السؤال #1

The exhibit shows FortiGate configuration and the output of the debug command. Based on the diagnostic output, how is the FortiGate handling the traffic for new sessions that require proxy based inspection?

A. It is allowed, but with no inspection

B. It is allowed and inspected, as long as the only inspection required is antivirus

C. It is dropped

D. It is allowed and inspected, as long as the inspection is flow based

عرض الإجابة

اجابة صحيحة: AD

السؤال #2

Refer to the exhibit to view the firewall policy. Which statement is correct if well-known viruses are not being blocked?

A. The firewall policy does not apply deep content inspection

B. The firewall policy must be configured in proxy-based inspection mode

C. The action on the firewall policy must be set to deny

D. Web filter should be enabled on the firewall policy to complement the antivirus profile

عرض الإجابة

اجابة صحيحة: B

السؤال #3

Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

A. There are five devices that are part of the security fabric

B. Device detection is disabled on all FortiGate devices

C. This security fabric topology is a logical topology view

D. There are 19 security recommendations for the security fabric

عرض الإجابة

اجابة صحيحة: D

السؤال #4

In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit. What should the administrator do next to troubleshoot the problem?

A. Run a sniffer on the web server

B. Capture the traffic using an external sniffer connected to port1

C. Execute another sniffer in the FortiGate, this time with the filter “host 10

D. Execute a debug flow

عرض الإجابة

اجابة صحيحة: C

السؤال #5

Refer to the exhibit, which contains a Performance SLA configuration. An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic. Why is FortiGate not generating any traffic for the performance SLA?

A. There may not be a static route to route the performance SLA traffic

B. You need to turn on the Enable probe packets switch

C. The Ping protocol is not supported for the public servers that are configured

D. Participants configured are not SD-WAN members

عرض الإجابة

اجابة صحيحة: AB

السؤال #6

Refer to the exhibits. The exhibits show a network diagram and the explicit web proxy configuration. In the command diagnose sniffer packet, what filter can you use to capture the traffic between the client and the explicit web proxy?

A. ‘host 192

B. ‘host 10

C. ‘host 192

D. ‘host 10

عرض الإجابة

اجابة صحيحة: CD

السؤال #7

An administrator observes that the port1 inteface cannot be configured with an IP address. What are three possible reasons for this? (Choose three.)

A. The operation mode is transparent

B. The interface is a member of a virtual wire pair

C. The interface is a member of a zone

D. The interface has been configured for one-arm sniffer

E. Captive portal is enabled in the interface

عرض الإجابة

اجابة صحيحة: BC

السؤال #8

The exhibit shows the IPS sensor configuration and forward traffic logs. An administrator has configured the WINDOWS_SERVERS IPS sensor in an attempt to determine whether the influx of HTTPS traffic is an attack attempt, or not. After applying the IPS sensor, FortiGate is still not generating any IPS logs for the HTTPS traffic. What is a possible reason for this?

A. The HTTPS signatures have not been added to the sensor

B. The IPS filter is missing the Protocol:HTTPS option

C. The firewall policy is not using a full SSL inspection profile

D. A DoS policy should be used, instead of an IPS sensor

عرض الإجابة

اجابة صحيحة: A

السؤال #9

What inspection mode does FortiGate use if it is configured as a policy-based next-generation firewall (NGFW)?

A. Full Content inspection

B. Proxy-based inspection

C. Certificate inspection

D. Flow-based inspection

عرض الإجابة

اجابة صحيحة: AD

السؤال #10

The exhibit shows two static routes. Which option accurately describes how FortiGate will handle these two routes to the same destination?

A. FortiGate will only activate the port1 route in the routing table

B. FortiGate will use the port1 route as the primary candidate

C. FortiGate will load balance all traffic across both routes

D. FortiGate will route twice as much traffic to the port2 route

عرض الإجابة

اجابة صحيحة: B

السؤال #11

Given the partial output of an IKE real-time debug shown in the exhibit, which statement about the output is true?

A. The VPN is configured to use pre-shared key authentication

B. Extended authentication (XAuth) was successful

C. Remote is the host name of the remote IPsec peer

D. Phase 1 went down

عرض الإجابة

اجابة صحيحة: B

السؤال #12

The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme, users, and firewall address. An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies. The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a form-based authentication scheme for the FortiGate local user database. Users will be prompted for authentication. How will FortiGate process the traffic when the HTTP r

A. If a Mozilla Firefox browser is used with User-B credentials, the HTTP request will be allowed

B. If a Google Chrome browser is used with User-B credentials, the HTTP request will be allowed

C. If a Mozilla Firefox browser is used with User-A credentials, the HTTP request will be allowed

D. If a Microsoft Internet Explorer browser is used with User-B credentials, the HTTP request will be allowed

عرض الإجابة

اجابة صحيحة: BC

السؤال #13

An administrator has configured the following settings: What are the two results of this configuration? (Choose two.)

A. Device detection on all interfaces is enforced for 30 minutes

B. Denied users are blocked for 30 minutes

C. A session for denied traffic is created

D. The number of logs generated by denied traffic is reduced

عرض الإجابة

اجابة صحيحة: BD

السؤال #14

Given the FortiGate interfaces shown in the exhibit, which two statements about the FortiGate interfaces configuration in the exhibit are true? (Choose two.)

A. Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default

B. Broadcast traffic received on port1-VLAN10 will not be forwarded to port2-VLAN10

C. port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs

D. port1-VLAN1 is the native VLAN for the port1 physical interface

عرض الإجابة

اجابة صحيحة: D

السؤال #15

What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

A. It limits the scope of application control to scan traffic based on the browser-based technology category only

B. It limits the scope of application control to scan application traffic based on application category only

D. It limits the scope of application control to scan application traffic on DNS protocol only

عرض الإجابة

اجابة صحيحة: A

السؤال #16

The exhibits show the firewall policies and the objects used in the firewall policies. The administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit. Based on the input criteria, which of the following will be highlighted?

A. The policy with ID 1

B. The policy with ID 5

C. The policies with ID 2 and 3

D. The policy with ID 4

عرض الإجابة

اجابة صحيحة: C

السؤال #17

The exhibit shows a FortiGate configuration. How does FortiGate handle web proxy traffic coming from the IP address 10.2.1.200, that requires authorization?

A. It always authorizes the traffic without requiring authentication

B. It drops the traffic

C. It authenticates the traffic using the authentication scheme SCHEME2

D. It authenticates the traffic using the authentication scheme SCHEME1

عرض الإجابة

اجابة صحيحة: BC

السؤال #18

Examine this PAC file configuration. Which of the following statements are true? (Choose two.)

A. Browsers can be configured to retrieve this PAC file from FortiGate

B. Any web request sent to the 172

C. All requests not sent to fortinet

D. Any web request sent to fortinet

عرض الإجابة

اجابة صحيحة: D

السؤال #19

You are configuring the root FortiGate to implement the Security Fabric. You are configuring port10 to communicate with a downstream FortiGate. The exhibit shows the default Edit Interface. When configuring the root FortiGate to communicate with a downstream FortiGate, which two settings must you configure? (Choose two.)

A. Enable Device Detection

B. Administrative Access: FortiTelemetry

C. IP/Network Mask

D. Role: Security Fabric

عرض الإجابة

اجابة صحيحة: CD

السؤال #20

The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile. What order must FortiGate use when the web filter profile has features enabled, such as safe search?

A. DNS-based web filter and proxy-based web filter

B. Static URL filter, FortiGuard category filter, and advanced filters

C. Static domain filter, SSL inspection filter, and external connectors filters

D. FortiGuard category filter and rating filter

عرض الإجابة

اجابة صحيحة: A

السؤال #21

Refer to the exhibit to view the application control profile. Users who use Apple FaceTime video conferences are unable to set up meetings. In this scenario, which statement is true?

A. Apple FaceTime belongs to the custom monitored filter

B. The category of Apple FaceTime is being monitored

C. Apple FaceTime belongs to the custom blocked filter

D. The category of Apple FaceTime is being blocked

عرض الإجابة

اجابة صحيحة: D

السؤال #22

The exhibit shows a web filtering log. Which statement about the log message is true?

A. The web site miniclip

B. The usage quota for the IP address 10

C. The action for the category Games is set to block

D. The name of the applied web filter profile is default

عرض الإجابة

اجابة صحيحة: A

السؤال #23

Refer to the exhibits. Given the antivirus profile and file transfer output shown in the exhibits, why is FortiGate not blocking the eicar.com file over FTP download?

A. Because the proxy options profile needs to scan FTP traffic on a non-standard port

B. Because the FortiSandbox signature database is required to successfully scan FTP traffic

C. Because deep-inspection must be enabled for FortiGate to fully scan FTP traffic

D. Because FortiGate needs to be operating in flow-based inspection mode in order to scan FTP traffic

عرض الإجابة

اجابة صحيحة: D

السؤال #24

The exhibit shows network configurations. VDOM1 is operating in transparent mode. VDOM2 is operating in NAT mode. There is an inter-VDOM link between both VDOMs. A client workstation with the IP address 10.0.1.10/24 is connected to port2. A web server with the IP address 10.200.1.2/24 is connected to port1. Which two options must be included in the FortiGate configuration to route and allow connections from the client workstation to the web server? (Choose two.)

A. A static or dynamic route in VDOM2 with the subnet 10

B. A static or dynamic route in VDOM1 with the subnet 10

C. One firewall policy in VDOM1 with port2 as the source interface and InterVDOM0 as the destination interface

عرض الإجابة

اجابة صحيحة: AB

السؤال #25

An administrator is configuring an IPsec VPN between site A and site

B. The Remote Gateway setting in both sites has been configured as Static IP Address

A. 192

B. 192

C. 192

D. 192

عرض الإجابة

اجابة صحيحة: A

السؤال #26

A firewall administrator must configure equal cost multipath (ECMP) routing on FGT1 to ensure both port1 and port3 links are used, at the same time, for all traffic destined for 172.20.2.0/24. Given the network diagram shown in the exhibit, which two static routes will satisfy this requirement on FGT1? (Choose two.)

A. 172

B. 172

C. 172

D. 172

عرض الإجابة

اجابة صحيحة: ADE

السؤال #27

Examine the output from a debug flow: Why did the FortiGate drop the packet?

A. The next-hop IP address is unreachable

B. It failed the RPF check

C. It matched an explicitly configured firewall policy with the action DENY

D. It matched the default implicit firewall policy

عرض الإجابة

اجابة صحيحة: A

السؤال #28

Given the network diagram shown in the exhibit, which route is the best candidate route for FGT1 to route traffic from the workstation to the webserver?

A. 172

B. 172

C. 10

D. 0

عرض الإجابة

اجابة صحيحة: BC

السؤال #29

According to the certificate values shown in the exhibit, which type of entity was the certificate issued to?

A. A user

B. A root CA

C. A bridge CA

D. A subordinate

عرض الإجابة

اجابة صحيحة: B

السؤال #30

Why does FortiGate keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

A. To generate logs

B. To remove the NAT operation

C. To finish any inspection operations

D. To allow for out-of-order packets that could arrive after the FIN/ACK packets

عرض الإجابة

اجابة صحيحة: A

السؤال #31

Refer to the exhibits. The exhibits show the IPS sensor and DoS policy configuration. When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?

A. ip_src_session

B. IMAP

C. Location: server Protocol:SMTP

D. SMTP

عرض الإجابة

اجابة صحيحة: CD

السؤال #32

Which two actions are valid for a FortiGuard category-based filter, in a web filter profile, for a firewall policy in proxy-based inspection mode? (Choose two.)

A. Learn

B. Exempt

C. Allow

D. Warning

عرض الإجابة

اجابة صحيحة: CD

السؤال #33

Given to the static routes shown in the exhibit, which statements are correct? (Choose two.)

A. This is a redundant IPsec setup

B. This setup requires at least two firewall policies with the action set to IPsec

C. Dead peer detection must be disabled to support this type of IPsec setup

D. The TunnelB route is the primary route for reaching the remote site

عرض الإجابة

اجابة صحيحة: CD

لا تريد أن تفوت شيئا؟

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع!
احصل الان

عرض الإجابات بعد التقديم

لا تريد أن تفوت شيئا؟

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع! احصل الان

عرض الإجابات بعد التقديم

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع!
احصل الان