Refer to the exhibit, which contains a TCL script configuration on FortiManager.
An administrator has configured the TCL script on FortiManager, but failed to apply any changes to
the managed device after being executed.
Why did the TCL script fail to make any changes to the managed device? A. Changes in an interface configuration can only be done by CLI script. B. The TCL script must start with #include <>. C. Incomplete commands are ignored in TCL scripts. D. The TCL command run_cmd has not been created.
Refer to the exhibit, which contains the partial output of an IKE real-time debug.Which two statements about this debug output are correct? (Choose two.)
A. The initiator has provided remote as its IPsec peer ID. B. The negotiation is using AES128 encryption with CBC hash. C. The remote gateway IP address is 10.0.0.1. D. It shows a phase 1 negotiation.
Refer to the exhibit, which contains the output of a real-time debug.Which statement regarding this output is true?
A. FortiGate found the requested URL in its local cache. B. The requested URL belongs to category ID 52. C. The client hostname is training.fortinet.com.
D. This web request was inspected using the root web filter profile.
Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.) A. Import policy packages from managed devices. B. Preview pending configuration changes for managed devices. C. Add devices to FortiManager. D. Import interface mappings from managed devices. E. Install configuration changes to managed devices.
Refer to the exhibit, which contains a partial routing table.Assuming all the appropriate firewall policies are configured, which two pings will FortiGate route?
(Choose two.) A. Source IP address: 10.72.3.52, Destination IP address: 10.1.0.254 B. Source IP address: 10.73.9.10, Destination IP address: 10.72.3.15 C. Source IP address: 10.10.4.24, Destination IP address: 10.72.3.20 D. Source IP address: 10.1.0.10, Destination IP address: 10.64.1.52.
Which two conditions must be met for a statistic route to be active in the routing table? (Choose
two.) A. The link health monitor (if configured) is up. B. There is no other route, to the same destination, with a higher distance. C. The outgoing interface is up. D. The next-hop IP address is up.
When using the SSL certificate inspection method to inspect HTTPS traffic, how does FortiGate filter
web requests when the client browser does not provide the server name indication (SNI) extension?
A. FortiGate uses the requested URL from the user’s web browser. B. FortiGate uses the CN information from the Subject field in the server certificate. C. FortiGate blocks the request without any further inspection. D. FortiGate switches to the full SSL inspection method to decrypt the data.
Refer to the exhibit, which contains the output of a BGP debug command.
Which statement about the exhibit is true?
A. The local router has received a total of three BGP prefixes from all peers. B. The local router has not established a TCP session with 100.64.3.1. C. Since the counters were last reset, the 10.200.3.1 peer has never been down. D. The local router BGP state is OpenConfirm with the 10.127.0.75 peer.
Refer to the exhibit, which contains the output of a web filtering diagnose command.Which statement explains why the cache statistics are all zeros?
A. The FortiGate web filter cache is disabled in the FortiGate configuration. B. FortiGate is using flow-based inspection which does not use the cache. C. The administrator has reallocated the cache memory to a separate process. D. There are no users making web requests.
An administrator wants to capture ESP traffic between two FortiGate devices using the built-in
sniffer.
If the administrator knows that there is no NAT device located between both FortiGate devices,
which command should the administrator execute?
A. diagnose sniffer packet any ‘esp’ B. diagnose sniffer packet any ‘udp port 4500’ C. diagnose sniffer packet any ‘udp port 500’ D. diagnose sniffer packet any ‘tcp port 500 or tcp port 4500’.
Refer to the exhibit, which contains the output of a debug command.
Which statement about this FortiGate is correct? A. It is currently in system conserve mode because of high CPU usage. B. It is currently in extreme conserve mode because of high memory usage. C. It is currently in proxy conserve mode because of high memory usage. D. It is currently in memory conserve mode because of high memory usage.
How does FortiManager handle FortiGate requests from FortiGate devices, when it is configured as a
local FDS?
A. FortiManager will respond to update requests only from a managed device. B. FortiManager can download and maintain local copies of FortiGuard databases. C. FortiManager supports only FortiGuard push update to managed devices. D. FortiManager does not support web filter rating requests.
What does the dirty flag mean in a FortiGate session? A. The session must be removed from the former primary unit after an HA failover. B. Traffic has been blocked by the antivirus inspection. C. Traffic has been identified as from an application that is not allowed. D. The next packet must be re-evaluated against the firewall policies.
Refer to the exhibit, which contains partial outputs from two routing debug commands.
Which outbound interface will FortiGate use to route web traffic from internal users to the Internet? A. port3 B. port2 C. port1 D. Both port1 and port2.
Refer to the exhibit, which contains the output of diagnose sys session list.
If the HA ID for the primary unit is zero (0), which statement about the output is true? A. This session cannot be synced with the slave unit. B. The inspection of this session has been offloaded to the slave unit. C. The master unit is processing this traffic. D. This session is for HA heartbeat traffic.
Refer to the exhibit, which contains the partial output of an IKE real-time debug.Why did the tunnel not come up? A. The pre-shared keys do not match B. The remote gateway phase 1 configuration does not match the local gateway phase 1
configuration. C. The remote gateway phase 2 configuration does not match the local gateway phase 2
configuration. D. The remote gateway is using aggressive mode and the local gateway is configured to use main
mode.
An administrator has configured two FortiGate devices for an HA cluster. While testing the HA
failover, the administrator notices that some of the switches in the network continue to send traffic
to the former primary unit. The administrator decides to enable the setting link-failed-signal to fix
the problem.
Which statement about this command is true?
A. It forces the former primary device to shut down all its non-heartbeat interfaces for one second
while the failover occurs. B. It disables all the non-heartbeat interfaces in all the HA members for two seconds after a failover. C. It sends a link failed signal to all connected devices. D. It sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is
reachable through a new master after a failover.
Refer to the exhibit, which contains the output of diagnose sys session stat.
Which two statements about the output shown are correct? (Choose two.) A. No sessions have been deleted because of memory pages exhaustion. B. There are 0 ephemeral sessions. C. There are 168 TCP sessions waiting to complete the three-way handshake. D. All the sessions in the session table are TCP sessions.
Refer to the exhibit, which contains central management configuration.
Which server will FortiGate choose for antivirus and IPS updates if 10.0.1.243 is experiencing an
outage?
A. 10.0.1.242 B. 10.0.1.244 C. Public FortiGuard servers D. 10.0.1.240.
Refer to the exhibit, which contains a session table entry.
Which statement about FortiGate inspection of this session is true? A. FortiGate applied proxy-based inspection. B. FortiGate applied flow-based NGFW policy-based inspection. C. FortiGate applied flow-based inspection. D. FortiGate forwarded this session without any inspection.
Refer to the exhibit, which contains the output of a debug command.Which two statements about the exhibit are true? (Choose two.) A. The local FortiGate OSPF router ID is 0.0.0.4. B. The local FortiGate is the backup designated router. C. In the network connected to port4, two OSPF routers are down. D. Port4 is connected to the OSPF backbone area.
Which two statements about bulk configuration changes using FortiManager CLI scripts are correct?
(Choose two.) A. When executed on the Device Database, you must use the installation wizard to apply the
changes to the managed FortiGate. B. When executed on the Policy Package, ADOM database, changes are applied directly to the
managed FortiGate. C. When executed on the All FortiGate in ADOM, changes are automatically installed without
creating a new revision history. D. When executed on the Remote FortiGate directly, administrators do not have the option to
review the changes prior to installation.
Refer to the exhibit, which contains a partial output of an IKE real-time debug.Based on the debug output, which phase-1 setting is enabled in the configuration of this VPN? A. auto-discovery-receiver B. auto-discovery-forwarder C. auto-discovery-sender D. auto-discovery-shortcut.
What is the diagnose test application ipsmonitor 99 command used for? A. To enable IPS bypass mode B. To provide information regarding IPS sessions C. To disable the IPS engine D. To restart all IPS engines and monitors.
Refer to the exhibits, which contain configuration on FortiGate and partial session information.All traffic to the Internet currently egresses from port1. The exhibit shows partial session
information for Internet traffic from a user on the internal network.
If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that
user’s session?
A. The session would remain in the session table, but its traffic would now egress from both port1
and port2. B. The session would remain in the session table, and its traffic would still egress from port1.
C. The session would remain in the session table, and its traffic would start to egress from port2. D. The session would be deleted, so the client would need to start a new session.
Which three conditions are required for two FortiGate devices to form an OSP adjacency? (Choose
three.) A. OSPF costs match B. OSPF peer IDs match C. Hello and dead intervals match D. OSPF IP MTUs match E. IP addresses are in the same subnet.
Refer to the exhibit, which contains the partial output of a diagnose command.
Based on the output, which two statements are correct? (Choose two.) A. Anti-replay is enabled. B. DPD is disabled. C. Remote gateway IP is 10.200.4.1. D. Quick mode selectors are disabled.
Refer to the exhibit, which contains the output of a diagnose command.
Which two statements regarding the output in the exhibit are true? (Choose two.) A. FortiGate will probe 121.111.236.179 every fifteen minutes for a response. B. Servers with a negative TZ value are experiencing a service outage. C. Servers with the D flag are considered to be down. D. FortiGate used 209.222.147.36 as the initial server to validate its contract.
Which two statements about application layer test commands are true? (Choose two.) A. They are used to filter real-time debugs. B. They display real-time application debugs. C. Some of them can be used to restart an application. D. Some of them display statistics and configuration information about a feature or process.
Which two configuration settings change the behavior for content-inspected traffic while FortiGate
is in conserve mode? (Choose two.) A. IPS failopen B. mem failopen C. AV failopen D. UTM failopen.
|
