Quiz
NST
Crie uma conta grátis para terminar este quiz
Salve seu progresso e veja sua nota final.
Já tem uma conta? Inicie sessão
Perguntas do quiz (93)
1Refer to the exhibit.
An administrator deployed FSSO in DC Agent mode but FSSO is failing on FortiGate. Pinging FortiGate from where the collector agent is deployed is successful. The administrator then produces the debug output shown in the exhibit.
Which two components could be causing this error message? (Choose two.)
- AThe connection is blocked by the Windows firewall.
- BFortiGate and the collector agent are using different TCP ports.
- CTCP port 445 is blocked between FortiGate and the collector agent.
- DThe collector agent preshared password is mismatched.
2Refer to the exhibits.
FGT-1 is an area border router (ABR) that has interfaces in OSPF areas 0.0.0.0 and 0.0.0.5.
FGT-3 acts as an autonomous system border router (ASBR), importing static routes into OSPF.
FGT-2 is an internal router with all its interfaces belonging to area 0.0.0.5.
FGT-1 is receiving all advertised routes from FGT-2; however, FGT-3 is not receiving any of the advertised routes from FGT-1.
What is the most likely reason for this?
- AIP protocol 89 is blocked between FGT-1 and FGT-3.
- BArea 0.0.0.5 is configured not to propagate type 5 LSAs.
- CFGT-3 and FGT-2 have not formed an OSPF adjacency yet.
- DFGT-2 is configured with a distribution list to block all advertised routes from FGT-3.
3Refer to the exhibit.
If the default settings are in place, what can you conclude about the conserve mode shown in the exhibit?
- AFortiGate is currently allowing new sessions and will continue to allow sessions if memory increases another 6%.
- BFortiGate is currently allowing new sessions that require flow-based or proxy-based content inspection, but is not performing inspection on those sessions.
- CFortiGate is currently allowing new sessions that require flow-based content inspection and blocking sessions that require proxy-based content inspection.
- DFortiGate is currently blocking all new sessions regardless of the content inspection requirements or configuration settings because of high memory use.
4What are two reasons you might see iprope_in_check() check failed, drop when using the debug flow? (Choose two.)
- AThe packet was dropped because the requested service is not enabled on FortiGate.
- BThe packet was dropped because there is no route to the source.
- CThe packet was dropped because the trusted host list is misconfigured.
- DThe packet was dropped because it is not allowed by any firewall policy.
5A VPN tunnel is up. To monitor traffic flow, the administrator enters the following CLI commands on an SSH session on FortiGate:
# diagnose debug enable
# diagnose sniffer packet any 'udp and port 500' 4
However, the sniffer does not show any output.
Assuming default configuration values, what are two possible reasons there is no output? (Choose two.)- AThe filter should be modified to also capture packets for TCP port 443 or TCP port 4500.
- BNAT Traversal is enabled.
- CThe sniffer must be restricted to the remote peer IP address.
- DThe sniffer output will be ignored because running diagnose debug enable shows only application real-time debugs.
6Refer to the exhibit.
The port1 interface configuration on FortiGate and partial session information for ICMP traffic are shown.
Which two things happen to the session information if a routing change occurs that affects this session? (Choose two.)
- AThis session will be unaffected by routing changes. The routing changes will apply only to new sessions.
- BThe session information will not change even when the active route has been removed from the routing table.
- CThe session will be flagged as dirty but no route lookups will be performed.
- DThe session information will not change unless the current route has been removed from the routing table.
7Refer to the exhibit.
The output from using the command diagnose debug application samld -1 to diagnose a SAML connection is shown.
Based on this output, which two conclusions can you draw? (Choose two.)
- AThe SP IP address is 10.1.10.254
- BThe IdP IP address is 10.1.10.2
- CThe IdP IP address is 10.1.10.254
- DThe SP IP address is 10.1.10.2
8Which two actions does FortiGate take after an administrator enables the auxiliary session setting? (Choose two.)
- AFortiGate creates two sessions in case of a routing change.
- BFortiGate accelerates all ECMP traffic to the NP6 processor.
- CFortiGate only offloads auxiliary sessions.
- DFortiGate creates a new auxiliary session for each packet it receives.
9Which two statements about Security Fabric communications are true? (Choose two.)
- AFortiTelemetry must be manually enabled on the FortiGate interface.
- BSecurity Fabric communication is enabled by default among all Fortinet devices.
- CThe default ports for FortiTelemetry and Neighbor Discovery can be modified.
- DBy default, the downstream FortiGate establishes a connection with the upstream FortiGate using TCP port 8013.
10Which two troubleshooting steps should you perform if you encounter issues with intermittent web filter behavior? (Choose two.)
- ACheck that FortiGate is not entering conserve mode.
- BCheck that the correct port is mapped to HTTP in the Protocol Options.
- CCheck that the inspection mode configured for the web filter profile matches that of the firewall policy where it is applied.
- DCheck that the communication between FortiGate and FortiGuard is stable.
11Refer to the exhibit.
The sniffer log on two FortiGate devices are shown.
Based on the information in the log, which two factors explain the output on FortiGate FGT-02? (Choose two.)
- AThe administrator has not yet configured the VPN tunnel on FGT-02.
- BThe administrator set the wrong sniffer filter on FGT-02.
- CThe administrator configured the wrong remote peer IP address on FGT-01.
- DA third-party device is blocking protocol 50.
12Refer to the exhibit.
The output of a policy route table entry is shown.
Which type of policy route does the output show?
- AAn SD-WAN rule
- BA regular policy route, which is associated with an active static route in the FIB
- CAn ISDB route
- DA regular policy route, which is not associated with an active static route in the FIB
13Refer to the exhibit.
The partial output of diagnose hardware sysinfo memory command is shown:
Which two memory allocations could help you troubleshoot a potential resource issue? (Choose two.)
- AThe user space, which has 708880 kB of physical memory that is not used by the system.
- BThe unused cache page, which is represented by the value indicated next to the Inactive heading.
- CThe I/O cache, which has 641364 kB of memory allocated to it.
- DThe 98908 kB of memory that will never be used.
14Refer to the exhibit.
An administrator has configured a firewall policy to use proxy-based inspection mode.
What could explain the messages observed in the debug flow output?
- ASSL deep inspection is not configured.
- BThe FTP protocol has not yet been mapped to port 211 under Protocol Options.
- CFortiGate does not have enough free memory to perform proxy-based inspections.
- DAt least one protocol port under Protocol Options has been mapped to Any.
15What is the correct order of the IKEv2 request-and-response protocol?
- ACreate_Child_SA, IKE_SA_INIT, IKE_AUTH
- BIKE_SA_INIT, IKE_AUTH, Create_Child_SA
- CIKE_AUTH, IKE_SA_INIT, Create_Child_SA
- DCreate_Child_SA, IKE_AUTH, IKE_SA_INIT
16Refer to the exhibit.
The partial output of a session table entry is shown.
Which two statements about the output shown in the exhibit are correct? (Choose two.)
- ANP7 is handling offloading of this session.
- BThe session has been offloaded.
- CThe traffic matches Policy ID 1.
- DThe traffic is tagged for a VLAN interface.
17Refer to the exhibit.
The output of the get router info bgp summary command is shown.
Which statement regarding adjacencies between the local router and its neighbors is correct?
- AThe local router and neighbor 100.64.2.254 are unable to establish adjacency until the adjacency with neighbor 100.64.1.254 ceases.
- BThe local router and neighbor 100.64.2.254 are unable to establish adjacency because AS 100 is already used by neighbor 100.64.1.254.
- CThe local router and neighbor 100.64.1.254 established adjacency because the priority of 100.64.1.254 is higher than that of 100.64.2.254.
- DThe local router and neighbor 100.64.2.254 are unable to establish adjacency because the TCP session could not be established.
18What are two reasons that an OSPF router does not have any type 5 link-state advertisements (LSAs) in its link-state database (LSDB)? (Choose two.)
- AThe peer of the local router is using a prefix-list-out configuration to prevent all type 5 LSAs to be advertised.
- BThere is no autonomous system border router (ASBR) in the network.
- CThe local router is located in a stub area.
- DIP protocol 89 is blocked between the local router and its peer.
19Refer to the exhibit.
Partial output of the fssod daemon real-time debug command is shown.
Which two conclusions can you draw from the output? (Choose two.)
- AFortiGate is frequently polling the workstation in case the user has logged out.
- BFSSO cannot verify if the user is still logged in.
- CFortiGate polled this event through TCP port 8000.
- DFSSO is using agentless polling mode to detect logon events.
- EFortinet Single Sign-On (FSSO) is using DC Agent mode to detect logon events.
20Refer to the exhibit.
A partial output of diagnose npu np6 port-list on FortiGate 2000E is shown.
An administrator is unable to analyze traffic flowing between port1 and port17 using the diagnose sniffer command.
Which two commands allow the administrator to view the traffic? (Choose two.)
- Aconfig firewall policy
edit 5
set auto-asic-offload disable
end
next
edit 17
set auto-asic-offload disable
end - Bdiagnose npu np6 fastpath disable 1
- Cconfig system npu
set fastpath disable
end - Ddiagnose npu np6 port-list disable 5 17
- Aconfig firewall policy
21Refer to the exhibit.
The output of the command diagnose vpn tunnel list name VPN is shown.
Which two statements accurately describe the status of the tunnel? (Choose two.)
- APhase 2 is down.
- BPhase 1 is down.
- CBoth Phase 1 and Phase 2 were negotiated successfully
- DThere is currently no traffic traversing the tunnel.
22Refer to the exhibit.
A partial output from an IKE real-time debug is shown.
The administrator does not have access to the remote gateway.
Based on the debug output, which two conclusions can you draw? (Choose two.)
- AThe remote peer is the initiating peer.
- BThis is a phase2 negotiation.
- CThere is a Diffie-Hellman group mismatch.
- DThis is a phase1 negotiation.
23In a Security Fabric environment, which three actions must you take to ensure successful communication among the nodes? (Choose three.)
- AYou must enable FortiTelemetry on the receiving interface of the upstream FortiGate.
- BYou must configure FortiGate in transparent mode.
- CYou must ensure that the port for Neighbor Discovery has been changed.
- DYou must authorize the downstream FortiGate on the root FortiGate.
- EYou must ensure that TCP port 8013 is not blocked along the way.
24Refer to the exhibit.
Which two statements about the output are true considering NGFW-1 and NGFW-2 have been up for a week? (Choose two.)
- AIf a configuration change is made to the secondary FortiGate, the Configuration Status will not change.
- BIf a configuration change is made to the primary FortiGate at this time, the secondary will initiate a synchronization reset.
- CIf FGVM…649 is rebooted, FGVM…650 will become the primary FortiGate and retain that role, even after FGVM…649 rejoins the cluster.
- DIf port7 becomes disconnected on the secondary FortiGate, both FortiGate devices will elect themselves as primary.
25Refer to the exhibit.
The output of diagnose automation test command is shown.
Which two observations can you make from the output? (Choose two.)
- AThe test was unsuccessful.
- BThe automation stitch test is not being logged.
- CA high availability (HA) failover occurred.
- DThe configuration was backed up.
26Refer to the exhibit.
Which two statements about FortiGate behavior relating to this session are correct? (Choose two.)
- AFortiGate forwarded this session without any inspection.
- BFortiGate redirected the client to the captive portal to authenticate so that a correct policy match could be made.
- CFortiGate is performing a security profile inspection using the CPU.
- DFortiGate either initiated the session or the session terminates at FortiGate.
27Refer to the exhibit.
The administrator did not override the FortiGuard FQDN or IP address in the FortiGate configuration.
Which IP address did FortiGate get when resolving the service fortiguard.net name?
- A209.22.147.36
- B208.91.112.194
- C96.45.33.65
- D64.26.151.37
28Refer to the exhibits.
An OSPF peer is advertising route 172.16.52.0/24. The local FortiGate is configured with an inbound distribution list that allows the 172.16.0.0/16 network to be injected into its routing table. However, the 172.16.52.0/24 subnet cannot be seen in the FIB.
Which two steps can the administrator of the local FortiGate take to ensure that the advertised 172.16.52.0/24 subnet will be injected into the routing table? (Choose two.)
- AChange the ge value to 17.
- BChange the le value to 16.
- CAdd another entry to the prefix list to specifically allow the 172.16.52.0/24 network.
- DModify the default prefix-list behavior from implicit deny to implicit allow.
29Refer to the exhibit.
The exhibit shows the output of a session.
Which two statements are correct? (Choose two.)
- AThe TCP session has been successfully establishe
- BThe gateway to the destination is 10.1.10.1.
- CThe session did not match a firewall policy.
- DThe session was initiated from an authenticated user.
30Refer to the exhibit.
The routing table information is shown.
Assuming a default configuration, which three statements about the RPF check on FortiGate are correct? (Choose three.)
- AUser B: Pass. FortiGate will use asymmetric routing using wan1 to reply to traffic from 95.56.234.24.
- BUser C: Pass. FortiGate will forward all incoming packets from User C using the default static route.
- CUser A: Pass. The default static route through wan1 passes the RPF check regardless of the source IP address.
- DUser B: Fail. There is no route to 95.56.234.24 using wan2 in the routing table.
- EUser C: Fail. There is no route to 10.0.4.63 using port1 in the routing table.
31Which three common FortiGate-to-collector-agent connectivity issues can you identify using the FSSO real-time debug? (Choose three.)
- AThe pre-shared key does not match.
- BThe group filters do not match.
- CThe SSL certificate used for FSSO over SSL has expired.
- DFortiGate cannot reach the IP address of the collector agent
- EThe connection was refused. There may be a mismatch of the TCP port.
32Refer to the exhibit.
Partial output of a real-time LDAP debug is shown.
Which two conclusions can you draw from the output? (Choose two.)
- AThe user was found in the LDAP tree whose root is TAC.ottawa.fortinet.com.
- BFortiOS collects the user group information.
- CFortiOS performs a bind to the LDAP server using the user's credentials.
- DFortiOS is performing the second step (Search Request) in the LDAP authentication process.
33Diagnose output
Refer to the exhibit.
An IPsec VPN tunnel using IKEv2 was brought up successfully, but when the tunnel rekeys, the tunnel goes down.
The debug command for IKE was enabled, and in the debug, you can review the partial output of the debug IKE while attempting to bring the tunnel up.
What is causing the tunnel to be down?
- ABlocked traffic on UDP port 500
- BA mismatch in the Phase 1 negotiations
- CA Diffie-Hellman mismatch
- DA mismatch in the Phase 2 negotiations
34Refer to the exhibits.
Partial configurations of two VPNs on FortiGate are shown.
An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovers that FortiGate is not matching the user-2 VPN for members of the Users-2 group.
Which two changes must the administrator make to fix the issue? (Choose two.)
- ASet up specific peer IDs on both VPNs.
- BEnable XAuth on both VPNs.
- CChange to aggressive mode on both VPNs.
- DUse different pre-shared keys on both VPNs.
35What is an accurate description of LDAP authentication using the regular bind type?
- AThe regular bind type requires a FortiGate super_admin account to access the LDAP server.
- BThe regular bind type is the easiest bind type to configure on FortiOS.
- CIt is not often used as a bind type.
- DThe regular bind requires the client to send the full distinguished name (DN).
36When FortiGate enters conserve mode because of memory pressure, which action can FortiGate perform to preserve memory?
- AFortiGate automatically reboots to clear memory and restore full operation.
- BFortiGate switches to a less memory-intensive inspection mode, such as flow-based inspection.
- CFortiGate begins dropping all new sessions to protect system resources.
- DFortiGate reduces or stops non-essential processes like logging and antivirus scanning.
37Refer to the exhibit.
Which two observations can you make about the web filter traffic captured using the flow tool? (Choose two.)
- AThe web filter profile is configured with proxy-based inspection mode
- BThe firewall policy is configured with proxy-based inspection mode.
- CThe session is offloaded to the NPU.
- DThe HTTPS port is mapped to 443 in the SSL/SSH Inspection Profile.
38Refer to the exhibits.
An administrator is attempting to advertise the network configured on port3. However, FGT-A is not receiving the prefix.
Which two actions can the administrator take to fix this problem? (Choose two.)
- ARestart BGP using a soft reset to force both peers to exchange more complete BGP routing tables.
- BModify the prefix using the network command and specify le 16 to include the 172.16.54.0/24 subnet.
- CUse the set network-import-check disable command.
- DModify the prefix using the network command from 172.16.0.0/16 to 172.16.54.0/24.
39Refer to the exhibit.
The output of the command
get router info bgp neighbors 100.64.2.254 advertised-routes is shown.
What can you conclude from the output?
- AThe router ID of the neighbor is 100.64.2.254.
- BThe BGP neighbor is advertising the 10.20.30.0/24 network to the local router.
- CThe local router is advertising the 10.20.30.0/24 network to its BGP neighbor.
- DThe BGP state of the two BGP participants is OpenConfirm.
40Refer to the exhibit, which shows the port1 interface configuration on FortiGate and partial session information for ICMP traffic.
Question:
What happens to the session information if a routing change occurs that affects this session?
- AOnly the interface and gateway information for dev=7 will be removed.
- BThe session information will not change unless the current route has been removed from the routing table.
- CThe session will be flagged as dirty but no route lookups will be performed.
- DSessions involving port7 or port19 will not have their routing information flushed.
41Refert to exhibit.
Question:
Which statement is true?
- AThe egress interface associated with static route 8.8.8.8/32 is administratively up.
- BThe default static route through 10.200.1.254 is not in the forwarding information base.
- CThe default static route through port2 is in the forwarding information base.
- DThe BGP route to 10.0.4.0/24 is not in the forwarding information base.
42Refert to exhibit.
Based on this output, what can you conclude?
- AActive Directory is used for authentication.
- BThe authentication request is for an SSL VPN connection.
- CThe IdP IP address is 10.1.10.254.
- DThe IdP IP address is 10.1.10.2.
43Refer to the exhibit, which shows the output of the command:
What can you conclude from the output?
- AThe BGP state of the two BGP participants is OpenConfirm.
- BThe router ID of the neighbor is 100.64.2.254.
- CThe BGP neighbor is advertising the 10.20.30.40/24 network to the local router.
- DThe local router is advertising the 10.20.30.40/24 network to its BGP neighbor.
44Why are the two FortiGate devices unable to form an adjacency?
- AThe Hello packet is being sent from an OSPF router with ID 0.0.0.112.
- BThe two FortiGate devices attempting adjacency are in area 0.0.0.0.
- COne FortiGate device is configured to require authentication, while the other is not. (correcto)
- DThe passwords on the FortiGate devices do not match. (correcto)
45Refer to the exhibit, which shows the partial output of FortiOS kernel slabs.
Which statement is true?
- AThe total slab size of the sctp_session slab is 0 kB and is associated with the user space.
- BThe total slab size of the ip_session slab is 3600 kB and is associated with the user space.
- CThe total slab size of the ip6_session slab is 1300 kB and is associated with the kernel.
- DThe total slab size of the tcp_session slab is 7500 kB and is associated with the kernel.
46Refer to the exhibit, which shows one way communication of the downstream FortiGate with the upstream FortiGate within a Security Fabric.
What three actions must you take to ensure successful communication? (Choose three.)
- AYou must authorize the downstream FortiGate on the root FortiGate.
- BFortiGate must not be in NAT mode.
- CEnsure TCP port 8013 is not blocked along the way.
- DYou must enable Security Fabric/FortiTelemetry on the receiving interface of the upstream FortiGate.
- EEnsure the port for Neighbor Discovery has been changed.
47Refer to the exhibit, which shows a network topology and a partial routing table
Which changes must the administrator perform to ensure the server at 10.4.0.1/24 receives the echo reply from the laptop at 10.1.0.1/24?
- AEnable asymmetric routing under config system settings.
- BChange the configuration from strict RPF check mode to feasible RPF check mode.
- CA firewall policy that allows all ICMP traffic from port3 to port1. (correcto)
- DModify the default gateway on the laptop from 10.1.0.2 to 10.2.0.2.
48What are two functions of automation stitches? (Choose two.)
- AYou can configure automation stitches on any FortiGate device in a Security Fabric environment.
- BYou can configure automation stitches to execute actions sequentially by taking parameters from previous actions as input for the current action.
- CYou can set an automation stitch configured to execute actions in parallel to insert a specific delay between actions.
- DYou can create automation stitches to run diagnostic commands and attach the results to an email message when CPU or memory usage exceeds specified thresholds.
49After reviewing the configuration, what can you conclude about the IPsec VPN Phase 1 setup?
- AThe VPN is configured using IKEv2.
- BDead Peer Detection is disabled.
- CThe VPN is configured with DHCP over IPsec
- DThe tunnel is configured as a route-based VPN.
50Refer to the exhibit, which shows the output of diagnose sys session list.
If the HA ID for the primary device is 0, what happens if the primary fails and the secondary becomes the primary?
- AThe secondary device has this session synchronized; however, because application control is applied, the session is marked dirty and has to be re-evaluated after failover. (correcta)
- BTraffic for this session continues to be permitted on the new primary device after failover, without requiring the client to restart the session with the server.
- CThe session will be removed from the session table of the secondary device because of the presence of allowed error packets, which will force the client to restart the session with the server.
- DThe session state is preserved but the kernel will need to re-evaluate the session because NAT was applied.
51Refert to exhibit.
Which two conclusions can you draw from the output shown in the exhibit? (Choose two.)
- AFortiGate will drop the expected traffic if it does not arrive within 23 seconds.
- BClearing the master session has no impact on the expectation session.
- CThis is a pinhole session to allow traffic for a TCP protocol that dynamically assigns TCP ports
- DThe session is checked against firewall policy ID 25.
52Consider the scenario where the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate.
Which action will FortiGate take when using the default settings for SSL certificate inspection?- AFortiGate uses the CN information from the Subject field in the server certificate.
- BFortiGate uses the SNI from the user's web browser. (correcta)
- CFortiGate will establish a connection without SSL/TLS inspection.
- DThe web filter will automatically bypass SSL inspection for this connection.
53An administrator is attempting to advertise the network configured on port3. However, FGT-A is not receiving the prefix.
Which two actions can the administrator take to fix this problem? (Choose two.)
- AModify the prefix using the network command from 172.16.0.0/16 to 172.16.54.0/24.
- BManually add the BGP route on FGT-A.
- CRestart BGP using a soft reset to force both peers to exchange their complete BGP routing tables.
- DUse the set network-import-check disable command.
54Refert to exhibit.
hat two conclusions can you draw from the output? (Choose two.)
- AThe user was found in the LDAP tree, whose root is TAC.ottawa.fortinet.com.
- BFortiOS performs a bind to the LDAP server using the user’s credentials.
- CFortiOS collects the user group information.
- DFortiOS is performing the second step (Search Request) in the LDAP authentication process.
55During which phase of IKEv2 does the Diffie-Hellman key exchange take place?
- AIKE_Req_INIT
- BCreate_CHILD_SA
- CIKE_Auth
- DIKE_SA_INIT
56In the SAML negotiation process, which section does the Identity Provider (IdP) provide the SAML attributes utilized in the authentication process to the Service Provider (SP)?
- ASP Login dump
- BAuthentication Response
- CAuthentication Request
- DAssertion dump
57Refer to the exhibit, which shows the partial output of diagnose sys session stat.
Which statement about the output shown in the exhibit is correct?
- A27 sessions have expired but are still in the session table in case any out-of-order packets arrive.
- B15 sessions have been categorized as ephemeral.
- C113 sessions have been dropped because of memory page exhaustion
- D562 TCP sessions have their proto_state set to 01 if there is no inspection.
58Refer to the exhibit, which shows the output of the command get router info ospf neighbor.
To what extent does FortiGate operate when looking at its OSPF neighbors? (Choose two.)
- AThe local FortiGate has at least one interface that participates in a broadcast network.
- BThe local FortiGate has at least one interface that participates in a point-to-point network.
- CThe local FortiGate is the DR.
- DNeighbor 0.0.0.18 is the designated router (DR).
59FortiGate performs different actions in conserve mode depending on the configured memory thresholds.
Which actions correlates to which thresholds? (Choose two.)- AFortiGate exits conserve mode when the system memory goes below the configured green threshold.
- BFortiGate starts dropping all new sessions when the system memory reaches the configured red threshold.
- CFortiGate enters conserve mode when the system memory reaches the configured extreme threshold.
- DFortiGate starts taking the configured action for new sessions requiring content inspection when the system memory reaches the configured red threshold.
60An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovers that FortiGate is not matching the user-2 VPN for members of the Users-2 group.
Which two changes must the administrator make to fix the issue? (Choose two.)
- AChange to aggressive mode on both VPNs.
- BEnable XAuth on both VPNs.
- CUse different pre-shared keys on both VPNs.
- DSet up specific peer IDs on both VPNs.
61Refer to exhibit.
An IPsec VPN tunnel is dropping, as shown by the debug output.
Analyzing the debug output, what could be causing the tunnel to go down?
- APhase 2 drops but Phase 1 is up.
- BDead Peer Detection is not receiving its acknowledge packet.
- CThe tunnel drops during rekey negotiation.
- DThe tunnel drops after the timer expires.
62Refer to the exhibit, which shows two entries that were generated in the FSSO collector agent logs.
What three conclusions can you draw from these log entries? (Choose three.)
- AThe user’s status shows as "not verified" in the collector agent.
- BThe FortiGate firmware version is not compatible with that of the collector agent.
- CRemote registry is not running on the workstation.
- DDNS resolution is unable to resolve the workstation name.
- EA firewall is blocking traffic to port 139 and 445.
63REfer to exhibit.
The URL www.dropbox.com is categorized as File Sharing and Storage.
Which action does FortiGate take if a user attempts to access www.dropbox.com?
- AFortiGate blocks the connection as an invalid URL.
- BBased on the URL Filter configuration, FortiGate allows the connection.
- CFortiGate blocks the connection, based on the FortiGuard category-based filter configuration.
- DBased on the Web Content filter configuration, access to www.dropbox.com would be exempted.
64The local OSPF router is unable to establish adjacency with a peer.
Which two things should the administrator do to troubleshoot the issue? (Choose two.)- ACheck whether TCP port 179 is blocked.
- BCheck if there is an active static route to the peer.
- CCheck whether both peers have an IP address within the same subnet.
- DCheck if IP protocol 89 is blocked.
65Refer to the exhibit.
Which three pieces of information does the diagnose sys top command provide? (Choose three.)
- AThe miglogd daemon is running on CPU core ID 0.
- BThe diagnose sys top command has been running for 18 minutes.
- CThe cmdbsvr process is occupying 2.4% of the total user memory space.
- DThe miglogd daemon would be on top of the list, if the administrator pressed m on the keyboard.
- EIf the newcli daemon continues to be in the R state, it will need to be manually restarted.
66Refer to the exhibit, which shows a partial output from the get router info routing-table database command.
The administrator wants to configure a default static route for port3 and assign a distance of 50 and a priority of 0.
What will happen to the port1 and port2 default static routes after the port3 default static route is created?
- AThe port2 default static route will be injected into the forwarding information base (FIB).
- BThe port1 default static route will be injected into the FIB.
- CNeither of the routes shown in the output will be injected into the FIB.
- DBoth default static routes shown in the output will be injected into the FIB.
67Which three common FortiGate-to-collector-agent connectivity issues can you identify using the FSSO real-time debug? (Choose three.)
- ALog is full on the collector agent.
- BInability to reach IP address of the collector agent.
- CRefused connection. Potential mismatch of TCP port.
- DMismatched pre-shared password.
- EIncompatible collector agent software version.
68Refert to exhibit.
An administrator is troubleshooting a web filter issue on FortiGate.
The administrator has configured a web filter profile and applied it to a policy; however, the web filter is not inspecting any traffic that is passing through the policy.
What must the administrator do to fix the issue?
- ADisable webfilter-force-off at the VDOM level.
- BSet sdns-server-ip to service.fortiguard.net.
- CDisable webfilter-force-off.
- DChange protocol to TCP and port to 53.
69Refert to exhibit.
The administrator does not have access to the remote gateway.
Based on the debug output, which configuration change the administrator make to the local gateway to resolve the phase 1 negotiation error?
- AIn the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.
- BIn the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.
- CIn the phase 1 network configuration, set the IKE version to 2.
- DIn the phase 1 proposal configuration, add AES128-SHA128 to the list of encryption algorithms.
70Refert to exhibit.
Antivirus is unable to detect an infected file downloaded through HTTPS.
Part of the configuration used for antivirus inspection is shown in the exhibit.
Which configuration changes can be performed to inspect HTTPS?
- ASet a different antivirus database.
- BIncrease the maximum number of subdirectories and nested archives.
- CDisable the emulator setting.
- DEnable SSL deep inspection.
71Which of the following regarding protocol states is true?
- Aproto_state=10 indicates an established TCP session.
- Bproto_state=00 indicates that UDP traffic flows in both directions.
- Cproto_state=01 indicates two-way ICMP traffic. (correcta)
- Dproto_state=01 indicates an established TCP session.
72Refer to the exhibit, which shows the output of a BGP debug command.
Why has the local router at 172.16.23.58 been unable to establish adjacency with its only neighbor?
- AThe local router has not received a keepalive message from the neighbor.
- BThere is no active route to the BGP neighbor.
- CThe local router has not received a SYN/ACK packet from the neighbor.
- DThe local router has not received an OPEN message from the neighbor.
73Refer to the exhibit.
FortiGate is in conserve mode as shown in the Event logs.
Based on the information shown in the exhibit, what can you conclude about the FortiGate intrusion prevention system (IPS) configuration?
- AIPS fail open mode is disabled.
- BThe inspected protocol is not supported.
- CThe IPS profile is proxy based.
- DNew packets might pass through without inspection.
74Refer to the exhibit, which shows the sniffer log on two FortiGate devices.
The IPsec tunnel is up on both ends of the tunnel, but traffic is not flowing.
Based on the information in the log, which scenario explains the output on FortiGate FGT-02?
- AThe encryption method is not supported on FGT-02.
- BA third-party device is blocking protocol 50.
- CHardware offload is disabled on FGT-02.
- DThe IKE daemon crashed.
75Which three conditions would prevent a static route from being used by the kernel to route traffic? (Choose three.)
- AThe interface specified in the route configuration is down.
- BThere is another route to the same destination, with a higher distance.
- CThe route has a lower metric than another route to the same destination.
- DThe next-hop IP address is unreachable and health monitor is configured.
- EThere is another route to the same destination, with a lower distance.
76Refer to the exhibit, which shows a partial output of the fssod daemon real-time debug command.
What two conclusions can you draw from the output? (Choose two.)
- AFortinet Single Sign-On (FSSO) is using DC Agent mode to detect logon events.
- BFortiGate is frequently polling the workstation, in case the user has logged off.
- CThe collector agent cannot verify if the user is still logged in.
- DFortiGate polled this event through TCP port 8000.
- EFSSO is using agentless polling mode to detect logon events.
77Refer to the exhibit, which shows the partial output of diagnose sys session stat.
An administrator has noticed unusual behavior from FortiGate. It appears that sessions are randomly removed.
Which two reasons could explain this? (Choose two.)
- AThe FortiGate is dropping all TCP sessions with incomplete three-way handshakes.
- BThe FortiGate is deleting sessions because the kernel cannot allocate more memory pages.
- CThe FortiGate is flushing sessions because of high memory usage.
- DThe FortiGate is not accepting sessions because the device has been down 16 out of 120 seconds.
78Refer to the exhibit, which shows the partial output of:
What is the status of the tunnel?
- ABoth Phase 1 and Phase 2 were negotiated successfully
- BPhase 2 is down.
- CTraffic is passing through the tunnel.
- DPhase 1 is down.
79Refer to the exhibit, which shows a session table entry:
Which statement about FortiGate behavior relating to this session is correct?
- AFortiGate redirected the client to the captive portal to authenticate, so that a correct policy match could be made. (correcto)
- BFortiGate forwarded this session without any inspection.
- CFortiGate is performing a security profile inspection using the CPU.
- DFortiGate applied only IPS inspection to this session.
80Refer to the exhibit showing a debug output.
An administrator deployed FSSO in DC Agent Mode but FSSO is failing on FortiGate. Pinging FortiGate from where the collector agent is deployed is successful.
The administrator then produces the debug output shown in the exhibit.
What could be causing this error message?
- AThe TCP port 445 is blocked between FortiGate and collector agent.
- BThe collector agent preshared password is mismatched. (correcto)
- CThe FortiGate cannot resolve the active directory server name.
- DThe FortiGate and the collector agent are using different TCP ports.
81Refer to the exhibit, which shows a partial output of the real-time LDAP debug.
What two actions can the administrator take to resolve this issue? (Choose two.)
- AEnsure the user logs in using 'John Smith' not 'jsmith'.
- BEnsure the user is providing the correct user credentials.
- CEnsure the user is a member of at least one AD group to ensure step 4 of the LDAP authentication process is successful.
- DEnsure the account is active.
82What are two reasons you might see iprope_in_check() check failed, drop when using the debug flow? (Choose two.)
- APacket was dropped because of policy route misconfiguration.
- BVIP or IP pool misconfiguration.
- CTrusted host list misconfiguration.
- DPacket was dropped because of traffic shaping.
83Refer to the exhibit.
FortiGate is showing continuous high CPU usage. During a maintenance window the CLI command diagnose sys top displays the output shown in the exhibit.
The CLI command diagnose test application ipsmonitor 5 was run but the CPU usage by daemon ipsengine did not drop.
What immediate action can you take to reduce the CPU usage effectively?
- AMonitor if there is a traffic surge.
- BRestart all IPS engines.
- CDisable IPS on internal-to-internal policies.
- DReview the IPS signatures enabled on the active IPS profiles.
84Refer to the exhibit, which displays the output of a real-time debug.
Which statement accurately describes this output?
- AAccess to the requested website was allowed by web filter profile ftgd-allow. (correcto)
- BThe server hostname was extracted either from the common name (CN) in the server certificate or the server name indication (SNI) in the client request.
- CThe URL requested was detected to belong to FortiGuard category ID 255.
- DThe urlfilter debug detected a category mismatch.
85Refer to the exhibit, which shows output from a collector agent log.
The collector agent is showing the status of a workstation as "Not Verified".
What is a common cause for this message?
- AThe workstation has come out of hibernate mode.
- BThe collector agent is crashing.
- CTraffic to port 139 and 445 is blocked.
- DDNS cannot resolve the workstation name. (correcto)
86Refer to the exhibit, which shows the output of a debug command.
What needs to happen for the local router to be elected DR?
- AThe local router will be elected DR only if re-election occurs and its router ID is highest, assuming equal priority.
- BThe local router will be elected DR if the current DR fails because it has a higher router ID than the BDR.
- CThe local router will never be elected DR.
- DBoth the DR and BDR will have to fail before the local router will be elected DR.
87Refer to the exhibit, which shows partial outputs from two routing debug commands.
Which change must an administrator make on FortiGate to route web traffic from internal users to the internet, using ECMP?
- ASet the priority of the static default route using port1 to 10.
- BSet snat-route-change to enable.
- CSet preserve-session-route to enable.
- DSet the priority of the static default route using port2 to 1.
88Refer to the exhibit, which shows the output of a BGP debug command.
What is the reason that the local FortiGate is not receiving any prefixes from its neighbors?
- AThe RIB-OUT configuration for router 10.127.0.75 prevents any route advertisement to the local router.
- BThe router 100.64.3.1 needs to update the local AS number to 65060 to become adjacent with the local router.
- CThe local router is waiting for the keepalive message from the router 10.125.0.60. (correcta)
- DNone of the three neighbors have successfully established the TCP three-way handshake with the local router.
89Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.
Based on the output, which two statements are correct? (Choose two.)
- AThe npu_flag for this tunnel is 02.
- BThe npu_flag for this tunnel is 03.
- CDifferent SPI values are a result of auto-negotiation being disabled for phase 2 selectors.
- DAnti-replay is enabled.
90Refert to exhibit.
An administrator would like to test session failover between the two service provider connections.
Which two changes must the administrator make to force this existing session to immediately start using the other interface? (Choose two.)
- AConfigure set snat-route-change enable.
- BChange the priority of the port1 static route to 11.
- CConfigure unset snat-route-change to return it to the default setting.
- DChange the priority of the port2 static route to 5.
91Refer to the exhibit, which shows the output of the BGP database.
Which two statements are correct? (Choose two.)
- AThe output shows all prefixes advertised by all neighbors as well as the local router.
- BThe advertised prefix of 10.20.30.0/24 was configured using the network command.
- CThe advertised prefix of 10.20.30.0/24 is being advertised through the redistribution of another routing protocol.
- DThe first prefixes are being advertised using a legacy route advertisement.
92Refer to the exhibit, which shows a session entry.
Which statement about this TCP session is true?
- AReturn traffic to the initiator is sent to 10.9.31.117.
- BIt is a TCP session from 10.9.31.11 to 200.8.57.5.
- CIt is a TCP session from 10.9.31.117 to 10.1.0.3.
- DReturn traffic to the initiator is sent to 10.1.0.254.
93Reviewing the debug command, what is the current status of the traffic flowing through the tunnel?
- ATraffic is flowing with an asymmetric selector.
- BThere is an unsupported cipher or HMAC.
- CThe inbound IPsec SA was copied to the NPU.
- DThe outbound IPsec SA was copied to the NPU.
Informações
- Descrição
- Grado Superior Electricidad y Electrónica Quiz sobre NST, criado por Fran zumos em 27-05-2026.
- Autor
- Fran zumos
- Idioma
- Español
- Visualizações
- 0
- Etiquetas
- Avaliação
- Ainda sem avaliações Avalie este quiz