1. Refer to the exhibit, which contains partial output from an IKE real-time debug.
Which two statements about this debug output are correct? (Choose two.) The initiator provided remote as its IPsec peer ID. It shows a phase 2 negotiation. Perfect Forward Secrecy (PFS) is enabled in the configuration. The local gateway IP address is 10.0.0.1.
2. View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.
The administrator does not have access to the remote gateway.
Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?
Change phase 1 encryption to 3DES and authentication to SHA128. Change phase 1 encryption to AES128 and authentication to SHA512. Change phase 1 encryption to AESCBC and authentication to SHA2. Change phase 1 encryption to AES256 and authentication to SHA256.
3. An administrator has created a VPN community within VPN Manager on FortiManager. They also added gateways to the VPN community and are now trying to create firewall policies to permit traffic over the tunnel; however, the VPN interfaces are not listed as available options.
What step must the administrator take to resolve this issue? Install the VPN community and gateway configuration to the FortiGate devices, in order for the interfaces to be displayed within Policy & Objects on FortiManager. Set up all of the phase 1 settings in the VPN community that they neglected to set up initially. The interfaces will be automatically generated after the administrator configures all of the required settings. Refresh the device status from the Device Manager so that FortiGate will populate the IPsec interfaces. Create interface mappings for the IPsec VPN interfaces, before they can be used in a policy.
4. Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.
Which statement are true regarding the output in the exhibit? (Choose two.) There are three FortiGuard servers that are not responding to the queries sent by the FortiGate. The TZ value represents the delta between each FortiGuard server's time zone and the FortiGate's time zone. FortiGate will send the FortiGuard queries to the server with highest weight. A server's round trip delay (RTT) is not used to calculate its weight.
5. How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS? FortiManager can download and maintain local copies of FortiGuard databases. FortiManager supports only FortiGuard push to managed devices. FortiManager will respond to update requests only if they originate from a managed device. FortiManager does not support rating requests.
6. View these partial outputs from two routing debug commands:
Which outbound interface will FortiGate use to route web traffic from internal users to the Internet? Both port1 and port2 port3 port1 port2.
7. Refer to the exhibit, which shows the output of a diagnose command.
What can be concluded about the debug output in this scenario? Servers with a negative TZ value are less preferred for rating requests. There is a natural correlation between the value in the Packets field and the value in the Weight field. FortiGate used 64.26.151.37 as the initial server to validate its contract. The first server provided to FortiGate when it performed a DNS query looking for a list of rating servers, was 121.111.236.179.
8. An administrator has configured two FortiGate devices for an HA cluster. While testing the HA failover, the administrator noticed that some of the switches in the network continue to send traffic to the former primary unit. The administrator decides to enable the setting link-failed-signal to fix the problem.
Which statement is correct regarding this command? Forces the former primary device to shut down all its non-heartbeat interfaces for one second while the failover occurs. Sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover. Sends a link failed signal to all connected devices. Disables all the non-heartbeat interfaces in all the HA members for two seconds after a failover.
9. View the central management configuration shown in the exhibit, and then answer the question below.
Which server will FortiGate choose for antivirus and IPS updates if 10.0.1.243 is experiencing an outage? 10.0.1.240 One of the public FortiGuard distribution servers 10.0.1.244 10.0.1.242.
10. Exhibits:
Refer to the exhibits, which contain the network topology and BGP configuration for a hub.
An administrator is trying to configure ADVPN with a hub-spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however, the spokes are not receiving route information from each other.
What change must the administrator make to the hub BGP configuration so that the routes learned by one spoke are forwarded to the other spokes?
Configure an individual neighbor and remove neighbor-range configuration. Configure the hub as a route reflector client. Change the router id to 10.1.0.254. Make the configuration of remote-as different from the configuration of local-as.
11. Refer to the exhibit, which contains the output of diagnose sys session list.
If the HA ID for the primary unit is zero (0), which statement about the output is true? This session cannot be synced with the slave unit. The inspection of this session has been offloaded to the slave unit. The master unit is processing this traffic. This session is for HA heartbeat traffic.
12. View the exhibit, which contains the output of get sys ha status, and then answer the question below.
Which statements are correct regarding the output? (Choose two.) The slave configuration is not synchronized with the master. The HA management IP is 169.254.0.2. Master is selected because it is the only device in the cluster. port 7 is used the HA heartbeat on all devices in the cluster.
13. Which statement about protocol options is true? Protocol options allows administrators a streamlined method to instruct FortiGate to block all sessions corresponding to disabled protocols. Protocol options allows administrators the ability to configure the Any setting for all enabled protocols which provides the most efficient use of system resources. Protocol options allow administrators to configure a maximum number of sessions for each configured protocol. Protocol options allows administrators to configure which Layer 4 port numbers map to upper-layer protocols, such as HTTP, SMTP, FTP, and so on.
14. An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage. However, after the changes, one network application started to have problems. During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs. When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions.
Which TCP session timer must be increased to fix this problem? TCP half open. TCP half close. TCP time wait. TCP session time to live.
15. A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website.
The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:
What should the administrator check to fix the problem? The connectivity between the FortiGate unit and the DNS server. The connectivity between the client workstations and the DNS server. That DNS traffic from client workstations is allowed by the explicit web proxy policies. That DNS service is enabled in the explicit web proxy interface.
16. Refer to the exhibit, which contains a screenshot of some phase 1 settings.
The VPN is not up. To diagnose the issue, the administrator enters the following CLI commands to an SSH session on FortiGate:
diagnose vpn ike log-filter dst-addr4 10.0.10.1
diagnose debug application ike -1
However, the IKE real-time debug does not show any output. Why? The administrator must also run the command diagnose debug enable. The administrator must enable the following real-time debug: diagnose debug application ipsec -1. The log-filter setting is incorrect. The VPN traffic does not match this filter. The debug shows only error messages. If there is no output, then the phase 1 and phase 2 configurations match.
17. Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)
Installing configuration changes to managed devices. Importing interface mappings from managed devices Adding devices to FortiManager Previewing pending configuration changes for managed devices.
18. Refer to the exhibit, which shows the output of a BGP debug command.
Which statement explains why the state of the 10.200.3.1 peer is Connect? The local router has a different AS number than the remote peer. The local router is receiving BGP keepalives from the remote peer, but the local peer has not received the openConfirm yet. The local router initiated the BGP session to 10.200.3.1 but did not receive a response. The router 10.200.3.1 has authentication configured for BGP and the local router does not.
19. View the global IPS configuration, and then answer the question below.
Which of the following statements is true regarding this configuration? IPS will scan every byte in every session. FortiGate will spawn IPS engine instances based on the system load. New packets will be passed through without inspection if the IPS socket buffer runs out of memory. IPS will use the faster matching algorithm which is only available for units with more than 4 GB memory.
20. The CLI command set intelligent-mode <enable | disable> controls the IPS engine’s adaptive scanning behavior.
Which of the following statements describes IPS adaptive scanning? Determines the optimal number of IPS engines required based on system load. Downloads signatures on demand from FDS based on scanning requirements. Determines when it is secure enough to stop scanning session traffic. Choose a matching algorithm based on available memory and the type of inspection being performed.
21. In which two states is a given session categorized as ephemeral? (Choose two.) A TCP session waiting for FIN ACK A UDP session with packets sent and received A UDP session with only one packet received A TCP session waiting for the SYN ACK.
22. View the exhibit, which contains the output of diagnose sys session stat, and then answer the question below.
Which statements are correct regarding the output shown? (Choose two.)
There are 0 ephemeral sessions. All the sessions in the session table are TCP sessions. No sessions have been deleted because of memory pages exhaustion. There are 166 TCP sessions waiting to complete the three-way handshake.
23. Which real time debug should an administrator enable to troubleshoot RADIUS authentication problems?
Diagnose debug application radius -1. Diagnose debug application fnbamd -1. Diagnose authd console –log enable. Diagnose radius console –log enable.
24. Four FortiGate devices configured for OSPF connected to the same broadcast domain. The first unit is elected as the designated router. The second unit is elected as the backup designated router Under normal operation, how many OSPF full adjacencies are formed to each of the other two units? 1 2 3 4.
25. Refer to the exhibit, which contains the partial output of a diagnose command.
Based on the output, which two statements are correct? (Choose two.) Anti-replay is enabled The remote gateway IP is 10.200.4.1. DPD is disabled. Quick mode selectors are disabled.
26. View the exhibit, which contains an entry in the session table, and then answer the question below.
Which one of the following statements is true regarding FortiGate’s inspection of this session?
FortiGate applied proxy-based inspection. FortiGate forwarded this session without any inspection. FortiGate applied flow-based inspection. FortiGate applied explicit proxy-based inspection.
27. An administrator added the following Ipsec VPN to a FortiGate configuration:
configvpn ipsec phasel -interface
edit "RemoteSite"
set type dynamic
set interface "port1"
set mode main
set psksecret ENC LCVkCiK2E2PhVUzZe
next
end
config vpn ipsec phase2-interface
edit "RemoteSite"
set phasel name "RemoteSite"
set proposal 3des-sha256
next
end
However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while attempting the Ipsec connection.
The output is shown in the exhibit.
What is causing the IPsec problem in the phase 1 ? The incoming IPsec connection is matching the wrong VPN configuration The phrase-1 mode must be changed to aggressive The pre-shared key is wrong NAT-T settings do not match.
28. View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.
The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel.
To diagnose, the administrator enters these CLI commands:
However, the IKE real time debug does not show any output. Why? The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output. The log-filter setting was set incorrectly. The VPN’s traffic does not match this filter. The debug shows only error messages. If there is no output, then the tunnel is operating normally. The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
29. Refer to the exhibit, which contains partial output from an IKE real-time debug.
Which two statements about this debug output are correct? (Choose two.)
The remote gateway IP address is 10.0.0.1. The initiator provided remote as its IPsec peer ID. It shows a phase 1 negotiation. The negotiation is using AES128 encryption with CBC hash.
30. Examine the output of the ‘get router info ospf interface’ command shown in the exhibit; then answer the question below.
Which statements are true regarding the above output? (Choose two.) The port4 interface is connected to the OSPF backbone area. The local FortiGate has been elected as the OSPF backup designated router. There are at least 5 OSPF routers connected to the port4 network. Two OSPF routers are down in the port4 network.
31. Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.
# diagnose debug authd fsso list
---FSSO logons---
IP: 192.168.3.1 User: STUDENT Groups: TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB
The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.
What should the administrator check? The IP address recorded in the logon event for the user STUDENT. The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB. The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2. TRAINING. LAB. The reserve DNS lookup for the IP address 192.168.3.1.
32. Refer to the exhibits, which show the configuration on FortiGate and partial session information for internet traffic from a user on the internal network.
If the priority on route ID 2 were changed from 10 to 0, what would happen to traffic matching that user session? The session would remain in the session table, but its traffic would now egress from both port1 and port2. The session would remain in the session table, and its traffic would egress from port2. The session would be deleted, and the client would need to start a new session. The session would remain in the session table, and its traffic would egress from port1.
33. Which two conditions would prevent a static route from being added to the routing table? (Choose two.) There is another other route to the same destination, with a lower distance. The route has a lower priority value than another route to the same destination. The next-hop IP address is unreachable. The interface specified in the route configuration is down.
34. Refer to the exhibit, which contains partial outputs from two routing debug commands.
Why is the port2 default route not in the second command's output? It has a higher priority value than the default route using port1. It is disabled in the FortiGate configuration. It has a lower priority value than the default route using port1. It has a higher distance than the default route using port1.
35. View the exhibit, which contains the output of a web diagnose command, and then answer the question below.
Which one of the following statements explains why the cache statistics are all zeros? The administrator has reallocated the cache memory to a separate process. There are no users making web requests. The FortiGuard web filter cache is disabled in the FortiGate’s configuration. FortiGate is using a flow-based web filter and the cache applies only to proxy-based inspection.
36. What is the diagnose test application ipsmenitor 5 command used for?
To enable IPS bypass mode To disable the IPS engine To restart all IPS engines and monitors To provide information regarding IPS sessions.
37. View the exhibit, which contains the output of a real-time debug, Which statement about this output is true?
Which of the following statements is true regarding this output? The requested URL belongs to category ID 255. The server hostname Is training, fortinet.com. FortiGate found the requested URL in its local cache. This web request was inspected using the ftgd-allow web filler profile.
38. What does the dirty flag mean in a FortiGate session configured for NGFW policy mode?
The existing session table entry has been updated with the app_id and the firewall policy table needs to be checked for a match. The application or URL category is unknown and needs to be rescanned by the IPS engine to try to identify the Layer 7 details. The URL category for this session has been updated by FortiGuard and the session needs to be checked against the policy again to ensure proper web filtering is applied. Traffic has been identified as coming from an application that is not allowed and the relevant replacement message needs to be displayed to the user, if configured.
39. View the following FortiGate configuration.
All traffic to the Internet currently egresses from port1.
The exhibit shows partial session information for Internet traffic from a user on the internal network:
If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user’s session? The session would remain in the session table, and its traffic would still egress from port1. The session would remain in the session table, but its traffic would now egress from both port1 and port2. The session would remain in the session table, and its traffic would start to egress from port2. The session would be deleted, so the client would need to start a new session.
40.Refer to the exhibit, which shows a FortiGate configuration.
An administrator is troubleshooting a web filter issue on FortiGate. The administrator has configured a web filter profile and applied it to a policy; however, the web filter is not inspecting any traffic that is passing through the policy.
What must the administrator change to fix the issue? Increase webfilter-timeout. Change protocol to TCP. Enable fortiguard-anycast. Disable webfilter-force-off.
41. A FortiGate is rebooting unexpectedly without any apparent reason.
What troubleshooting tools could an administrator use to get more information about the problem? (Choose two.)
Firewall monitor. Policy monitor. Logs. Crashlogs.
42. Refer to the exhibits, which show the configuration on FortiGate and partial internet session information from a user on the internal network.
An administrator would like to test session failover between the two service provider connections. What changes must the administrator make to force this existing session to immediately start using the other interface? (Choose two.)
Configure set snat-route-change enable. Change the priority of the port2 static route to 5. Change the priority of the port1 static route to 11. unset snat-route-change to return it to the default setting.
43. Which statement about IKE and IKE NAT-T is true?
IKE is used to encapsulate ESP traffic in some situations, and IKE NAT-T is used only when the local FortiGate is using NAT on the IPsec interface. IKE is the standard implementation for IKEv1 and IKE NAT-T is an extension added in IKEv2. They both use UDP as their transport protocol and the port number is configurable. They each use their own IP protocol number.
44. An administrator cannot connect to the GIU of a FortiGate unit with the IP address 10.0.1.254. The administrator runs the debug flow while attempting the connection using HTTP.
The output of the debug flow is shown in the exhibit:
Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)
HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254. Redirection of HTTP to HTTPS administrative access is disabled. HTTP administrative access is configured with a port number different than 80. The packet is denied because of reverse path forwarding check.
45. View the exhibit, which contains the output of a debug command, and then answer the question below.
Which of the following statements about the exhibit are true? (Choose two.) In the network on port4, two OSPF routers are down. Port4 is connected to the OSPF backbone area. The local FortiGate’s OSPF router ID is 0.0.0.4 The local FortiGate has been elected as the OSPF backup designated router.
46. Refer to the exhibit, which contains the output of a debug command.
If the default settings are in place, what can be concluded about the conserve mode shown in the exhibit?
FortiGate is currently blocking all new sessions regardless of the content inspection requirements or configuration settings due to high memory use. FortiGate is currently allowing new sessions that require flow-based or proxy-based content inspection but is not performing inspection on those sessions. FortiGate is currently blocking new sessions that require flow-based or proxy-based content inspection. FortiGate is currently allowing new sessions that require flow-based content inspection and blocking sessions that require proxy-based content inspection.
47. View the exhibit, which contains a partial web filter profile configuration, and then answer the question below.
Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?
FortiGate will exempt the connection based on the Web Content Filter configuration. FortiGate will block the connection based on the URL Filter configuration. FortiGate will allow the connection based on the FortiGuard category based filter configuration. FortiGate will block the connection as an invalid URL.
48. Which of the following statements are true regarding the SIP session helper and the SIP application layer gateway (ALG)? (Choose three.) SIP session helper runs in the kernel; SIP ALG runs as a user space process. SIP ALG supports SIP HA failover; SIP helper does not. SIP ALG supports SIP over IPv6; SIP helper does not. SIP ALG can create expected sessions for media traffic; SIP helper does not. SIP helper supports SIP over TCP and UDP; SIP ALG supports only SIP over UDP.
49. An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device.
What can the administrator do to fix this problem? Configure remote link monitoring to detect an issue in the forwarding path. Configure set send-garp-on-failover enable under config system ha on both cluster members. Verify that the speed and duplex settings match between the FortiGate interfaces and the connected switch ports. Configure set link-failed-signal enable under config system ha on both cluster members.
50. Examine the output of the ‘diagnose ips anomaly list’ command shown in the exhibit; then answer the question below.
Which IP addresses are included in the output of this command? Those whose traffic matches a DoS policy. Those whose traffic matches an IPS sensor. Those whose traffic exceeded a threshold of a matching DoS policy. Those whose traffic was detected as an anomaly by an IPS sensor.
|
