EXAMEN 4 1 Gabriel

Por favor espera - en proceso…

Pregunta 1 de 133

Which configuration objects can be selected for the Source field of a firewall policy? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

IP Pool
Firewall service
User or user group
FQDN address

Explicación

Pregunta 2 de 133

By default, when logging to disk, when does FortiGate delete logs?

Selecciona una de las siguientes respuestas posibles:

30 days
1 year
Never
7 days

Explicación

Pregunta 3 de 133

Which of the following conditions are required for establishing an IPSec VPN between two FortiGate devices? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

If XAuth is enabled as a server in one peer, it must be enabled as a client in the other peer.
If the VPN is configured as route-based, there must be at least one firewall policy with the action set to IPSec.
If the VPN is configured as DialUp User in one peer, it must be configured as either Static IP Address or Dynamic DNS in the other peer.
If the VPN is configured as a policy-based in one peer, it must also be configured as policy-based in the other peer.

Explicación

Pregunta 4 de 133

Based on this output, which statements are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The all VDOM is not synchronized between the primary and secondary FortiGate devices.
The root VDOM is not synchronized between the primary and secondary FortiGate devices.
The global configuration is synchronized between the primary and secondary FortiGate devices.
The FortiGate devices have three VDOMs.

Explicación

Pregunta 5 de 133

Which of the following statements about NTLM authentication are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

It is useful when users log in to DCs that are not monitored by a collector agent.
It takes over as the primary authentication method when configured alongside FSSO.
Multi-domain environments require DC agents on every domain controller.
NTLM-enabled web browsers are required.

Explicación

Pregunta 6 de 133

Which of the following will be highlighted based on the input criteria?

Selecciona una de las siguientes respuestas posibles:

Policy with ID1.
Policies with ID 2 and 3.
Policy with ID 5.
Policy with ID 4.

Explicación

Pregunta 7 de 133

An administrator is attempting to allow access to https://fortinet.com through a firewall policy that is configured with a web filter and an SSL inspection profile configured for deep inspection. Which of the following are possible actions to eliminate the certificate error generated by deep inspection? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Implement firewall authentication for all users that need access to fortinet.com.
Manually install the FortiGate deep inspection certificate as a trusted CA.
Configure fortinet.com access to bypass the IPS engine.
Configure an SSL-inspection exemption for fortinet.com.

Explicación

Pregunta 8 de 133

An administrator has configured a dialup IPsec VPN with XAuth. Which statement best describes what occurs during this scenario?

Selecciona una de las siguientes respuestas posibles:

Phase 1 negotiations will skip preshared key exchange.
Only digital certificates will be accepted as an authentication method in phase 1.C
Dialup clients must provide a username and password for authentication.
Dialup clients must provide their local ID during phase 2 negotiations.

Explicación

Pregunta 9 de 133

What are the expected actions if traffic matches this IPS sensor? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The sensor will gather a packet log for all matched traffic.
The sensor will not block attackers matching the A32S.Botnet signature.
The sensor will block all attacks for Windows servers.
The sensor will reset all connections that match these signatures.

Explicación

Pregunta 10 de 133

An administrator has configured the following settings

config system settings
set ses-denied-traffic enable
end

config system global
set block-session-timer 30
end

What does the configuration do? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Reduces the amount of logs generated by denied traffic.
Enforces device detection on all interfaces for 30 minutes.
Blocks denied users for 30 minutes.
Creates a session for traffic being denied.

Explicación

Pregunta 11 de 133

How does FortiGate verify the login credentials of a remote LDAP user?

Selecciona una de las siguientes respuestas posibles:

FortiGate regenerates the algorithm based on the login credentials and compares it to the algorithm stored on the LDAP server.
FortiGate sends the user-entered credentials to the LDAP server for authentication.
FortiGate queries the LDAP server for credentials.
FortiGate queries its own database for credentials.

Explicación

Pregunta 12 de 133

Which users and user groups are allowed access to the network through captive portal?

Selecciona una de las siguientes respuestas posibles:

Users and groups defined in the firewall policy.
Only individual users – not groups – defined in the captive portal configuration
Groups defined in the captive portal configuration
All users

Explicación

Pregunta 13 de 133

Which of the following statements about policy-based IPsec tunnels are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

They support L2TP-over-IPsec.
They can be configured in both NAT/Route and transparent operation modes.
They require two firewall policies: one for each directions of traffic flow.
They support GRE-over-IPsec.

Explicación

Pregunta 14 de 133

An administrator wants to block HTTP uploads. Examine the exhibit, which contains the proxy address created for that purpose.

Where must the proxy address be used?

Selecciona una de las siguientes respuestas posibles:

As the source in a firewall policy.
As the source in a proxy policy.
As the destination in a firewall policy.
As the destination in a proxy policy.

Explicación

Pregunta 15 de 133

Which one of the following processes is involved in updating IPS from FortiGuard?

Selecciona una de las siguientes respuestas posibles:

FortiGate IPS update requests are sent using UDP port 443.
Protocol decoder update requests are sent to service.fortiguard.net.
IPS signature update requests are sent to update.fortiguard.net.
IPS engine updates can only be obtained using push updates.

Explicación

Pregunta 16 de 133

An administrator wants to create a policy-based IPsec VPN tunnel betweeb two FortiGate devices. Which configuration steps must be performed on both devices to support this scenario? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Define the phase 1 parameters, without enabling IPsec interface mode
Define the phase 2 parameters.
Set the phase 2 encapsulation method to transport mode
Define at least one firewall policy, with the action set to IPsec.
Define a route to the remote network over the IPsec tunnel.

Explicación

Pregunta 17 de 133

An administrator wants to configure a FortiGate as a DNS server. The FortiGate must use its DNS database first, and then relay all irresolvable queries to an external DNS server. Which of the following DNS method must you use?

Selecciona una de las siguientes respuestas posibles:

Non-recursive
Recursive
Forward to primary and secondary DNS
Forward to system DNS

Explicación

Pregunta 18 de 133

Why is the administrator getting the error shown in the exhibit?

Selecciona una de las siguientes respuestas posibles:

The administrator must first enter the command edit global.
The administrator admin does not have the privileges required to configure global settings.
The global settings cannot be configured from the root VDOM context.
The command config system global does not exist in FortiGate.

Explicación

Pregunta 19 de 133

If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?

Selecciona una de las siguientes respuestas posibles:

A CRL
A person
A subordinate CA
A root CA

Explicación

Pregunta 20 de 133

Which statements about a One-to-One IP pool are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

It is used for destination NAT.
It allows the fixed mapping of an internal address range to an external address range.
It does not use port address translation.
ID It allows the configuration of ARP replies

Explicación

Pregunta 21 de 133

Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?

Selecciona una de las siguientes respuestas posibles:

FortiGate will load balance all traffic across both routes.
FortiGate will use the port1 route as the primary candidate.
FortiGate will route twice as much traffic to the port2 route
FortiGate will only actuate the port1 route in the routing table

Explicación

Pregunta 22 de 133

Examine the exhibit, which shows the partial output of an IKE real time debug

Which of the following statement about the output is true?

Selecciona una de las siguientes respuestas posibles:

The VPN is configured to use pre-shared key authentication.
Extended authentication (XAuth) was successful.
Remote is the host name of the remote IPsec peer.
Phase 1 went down.

Explicación

Pregunta 23 de 133

How can you block or allow to Twitter using a firewall policy?

Selecciona una de las siguientes respuestas posibles:

Configure the Destination field as Internet Service objects for Twitter.
Configure the Action field as Learn and select Twitter.
Configure the Service field as Internet Service objects for Twitter.
Configure the Source field as Internet Service objects for Twitter.

Explicación

Pregunta 24 de 133

Which of the following services can be inspected by the DLP profile? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

NFS
FTP
IMAP
CIFS
HTTP-POST

Explicación

Pregunta 25 de 133

When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?

Selecciona una de las siguientes respuestas posibles:

remote user’s public IP address
The public IP address of the FortiGate device.
The remote user’s virtual IP address.
The internal IP address of the FortiGate device.

Explicación

Pregunta 26 de 133

A company needs to provide SSL VPN access to two user groups. The company also needs to display different welcome messages on the SSL VPN login screen for both user groups.
What is required in the SSL VPN configuration to meet these requirements?

Selecciona una de las siguientes respuestas posibles:

Different SSL VPN realms for each group.
Two separate SSL VPNs in different interfaces mapping the same ssl.root.
Two firewall policies with different captive portals.
Different virtual SSL VPN IP addresses for each group

Explicación

Pregunta 27 de 133

The FSSO Collector Agent set to advanced access mode for the Windows Active Directory uses which of the following?

Selecciona una de las siguientes respuestas posibles:

RSSO convention
Windows convention - NetBios\Username
LDAP convention
NTLM convention

Explicación

Pregunta 28 de 133

NGFW mode allows policy-based configuration for most inspection rules. Which security profile’s configuration does not change when you enable policy-based inspection?

Selecciona una de las siguientes respuestas posibles:

Web filtering
Antivirus
Web proxy
Application control

Explicación

Pregunta 29 de 133

Which of the following statements are true when using WPAD with the DHCP discovery method? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

If the DHCP method fails, browsers will try the DNS method.
The browser needs to be preconfigured with the DHCP server’s IP address.
The browser sends a DHCPONFORM request to the DHCP server.
The DHCP server provides the PAC file for download.

Explicación

Pregunta 30 de 133

What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

Selecciona una de las siguientes respuestas posibles:

It limits the scope of application control to the browser-based technology category only.
It limits the scope of application control to scan application traffic based on application category only.
It limits the scope of application control to scan application traffic using parent signatures only
It limits the scope of application control to scan application traffic on DNS protocol only.

Explicación

Pregunta 31 de 133

Based on the configuration shown in the exhibit, what statements about application control behavior are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Access to all unknown applications will be allowed.
Access to browser-based Social.Media applications will be blocked.
Access to mobile social media applications will be blocked
Access to all applications in Social.Media category will be blocked.

Explicación

Pregunta 32 de 133

An administrator is running the following sniffer command: diagnose sniffer packet any "host 10.0.2.10" 3
What information will be included in the sniffer output? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

IP header
Ethernet header
Packet payload
Application header
Interface name

Explicación

Pregunta 33 de 133

A DHCP server is connected to the VLAN10 interface. A DHCP client is connected to the VLAN5 interface. However, the DHCP client cannot get a dynamic IP address from the DHCP server. What is the cause of the problem?

Selecciona una de las siguientes respuestas posibles:

Both interfaces must belong to the same forward domain.
The role of the VLAN10 interface must be set to server.
Both interfaces must have the same VLAN ID.
Both interfaces must be in different VDOMs

Explicación

Pregunta 34 de 133

An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

The interface has been configured for one-arm sniffer.
The interface is a member of a virtual wire pair.
The operation mode is transparent.
The interface is a member of a zone.
Captive portal is enabled in the interface

Explicación

Pregunta 35 de 133

Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.
When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?

Selecciona una de las siguientes respuestas posibles:

SMTP.Login.Brute.Force
IMAP.Login.brute.Force
ip_src_session
Location: server Protocol: SMTP

Explicación

Pregunta 36 de 133

When using SD-WAN, how do you configure the next-hop gateway address for a member interface so that FortiGate can forward Internet traffic?

Selecciona una de las siguientes respuestas posibles:

It must be configured in a static route using the sdwan virtual interface.
It must be provided in the SD-WAN member interface configuration.
It must be configured in a policy-route using the sdwan virtual interface.
It must be learned automatically through a dynamic routing protocol.

Explicación

Pregunta 37 de 133

Examine the IPS sensor configuration shown in the exhibit, and then answer the question below.

An administrator has configured the WINDOS_SERVERS IPS sensor in an attempt to determine whether the influx of HTTPS traffic is an attack attempt or not. After applying the IPS sensor, FortiGate is still not generating any IPS logs for the HTTPS traffic.
What is a possible reason for this?

Selecciona una de las siguientes respuestas posibles:

The IPS filter is missing the Protocol: HTTPS option.
The HTTPS signatures have not been added to the sensor.
A DoS policy should be used, instead of an IPS sensor
The firewall policy is not using a full SSL inspection profile.

Explicación

Pregunta 38 de 133

A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub interfaces added to the physical interface.
Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

Selecciona una de las siguientes respuestas posibles:

The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets
The two VLAN sub interfaces must have different VLAN IDs.
The two VLAN sub interfaces can have the same VLAN ID, only if they belong to different VDOMs.
The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.

Explicación

Pregunta 39 de 133

How does FortiGate select the central SNAT policy that is applied to a TCP session?

Selecciona una de las siguientes respuestas posibles:

It selects the SNAT policy specified in the configuration of the outgoing interface.
It selects the first matching central SNAT policy, reviewing from top to bottom.
It selects the central SNAT policy with the lowest priority.
. It selects the SNAT policy specified in the configuration of the firewall policy that matches the traffic.

Explicación

Pregunta 40 de 133

Which of the following SD-WAN load balancing method use interface weight value to distribute traffic? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Source IP
Spillover
Volume
Session

Explicación

Pregunta 41 de 133

View the exhibit.

Which of the following statements are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

This setup requires at least two firewall policies with the action set to IPsec.
Dead peer detection must be disabled to support this type of IPsec setup.
The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
This is a redundant IPsec setup

Explicación

Pregunta 42 de 133

What information is flushed when the chunk-size value is changed in the config dlp settings?

Selecciona una de las siguientes respuestas posibles:

The database for DLP document fingerprinting
The supported file types in the DLP filters
The archived files and messages
The file name patterns in the DLP filters

Explicación

Pregunta 43 de 133

Which is the correct description of a hash result as it relates to digital certificates?

Selecciona una de las siguientes respuestas posibles:

A unique value used to verify the input data
An output value that is used to identify the person or deduce that authored the input data.
An obfuscation used to mask the input data.
An encrypted output value used to safe-guard the input data

Explicación

Pregunta 44 de 133

What does this raw log indicate? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

type indicates that a security event was recorded.
FortiGate blocked the traffic.
10.0.1.20 is the IP address for lavito.tk.
policyid indicates that traffic went through the IPS firewall policy.

Explicación

Pregunta 45 de 133

An administrator needs to strengthen the security for SSL VPN access. Which of the following statements are best practices to do so? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Configure split tunneling for content inspection
Configure host restrictions by IP or MAC address.
Configure two-factor authentication using security certificates.
Configure SSL offloading to a content processor (FortiASIC).
Configure a client integrity check (host-check).

Explicación

Pregunta 46 de 133

Which of the following statements are best practices for troubleshooting FSSO? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Include the group of guest users in a policy.
Extend timeout timers.
Guarantee at least 34 Kbps bandwidth between FortiGate and domain controllers.
Ensure all firewalls allow the FSSO required ports.

Explicación

Pregunta 47 de 133

Which of the following FortiGate configuration tasks will create a route in the policy route table? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Static route created with a Named Address object
Static route created with an Internet Services object
SD-WAN route created for individual member interfaces
SD-WAN rule created to route traffic based on link latency

Explicación

Pregunta 48 de 133

What criteria does FortiGate use to look for a matching firewall policy to process traffic? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Services defined in the firewall policy.
Highest to lowest priority defined in the firewall policy.
Incoming and outgoing interfaces
Lowest to highest policy ID number.

Explicación

Pregunta 49 de 133

Examine the routing database shown in the exhibit , and then answer the following question

Which of the following statements are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The port3 default route has the highest distance.
The port3 default route has the lowest metric.
There will be eight routes active in the routing table.
The port1 and port2 default routes are active in the routing table.

Explicación

Pregunta 50 de 133

On a FortiGate with a hard disk, how can you upload logs to FortiAnalyzer or FortiManager? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

hourly
real time
on-demand
store-and-upload

Explicación

Pregunta 51 de 133

An administration wants to throttle the total volume of SMTP sessions to their email server. Which of the following DoS sensors can be used to achieve this?

Selecciona una de las siguientes respuestas posibles:

tcp_port_scan
ip_dst_session
udp_flood
ip_src_session

Explicación

Pregunta 52 de 133

If traffic matches a DLP filter with the action set to Quarantine IP Address, what action does FortiGate take?

Selecciona una de las siguientes respuestas posibles:

It notifies the administrator by sending an email.
It provides a DLP block replacement page with a link to download the file.
It blocks all future traffic for that IP address for a configured interval.
It archives the data for that IP address.

Explicación

Pregunta 53 de 133

An administrator has configured a route-based IPsec VPN between two FortiGate devices. Which statement about this IPsec VPN configuration is true?

Selecciona una de las siguientes respuestas posibles:

A phase 2 configuration is not required.
This VPN cannot be used as part of a hub-and-spoke topology.
A virtual IPsec interface is automatically created after the phase 1 configuration is completed.
The IPsec firewall policies must be placed at the top of the list

Explicación

Pregunta 54 de 133

You have tasked to design a new IPsec deployment with the following criteria:+

• There are two HQ sues that all satellite offices must connect to
• The satellite offices do not need to communicate directly with other satellite offices
• No dynamic routing will be used
• The design should minimize the number of tunnels being configured.

Which topology should be used to satisfy all of the requirements?

Selecciona una de las siguientes respuestas posibles:

Partial mesh
Hub-and-spoke
Fully meshed
Redundant

Explicación

Pregunta 55 de 133

Examine the network diagram shown in the exhibit, and then answer the following question

A firewall administrator must configure equal cost multipath (ECMP) routing on FGT1 to ensure both port1 and port3 links are used at the same time for all traffic destined for 172.20.2.0/24. Which of the following static routes will satisfy this requirement on FGT1? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

172.20.2.0/24 (1/0) via 10.10.1.2, port1 [0/0]
172.20.2.0/24 (25/0) via 10.10.3.2, port3 [5/0]
172.20.2.0/24 (1/150) via 10.10.3.2, port3 [10/0]
172.20.2.0/24 (1/150) via 10.30.3.2, port3 [10/0]

Explicación

Pregunta 56 de 133

What files are sent to FortiSandbox for inspection in flow-based inspection mode?

Selecciona una de las siguientes respuestas posibles:

All suspicious files that do not have their hash value in the FortiGuard antivirus signature database
All suspicious files that are above the defined oversize limit value in the protocol options.
All suspicious files that match patterns defined in the antivirus profile.
All suspicious files that are allowed to be submitted to FortiSandbox in the antivirus profile.

Explicación

Pregunta 57 de 133

What FortiGate configuration is required to actively prompt users for credentials?

Selecciona una de las siguientes respuestas posibles:

You must enable one or more protocols that support active authentication on a firewall policy.
You must assign users to a group for active authentication.
You must place the firewall policy for active authentication before a firewall policy for passive authentication.
You must enable the Authentication setting on the firewall policy.

Explicación

Pregunta 58 de 133

Examine the network diagram shown in the exhibit, then answer the following question:

Which one of the following routes is the best candidate route for FGT1 to route traffic from the Workstation to the Web server?

Selecciona una de las siguientes respuestas posibles:

172.16.0.0/16 [50/0] via 10.4.200.2, port2 [5/0]
0.0.0.0/0 [20/0] via 10.4.200.2, port2
10.4.200.0/30 is directly connected, port2
172.16.32.0/24 is directly connected, port1

Explicación

Pregunta 59 de 133

Which statements about DNS filter profiles are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

They can inspect HTTP traffic.
They can redirect blocked requests to a specific portal.
They can block DNS requests to known botnet command and control servers.
They must be applied in firewall policies with SSL inspection enabled.

Explicación

Pregunta 60 de 133

Examine the exhibit, which contains a session diagnostic output.

Which of the following statements about the session diagnostic output is true?

Selecciona una de las siguientes respuestas posibles:

The session is in ESTABLISHED state.
The session is in LISTEN state.
The session is in TIME_WAIT state.
The session is in CLOSE_WAIT state

Explicación

Pregunta 61 de 133

A FortiGate device has multiple VDOMs. Which statement about an administrator account configured with the default prof_admin profile is true?

Selecciona una de las siguientes respuestas posibles:

It can create administrator accounts with access to the same VDOM.
It cannot have access to more than one VDOM.
It can reset the password for the admin account.
It can upgrade the firmware on the FortiGate device.

Explicación

Pregunta 62 de 133

View the exhibit

What should be done next to troubleshoot the problem?

Selecciona una de las siguientes respuestas posibles:

Run a sniffer in the web server.
Execute another sniffer in the FortiGate, this time with the filter "host 10.0.1.10".
Capture the traffic using an external sniffer connected to port1.
Execute a debug flow.

Explicación

Pregunta 63 de 133

Which statement about FortiGuard services for FortiGate is true?

Selecciona una de las siguientes respuestas posibles:

The web filtering database is downloaded locally on FortiGate.
Antivirus signatures are downloaded locally on FortiGate.
FortiGate downloads IPS updates using UDP port 53 or 8888.
FortiAnalyzer can be configured as a local FDN to provide antivirus and IPS updates.

Explicación

Pregunta 64 de 133

Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Log downloads from the GUI are limited to the current filter view
Log backups from the CLI cannot be restored to another FortiGate.
Log backups from the CLI can be configured to upload to FTP as a scheduled time
Log downloads from the GUI are stored as LZ4 compressed files.

Explicación

Pregunta 65 de 133

Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
ADVPN is only supported with IKEv2.
Tunnels are negotiated dynamically between spokes.
Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Explicación

Pregunta 66 de 133

Which of the following static routes are not maintained in the routing table? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Named Address routes
Dynamic routes
ISDB routes
Policy routes

Explicación

Pregunta 67 de 133

Which statement is true regarding SSL VPN timers? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Allow to mitigate DoS attacks from partial HTTP requests.
SSL VPN settings do not have customizable timers.
Disconnect idle SSL VPN users when a firewall policy authentication timeout occurs.
Prevent SSL VPN users from being logged out because of high network latency.

Explicación

Pregunta 68 de 133

Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

To delete intermediary NAT devices in the tunnel path.
To dynamically change phase 1 negotiation mode aggressive mode.
To encapsulation ESP packets in UDP packets using port 4500.
To force a new DH exchange with each phase 2 rekey.

Explicación

Pregunta 69 de 133

View the exhibit.

A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting.Games). Based on this configuration, which statement is true?

Selecciona una de las siguientes respuestas posibles:

Addicting.Games is allowed based on the Application Overrides configuration.
Addicting.Games is blocked based on the Filter Overrides configuration.
Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.
Addicting.Games is allowed based on the Categories configuration.

Explicación

Pregunta 70 de 133

If the services fiel is configured in a virtual IP (VIP), which of the following statements is true when central NAT is used?

Selecciona una de las siguientes respuestas posibles:

The services field removes the requirement of creating multiple VIPs for different services
The services field is used when several VIPs need to be bundled into VIP groups
The services field does not allow source NAT and destination NAT to be combined in the same policy
The services field does not allow multiple sources of traffic, to use multiple services, to connect to a single computer

Explicación

Pregunta 71 de 133

Which statements about virtual domains (VDOMs) are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Transparent mode and NAT mode VDOMs cannot be combined on the same FortiGate.
Each VDOM can be configured with different system hostnames.
Different VLAN sub-interfaces of the same physical interface can be assigned to different VDOMs.
Each VDOM has its own routing table.

Explicación

Pregunta 72 de 133

An employee connects to the https://example.com on the Internet using a web browser. The web server’s certificate was signed by a private internal CA. The FortiGate that is inspecting this traffic is configured for full SSL inspection.
This exhibit shows the configuration settings for the SSL/SSH inspection profile that is applied to the policy that is invoked in this instance. All other settings are set to defaults. No certificates have been imported into FortiGate. View the exhibit and answer the question-that follows.

Which certificate is presented to the employee’s web browser?

Selecciona una de las siguientes respuestas posibles:

The web server’s certificate.
The user’s personal certificate signed by a private internal CA.
A certificate signed by Fortinet_CA_SSL.
A certificate signed by Fortinet_CA_Untrusted.

Explicación

Pregunta 73 de 133

Which of the following statements correctly describes FortiGates route lookup behavior when searching for a suitable gateway? (Choose two)

Selecciona una o más de las siguientes respuestas posibles:

Lookup is done on the trust packet from the session originator
Lookup is done on the last packet sent from the responder
Lookup is done on every packet, regardless of direction
Lookup is done on the trust reply packet from the responder

Explicación

Pregunta 74 de 133

HTTP Public Key Pinning (HPKP) can be an obstacle to implementing full SSL inspection. What solutions could resolve this problem? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Enable Allow Invalid SSL Certificates for the relevant security profile.
Change web browsers to one that does not support HPKP.
Exempt those web sites that use HPKP from full SSL inspection.
Install the CA certificate (that is required to verify the web server certificate) stores of users’ computers.

Explicación

Pregunta 75 de 133

Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

Selecciona una de las siguientes respuestas posibles:

To remove the NAT operation.
To generate logs
To finish any inspection operations
To allow for out-of-order packets that could arrive after the FIN/ACK packets

Explicación

Pregunta 76 de 133

Refer to the following exhibit

Why is FortiGate not blocking the test file over FTP download?

Selecciona una de las siguientes respuestas posibles:

Deep-inspection must be enabled for FortiGate to fully scan FTP traffic.
FortiGate needs to be operating in flow-based inspection mode in order to scan FTP traffic.
The FortiSandbox signature database is required to successfully scan FTP traffic.
The proxy options profile needs to scan FTP traffic on a non-standard port.

Explicación

Pregunta 77 de 133

Examine the exhibit, which shows the output of a web filtering real time debug.

Why is the site www.bing.com being blocked?

Selecciona una de las siguientes respuestas posibles:

The web site www.bing.com is categorized by FortiGuard as Malicious Websites.
The user has not authenticated with the FortiGate yet.
The web server IP address 204.79.197.200 is categorized by FortiGuard as Malicious Websites.
. The rating for the web site www.bing.com has been locally overridden to a category that is being blocked.

Explicación

Pregunta 78 de 133

Which statement about data leak prevention (DLP) on a FortiGate is true?

Selecciona una de las siguientes respuestas posibles:

Traffic shaping can be applied to DLP sensors.
It can be applied to a firewall policy in a flow-based VDOM.
Files can be sent to FortiSandbox for detecting DLP threats.
It can archive files and messages.

Explicación

Pregunta 79 de 133

When using WPAD DNS method, which FQDN format do browsers use to query the DNS server?

Selecciona una de las siguientes respuestas posibles:

srv_proxy.<local-domain>/wpad.dat
srv_tcp.wpad.<local-domain>
wpad.<local-domain>
proxy.<local-domain>.wpad

Explicación

Pregunta 80 de 133

Which statements about HA for FortiGate devices are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Sessions handled by proxy-based security profiles cannot be synchronized
Virtual clustering can be configured between two FortiGate devices that have multiple VDOMs.
HA management interface settings are synchronized between cluster members.
Heartbeat interfaces are not required on the primary device.

Explicación

Pregunta 81 de 133

Which of the following statements about virtual domains (VDOMs) are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The root VDOM is the management VDOM by default.
A FortiGate device has 64 VDOMs, created by default.
Each VDOM maintains its own system time.
Each VDOM maintains its own routing table.

Explicación

Pregunta 82 de 133

Examine this PAC file configuration

Which of the following statements are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Browsers can be configured to retrieve this PAC file from the FortiGate.
Any web request to the 172.25.120.0/24 subnet is allowed to bypass the proxy.
All requests not made to Fortinet.com or the 172.25.120.0/24 subnet, have to go through altproxy.corp.com: 8060.
Any web request fortinet.com is allowed to bypass the proxy.

Explicación

Pregunta 83 de 133

Which of the following statements about converse mode are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

. FortiGate stops sending files to FortiSandbox for inspection.
FortiGate stops doing RPF checks over incoming packets.
. Administrators cannot change the configuration.
Administrators can access the FortiGate only through the console port.

Explicación

Pregunta 84 de 133

During the digital verification process, comparing the original and fresh hash results satisfies which security requirement?

Selecciona una de las siguientes respuestas posibles:

Authentication.
Data integrity.
Non-repudiation.
Signature verification.

Explicación

Pregunta 85 de 133

Which statement about the IP authentication header (AH) used by IPsec is true?

Selecciona una de las siguientes respuestas posibles:

AH does not provide any data integrity or encryption.
AH does not support perfect forward secrecy.
AH provides data integrity but no encryption.
AH provides strong data integrity but weak encryption.

Explicación

Pregunta 86 de 133

Examine the network diagram and the existing FGTI routing table shown in the exhibit, and then answer the following question:

Since the change, the new static route is not showing up in the routing table. Given the information provided, which of the following describes the cause of this problem?

Selecciona una de las siguientes respuestas posibles:

The new route’s destination subnet overlaps an existing route
The new route’s Distance value should be higher than 10
The Gateway IP address is not in the same subnet as port1.
The Priority is 0, which means that this route will remain inactive.

Explicación

Pregunta 87 de 133

What FortiGate components are tested during the hardware test? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Administrative access
HA heartbeat
CPU
Hard disk
Network interfaces

Explicación

Pregunta 88 de 133

Which of the following statements describe WMI polling mode for the FSSO collector agent? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The NetSessionEnum function is used to track user logoffs.
WMI polling can increase bandwidth usage in large networks.
The collector agent uses a Windows API to query DCs for user logins.
The collector agent do not need to search any security event logs.

Explicación

Pregunta 89 de 133

Which statements correctly describe transparent mode operation? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

All interfaces of the transparent mode FortiGate device must be on different IP subnets.
Ethernet packets are forwarded based on destination MAC addresses, not IP addresses.
The transparent FortiGate is visible to network hosts in an IP traceroute
It permits inline traffic inspection and firewalling without changing the IP scheme of the network.
FortiGate acts as transparent bridge and forwards traffic at Layer 2.

Explicación

Pregunta 90 de 133

Which statements about the firmware upgrade process on an active-active high availability (HA) cluster are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The firmware image must be manually uploaded to each FortiGate.
Only secondary FortiGate devices are rebooted.
Uninterruptable upgrade is enabled by default.
. Traffic load balancing is temporally disabled while upgrading the firmware

Explicación

Pregunta 91 de 133

Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?

Selecciona una de las siguientes respuestas posibles:

The public key of the web server certificate must be installed on the browser.
The web-server certificate must be installed on the browser.
The CA certificate that signed the web-server certificate must be installed on the browser.
The private key of the CA certificate that signed the browser certificate must be installed on the browser.

Explicación

Pregunta 92 de 133

Which statement is true regarding the policy ID number of a firewall policy?

Selecciona una de las siguientes respuestas posibles:

Defines the order in which rules are processed.
Represents the number of objects used in the firewall policy.
Required to modify a firewall policy using the CLI.
Changes when firewall policies are reordered.

Explicación

Pregunta 93 de 133

Which of the following statements regarding the firewall policy authentication timeout is true?

Selecciona una de las siguientes respuestas posibles:

The authentication timeout is an idle timeout. This means that the FortiGate unit will consider a user to be "idle" if it does not see any packets coming from the user’s source IP.
The authentication timeout is a hard timeout. This means that the FortiGate unit will remove the temporary policy for this user’s source IP after this timer has expired.
The authentication timeout is an idle timeout. This means that the FortiGate unit will consider a user to be "idle" if it does not see any packets coming from the user’s source MAC.
The authentication timeout is a hard timeout. This means that the FortiGate unit will remove the temporary policy for this user’s source MAC after this timer has expired.

Explicación

Pregunta 94 de 133

Why must you use aggressive mode when a local FortiGate IPSec gateway hosts multiple dialup tunnels?

Selecciona una de las siguientes respuestas posibles:

In aggressive mode, the remote peers are able to provide their peer IDs in the first message.
FortiGate is able to handle NATed connections only in aggressive mode.
FortiClient only supports aggressive mode
Main mode does not support XAuth for user authentication

Explicación

Pregunta 95 de 133

Examine this FortiGate configuration:

How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

Selecciona una de las siguientes respuestas posibles:

It always authorizes the traffic without requiring authentication.
It drops the traffic.
It authenticates the traffic using the authentication scheme SCHEME2.
It authenticates the traffic using the authentication scheme SCHEME1.

Explicación

Pregunta 96 de 133

View the exhibit.

VDOM1 is operating in transparent mode VDOM2 is operating in NAT Route mode. There is an inteface VDOM link between both VDOMs. A client workstation with the IP address 10.0.1.10/24 is connected to port2. A web server with the IP address 10.200.1.2/24 is connected to port1.
What is required in the FortiGate configuration to route and allow connections from the client workstation to the web server? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

A static or dynamic route in VDOM2 with the subnet 10.0.1.0/24 as the destination.
A static or dynamic route in VDOM1 with the subnet 10.200.1.0/24 as the destination.
One firewall policy in VDOM1 with port2 as the source interface and InterVDOM0 as the destination interface.
One firewall policy in VDOM2 with InterVDOM1 as the source interface and port1 as the destination interface.

Explicación

Pregunta 97 de 133

An administrator needs to create an SSL-VPN connection for accessing an internal server using the bookmark Port Forward.

What step is required for this configuration?

Selecciona una de las siguientes respuestas posibles:

Configure an SSL VPN realm for clients to use the port forward bookmark.
Configure the client application to forward IP traffic through FortiClient
Configure the virtual IP address to be assigned t the SSL VPN users
Configure the client application to forward IP traffic to a Java applet proxy.

Explicación

Pregunta 98 de 133

View the exhibit:
Which statement about the exhibit is true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.
port-VLAN1 is the native VLAN for the port1 physical interface.
port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.
Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.

Explicación

Pregunta 99 de 133

Which action can be applied to each filter in the application control profile?

Selecciona una de las siguientes respuestas posibles:

Block, monitor, warning, and quarantine
Allow, monitor, block and learn
Allow, block, authenticate, and warning
Allow, monitor, block, and quarantine

Explicación

Pregunta 100 de 133

An administrator is configuring an antivirus profiles on FortiGate and notices that Proxy Options is not listed under Security Profiles on the GUI. What can cause this issue?

Selecciona una de las siguientes respuestas posibles:

FortiGate needs to be switched to NGFW mode
Proxy options section is hidden by default and needs to be enabled from the Feature Visibility menu.
Proxy options are no longer available starting in FortiOS 5.6.
FortiGate is in flow-based inspection mode.

Explicación

Pregunta 101 de 133

An administrator is configuring an Ipsec between site A and siteB. The Remotes Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.16.1.0/24 and the remote quick mode selector is 192.16.2.0/24. How must the administrator configure the local quick mode selector for site B?

Selecciona una de las siguientes respuestas posibles:

192.168.3.0/24
192.168.2.0/24
192.168.1.0/24
192.168.0.0/8

Explicación

Pregunta 102 de 133

What settings must you configure to ensure FortiGate generates logs for web filter activity on a firewall policy called Full Access? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Enable Event Logging.
Enable a web filter security profile on the Full Access firewall policy.
Enable Log Allowed Traffic on the Full Access firewall policy.
Enable disk logging.

Explicación

Pregunta 103 de 133

View the certificate shown to the exhibit, and then answer the following question:
The CA issued this certificate to which entity?

Selecciona una de las siguientes respuestas posibles:

A root CA
A person
A bridge CA
A subordinate CA

Explicación

Pregunta 104 de 133

Which of the following are valid actions for FortiGuard category based filter in a web filter profile ui proxy-based inspection mode? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Warning
Exempt
Allow
Learn

Explicación

Pregunta 105 de 133

Which of the following statements about central NAT are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

IP tool references must be removed from existing firewall policies before enabling central NAT.
Central NAT can be enabled or disabled from the CLI only.
Source NAT, using central NAT, requires at least one central SNAT policy.
Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.

Explicación

Pregunta 106 de 133

An administrator is investigating a report of users having intermittent issues with browsing the web. The administrator ran diagnostics and received the output shown in the exhibit.

Examine the diagnostic output shown exhibit. Which of the following options is the most likely cause of this issue?

Selecciona una de las siguientes respuestas posibles:

NAT port exhaustion
High CPU usage
High memory usage
High session timeout value

Explicación

Pregunta 107 de 133

Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

This is known as many-to-one NAT.
Source IP is translated to the outgoing interface IP.
Connections are tracked using source port and source MAC address.
Port address translation is not used.

Explicación

Pregunta 108 de 133

Which of the following features is supported by web filter in flow-based inspection mode with NGFW mode set to profile-based?

Selecciona una de las siguientes respuestas posibles:

FortiGuard Quotas
Static URL
Search engines
Rating option

Explicación

Pregunta 109 de 133

How can you format the FortiGate flash disk?

Selecciona una de las siguientes respuestas posibles:

Load the hardware test (HQIP) image.
Execute the CLI command execute formatlogdisk.
Load a debug FortiOS image.
Select the format boot device option from the BIOS menu.

Explicación

Pregunta 110 de 133

An administrator has configured central DNAT and virtual IPs. Which of the following can be selected in the firewall policy Destination field?

Selecciona una de las siguientes respuestas posibles:

A VIP group
The mapped IP address object of the VIP object
A VIP object
An IP pool

Explicación

Pregunta 111 de 133

Which statements about antivirus scanning mode are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

In proxy-based inspection mode antivirus buffers the whole file for scarring before sending it to the client.
In flow-based inspection mode, you can use the CLI to configure antivirus profiles to use protocol option profiles.
In proxy-based inspection mode, if a virus is detected, a replacement message may not be displayed immediately.
In quick scan mode, you can configure antivirus profiles to use any of the available signature data bases.

Explicación

Pregunta 112 de 133

When override is enabled, which of the following shows the process and selection criteria that are used to elect the primary FortiGate in an HA cluster?

Selecciona una de las siguientes respuestas posibles:

Connected monitored ports > HA uptime > priority > serial number
Priority > Connected monitored ports > HA uptime > serial number
Connected monitored ports > priority > HA uptime > serial number
HA uptime > priority > Connected monitored ports > serial number

Explicación

Pregunta 113 de 133

Which of the following statements about the FSSO collector agent timers is true?

Selecciona una de las siguientes respuestas posibles:

The workstation verify interval is used to periodically check of a workstation is still a domain member.
The IP address change verify interval monitors the server IP address where the collector agent is installed, and the updates the collector agent configuration if it changes.
The user group cache expiry is used to age out the monitored groups.
The dead entry timeout interval is used to age out entries with an unverified status

Explicación

Pregunta 114 de 133

A team manager has decided that while some members of the team need access to particular website, the majority of the team does not. Which configuration option is the most effective option to support this request?

Selecciona una de las siguientes respuestas posibles:

Implement a web filter category override for the specified website.
Implement web filter authentication for the specified website
Implement web filter quotas for the specified website.
Implement DNS filter for the specified website.

Explicación

Pregunta 115 de 133

Examine the following web filtering log.

Which statement about the log message is true?

Selecciona una de las siguientes respuestas posibles:

The action for the category Games is set to block.
The usage quota for the IP address 10.0.1.10 has expired.
The name of the applied web filter profile is default.
The web site miniclip.com matches a static URL filter whose action is set to Warning.

Explicación

Pregunta 116 de 133

Which of the following route attributes must be equal for static routes to be eligible for equal cost multipath (ECMP) routing? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Priority
Metric
Distance
Cost

Explicación

Pregunta 117 de 133

In a high availability (HA) cluster operating in active-active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a secondary FortiGate?

Selecciona una de las siguientes respuestas posibles:

Client > primary FortiGate> secondary FortiGate> primary FortiGate> web server.
Client > secondary FortiGate> web server.
Client >secondary FortiGate> primary FortiGate> web server.
Client> primary FortiGate> secondary FortiGate> web server.

Explicación

Pregunta 118 de 133

Examine this output from a debug flow:

Why did the FortiGate drop the packet?

Selecciona una de las siguientes respuestas posibles:

The next-hop IP address is unreachable.
It failed the RPF check.
It matched an explicitly configured firewall policy with the action DENY.
It matched the default implicit firewall policy.

Explicación

Pregunta 119 de 133

Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?

Selecciona una de las siguientes respuestas posibles:

By default, FortiGate uses WINS servers to resolve names.
By default, the SSL VPN portal requires the installation of a client’s certificate.
By default, split tunneling is enabled.
By default, the admin GUI and SSL VPN portal use the same HTTPS port.

Explicación

Pregunta 120 de 133

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?

Selecciona una de las siguientes respuestas posibles:

It is allowed, but with no inspection
It is allowed and inspected as long as the inspection is flow based
It is dropped.
It is allowed and inspected, as long as the only inspection required is antivirus.

Explicación

Pregunta 121 de 133

Which statements about the output are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

FortiGate received a TCP SYN/ACK packet.
The source IP address of the packet was translated to 10.0.1.10.
FortiGate routed the packet through port 3
The packet was allowed by the firewall policy with the ID 00007fc0.

Explicación

Pregunta 122 de 133

Which is a requirement for creating an inter-VDOM link between two VDOMs?

Selecciona una de las siguientes respuestas posibles:

The inspection mode of at least one VDOM must be proxy-based
At least one of the VDOMs must operate in NAT mode
The inspection mode of both VDOMs must match.
Both VDOMs must operate in NAT mode.

Explicación

Pregunta 123 de 133

What traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Traffic to inappropriate web sites
SQL injection attacks
Server information disclosure attacks
Credit card data leaks
Traffic to botnet servers

Explicación

Pregunta 124 de 133

You are configuring the root FortiGate to implement the security fabric. You are configuring port10 to communicate with a downstream FortiGate. View the default Edit Interface in the exhibit below:

When configuring the root FortiGate to communicate with a downstream FortiGate, which settings are required to be configured? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Device detection enabled.
Administrative Access: FortiTelemetry.
IP/Network Mask.
Role: Security Fabric.

Explicación

Pregunta 125 de 133

Examine the exhibit, which contains a virtual IP and firewall policy configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address 10.0.1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address. Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

Selecciona una de las siguientes respuestas posibles:

10.200.1.10
Any available IP address in the WAN (port1) subnet 10.200.1.0/24
10.200.1.1
10.0.1.254

Explicación

Pregunta 126 de 133

What filter can be used in the command diagnose sniffer packet to capture the traffic between the client and the explicit web proxy

Selecciona una de las siguientes respuestas posibles:

Host 192.168.0.1 and port 80
Host 10.0.0.50 and port 80
Host 192.168.0.2 and port 8080
Host 10.0.0.50 and port 8080

Explicación

Pregunta 127 de 133

Examine the network diagram shown in the exhibit, and then answer the following question:
A firewall administrator must configure equal cost multipath (ECMP) routing on FGT1 to ensure both port1 and port3 links are used at the same time for all traffic destined for 172.20.2.0/24. Which of the following static routes will satisfy this requirement on FGT1? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

172.20.2.0/24 (25/0) via 10.30.3.2, port3 [5/0]
172.20.2.0/24 (25/0) via 10.10.1.2, port1 [5/0]
172.20.2.0/24 (1/0) via 10.10.1.2, port1 [0/0]
172.20.2.0/24 (1/150) via 10.30.3.2, port3 [10/0]

Explicación

Pregunta 128 de 133

Which two statements about antivirus scanning mode are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

In proxy-based inspection mode, files bigger than the buffer size are scanned
In full scan flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.
In quick scan mode, you can configure antivirus profiles to use any of the available antivirus signature databases
In proxy-based inspection mode, antivirus scanning buffers the whole file for scanning, before sending it to the client.

Explicación

Pregunta 129 de 133

Examine the FortiGate configuration:

config user settings
Set auth-on-demand implicitly
end

What will happen to unauthenticated users when an active authentication policy is followed by a fall through policy without authentication?

Selecciona una de las siguientes respuestas posibles:

The user must log in again to authenticate.
The user will be denied access to resources without authentication.
The user will not be prompted for authentication.
User authentication happens at an interface level.

Explicación

Pregunta 130 de 133

Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?

Selecciona una de las siguientes respuestas posibles:

FG-traffic VDOM
Root VDOM
Customer VDOM
Global VDOM

Explicación

Pregunta 131 de 133

Which two actions are valid for a FortiGuard category based filter in a web filter profile ufor a firewall policy in proxy-based inspection mode? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Warning
Exempt
Allow
Learn

Explicación

Pregunta 132 de 133

To complete the final step of a security fabric configuration an administrator must authorize all the devices on which device?

Selecciona una de las siguientes respuestas posibles:

Fort manager
Root fortigate
Fort analyzer
Downstream fortigate

Explicación

Pregunta 133 de 133

Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?

Selecciona una de las siguientes respuestas posibles:

Subject Key Identifier value
SMMIE Capabilities value
Subject value
Subject Alternative Name value

Explicación

["https://cdn.goconqr.com/uploads/media/image/30957263/desktop_0172e98b-01f6-4d84-8d9d-3472f87778b1.PNG","https://cdn.goconqr.com/uploads/media/image/30957510/desktop_3a74b6b6-5460-4e69-8445-28f63b7480b8.PNG","https://cdn.goconqr.com/uploads/media/image/30957853/desktop_9317a4e1-2d7f-4b79-b680-38b22f844dd8.PNG","https://cdn.goconqr.com/uploads/media/image/30958147/desktop_842b863f-56f3-48a7-9e82-1e048f7add2c.PNG","https://cdn.goconqr.com/uploads/media/image/30958255/desktop_845d3541-f74f-4ff3-a0ca-300c11733f64.PNG","https://cdn.goconqr.com/uploads/media/image/30958516/desktop_0d9b218b-d349-47f4-9a33-bda566aeb996.PNG","https://cdn.goconqr.com/uploads/media/image/30958632/desktop_9a3e131e-92bb-4afd-b9d2-ab3f0c5cf54e.PNG","https://cdn.goconqr.com/uploads/media/image/30958753/desktop_3a6a8aae-874e-4cb1-93e1-66fd5c5d858d.PNG","https://cdn.goconqr.com/uploads/media/image/30959378/desktop_c5bce80f-da25-48f1-8aaf-53ac30060219.PNG","https://cdn.goconqr.com/uploads/media/image/30959585/desktop_4cf27f48-1f63-444d-894b-4c5d4cd3618e.PNG","https://cdn.goconqr.com/uploads/media/image/30960437/desktop_c2248e46-511c-4f29-ae65-4121a501fefe.PNG","https://cdn.goconqr.com/uploads/media/image/30960667/desktop_4b598a06-96c9-4e70-b6b7-d5fa8b9742a6.PNG","https://cdn.goconqr.com/uploads/media/image/30971224/desktop_f5b9808d-eaa1-4acf-a6e8-1c8b8271ced9.PNG","https://cdn.goconqr.com/uploads/media/image/30971978/desktop_c53a4a6a-cae7-4b2e-87c5-a5b1b57b19eb.PNG","https://cdn.goconqr.com/uploads/media/image/30990416/desktop_bac0e800-bee0-4855-9603-149fc096da82.PNG","https://cdn.goconqr.com/uploads/media/image/31005674/desktop_0388c76d-680b-45d2-9431-9c2a2dbc2497.PNG","https://cdn.goconqr.com/uploads/media/image/31005870/desktop_66ee6fb0-6a36-49b7-9500-c70efa92505f.PNG","https://cdn.goconqr.com/uploads/media/image/31006089/desktop_4567181f-7948-4253-a9d1-f4946a0ef651.PNG","https://cdn.goconqr.com/uploads/media/image/31007213/desktop_b4cd8510-36e2-4c5d-81ce-2915ac49cc5f.PNG","https://cdn.goconqr.com/uploads/media/image/31008231/desktop_730816d6-10d1-4681-bff8-9c6ac403a7fd.PNG","https://cdn.goconqr.com/uploads/media/image/31008782/desktop_c524fb87-cd62-4304-ae4d-37b222fb7c22.PNG","https://cdn.goconqr.com/uploads/media/image/31009374/desktop_d10d98b2-47c5-4245-8470-3f95ddef179c.PNG","https://cdn.goconqr.com/uploads/media/image/31009866/desktop_0cbbc1fd-b378-4a81-b15f-85cbd22c2640.PNG","https://cdn.goconqr.com/uploads/media/image/31010320/desktop_1d62e915-3103-4dce-83a0-57916116c08a.PNG","https://cdn.goconqr.com/uploads/media/image/31011412/desktop_4ddcfc4c-cd4d-4552-9f03-1f12a31ab178.PNG","https://cdn.goconqr.com/uploads/media/image/31011690/desktop_ea19a49b-f295-4b9c-b54a-7dcba16736f8.PNG","https://cdn.goconqr.com/uploads/media/image/31012138/desktop_aecb3d53-0a72-4d9e-b119-ea18eebacfba.PNG","https://cdn.goconqr.com/uploads/media/image/31014849/desktop_50a51bb7-0004-4ca6-a2fe-383c753d142d.PNG","https://cdn.goconqr.com/uploads/media/image/31015281/desktop_045363df-2543-4ce4-967f-0a063097fcb3.PNG","https://cdn.goconqr.com/uploads/media/image/31016358/desktop_fe765da8-7363-4b27-bbe8-65f5253b11de.PNG","https://cdn.goconqr.com/uploads/media/image/31016721/desktop_fc1d7bcc-19c1-474f-83ad-91bf89db6890.PNG","https://cdn.goconqr.com/uploads/media/image/31017034/desktop_814aadff-b6f2-4d04-b835-b69beec6d5fa.PNG","https://cdn.goconqr.com/uploads/media/image/31017234/desktop_16defd10-f048-44f2-a13e-f643c915da8b.PNG","https://cdn.goconqr.com/uploads/media/image/31017837/desktop_a59a3582-bdd9-4f23-8ff3-a836588ee978.PNG","https://cdn.goconqr.com/uploads/media/image/31017999/desktop_9576670f-2188-4a5f-b472-792d5230976c.PNG","https://cdn.goconqr.com/uploads/media/image/31018597/desktop_e37d7a1b-1a79-46ab-9903-1ba7273f7e86.PNG","https://cdn.goconqr.com/uploads/media/image/31019009/desktop_7c300727-f358-4c82-be42-e848bef8ceed.PNG"]

	Creado por osvaldo linconir hace más de 3 años

examen para preparar

EXAMEN 4 1 Gabriel

Pregunta 1 de 133

Which configuration objects can be selected for the Source field of a firewall policy? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 2 de 133

By default, when logging to disk, when does FortiGate delete logs?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 3 de 133

Which of the following conditions are required for establishing an IPSec VPN between two FortiGate devices? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 4 de 133

Based on this output, which statements are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 5 de 133

Which of the following statements about NTLM authentication are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 6 de 133

Which of the following will be highlighted based on the input criteria?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 7 de 133

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 8 de 133

An administrator has configured a dialup IPsec VPN with XAuth. Which statement best describes what occurs during this scenario?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 9 de 133

What are the expected actions if traffic matches this IPS sensor? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 10 de 133

An administrator has configured the following settings config system settings set ses-denied-traffic enable end config system global set block-session-timer 30 end What does the configuration do? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 11 de 133

How does FortiGate verify the login credentials of a remote LDAP user?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 12 de 133

Which users and user groups are allowed access to the network through captive portal?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 13 de 133

Which of the following statements about policy-based IPsec tunnels are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 14 de 133

An administrator wants to block HTTP uploads. Examine the exhibit, which contains the proxy address created for that purpose. Where must the proxy address be used?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 15 de 133

Which one of the following processes is involved in updating IPS from FortiGuard?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 16 de 133

An administrator wants to create a policy-based IPsec VPN tunnel betweeb two FortiGate devices. Which configuration steps must be performed on both devices to support this scenario? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 17 de 133

An administrator wants to configure a FortiGate as a DNS server. The FortiGate must use its DNS database first, and then relay all irresolvable queries to an external DNS server. Which of the following DNS method must you use?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 18 de 133

Why is the administrator getting the error shown in the exhibit?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 19 de 133

If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 20 de 133

Which statements about a One-to-One IP pool are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

An administrator has configured the following settings

config system settings
set ses-denied-traffic enable
end

config system global
set block-session-timer 30
end

What does the configuration do? (Choose two.)

An administrator wants to block HTTP uploads. Examine the exhibit, which contains the proxy address created for that purpose.

Where must the proxy address be used?

Examine the exhibit, which shows the partial output of an IKE real time debug

Which of the following statement about the output is true?

A company needs to provide SSL VPN access to two user groups. The company also needs to display different welcome messages on the SSL VPN login screen for both user groups.
What is required in the SSL VPN configuration to meet these requirements?

An administrator is running the following sniffer command: diagnose sniffer packet any "host 10.0.2.10" 3
What information will be included in the sniffer output? (Choose three.)

Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.
When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?