already set to default (Global CMDB objects will be synchronized in Security Fabric.)
The root device has downstream access disabled, so it needs to be enabled to sync the object.
downstream-access - Enable/disable downstream device access to this device’s configuration and data.
disable - Disable downstream device access to this device’s configuration and data.
Reference: https://docs.fortinet.com/document/fortigate/7.2.0/cli-reference/147620/config-system-csf
Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds.
Based on the system performance output, which two results are correct? (Choose two.)
- Fortigate has entered conserve mode.
- Administrators cannot change the configuration.
What actions does FortiGate take to preserve memory while in conserve mode?
* FortiGate does not accept configuration changes, because they might increase memory usage.
* FortiGate does not run any quarantine action, including forwarding suspicious files to FortiSandbox.
* You can configure the fail-open setting under config ips global to control how the IPS engine behaves when the IPS socket buffer is full.
Based on the system performance output, it appears that FortiGate has entered conserve mode and administrators cannot change the configuration.
FortiGate has entered conserve mode: When FortiGate enters conserve mode, it reduces its operational capacity in order to conserve resources and improve performance. This may be necessary if the system is experiencing high levels of traffic or if there are issues with resource utilization.
Administrators cannot change the configuration: When the system is in conserve mode, administrators may not be able to change the configuration. This is because the system is prioritizing resource conservation over other activities, and making changes to the configuration may require additional resources that are not available.
It is important to note that FortiGate will not start sending all files to FortiSandbox for inspection, and administrators may still be able to access FortiGate through other means besides the console port.
Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-conserve-mode-is-triggered/ta-p/198580
The exhibits contain a network diagram, and virtual IP, IP pool, and firewall policies configuration information.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
The first firewall policy has NAT enabled using IP pool.
The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.1.10?
10.200.1.100
From LAN to WAN, the Source NAT will use the IPPOOL with address configured 10.200.1.100
Destination NAT, from WAN to LAN, will use the VIP
The question says SNAT, so the only correct answer here (looking at the IP Pool) is D.
An administrator configured the web filtering profile shown in the exhibit to block access to all social networking sites except Twitter. However, when users try to access twitter.com, they are redirected to a FortiGuard web filtering block page.
Based on the exhibit, which configuration change can the administrator make to allow Twitter while blocking all other social networking sites?
On the Static URL Filter configuration, set Action to Exempt.
Based on the exhibit, the administrator has configured the FortiGuard Category Based Filter to block access to all social networking sites, and has also configured a Static URL Filter to block access to twitter.com. As a result, users are being redirected to a block page when they try to access twitter.com.
To allow users to access twitter.com while blocking all other social networking sites, the administrator can make the following configuration change:
On the Static URL Filter configuration, set Action to Exempt: By setting the Action to Exempt, the administrator can override the block on twitter.com that was specified in the FortiGuard Category Based Filter. This will allow users to access twitter.com, while all other social networking sites will still be blocked.
Note: Tested this in a lab environment and to make this work as stated in the question the Exempt action is the only way to go, and also *.twimg.com will has to be added to the URL Filter with an Exempt action for this situation to really work!
Exhibit A shows a topology for a FortiGate HA cluster that performs proxy-based inspection on traffic. Exhibit B shows the HA configuration and the partial output of the get system ha status command.
Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose two.)
- For non-load balanced connections, packets forwarded by the cluster to the server contain the virtual MAC addres of port2 as source.
- For load balanced connections, the primary encapsulates TCP SYN packets before forwarding them to the secondary.
1: Non load balance: traffic enters port1 and go out port2 from FGT1. FGT2 is in primary mode
2: In proxy inspection mode, SYN packet goes to FGT1 port1. It is then forwarded to FGT2. the source MAC address of the packet is changed to the physical MAC address of port1 on the primary and the destination MAC address to the physical MAC address of port1 on the secondary. This is also known as MAC address rewrite. In addition, the primary encapsulates the packet in an Ethernet frame type 0x8891. The encapsulation is done only for the first packet of a load balanced session
Examine the exhibit, which shows a firewall policy configured with multiple security profiles.
Which two security profiles are handled by the IPS engine? (Choose two.)
- IPS
- Application Control
Which route will be selected when trying to reach 10.20.30.254?
10.20.30.0/24 [10/0] via 172.20.167.254, port3, [1/0]
Both VDOMs are operating in NAT/route mode. The subnet 10.0.1.0/24 is connected to VDOM1. The subnet 10.0.2.0/24 is connected to VDOM2. There is an inter-VDOM link between VDOM1 and VDOM2. Also, necessary firewall policies are configured in VDOM1 and VDOM2.
Which two static routes are required in the FortiGate configuration, to route traffic between both subnets through an inter-VDOM link? (Choose two.)
- A static route in VDOM2 for the destination subnet 10.0.1.0/24.
- A static route in VDOM1 for the destination subnet 10.0.2.0/24.
Which two behaviors result from this full (deep) SSL configuration? (Choose two.)
- A temporary trusted FortiGate certificate replaces the server certificate when the server certificate is trusted.
- A temporary untrusted FortiGate certificate replaces the server certificate when the server certificate is untrusted.
A user at 192.168.32.15 is trying to access the web server at 172.16.32.254.
Which two statements best describe how the FortiGate will perform reverse path forwarding (RPF) checks on this traffic? (Choose two.)
- Loose RPF check will allow the traffic.
- Strict RPF check will deny the traffic.
The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster. Which two statements are true? (Choose two.)
- FortiGate SN FGVM010000065036 HA uptime has been reset.
- FortiGate SN FGVM010000064692 has the higher priority.
- Override is disable by default - OK
- “If the HA uptime of a device is AT LEAST FIVE MINUTES (300 seconds) MORE than the HA Uptime
of the other FortiGate devices, it becomes the primary” The QUESTION NO: here is : HA Uptime of
FGVM01000006492 > 5 minutes? NO - 198 seconds < 300 seconds (5 minutes) Page 314 Infra Study
Guide. https://docs.fortinet.com/document/fortigate/6.0.0/handbook/666653/primary-unit-selection-with-override-disab
Examine the intrusion prevention system (IPS) diagnostic command. Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?
The IPS engine was inspecting high volume of traffic.
If there are high-CPU use problems caused by the IPS, you can use the diagnose test application ipsmonitor command with option 5 to isolate where the problem might be.
Option 5 enables IPS bypass mode.
In this mode, the IPS engine is still running, but it is not inspecting traffic.
If the CPU use decreases after that, it usually indicates that the volume of traffic being inspected is too high for that FortiGate model.
If the CPU use remains high after enabling IPS bypass mode, it usually indicates a problem in the IPS engine, which you must report to Fortinet Support.
