Quiz
NS7
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (89)
1Which statement defines how a per-IP traffic shaper of 10 Mbps is applied to the entire network?
- AA. The 10 Mbps bandwidth is shared equally among the IP addresses
- BB. Each IP is guaranteed a minimum 10 Mbps of bandwidth
- CC. FortiGate allocates each IP address a maximum 10 Mbps of bandwidth
- DD. A single user uses the allocated bandwidth divided by total number of users.
2Refer to exhibits
Exhibit A shows the traffic shaping policy and exhibit B shows the firewall policy.
FortiGate is not performing traffic shaping as expected based on the policies shown in the exhibits.
To correct this traffic shaping issue on FortiGate, what configuration change must be made on which policy?
- AThe URL category must be specified on the traffic shaping policy
- BThe shaper mode must be applied per-IP shaper on the traffic shaping policy.
- CThe web filter profile must be enabled on the firewall policy
- DThe application control profile must be enabled on the firewall policy
3Which statement is correct about the SD-WAN and ADVPN?
- ASpoke support dynamic VPN as a static interface
- BDynamic VPN is not supported as an SD-WAN interface
- CADVPN interface can be a member of SD-WAN interface
- DHub FortiGate is limited to use ADVPN as SD-WAN member interface
4Refer to the exhibit
Multiple IPsec VPNs are formed between two hub-and-spokes groups, and site-to-site between Hub 1 and Hub 2. The administrator configured ADVPN on the dual regions topology.
Which two statements are correct if a user in Toronto sends traffic to London? (Choose two)
- AToronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1.
- BThe first packets from Toronto to London are routed through Hub 1 then to Hub 2
- CLondon generates an IKE information message that contains the Toronto Public IP address
- DTraffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN
5Which components make up the secure SD-WAN solution?
- AFortiGate, FortiManager, FortiAnalyzer, and FortiDeploy
- BApplication, antivirus, and URL, and SSL inspection
- CDatacenter, branch offices, and public cloud
- DTelephone, ISDN, and telecom network
6Which statement about using BGP routes in SD-WAN is true?
- AAdding static routes must be enabled on all ADVPN interfaces
- BVPN topologies must be form using only BGP dynamic routing with SD-WAN
- CLearned routes can be used as dynamic destinations in SD-WAN rules
- DDynamic routing protocols can be used only with non-encrypted traffic
7Which diagnostic command you can use to show interface-specific SLA logs for the last 10 minutes?
- Adiagnose sys virtual-wan-link health-check
- Bdiagnose sys virtual-wan-link log
- Cdiagnose sys virtual-wan-link sla-log
- Ddiagnose sys virtual-wan-link intf-sla-log
8Refer to exhibits
Exhibit A shows the performance SLA exhibit B shows the SD-WAN diagnostics output.
Based on the exhibits, which statement is correct?
- APort1 became dead because no traffic was offload through the egress of port1.
- BSD-WAN member interfaces are affected by the SLA state of the inactive interface
- CBoth SD-WAN member interfaces have used separate SLA targets
- DThe SLA state of port1 is dead after five unanswered requests by the SLA servers
9Which three parameters are available to configure SD-WAN rules? (Choose three.)
- AApplication signatures
- BIncoming interface
- CInternet service database (ISDB) address object
- DSource and destination IP address
- EType of physical link connection
10Refer to exhibits
Exhibit A shows the source NAT global setting and exhibit B shows the routing table on FortiGate.
Based on the exhibits, which two statements about increasing the port2 interface priority to 20 are true? (Chosose two.)
- AAll the existing sessions with no SNAT will start using port1 as the outgoing interface instead of port2
- BAll the existing sessions will continue to use port2, and new sessions will use port1
- CAll the existing sessions using SNAT will start using port1 as the outgoing interface instead of port 2
- DAll the existing sessions will be blocked from using port1 and port2.
11Which two reasons make forward error correction (FEC) ideal to enable in a phase one VPN interface? (Choose two.)
- AFEC is useful to increase speed at which traffic is routed through IPsec tunnels.
- BFEC transmits the original payload in full to recover the error in transmission.
- CFEC transmits additional packets as redundant data to the remote device.
- DFEC improves reliability, which overcomes adverse WAN conditions such as noisy links
- EFEC reduces the stress on the remote device jitter buffer to reconstruct packet loss
12Refer to the exhibit.
Which two statements about the status of the VPN tunnel are true? (Choose two.)
- AThere are separate virtual interfaces for each dial-up client.
- BVPN static routes are prevented from populating the FortiGate routing table
- CFortiGate created a single IPsec virtual interface that is shared by all clients
- D100.64.3.1 is one of the remote IP address that comes through index interface 1.
13Refer to exhibits.
Exhibit A shows the SD-WAN rules and exhibit B shows the traffic logs. The SD-WAN traffic logs reflect how FortiGate processed traffic.
Which two statements about how the configured SD-WAN rules are processing traffic are true? (Choose two.)
- AThe implicit rule overrides all other rules because parameters widely cover sources and destinations
- BSD-WAN rules are evaluated in the same way as firewall policies: from top to buttom
- CThe All_Access_Rules rule load balances Vimeo application traffic among SD-WAN member interfaces
- DThe initial session of an application goes through a learning phase in order to apply the correct rule
14Refer to the exhibit
Based on the exhibit, which statement about FortiGate re-evaluating traffic is true?
- AThe type of traffic defined and allowed on firewall policy ID 1 is UDP
- BChanges have been made on firewall policy ID 1 on FortiGate
- CFirewall policy ID has source NAT disabled
- DFortiGate has terminated the session after a change on policy ID 1
15What are the two minimum configuration requirements for an outgoing interface to be selected once the SD-WAN logical interfaces is enabled? (Choose two.)
- ASpecify outgoing interface routing cost.
- BConfigure SD-WAN rules interfaces preference
- CSelect SD-WAN balancing strategy
- DSpecify incoming interfaces in SD-WAN rules
16What are two reasons why FortiGate would be unable to complete the zero-touch provisioning process? (Choose two.)
- AThe FortiGate cloud key has not been added to the FortiGate cloud portal.
- BFortiDeploy has connected with FortiGate and provided the initial configuration to contact FortiManager
- CFortiGate has obtained a configuration from the plataform template in FortiGate cloud
- DA factory reset performed on FortiGate
- EThe zero-touch provisioning process has completed internally, behind FortiGate.
17Based on output shown in the exhibit, which two commands can be used by SD-WAN rules? (Choose two.)
- Aset cost 15.
- Bset source 100.64.1.1
- Cset priority 10.
- Dset load-balance-mode source-ip-based.
18Which two statements reflect the benefits of implementing the ADVPN solution to replace conventional VPN topologies? (Choose two.)
- AIt creates redundant tunnel between hub-and-spokes, in case failure takes place on the primary link
- BIt dynamically assigns cost and weight between the hub and the spokes, based on the physical distance
- CIt ensures that spoke-to-spoke traffic no longer needs to flow through the tunnels through the hub.
- DIt provides direct connectivity between all sited by creating on-demand tunnels between spokes.
19Refer to the exhibit.
Which two statements about the debug output are correct? (Choose two.)
- AThe debug output shows per-IP shaper values and real-time readings
- BThis traffic shaper drops traffic that exceeds the set limits
- CTraffic being controlled by the traffic shaper is under 1Kbps
- DFortiGate provides statistics and readings based on historical traffic logs
20In the default SD-WAN minimum configuration, which two statements are correct when traffic matches the default implicit SD-WAN rule?
- ATraffic has matched none of the FortiGate policy routes.
- BMatched traffic failed RPF and was caught by the rule
- CThe FIB lookup resolved interface was the SD-WAN interface
- DAn absolute SD-WAN rule was defined and matched traffi
21Refer to the exhibit
Which statement about the trace evaluation by FortiGate is true?
- APacket exceeding the configured maximum concurrent connection limit are denied by the per-IP shaper
- BThe packet exceeded the configured bandwidth and was dropped based on the priority configuration
- CThe packet exceeded the configured maximum bandwidth and was dropped by the shared shaper
- DPackets exceeding the configured concurrent connection limit are dropped based on the priority configuration.
22Refer to exhibits
Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy.
The traffic shaping policy is being applied to all outbound traffic; however, inbound traffic is no being evaluated by the shaping policy.
Based on the exhibit, what configuration change must be made in which policy so that traffic shaping can be applied to inbound traffic?
- AThe guaranteed-10mbps option must be selected as the per-IP shaper option.
- BThe guaranteed-10mbps option must be selected as the reverse shaper option
- CA new firewall policy must be created, and SD-WAN must be selected as the incoming interface
- DThe reverse shaper option must be enabled, and a traffic shaper must be selected
23Refer to the exhibit.
What must you configure to enable ADVPN?
- AADVPN should only be enabled on unmanaged FortiGate devices
- BEach VPN device has a unique pre-shared key configured separately on phase one
- CThe protected subnets should be set to address object to all (0.0.0.0/0)
- DOn the hub VPN, only the device needs additional phase one settings
24Which two statements describe how IPsec phase 1 main mode is different from aggressive mode when performing IKE negotiation? (Choose two.)
- AA peer ID is included in the first packet from the initiator, along with suggested security policies
- BXAuth is enabled as an additional level of authentication, which requires a username and password.
- CA total of six packets are exchanged between an initiator and a responder instead of thee packets
- DThe use of Diffie Hellman keys is limited by the responder and needs initiator acceptance
25Which diagnostic command can you use to show the SD-WAN rules interface information and state?
- Adiagnose sys virtual-wan link route-tag-list
- Bdiagnose sys virtual-wan link service
- Cdiagnose sys virtual-wan link member
- Ddiagnose sys virtual-wan link neighbor
26Refer to the exhibit.
FortiGate has multiple dial-up VPN interfaces incoming on port1 that match only FIRST_VPN.
Which two configuration changes must be made to both IPsec VPN interfaces to allow incoming connections to match all possible IPsec dial-up interfaces? (Choose two.)
- AConfigure a unique peer ID for each dial-up VPN interface.
- BUse different proposals are used between the interfaces
- CConfigure the IKE mode to be aggressive mode
- DUse unique Diffie Hellman groups on each VPN interface
27What would best describe the SD-WAN traffic shaping mode that bases itself on a percentage of available bandwidth?
- APer-IP shaping mode
- BShared policy shaping mode
- CInterface-based shaping mode
- DReverse policy shaping mode
28Refer to exhibits
Exhibit A, which shows the SD-WAN performance SLA and exhibit B shows the health of the participating SD-WAN members.
Based on the exhibits, which statement is correct?
- AThe dead member interface stays unavailable until an administrator manually brings the interface back.
- BPort2 needs to wait 500milliseconds to change the status from alive to dead
- CThe SLA state of port2 has exceeded three consecutive unanswered requests from the SLA server
- DCheck interval is the time to wait before a packet sent by a member interface considered as lost
29What is the lnkmtd process responsible for?
- AFlushing route tags addresses
- BMonitoring links for any bandwidth saturation
- CLogging interface quality information
- DProcessing performance SLA probes
30Which statement reflects how BGP tags work with SD-WAN rules?
- AVPN topologies are formed using only BGP dynamic routing with SD-WAN.
- BRoute tags are used for a BGP community and the SD-WAN rules are assigned the same tag
- CBGP tags require that the adding of static routes be enabled on all ADVPN interfaces
- DBGP tags match the SD-WAN rule based on the order that these rules were installed
31An administrator is troubleshooting VoIP quality issues that occur when calling external phone numbers.
The SD-WAN interface on the edge FortiGate is configured with the default settings, and is using two upstream links. One link has random jitter and latency issues, and is based on a wireless connection.
Which two actions must the administrator apply simultaneously on the edge FortiGate to improve VoIP quality using SD-WAN rules? (Choose two.)- ASelect the corresponding SD-WAN balancing strategy in the SD-WAN rule
- BChoose the suitable interface based on the interface cost and weight
- CUse the performance SLA targets to detect latency and jitter instantly
- DPlace the troublesome link at the top of the interface preference list
- EConfigure an SD-WAN rule to load balance all traffic without VoIP.
32What are two benefits of using FortiManager to organize and manage the network for a group of FortiGate devices? (Choose two.)
- AIt simplifies the deployment and administration of SD-WAN on managed FortiGate devices.
- BIt improves SD-WAN performance on the managed FortiGate devices.
- CIt sends probe signals as health checks to the beacon servers on behalf of FortiGate
- DIt acts as a policy compliance entity to review all managed FortiGate devices.
- EIt reduces WAN usage on FortiGate devices by acting as a local FortiGuard server.
33Refer to exhibits.
Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN interface and the static routes configuration.
Port1 and port2 are member interfaces of the SD-WAN, and port2 becomes a dead member after reaching the failure thresholds.
Which statement about the dead member is correct?
- APort2 might become alive when a single response is receiver from an SLA server
- BDead members require manual administrator access to bring them back alive
- CSubnets 100.64.1.0/23 and 172.20.0.0/16 are reachable only though port1
- DSD-WAN interface becomes disabled and port1 becomes the WAN interface
34What are two roles that SD-WAN orchestrator plays when it works with FortiManager? (Choose two.)
- AIt configures and monitors SD-WAN networks on FortiGate devices that are managed by FortiManager.
- BIt acts as a standalone device to assist FortiManager to manage SD-WAN interfaces on the managed FortiGate devices.
- CIt acts as a hub FortiGate with an SD-WAN interfaces enabled and managed along with other FortiGate devices by FortiManager.
- DIt acts as an application that is released and signed by Fortinet to run as a part of management extensions on FortiManager.
35Refer to the exhibit.
Which statement about the command route-tag in the SD-WAN rule is true?
- AIt uses route tags for a BGP community and assigns the SD-WAN rules with same tag.
- BIt ensures route tags match the SD-WAN rule based on the rule order
- CIt tags each route and references the tag in the routing table.
- DIt enables the SD-WAN rule to load balance and assign traffic with a route tag
36Refer to the exhibit.
Which two statements about the debug output are true? (Choose two.)
- AThis traffic shaper drops traffic that exceeds the set limits
- BTraffic being controlled by the traffic shaper is under 100 KB/s
- CThe debug output shows per-IP shaper values and real-time readings
- DFortiGate provides statistics and readings based on historical traffic logs
37Which feature allows SD-WAN to combine IPsec VPN dynamic shortcut tunnels between spokes and a static tunnel to the hub?
- AADVPN
- BSSLVPN
- CSDVPN
- DOCVPN
38Which three protocols are available only on the command line to configure as performance SLA status check? (Choose three.)
- Atcp-echo
- Bsmtp
- Cudp-echo
- Dtwamp
- Eicmp
39Refer to the exhibit.
Based on the exhibit, which two statements about traffic passing through the SD-WAN member port2 are true? (Choose two.)
- AFortiGate performs new routing lookups for new packets after a route change.
- BFortiGate, by default, resets all session routing information after a route change
- CFortiGate marks an existing session routing information as persistent
- DFortiGate flushes all routing information from the session table after a route change
40Which two protocols in the IPsec suite are most used for authentication and encryption? (Chosse two.)
- AInternet Key Exchange (IKE)
- BTransport Layer Security (TLS)
- CEncapsulating Security Payload (ESP)
- DSecure Shell (SSH)
- ESecurity Association (SA)
41Refer to the exhibit
Based on the exhibit, which status description is correct?
- AThe SD-WAN members are monitored by different performance SLAs
- BPort2 is alive because its packet loss is lower than 10%
- CTraffic matching the SD-WAN rule is steered through port2
- DPort1 is dead because it does not meet the SLA target.
42Which two configuration tasks are required to use SD-WAN? (Choose two.)
- AConfigure at least one firewall policy for SD-WAN traffic.
- BAdd one or more members to an SD-WAN zone
- CSpecify the incoming interfaces in SD-WAN rules
- DSpecify the outgoing interface routing cost
43Refer to the exhibits.
Exhibit A shows the SD-WAN rules and exhibit B shows the traffic logs. The SD-WAN traffic logs reflect how FortiGate distributes traffic.
Based on the exhibits, what are two expected behaviors when FortiGate processes SD-WAN traffic? (Choose two.)
- AThe first Vimeo session may no match the Vimeo SD-WAN rule because the sessions is used for the application learning phase.
- BThe Vimeo SD-WAN rule steers Vimeo application traffic among all SD-WAN member interface
- CThe implicit rule overrides all other rules because parameters widely cover sources and destinatons
- DSD-WAN rules are evaluated in the same way as firewall policies: from top to bottom
44Which diagnostic command can you use to show the SD-WAN rules, interfaces information, and state?
- Adiagnose sys sdwan member
- Bdiagnose sys sdwan neighbor
- Cdiagnose sys sdwan service
- Ddiagnose sys sdwan route-tag-list
45Refer to the exhibit.
When attempting to establish an IPsec tunnel to FortiGate, all remote users match the FIRST_VPN IPsec VPN. This includes remote user that want to connect to the SECOND_VPN IPsec VPN.
Which two configuration changes must you make on both IPsec VPNs so that remote users can connect to their intended IPsec VPN? (Choose two.)
- AConfigure different Diffie Hullman groups.
- BConfigure a unique peer ID
- CConfigure different proposals
- DChange the IKE mode to aggressive
46Which three parameters are available to configure SD-WAN rules? (Choose three.)
- AType of physical link connection
- BSource and destination IP address
- CInternet service database (ISDB) address object
- DURL categories
- EApplication signatures
47Refer to the exhibit.
Which are two expected behaviors of the traffic that matches the traffic shaper? (Choose two.)
- AThe number of simultaneous connections allowed for each source IP address can exceed 5 connections
- BThe number of simultaneous connections among all source IP address can exceed 5 connections
- CThe traffic shaper limits the combined bandwidth of all connections to a maximum of 5MB/sec
- DThe traffic shaper limits the bandwidth of each source IP address to a maximum of 625 KB/sec
48Which two tasks about using central VPN management are true? (Choose two.)
- AYou must enable VPN zones for SD-WAN deployments
- BYou can configure full mesh, star, and dial-up VPN topologies
- CFortiManager installs VPN settings on both managed an external gateways
- DYou configure VPN communities to define common IPsec settings shared by all VPN gateways
49Refer to the exhibits
Exhibit A, which shows the SD-WAN performance SLA and exhibit B shows the health of the participating SD-WAN members.
Based on the exhibits, which statement is correct?
- APort2 needs to wait 500 milliseconds to change the status from alive to dead.
- BThe dead member interface stays unavailable until an administrator manually brings the interface back
- CFortiGate has not received three consecutive requests from the SLA server configured for port2
- DStatics routes using port2 are active in the routing table
50Which action FortiGate performs on traffic that is subject to a per-IP traffic shaper of 10 Mbps?
- AFortiGate applies traffic shaping to the original traffic direction only.
- BFortiGate shares 10 Mbps of bandwidth equally among all source IP addresses.
- CFortiGate limits each source IP address to a maximum bandwidth of 10 Mbps
- DFortiGate guarantees a minimum of 10 Mbps of bandwidth to each source IP address
51Which statement about using BGP routes in SD-WAN is true?
- ALearned routes can be used as dynamic destinations in SD-WAN rules.
- BYou must configure AS path prepending.
- CYou must use BGP to route traffic for both overlay and underlay links
- DYou must use external BGP
52Refer to the exhibits
Exhibits A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member and the static routes configuration.
If port2 is detected dead by FortiGate, which expected behavior is correct?
- ASubnets 10.0.20.0/23 and 172.20.0.0/16 are reacheable only through port1
- BDead members require manual administrator access to bring them back alive
- CThe SD-WAN interface becomes disables and port1 becomes the WAN interface
- DPort2 becomes alive after one successful probe is detected
53What are two benefits for replacing conventional VPN topologies with an ADVPN implementation? (Choose two.)
- AIt provides direct connectivity between all sites by creating on-demand tunnels between spokes
- BIt ensures that spoke-to-spoke traffic no longer needs to flow through the tunnels through the hub
- CIt dynamically assigns cost and weight between the hub and spokes, based on the physical distance
- DIt creates redundant tunnels between hub and spokes, in case failure takes place on the primary links.
54Which two statements about SD-WAN central management are true? (Choose two.)
- AAll uses templates to configure SD-WAN on managed devices
- BIt does not allow you to monitor the status of SD-WAN members
- CIt is enabled by default
- DIt is enabled or disabled on a per-ADOM basis
55Refer to the exhibit.
Which statement explains the output shown in the exhibit?
- AFortiGate has terminated the session after a change on policy ID 1
- BThe session is affected by a firewall policy change
- CFirewall policy ID 1 has source NAT disabled
- DThe type of traffic defined and allowed on firewall policy ID 1 is UDP
56Which two statements about SLA targets and SD-WAN rules are true? (Choose two.)
- ASD-WAN rules use SLA targets to check if the preferred members meet the SLA requirements
- BWhen configuring an SD-WAN rule, you can select multiple SLA targets of the same performance SLA
- CMember metric are measured only if an SLA target is configured.
- DSLA targets are used only by SD-WAN rules that are configured with Lowest Cost (SLA) or Maximize Bandwidth (SLA) as strategy
57What are two reasons for using FortiManager to organize and manage the network for a group of FortGate devices? (Choose two.)
- ATo send probe packets as health checks to the beacon servers on behalf of FortiGate.
- BTo simplify the deployment and administration of SD-WAN on managed FortiGate devices
- CTo reduce WAN usage on FortiGate devices by acting as a local FortiGuard server
- DTo improve SD-WAN performance on the managed FortiGate devices
58Which two interfaces are considered overlay links? (Choose two.)
- ALAG
- BPhysical
- CGRE
- DIPsec
59Which two benefits from using forward error correction (FEC) in IPsec VPNs are true? (Choose two.)
- AFEC reduces the stress on the remote device buffer to reconstruct packet loss
- BFEC transmits additional packets as redundant data to the remote device
- CFEC improves reliability, which overcomes adverse WAN conditions such as noisy link
- DFEC transmits the original payload in full to recover the error in transmission
60Which stratement is correct about SD-WAN and ADVPN?
- ASD-WAN can steer traffic to ADVPN shortcuts established over IPsec overlays configured as SD-WAN members
- BYou must use OSPF
- CSD-WAN does not monitor the health and performance of ADVPN shortcuts
- DRoutes for ADVPN shortcuts must be manually configured
61Which two statements are correct when traffic matches the default implicit SD-WAN rule? (Choose two.)
- AThe sdwan_service_id flag in the session information is 0
- BMatched traffic failed RPF and was caught by the rule
- CAn absolute SD-WAN rule was defined and matched traffic
- DTraffic has matched none of the FortiGate policy routes
62Which behavior reflects how BGP tags work with SD-WAN rules?
- ASD-WAN rules that use BGP tags have precedence over regular policy routes.
- BIf the destination network learned using BGP tag changes, you must re-configure the BGP tag so the information on the SD-WAN rule is updated.
- CRoute tags can be used to specify the destination subnets in SD-WAN rules.
- DRoute tags are mapped to the local preference attribute.
63Refer to the exhibit.
Which conclusion about the packet debug flow output is correct?
- AThe number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.
- BThe total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
- CThe packet size exceeded the outgoing interface MTU
- DThe number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
64What does the route-tag setting in the SD-WAN rule define?
- AThe number of members to use for load balancing the traffic.
- BThe number of routes to use for the SD-WAN rule
- CThe tag that identifies destination subnets based on their BGP communities
- DThe priority of the SD-WAN rule.
65Which two statements describe how IPsec phase1 aggressive mode is different from main mode, when performing IKE negotiation? (Choose two.)
- AXAuth is enabled as an additional level of authentication, which requires a username and password.
- BA total of three packets are exchanged between an initiator and a responder instead of six packets.
- CA peed ID is included in the first packet from the initiator, along with suggested segurity policies
- DThe use of Diffie Hellman keys is limited by the responder and needs initiator acceptance
66Exhibit A shows the firewall policy and exhibit B shows the traffic shaping policy. The traffic shaping policy is being applied to outbound traffic; however, the traffic shaping is not being applied to inbound traffic.
Based on the exhibits, what configuration change should the administrator make so traffic shaping is applied to inbound traffic?
- AIn the traffic shaping policy, select Assign Shaping Class ID as Action.
- BIn the traffic shaping policy, enable Reverse shaper, and then select the traffic shaper to use
- CIn the firewall policy, select Proxy-based as Inspection Mode.
- DCreate a new firewall policy, and the select the SD-WAN zone as Incoming Interface
67Refer to the exhibit.
Based on the exhibit, which two actions does FortiGate perform on traffic passing through the SD-WAN member port2? (Choose two.)
- AFortiGate flushes all routing information from the sessions table after a route change
- BFortiGate performs routing lookups for new sessions only after a route change
- CFortiGate marks the routing information on existing sessions as persistent
- DFortiGate always blocks all traffic after a route change
68Refer to the exhibits.
Exhibit A shows the traffic shaping policy and exhibit B shows the firewall policy.
FortiGate is not performing traffic shaping as expected, based on the policies shown in the exhibits.
To correct this traffic shaping issue on FortiGate, what configuration change must be made on which policy?
- AThe shaper mode must be applied per-IP shaper on the traffic shaping policy
- BThe URL category must be specified on the traffic shaping policy
- CThe application control profile must be enabled on the firewall policy
- DThe web filter profile must be enabled on the firewall policy
69Refer to the exhibit.
Which statement about the ADVPN device role in handling traffic is true?
- AThis is a spoke that has received a query from a remote hub and has forwarded the response to its hub
- BTwo hubs, 10.1.1.254 and 10.1.2.254, are receiving and forwarding queries between each other
- CTwo spokes, 100.64.3.1 and 10.1.2.254, forward their queries to their hubs
- DThis is a hub that has received a query from a spoke and has forwarded it to another spoke
70Which two difference between IPsec aggressive mode and main mode when performing IKE negotiation are true? (Choose two.)
- AThe peer ID is included in the first packet from the initiator, along with suggested security policies.
- BXAuth is enabled as an additional level of authentication, which requires a username and password
- CThree packets are exchanged between an initiator and a responder instead of six packets.
- DThe use of Diffie Hellmans keys is limited by the responder and needs initiator acceptance
71Refer to the exhibit
Based on the output, which two conclusions are true? (Choose two.)
- AThe all_rules rule represents the implicit SD-WAN rule.
- BThere is more than one SD-WAN rule configured
- CEntry 1 (id=1) is a regular policy route.
- DThe SD-WAN rules take precedence over regular policy routes
72In which two ways does FortiGate learn the FortiManager IP address or FQDN for zero-touch provisioning? (Choose two.)
- AFrom a FortiGuard definitions update
- BFrom the central management configuration configured in FortiDeploy
- CFrom a DHCP server configured with options 240 or 241
- DFrom another FortiGate device in the same local network
73Refer to the exhibit
Which two conclusions for traffic that matches the traffic shaper are true? (Choose two.)
- AThe traffic shaper drops packets if the bandwidth exceeds 6250 Kbps.
- BThe traffic shaper limits the bandwidth of each source IP to a maximum of 6250 KBps
- CThe traffic shaper drops packets if the bandwidth is less than 2500 KBps
- DThe measured bandwidth is less than 100 KBps
74Refer to the exhibit
Which configuration setting is correct if the responder FortiGate is using a dynamic routing protocol over the IPsec VPN interface?
- AAdd-route must be disables to prevent FortiGate from installing static routes from remote protected networks
- Bpeertype must be set to accept a unique peer ID per IPsec VPN
- Ctype must be set to static
- DDial-up clients must have XAuth enabled.
75Refer to the exhibit.
Which conclusion about the packet debug flow output is correct?
- AThe original traffic exceeded the maximum bandwidth of the outgoing interface, and the packet was dropped.
- BThe reply traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped.
- CThe original traffic exceeded the maximum packets per second of the outgoing interface, and the packet was dropped
- DThe original traffic exceeded the maximum bandwidth configured in the traffic shaper, and the packet was dropped
76Refer to the exhibit
Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2.
The administrator configured ADVPN on both hub-and-spoke groups.
If an ADVPN on-demand tunnel is established between Toronto and London, which two configuration settings are required for ADVPN to work? (Choose two.)
- AOn the hubs, auto-discovery-sender is enabled on the IPsec VPNs to spokes.
- BAuto-discovery-forwarder is enabled on all IPsec VPNs
- COn the hubs, tunnel-search is set selectors.
- DOn the spokes, auto-discovery-receiver is enabled on the IPsec VPN to the hub
77What are two reasons why it is effective to implement the internet service database (ISDB) in an SD-WAN rule? (Choose two.)
- AThe ISDB is dynamically updated and reduces administrative overhead
- BThe ISDB applies rules to traffic from specific sources, based on application type
- CThe ISDB requires application control to maintain signatures and perform load balancing.
- DThe ISDB contains the IP addresses and port ranges of well-known destinations
78Refer to the exhibit
Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?
- AAll traffic from a source IP to a destination IP is sent to the least used interface
- BAll traffic from a source IP is sent to the most used interface
- CAll traffic from a source IP to a destination IP is sent to the same interface
- DAll traffic from a source IP is sent to the same interface
79Which three performance SLA protocols are available on the FortiGate CLI only? (Choose three.)
- Atcp-echo
- Bicmp
- Ctwamp
- Dudp-echo
- Esmtp
80Why is it effective to use SD-WAN rules when configuring application control?
- ABecause you must use certificate full inspection on the firewall policy
- BBecause the application database is manually maintained by administrators
- CBecause traffic can be steered based on application type
- DBecause SD-WAN rules are independent from firewall policies to avoid controlling applications.
81Based on the exhibit, which two actions FortiGate performs on sessions after a firewall policy change? (Choose two.)
- AThe old sessions terminate after a policy change
- BExisting sessions remain unchanged after a policy change
- CAll sessions are flushed by FortiGate after a policy change
- DFortiGate re-evaluates new sessions after a policy change
82Refer to the exhibits.
Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate.
Based on the FortiGate configuration shown in the exhibits, what issue might you encounter when creating an SD-WAN zone for port1 and port2?
- Aport2 is referenced in a static route
- Bport1 is assigned a manual IP address
- Cport1 and port2 are not administratively down
- DPort1 is referenced in a firewall policy
83Which CLI command do you use to perform real-time troubleshooting for ADVPN negotiation?
- Aget ipsec tunnel list
- Bget router info routing-table
- Cdiagnose debug application ike
- Ddiagnose sys virtual-wan-link service
84Refer to the exhibit.
Based on output shown in the exhibit, which two settings can be used by SD-WAN rules? (Choose two.)
- Aset cost 15
- Bset priority 10
- Cset load-balance-mode source-ip-based
- Dset source 100.64.1.1
85Refer to the exhibits.
Exhibit A shows the source NAT global setting and exhibit B shows the routing table on FortiGate.
Based on the exhibits, which two actions does FortiGate perform on existing sessions if the administrator increases the priority on port2 to 20? (Choose two.)
- AAll the existing sessions will continue to use port2, and new sessions will use port1
- BAll the existing sessions with no SNAT will start using port1 as the outgoing interface instead of port2
- CAll the existing sessions using SNAT will start using port1 as the outgoing interface instead of port2
- DAll the existing sessions will be blocked from using port1 and port2
86Which diagnostic command can you use to show interface-specific SLA logs for the last 10 minutes?
- Adiagnose sys sdwan intf-sla-log
- Bdiagnose sys sdwan log
- Cdiagnose sys sdwan sla-log
- Ddiagnose sys sdwan health-check
87Refer to the exhibit.
Two hub-and-spoke groups are connected through a site-to-site IPsec VPN between Hub 1 and Hub 2.
The administrator configured ADVPN on both hub-and-spoke groups.
Which two outcomes are expected if a user in Toronto sends traffic to London? (Choose two.)
- ALondon generates an IKE information message that contains the Toronto public IP Address
- BToronto needs to establish a site-to-site tunnel with Hub 2 to bypass Hub 1
- CThe first packets from Toronto to London are routed through Hub 1 then to Hub 2
- DTraffic from Toronto to London triggers the dynamic negotiation of a direct site-to-site VPN
88Refer to the exhibit.
Which two statements about the IPsec VPN configuration and the status of the IPsec VPN tunnel are true? (Choose two.)
- AFortigate creates separate virtual interfaces for each dial-up client
- BFortigate creates a single IPsec virtual interface that is shared by all clients.
- CFortigate does not install IPsec static routes for remote protected networks in the routing table
- DFortigate aps the remote gateway 100.64.3.1 to tunnel index interface 1
89Refer to the exhibit
What must you configure to enable ADVPN?
- AThe protected subnet of each gateway should be set all (0.0.0.0/0)
- BADVPN should be enabled on unmanaged FortiGate devices only
- CAuthentication should be set to Certificates
- DThe phase 1 proposal must match the phase 2 proposal
Information
- Description
- Quiz on NS7, created by osvaldo linconir on 27/09/2022.
- Author
- osvaldo linconir
- Language
- Español
- Views
- 44
- Tags
- Rating
- No ratings yet Rate this quiz