Question 1Skipped

Which two statements are true about collector agent advanced mode? (Choose two.)

A. Security profiles can be applied only to user groups, nor individual users.

Correct selection

B. FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.

Correct selection

C. Advanced mode supports nested or inherited groups.

D. Advanced mode uses Windows convention-NetBios: Domain\Username.

Overall explanation

Correct answer: BC

In FortiGate's FSSO (Fortinet Single Sign-On) feature, the collector agent operates in either standard
mode or advanced mode. Here's an explanation of the statements:

B. FortiGate can be configured as an LDAP client, and group filters can be configured on FortiGate:

 In advanced mode, FortiGate can act as an LDAP client, allowing it to directly query Active
Directory for user and group information. Group filters can be configured on FortiGate to
selectively include or exclude specific groups in the FSSO process. This provides more flexibility
and control over which groups are considered for FSSO integration.

C. Advanced mode supports nested or inherited groups:

 In advanced mode, FortiGate can recognize and utilize nested group structures in Active
Directory. Nested groups refer to groups that contain other groups as members. With advanced
mode, FortiGate can accurately reflect the group memberships and apply policies accordingly.

These features enhance the capabilities of FSSO in advanced mode, making it suitable for environments
with complex group structures and the need for more granular control over user and group policies.

- In advanced mode, you can configure FortiGate as an LDAP client and configure the group filters on
FortiGate.

- Also, advanced mode supports nested or inherited groups.

D. Incorrect, Netbios is Standard mode.

A. Incorrect, in Advanced mode, FortiGate can apply security profiles to individual users, user groups,
and OUs.
Question 2Skipped

Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question
below.
When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?

A. [Link]

Correct answer

B. [Link]

C. ip_src_session

D. Location: server Protocol: SMTP

Overall explanation

Correct answer: B. [Link]

Anomalies can be zero-day or denial of service attack

Are Detected by behaivoral analysis:

Rate Based IPS Signatures.

DoS Policies.

Protocol Constraint Inspections.

DoS policy disabled in this scenario.

Question 3Skipped

Which statements are true regarding firewall policy NAT using the outgoing interface IP address with
fixed port disabled? (Choose two.)

Correct selection

A. This is known as many-to-one NAT.

Correct selection

B. Source IP is translated to the outgoing interface IP.

C. Connections are tracked using source port and source MAC address.

D. Port address translation is not used.

Overall explanation

Correct answer: AB

Because the fixed port is disabled (default). If it is enable, then the answer would be C&D.
Fixed port disable means that source port translation can be used.

A. This is known as many-to-one NAT.

This statement is correct. When the source IP is translated to the outgoing interface IP address, it
typically involves mapping multiple private IP addresses to a single public IP address. This is commonly
referred to as many-to-one NAT.

B. Source IP is translated to the outgoing interface IP.

This statement is also correct. In the context of the provided information, the source IP of outgoing
traffic is translated to the IP address of the outgoing interface.

So, both statements A and B are true regarding firewall policy NAT using the outgoing interface IP
address with fixed port disabled.

Question 4Skipped

Which three security features require the intrusion prevention system (IPS) engine to function?
(Choose three.)

Correct selection

A. Web filter in flow-based inspection

Correct selection

B. Antivirus in flow-based inspection

C. DNS filter

D. Web application firewall

Correct selection

E. Application control

Overall explanation

Correct answer: ABE

A. Web filter in flow-based inspection

B. Antivirus in flow-based inspection

E. Application control

These features do require the Intrusion Prevention System (IPS) engine to function effectively. The IPS
engine plays a crucial role in inspecting traffic for various security threats and ensuring that these
security features can operate efficiently.
It asks what uses the IPS system. And that is:

Application control

Anti-virus (flow-based)

Web filter (flow-based)

Email filter (flow-based)

Question 5Skipped

Which of the following SD-WAN load –balancing method use interface weight value to distribute
traffic? (Choose two.)

A. Source IP

B. Spillover

Correct selection

C. Volume

Correct selection

D. Session

Overall explanation

Correct answer: CD

Session is the name of a mode. Spillover is not the real name for SD-WAN that is in ECMP. Spillover is
called Usage in SD-WAN.

The correct load balancing method that uses interface weight values to distribute traffic is:

C. Volume

D. Session

Both Volume-based and Session-based load balancing methods in SD-WAN can use interface weight
values to distribute traffic proportionally based on the weights assigned to each interface.

The FortiGate uses the weight that you assign to each interface to calculate a percentage of the total
sessions that are allowed to connect through each interface.

The FortiGate uses the volume weight that you assign to each interface to calculate a percentage of the
total bandwidth that’s allowed to go through each interface.

Question 6Skipped

Which two statements correctly describe auto discovery VPN (ADVPN)? (Choose two.)
Correct selection

A. IPSec tunnels are negotiated dynamically between spokes.

B. ADVPN is supported only with IKEv2.

Correct selection

C. It recommends the use of dynamic routing protocols, so that spokes can learn the routes to other
spokes.

D. Every spoke requires a static tunnel to be configured to other spokes, so that phase 1 and phase 2
proposals are defined in advance.

Overall explanation

Correct answer: AC

The correct statements describing auto discovery VPN (ADVPN) are:

A. IPSec tunnels are negotiated dynamically between spokes.

C. It recommends the use of dynamic routing protocols, so that spokes can learn the routes to other
spokes.

Explanation:

A. In ADVPN, tunnels are negotiated dynamically between spokes, meaning that spokes do not need to
have predefined static tunnels. The spokes dynamically establish tunnels based on the requirements,
which can simplify the configuration and management of VPN connections.

C. ADVPN often relies on dynamic routing protocols (such as OSPF or BGP) to allow spokes to
dynamically learn routes to other spokes. This dynamic behavior enhances scalability and ease of
configuration.

Option B is incorrect because ADVPN is not limited to IKEv2; it can be used with IKEv1 as well.

Option D is incorrect because ADVPN is designed to establish tunnels dynamically, and it doesn't require
every spoke to have static tunnels configured in advance.

Question 7Skipped

The HTTP inspection process in web filtering follows a specific order when multiple features are
enabled in the web filter profile.
What order must FortiGate use when the web filter profile has features enabled, such as safe search?

A. DNS-based web filter and proxy-based web filter

Correct answer

B. Static URL filter, FortiGuard category filter, and advanced filters

C. Static domain filter, SSL inspection filter, and external connectors filters

D. FortiGuard category filter and rating filter

Overall explanation

Correct answer: B

The correct order for the HTTP inspection process in web filtering, specifically when features like safe
search are enabled in the web filter profile, is:

B. Static URL filter, FortiGuard category filter, and advanced filters

This means that the FortiGate device will first check against the Static URL filter, followed by the
FortiGuard category filter, and then any additional advanced filters configured in the web filter profile.
This sequence allows for a systematic evaluation of the URL against different criteria, ensuring
comprehensive web filtering.

The HTTP Inspection Order (Static URL Filter -> FortiGuard Category Filter -> Advanced Filters)

Question 8Skipped

An administrator has configured two-factor authentication to strengthen SSL VPN access.

Which additional best practice can an administrator implement?

A. Configure Source IP Pools

B. Configure different SSL VPN realms

Correct answer

C. Configure host check

D. Configure split tunneling in tunnel mode

Overall explanation

C is correct. Security check option.

For context, Host Check uses the FortiClient to check that certain conditions on the remote PC are met,
such as having AV installed, that there is a specific file located on the PC, that a certain process is running
on the PC, or that specific registry entries exist on the PC. Host Check basically ensures that the PC with
the VPN Client installed is setup according to your organizations standards.

When implementing two-factor authentication for SSL VPN access, configuring a host check is an
additional best practice. A host check involves checking the security posture and compliance of the
connecting device before granting access. This can include checking for the presence of antivirus
software, ensuring that the device is up-to-date with patches, and verifying other security-related
configurations.
This additional layer of security helps ensure that the devices connecting to the SSL VPN meet certain
security requirements, reducing the risk of compromised devices gaining access to the network. It adds
an extra level of assurance that the connecting devices are not only authenticating through two factors
(such as username/password and a token) but also adhering to security policies.

Question 9Skipped

If the Issuer and Subject values are the same in a digital certificate, to which type of entity was the
certificate issued?

A. A subordinate CA

Correct answer

B. A root CA

C. A user

D. A CRL

Overall explanation

If the Issuer and Subject values are the same in a digital certificate, it typically indicates that the
certificate is a self-signed certificate. Therefore, the correct answer is:

B. A root CA (Certificate Authority)

A self-signed certificate is one where the entity that issued the certificate is also the entity identified by
the certificate. In the context of a Certificate Authority (CA), this is often referred to as a root CA
certificate. Root CA certificates are at the top of the certificate hierarchy and are used to sign other
certificates, creating a chain of trust in a Public Key Infrastructure (PKI).

Question 10Skipped

You have enabled logging on your FortiGate device for Event logs and all Security logs, and you have
set up logging to use the FortiGate local [Link] is the default behavior when the local disk is full?

A. Logs are overwritten and the only warning is issued when log disk usage reaches the threshold of
95%.

B. No new log is recorded until you manually clear logs from the local disk.

Correct answer

C. Logs are overwritten and the first warning is issued when log disk usage reaches the threshold of
75%.

D. No new log is recorded after the warning is issued when log disk usage reaches the threshold of
95%.

Overall explanation
C. Logs are overwritten, and the first warning is issued when log disk usage reaches the threshold of
75%.

Explanation: When the log disk usage reaches 75%, a warning is issued, and logs are overwritten to make
space for new logs. This allows the device to continue logging events while maintaining a threshold to
prevent the disk from filling up completely.

First warning 75%, second 90% and final Warning 95%

Only 75% of the disk is available to store logs, this is distributed in the existing vdoms.

Diagnose sys logdisk usage -- CLI command to verify this.

Question 11Skipped

Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

Correct selection

A. To detect intermediary NAT devices in the tunnel path.

B. To dynamically change phase 1 negotiation mode aggressive mode.

Correct selection

C. To encapsulation ESP packets in UDP packets using port 4500.

D. To force a new DH exchange with each phase 2 rekey

Overall explanation

Correct answer: AC

When NAT-T is enabled on both ends, peers can detect any NAT device along the path. If NAT is found,
then the following occurs:

- Both phase 2 and remaining phase 1 packets change to UDP port 4500.

- Both ends encapsulate ESP within UDP port 4500.

Reference:

[Link]

Question 12Skipped

Which two statements are true when FortiGate is in transparent mode? (Choose two.)

Correct selection

A. By default, all interfaces are part of the same broadcast domain.

B. The existing network IP schema must be changed when installing a transparent mode FortiGate in
the network.

C. Static routes are required to allow traffic to the next hop.

Correct selection

D. FortiGate forwards frames without changing the MAC address.

Overall explanation

Correct answer: AD

The correct statements regarding FortiGate in transparent mode are:

A. By default, all interfaces are part of the same broadcast domain.

D. FortiGate forwards frames without changing the MAC address.

In transparent mode, FortiGate operates at Layer 2 and doesn't change the MAC addresses of the
packets it forwards. Also, all interfaces are part of the same broadcast domain by default. This means
that devices connected to different interfaces of the FortiGate can communicate with each other as if
they are on the same network segment.

Question 13Skipped

Examine the two static routes shown in the exhibit, then answer the following question.

Which of the following is the expected FortiGate behavior regarding these two routes to the same
destination?

A. FortiGate will load balance all traffic across both routes.

Correct answer

B. FortiGate will use the port1 route as the primary candidate.

C. FortiGate will route twice as much traffic to the port2 route

D. FortiGate will only actuate the port1 route in the routing table

Overall explanation

B. FortiGate will use the port1 route as the primary candidate.

FortiGate will use the port1 route as the primary candidate. It has better priority.

Question 14Skipped

Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address
conflict?

A. get system status

B. diagnose sys top

C. get system performance status

Correct answer

D. get system arp

Overall explanation

D. get system arp

Explanation: The get system arp command allows administrators to view the ARP (Address Resolution
Protocol) table on the FortiGate unit. This table maps IP addresses to MAC addresses and can be used to
troubleshoot Layer 2 issues, such as an IP address conflict, by checking for duplicate IP addresses or
incorrect MAC address mappings.

If you suspect that there is an IP address conflict, or that an IP has been assigned to the wrong device,
you may need to look at the ARP table. The get system arp command is used for that purpose.

Question 15Skipped

Which statement about video filtering on FortiGate is true?

A. Full SSL Inspection is not required.

Correct answer

B. It is available only on a proxy-based firewall policy.

C. It inspects video files hosted on file sharing services.

D. Video filtering FortiGuard categories are based on web filter FortiGuard categories.

Overall explanation

B. It is available only on a proxy-based firewall policy.

Video filtering on FortiGate is available only on a proxy-based firewall policy. This means that in order to
filter video content, the traffic must be routed through a proxy-based firewall policy where the FortiGate
can inspect and filter the video content based on its policies.
To apply the video filter profile, proxy-based firewall polices currently allow you to enable the video filter
profile. You must enable full SSL inspection on the firewall policy.

Question 16Skipped

Refer to the exhibits.

The exhibits show a firewall policy (Exhibit A) and an antivirus profile (Exhibit B).
Why is the user unable to receive a block replacement message when downloading an infected file for
the first time?

A. The volume of traffic being inspected is too high for this model of FortiGate.

B. The intrusion prevention security profile needs to be enabled when using flow-based inspection
mode.

C. The firewall policy performs the full content inspection on the file.
Correct answer

D. The flow-based inspection is used, which resets the last packet to the user.

Overall explanation

Correct answer: D. The flow-based inspection is used, which resets the last packet to the user.

Key to right answer is "unable to receive a block replacement message when downloading an infected
file for the first time".

• "ONLY" If the virus is detected at the "START" of the connection, the IPS engine sends the block
replacement message immediately

• When a virus is detected on a TCP session (FIRST TIME), but where "SOME PACKETS" have been already
forwarded to the receiver, FortiGate "resets the connection" and does not send the last piece of the file.
Although the receiver got most of the file content, the file has been truncated and therefore, can’t be
opened. The IPS engine also caches the URL of the infected file, so that if a "SECOND ATTEMPT" to
transmit the file is made, the IPS engine will then send a block replacement message to the client instead
of scanning the file again.

Two possible scenarios can occur when a virus is detected:

- When a virus is detected on a TCP session where some packets have been already forwarded to the
receiver, FG resets the connection and does not send the last piece of the file. Although the receiver got
most of the file content, the file has been truncated and therefore, can't be opened. The IPS engine also
caches the URL of the infected file, so that IF A SECOND ATTEMPT TO TRANSMIT THE FILE IS MADE, THE
IPS ENGINE WILL SEND A BLOCK REPLACEMENT MESSAGE to the client instead of scanning the file again.

- If the virus is detected at the start of the connection, the IPS engine sends the block replacement
message immediately.

In flow based inspection, when a virus is detected on a TCP session where some packets have been
already forwarded to the receiver, FortiGate resets the connection and does not send the last piece of
the file. Although the receiver got most of the file content, the file has been truncated and therefore,
can’t be opened. The IPS engine also caches the URL of the infected file, so that if a second attempt to
transmit the file is made, the IPS engine will then send a block replacement message to the client instead
of scanning the file again.

Question 17Skipped

Which two configuration settings are synchronized when FortiGate devices are in an active-active HA
cluster? (Choose two.)

A. FortiGuard web filter cache

B. FortiGate hostname

Correct selection

C. NTP D.

Correct selection

DNS

Overall explanation

Correct answer: CD
C. NTP

D. DNS

Explanation: In an active-active HA cluster, the NTP (Network Time Protocol) and DNS (Domain Name
System) settings are synchronized between the cluster members. This ensures that both devices have
consistent time synchronization and DNS resolution configurations, which are important for network
operations and security.

C and D are Correct: Fortigate Hostname is not synchronized between cluster member.

By elimination, its C (DNS) and D (NTP)

The list of configuration settings that are NOT synchronized includes both 'FortiGate host name' and
'Cache'.

Question 18Skipped

Which security feature does FortiGate provide to protect servers located in the internal networks from
attacks such as SQL injections?

A. Denial of Service

Correct answer

B. Web application firewall

C. Antivirus

D. Application control

Overall explanation

Correct answer: B

Some FortiGate features are meant to protect clients, not servers. For example, FortiGuard web filtering
blocks requests based on the category of the server’s web pages. Antivirus prevents clients from
accidentally downloading spyware and worms. Neither protects a server (which doesn’t send requests—
it receives them) from malicious scripts or SQL injections. Protecting web servers requires a different
approach because they are subject to other kinds of attacks. This is where WAF applies. The WAF feature
is available only in proxy inspection mode.

Web Application Firewall (WAF) is a security feature that protects web applications from a variety of
attacks, including SQL injections. It analyzes and filters HTTP traffic between a web application and the
internet to block malicious attempts to exploit vulnerabilities in the application. By monitoring and
filtering HTTP traffic, WAF helps prevent attacks such as SQL injections, cross-site scripting (XSS), and
other web application vulnerabilities.

Question 19Skipped

Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?

A. By default, FortiGate uses WINS servers to resolve names.

B. By default, the SSL VPN portal requires the installation of a client's certificate.

Correct answer

C. By default, split tunneling is enabled.

D. By default, the admin GUI and SSL VPN portal use the same HTTPS port.

Overall explanation

Correct answer: C

There is a Trap here... C and D have something right but the trick is the question...

Under SSL VPN settings you can see that port is 443 (same of https admin port)

BUT the question is about a SSL VPN Setting FOR A VPN PORTAL... so if you go to SSL VPN Portals and hit
"Create new" you will see Tunnel Mode and Split Tunnel enabled by default... so, the correct answer is C.

Split tunneling is a feature that allows a remote VPN user to tunnel only specific, protected traffic back to
the corporate network, while other traffic (e.g., internet traffic) is sent directly to its destination. This can
help optimize bandwidth usage and reduce the load on the corporate network.

In the context of SSL VPN settings for an SSL VPN portal on FortiGate, if split tunneling is enabled by
default, it means that the remote user's internet-bound traffic will not be forced through the corporate
network but will be sent directly to the internet. This can improve performance and reduce latency for
non-corporate internet traffic.

Extra explanation:

[Link]
Split_Tunnel.htm#:~:text=Split%20Tunnel,SSL%20VPN%20on%20FortiGate%20units.
Question 20Skipped

Which of the following statements about backing up logs from the CLI and downloading logs from the
GUI are true? (Choose two.)

Correct selection

A. Log downloads from the GUI are limited to the current filter view

Correct selection

B. Log backups from the CLI cannot be restored to another FortiGate.

C. Log backups from the CLI can be configured to upload to FTP as a scheduled time

D. Log downloads from the GUI are stored as LZ4 compressed files.

Overall explanation

Correct answer: AB

A. Log downloads from the GUI are limited to the current filter view: This statement is true. When
downloading logs from the GUI, you can only download logs that match the current filter settings.

B. Log backups from the CLI cannot be restored to another FortiGate: This statement is true. Log backups
from the CLI are specific to the FortiGate unit they were taken from and cannot be directly restored to
another FortiGate unit.

The question is about Backing up logs from CLI and Downloading logs from the GUI, therefore, C is
incorrect because the question doesn't say anything about uploading logs from CLI, but says backing up
from CLI...

Question 21Skipped

Consider the topology:

Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server.
An administrator is investigating a problem where an application establishes a Telnet session to a
Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes.
The administrator would like to increase or disable this timeout.
The administrator has already verified that the issue is not caused by the application or Linux server.
This issue does not happen when the application establishes a Telnet connection to the Linux server
directly on the LAN.
What two changes can the administrator make to resolve the issue without affecting services running
through FortiGate? (Choose two.)

A. Set the maximum session TTL value for the TELNET service object.

B. Set the session TTL on the SSLVPN policy to maximum, so the idle session timeout will not happen
after 90 minutes.
Correct selection

C. Create a new service object for TELNET and set the maximum session TTL.

Correct selection

D. Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic,
and set the new TELNET service object in the policy.

Overall explanation

Correct answer: CD

The key here is performing the task without affecting any of the other services.

C. Create a new service object for TELNET and set the maximum session TTL: By creating a new service
object specifically for TELNET and setting the maximum session TTL, you can control the idle session
timeout for Telnet connections established through the SSL VPN.

D. Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and
set the new TELNET service object in the policy: Creating a new firewall policy and placing it above the
existing SSLVPN policy allows you to apply the new TELNET service object with the modified session TTL,
ensuring that the idle session timeout does not occur after 90 minutes.

- Not A - Changing the maximum TTL value for TELNET will affect every other policy that references the
TELNET service

- Not B - Changing the session TTL on the SSLVPN policy will impact other services referenced in the
policy.

Question 22Skipped

Which certificate value can FortiGate use to determine the relationship between the issuer and the
certificate?

Correct answer

A. Subject Key Identifier value

B. SMMIE Capabilities value

C. Subject value

D. Subject Alternative Name value

Overall explanation

Correct answer: A

Subject Key Identifier value.

FortiGate can use the Subject Key Identifier and Authority Key Identifier values to determine the
relationship between the issuer of the certificate (identified in the Issuer field) and the certificate.

The Subject Key Identifier (SKI) is a value in a certificate that is used to uniquely identify the public key
associated with a particular private key. It allows FortiGate to determine the relationship between the
issuer (who signed the certificate) and the certificate itself. This identifier is often used in various
cryptographic protocols and is included in the certificate extensions. By comparing the SKI in the
certificate to the SKI of the issuing certificate, FortiGate can verify the certificate's authenticity and
maintain the chain of trust in the certificate hierarchy.

Question 23Skipped

Which two statements are true about the Security Fabric rating? (Choose two.)

A. The Security Fabric rating is a free service that comes bundled with all FortiGate devices.

Correct selection

B. Many of the security issues can be fixed immediately by clicking Apply where available.

Correct selection

C. The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.

D. It provides executive summaries of the four largest areas of security focus.

Overall explanation

Correct answer: BC

B. Many of the security issues can be fixed immediately by clicking Apply where available: This statement
is true. The Security Fabric rating often identifies security issues that can be resolved immediately by
clicking "Apply" where available, making it a valuable tool for quickly addressing security concerns.

C. The Security Fabric rating must be run on the root FortiGate device in the Security Fabric: This
statement is also true. The Security Fabric rating must be run on the root FortiGate device in the Security
Fabric to provide an overall security rating and analysis of the Security Fabric.

On checks that support Easy Apply, you can run the remediation on all the associated VDOMs.

To view the complete network, you must access the topology views on the root FortiGate in the Security
Fabric.

Incorrect:

A. The Security Fabric rating is a free service that comes bundled with all FortiGate devices. (subscription
service that requires a security rating license)
D. It provides executive summaries of the four largest areas of security focus. (three largest areas of
security focus)

Question 24Skipped

Which of the following statements correctly describes FortiGates route lookup behavior when
searching for a suitable gateway? (Choose two)

Correct selection

A. Lookup is done on the first packet from the session originator

B. Lookup is done on the last packet sent from the responder

C. Lookup is done on every packet, regardless of direction

Correct selection

D. Lookup is done on the first reply packet from the responder

Overall explanation

Correct answer: AD

FortiGate performs route lookup based on the trust packet. The trust packet is the first packet of the
session that is sent by the session originator. This is the packet that initiates the communication. The
route lookup is also done on the trust reply packet, which is the first reply packet received from the
responder.

In summary, FortiGate looks at the initial packet from the session originator and the first reply packet
from the responder when performing route lookup to determine the suitable gateway.

Question 25Skipped

An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken.
Each site has a FortiGate VPN gateway.
What must an administrator do to achieve this objective?

A. The administrator can register the same FortiToken on more than one FortiGate.

Correct answer

B. The administrator must use a FortiAuthenticator device.

C. The administrator can use a third-party radius OTP server.

D. The administrator must use the user self-registration server.

Overall explanation

B. The administrator must use a FortiAuthenticator device.

B is correct due to the FortiToken, a different OTP cannot use FortiToken. So we have to choose the
fortiAuthenticator.
To achieve VPN user access for multiple sites using the same soft FortiToken, the administrator can use a
FortiAuthenticator device. FortiAuthenticator is designed to provide centralized authentication services
for Fortinet devices, including VPN authentication. It allows for the centralized management of user
identities, authentication methods, and FortiTokens. By using FortiAuthenticator, the administrator can
register the same FortiToken for users across multiple FortiGate devices, providing a seamless and
centralized user access experience.

Question 26Skipped

Which three statements about security associations (SA) in IPsec are correct? (Choose three.)

Correct selection

A . Phase 2 SAs are used for encrypting and decrypting the data exchanged through the tunnel.

B . An SA never expires.

Correct selection

C . A phase 1 SA is bidirectional, while a phase 2 SA is directional.

Correct selection

D . Phase 2 SA expiration can be time-based, volume-based, or both.

E . Both the phase 1 SA and phase 2 SA are bidirectional.

Overall explanation

The correct statements about security associations (SA) in IPsec are:

A. Phase 2 SAs are used for encrypting and decrypting the data exchanged through the tunnel.

C. A phase 1 SA is bidirectional, while a phase 2 SA is directional.

D. Phase 2 SA expiration can be time-based, volume-based, or both.

Here's an explanation for the correct statements:

A. Phase 2 SAs (Security Associations) are established for the purpose of encrypting and decrypting the
actual data that is exchanged through the IPsec tunnel. Phase 1 SAs, on the other hand, are primarily
responsible for setting up the initial secure connection.

C. A phase 1 SA is bidirectional, meaning it covers both directions of communication between two peers.
However, a phase 2 SA is directional, and separate SAs are established for inbound and outbound traffic.

D. Phase 2 SAs can have expiration based on time, volume (data transferred), or a combination of both.
This allows for better control and security management in IPsec implementations.

Question 27Skipped
Which statements about the firmware upgrade process on an active-active HA cluster are true?
(Choose two.)

A. The firmware image must be manually uploaded to each FortiGate.

B. Only secondary FortiGate devices are rebooted.

Correct selection

C. Uninterruptable upgrade is enabled by default.

Correct selection

D. Traffic load balancing is temporally disabled while upgrading the firmware.

Overall explanation

The correct statements are:

C. Uninterruptable upgrade is enabled by default: This statement is true. Uninterruptable upgrade (also
known as "non-stop upgrade" or NSU) is enabled by default in an active-active HA cluster. This allows the
cluster to upgrade the firmware without interrupting traffic.

D. Traffic load balancing is temporarily disabled while upgrading the firmware: This statement is true.
During the firmware upgrade process, traffic load balancing is temporarily disabled to avoid potential
issues that may arise from traffic distribution while the firmware is being upgraded.

Question 28Skipped

Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)

Correct selection

A. Shut down/reboot a downstream FortiGate device.

B. Disable FortiAnalyzer logging for a downstream FortiGate device.

C. Log in to a downstream FortiSwitch device.

Correct selection

D. Ban or unban compromised hosts.

Overall explanation

Correct answer: AD

A. Shut down/reboot a downstream FortiGate device.

This is correct. The root FortiGate has the ability to control the power state of downstream FortiGate
devices.

D. Ban or unban compromised hosts.

This is also correct. The root FortiGate can take actions to ban or unban compromised hosts, helping to
manage and control security incidents.

Therefore, the correct answers are A and D.

Question 29Skipped

Which of the following steps is necessary when implementing the Fortinet Security Fabric?

A. Configure the FGCP HA cluster to ensure high availability.

Correct answer

B. Enable the Security Fabric on the root FortiGate device and connect downstream FortiGates.

C. Set up a static route to prioritize traffic between the primary and secondary WAN links.

D. Deploy an SSL VPN to allow secure remote access to the network.

Overall explanation

B. Enable the Security Fabric on the root FortiGate device and connect downstream FortiGates.

Explanation:

When implementing the Fortinet Security Fabric, the primary step is to enable the Security Fabric on the
root (primary) FortiGate device. This configuration allows you to link and manage multiple FortiGate
devices, creating a cohesive and secure network environment. Connecting downstream FortiGates is
crucial for extending the security fabric across your network, ensuring unified visibility, and simplified
management.

Options A, C, and D are related to other aspects of Fortinet configuration but are not specifically
necessary steps in implementing the Security Fabric.

Question 30Skipped

Which statement about the IP authentication header (AH) used by IPsec is true?

A. AH does not provide any data integrity or encryption.

B. AH does not support perfect forward secrecy.

Correct answer

C. AH provides data integrity but no encryption.

D. AH provides strong data integrity but weak encryption.

Overall explanation

The answer is C. AH provides data integrity but no encryption.

The correct statement about the IP Authentication Header (AH) used by IPsec is that AH provides data
integrity and authentication but does not provide encryption.
"IPsec is a suite of protocols that is used for authenticating and encrypting traffic between two peers.
The threemost used protocols in the suite are the following:

- Internet Key Exchange (IKE), which does the handshake, tunnel maintenance, and disconnection.

- Encapsulation Security Payload (ESP), which ensures data integrity and encryption.

- Authentication Header (AH), which offers only data integrity - not encryption."

Question 31Skipped

Refer to the exhibit.

In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The
administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.

What should the administrator do next to troubleshoot the problem?

A. Run a sniffer on the web server.

B. Capture the traffic using an external sniffer connected to port1.

C. Execute another sniffer in the FortiGate, this time with the filter “host [Link]”

Correct answer

D. Execute a debug flow.

Overall explanation

Correct answer: D. Execute a debug flow.

Because sniffer shows the ingressing and egressing packets, but we cannot see dropped packets by
fortigate in a sniffer. Debugging can show the packets are not entering for any reasons caused by
fortigate. So, if a packed is reached to fortigate and dropped , debug will show us.

Question 32Skipped
Which two statements are correct about SLA targets? (Choose two.)

A. You can configure only two SLA targets per one Performance SLA.

Correct selection

B. SLA targets are optional.

C. SLA targets are required for SD-WAN rules with a Best Quality strategy.

Correct selection

D. SLA targets are used only when referenced by an SD-WAN rule.

Overall explanation

Correct answer: BD

B. SLA targets are optional.

D. SLA targets are used only when referenced by an SD-WAN rule.

Incorrect:

A. You can configure only two SLA targets per one Performance SLA. (more is possible)

C. SLA targets are required for SD-WAN rules with a Best Quality strategy. (not required)

If the health check is used in an SD-WAN rule that uses Manual or Best Quality strategies, enabling SLA
Target is optional. If the health check is used in an SD-WAN rule that uses Lowest Cost (SLA) or Maximum
Bandwidth (SLA) strategies, then SLA Target is enabled.

Enable SLA Targetsand configure the constraints. To add multiple SLA targets, use the CLI.

Question 33Skipped

Which type of logs on FortiGate record information about traffic directly to and from the FortiGate
management IP addresses?

Correct answer

A. Local traffic logs

B. Forward traffic logs

C. System event logs

D. Security logs

Overall explanation

Correct answer: A
The type of logs on FortiGate that record information about traffic directly to and from the FortiGate
management IP addresses is: A. Local traffic logs

Explanation:

A. Local traffic logs: These logs record information about traffic that is processed by the FortiGate unit
itself, including traffic directed to and from the FortiGate management IP addresses.

The other options are not specifically focused on the management IP addresses:

B. Forward traffic logs: These logs generally pertain to traffic that is forwarded through the FortiGate
unit.

C. System event logs: These logs capture system-level events, but they may not specifically address traffic
to and from management IP addresses.

D. Security logs: While security logs can provide information about security-related events, they may not
be specific to the management IP addresses.

Question 34Skipped

Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides
(client and server) have terminated the session?

A. To remove the NAT operation.

B. To generate logs

C. To finish any inspection operations.

Correct answer

D. To allow for out-of-order packets that could arrive after the FIN/ACK packets.

Overall explanation

Correct answer: D. To allow for out-of-order packets that could arrive after the FIN/ACK packets.

TCP provides the ability for one end of a connection to terminate its output while still receiving data
from the other end. This is called a half-close. FortiGate unit implements a specific timer before
removing an entry in the firewall session table.

When a session is closed by both sides, FortiGate keeps it in the session table for a few seconds more, t‹
allow any out-of-order packets that could arrive after the FIN/ACK packet. This is the state value.

One of the reasons FortiGate keeps TCP sessions in the session table for several seconds, even after both
sides have terminated the session, is indeed to allow for out-of-order packets that could arrive after the
FIN/ACK packets. This helps in handling potential network delays and ensuring that all relevant packets
are processed before fully closing the session.

Question 35Skipped
Examine the output from a debug flow:

Why did the FortiGate drop the packet?

A. The next-hop IP address is unreachable.

B. It failed the RPF check.

C. It matched an explicitly configured firewall policy with the action DENY.

Correct answer

D. It matched the default implicit firewall policy.

Overall explanation

Correct answer: D. It matched the default implicit firewall policy.

implicit firewall rule == (policy id 0)

traffic is denied by implicit firewall rule.

Question 36Skipped

Refer to the exhibit.

The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy
and IP pool configuration on the FortiGate device.
Which two actions does FortiGate take on internet traffic sourced from the subscribers? (Choose two.)

A. FortiGate allocates port blocks per user, based on the configured range of internal IP addresses.

Correct selection

B. FortiGate allocates port blocks on a first-come, first-served basis.

Correct selection

C. FortiGate generates a system event log for every port block allocation made per user.

D. FortiGate allocates 128 port blocks per user.

Overall explanation

Correct answer: BC

B: FortiGate allocates port blocks on a first-come, first-served basis

C: For logging purposes, when FortiGate allocates a port block to a host, it generates a system event log
to inform the administrator

Not A: FortiGate allocates a block size and number per host for a range of external addresses

Not D: It allows 8 blocks of 128 ports per host

FortiGate allocates port blocks on a first-come, first-served basis.

For logging purposes, when FortiGate allocates a port block to a host, it generates a system event log to
inform the administrator.

Question 37Skipped

Which statement regarding the firewall policy authentication timeout is true?

Correct answer

A. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets
coming from the user's source IP.

B. It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after
this timer has expired.

C. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming
from the user's source MAC.

D. It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address
after this timer has expired.

Overall explanation

A. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming
from the user's source IP.

Explanation: The firewall policy authentication timeout is an idle timeout, meaning that it measures the
duration of inactivity for a user. If the FortiGate does not see any packets coming from the user's source
IP within the specified timeout period, it considers the user to be idle and may remove the temporary
policy associated with that user.

*** If there is no traffic received from the user IP address for the configured auth-timeout (5 minutes by
default), user authentication entry will be removed.

* If the user tries to access resources now, FortiGate will prompt the user to authenticate again.

The firewall policy authentication timeout is indeed often an idle timeout, and the FortiGate considers a
user to be "idle" if it does not detect any packets coming from the user's source IP within the specified
time period.

Reference:

[Link]

Question 38Skipped

What is the primary FortiGate election process when the HA override setting is disabled?
A. Connected monitored ports > System uptime > Priority > FortiGate Serial number

Correct answer

B. Connected monitored ports > HA uptime > Priority > FortiGate Serial number

C. Connected monitored ports > Priority > HA uptime > FortiGate Serial number

D. Connected monitored ports > Priority > System uptime > FortiGate Serial number

Overall explanation

Correct answer: B

If Override DISABLED then: ports > HA Uptime > Priority > SN.

If Overrrid ENABLED then: ports > Priority > HA Uptime > SN.

The FortiGate election process when the HA override setting is disabled follows the criteria you provided:

 Connected monitored ports: The FortiGate with more connected monitored ports is preferred.

 HA uptime: The FortiGate with the longer High Availability (HA) uptime (less recently rebooted in
HA) is preferred.

 Priority: Priority is used as a tiebreaker. If two FortiGates have the same number of connected
monitored ports and the same HA uptime, the one with the higher priority is preferred.

 FortiGate Serial number: The FortiGate Serial number is used as a final tiebreaker if all other
criteria are the same.

Question 39Skipped

What types of traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose
three.)

A. Traffic to botnetservers

B. Traffic to inappropriate web sites

Correct selection

C. Server information disclosure attacks

Correct selection

D. Credit card data leaks

Correct selection

E. SQL injection attacks

Overall explanation
Correct answer: CDE

The types of traffic and attacks that can be blocked by a Web Application Firewall (WAF) profile include:

C. Server information disclosure attacks: A WAF can help block attacks attempting to disclose sensitive
information about the server.

D. Credit card data leaks: A WAF can be configured to detect and block attempts to leak credit card or
other sensitive data.

E. SQL injection attacks: WAFs are effective in blocking SQL injection attacks, where attackers attempt to
manipulate a web application's database by injecting malicious SQL code.

Options A and B are not typically associated with the primary functions of a WAF:

A. Traffic to botnet servers: This is often more related to network security or threat intelligence solutions
rather than the primary function of a WAF.

B. Traffic to inappropriate websites: Blocking traffic to inappropriate websites is generally handled by

content filtering or URL filtering solutions rather than a WAF.

Question 40Skipped

An organization's employee needs to connect to the office through a high-latency internet connection.
Which SSL VPN setting should the administrator adjust to prevent the SSL VPN negotiation failure?

A. Change the session-ttl.

Correct answer

B. Change the login-timeout.

C. Change the idle-timeout.

D. Change the udp-idle-timer.

Overall explanation

Correct answer: B. Change the login-timeout.

Set up timers to avoid logouts when SSL VPN users are connected over high latency connections.

When connected to SSL VPN over high latency connections, FortiGate can time out the client before the
client can finish the negotiation process, such as DNS lookup and time to enter a token. Two new CLI
commands under "config vpn ssl settings" have been added to address this. The first command "set
login-timeout" allows you to set up the login timeout, replacing the previous hard timeout value. The
second command "set dtls-hello-timeout" allows you to set up the maximum DTLS hello timeout for SSL
VPN connections.

Question 41Skipped
Refer to the exhibit to view the authentication rule configuration.

In this scenario, which statement is true?

Correct answer

A. Session-based authentication is enabled

B. Policy-based authentication is enabled

C. IP-based authentication is enabled

D. Route-based authentication is enabled

Overall explanation

Correct answer: A

The correct statement is:

A. Session-based authentication is enabled

The configuration specifies the use of web authentication cookies (set web-auth-cookie enable), which
is a form of session-based authentication.

NTLM authentication = session-based

Question 42Skipped

Refer to the exhibit, which contains a radius server configuration.

An administrator added a configuration for a new RADIUS server. While configuring, the administrator
selected the Include in every user group option.
What will be the impact of using Include in every user group option in a RADIUS configuration?

Correct answer

A. This option places the RADIUS server, and all users who can authenticate against that server, into
every FortiGate user group.

B. This option places all FortiGate users and groups required to authenticate into the RADIUS server,
which, in this case, is FortiAuthenticator.

C. This option places all users into every RADIUS user group, including groups that are used for the
LDAP server on FortiGate.

D. This option places the RADIUS server, and all users who can authenticate against that server, into
every RADIUS group.

Overall explanation

Correct answer: A

The Include in every User Group option adds the RADIUS server and all users that can authenticate
against it, to every user group created on FortiGate. So, you should enable this option only in very
specific scenarios (for example, when only administrators can authenticate against the RADIUS server
and policies are ordered from least restrictive to most restrictive).

Question 43Skipped

If Internet Service is already selected as Source in a firewall policy, which other configuration objects
can be added to the Source field of a firewall policy?
A. IP address

B. Once Internet Service is selected, no other object can be added

Correct answer

C. User or User Group

D. FQDN address

Overall explanation

Correct answer: C

C is correct and tested (user added and user group are added to policy but ip address or network failed
to add)

We have just confirmed this on a Production Fortigate FW and you can add user/User group but you
cannot add Address group with ISDB object. It will simply show a red highlighted error which is read as
"Addresses/groups cannot be mixed with Internet Services"

if src: you can add user, if dst: you cannot add any other object.

You can't mix ISDB objects with regular address objects. User objects are not restricted in any way.

Question 44Skipped

In which two ways can RPF checking be disabled? (Choose two.)

A. Enable anti-replay in firewall policy.

Correct selection

B. Enable asymmetric routing.

C. Disable strict-src-check under system settings.

Correct selection

D. Disable the RPF check at the FortiGate interface level for the source check.

Overall explanation

Correct answer: BD

B. Disabling the RPF check at the FortiGate interface level means that the FortiGate device won't perform
RPF checks for the specified interface, allowing traffic with source addresses that do not conform to RPF
checks.

D. Enabling asymmetric routing means that the network allows different paths for incoming and
outgoing traffic, and this can lead to situations where RPF checks may fail.
Option A is incorrect because enabling anti-replay in a firewall policy is not a method for disabling RPF
checking. Anti-replay is a feature that helps prevent the insertion of malicious or duplicate packets into
the network.

Option C is incorrect because disabling strict-src-check under system settings is not a valid option for
disabling RPF checking. Strict source checking is typically related to RPF checks, but disabling it might not
disable RPF checks entirely.

Reference:

[Link]

[Link]
RPF-per/ta-p/193338

Question 45Skipped

Refer to the exhibit to view the application control profile.

Users who use Apple FaceTime video conferences are unable to set up meetings.
In this scenario, which statement is true?

A. Apple FaceTime belongs to the custom monitored filter.

B. The category of Apple FaceTime is being monitored.

Correct answer

C. Apple FaceTime belongs to the custom blocked filter.

D. The category of Apple FaceTime is being blocked.

Overall explanation
Correct answer: C. Apple FaceTime belongs to the custom blocked filter.

FaceTime categorized (filtered) under "Excessive-Bandwidth" and custom filter override set to block this.
Also we know that users can't use FaceTime.

Apple FaceTime falls under (VoIP Catagory), (Excessive-Bandwidth Behavior) and (Vendor as Apple).

A. Correct, but that comes 2nd.

B. Correct, but that comes 2nd, as custom Filter Overrides the precedence of Category.

C. Correct, and that comes 1st.

D. Wrong, VoIP Category is monitored

So correct answer is (C).

Question 46Skipped

Which three statements are true regarding session-based authentication? (Choose three.)

Correct selection

A. HTTP sessions are treated as a single user.

B. IP sessions from the same source IP address are treated as a single user.

Correct selection

C. It can differentiate among multiple clients behind the same source IP address.

Correct selection

D. It requires more resources.

E. It is not recommended if multiple users are behind the source NAT

Overall explanation

Correct answer: ACD

These three statements are indeed true regarding session-based authentication:

A. HTTP sessions are treated as a single user: Session-based authentication can treat multiple HTTP
sessions as a single user, providing a consolidated view of user activity.

C. It can differentiate among multiple clients behind the same source IP address: Session-based
authentication is capable of distinguishing between multiple clients behind the same source IP address.

D. It requires more resources: Session-based authentication may require more resources compared to
simpler authentication methods due to the additional processing involved in tracking and managing user
sessions.
For A: Each session-based authenticated user is counted as a single user using their authentication
membership (RADIUS, LDAP, FSSO, local database etc.) to match users in other sessions. So one
authenticated user in multiple sessions is still one user.

Question 47Skipped

Examine this FortiGate configuration:

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that
require inspection?

A. It is allowed, but with no inspection

B. It is allowed and inspected as long as the inspection is flow based

Correct answer

C. It is dropped.

D. It is allowed and inspected, as long as the only inspection required is antivirus.

Overall explanation
C because it exceeded the Extreme memory threshold.

"However, if the memory usage exceeds the extreme threshold, new sessions are ALWAYS DROPPED,
regardless of the FortiGate configuration."

Explanation : if the memory usage keeps increasing, it might exceed the extreme threshold. While the
memory usage is above this highest threshold, all new sessions are dropped.

Note: "Extreme threshold is when the memory usage goes above 95%, and all NEW sessions are
dropped.

av-failopen pass (default): All new sessions pass without inspection

but the 3 memory thresholds : red, extreme and green are set with the values:

green: 82%

red: 88%

extreme: 95%

These values serve as a reference for the “memory used” which in this case is 97% used. So…

However, if the “memory usage exceeds” the “extreme threshold”, new sessions “are always dropped”,
regardless of the FortiGate configuration.

Question 48Skipped

Which scanning technique on FortiGate can be enabled only on the CLI?

Correct answer

A. Machine learning (AI) scan

B. Trojan scan

C. Antivirus scan

D. Ransomware scan

Overall explanation

The scanning technique on FortiGate that can be enabled only on the CLI (Command Line Interface) is:

A. Machine learning (AI) scan

Explanation: While most scanning techniques on FortiGate can be configured through the GUI (Graphical
User Interface) or CLI, the machine learning (AI) scan is a feature that can only be enabled and
configured using the CLI.

The AI scan is an optional feature that must be enabled in the CLI. You can configure the action for the AI
scan to enable, monitor, or disable using the CLI command in the antivirus settings.

Question 49Skipped

Which three authentication timeout types are availability for selection on FortiGate? (Choose three.)

Correct selection

A. hard-timeout

B. auth-on-demand

C. soft-timeout

Correct selection

D. new-session

Correct selection

E. Idle-timeout

Overall explanation

Correct answer: ADE

These three authentication timeout types are indeed available for selection on FortiGate:

A. hard-timeout: This refers to a fixed period after which the user's authentication is forcefully
terminated.

D. new-session: This timeout type is related to creating a new authentication session.

E. Idle-timeout: This timeout type determines the duration of inactivity after which a user is
automatically logged out.

Reference:

[Link]
Firewall/ta-p/189423?externalID=FD37221

Question 50Skipped

Which of the following are valid actions for FortiGuard category based filter in a web filter profile ui
proxy-based inspection mode? (Choose two.)
Correct selection

A. Warning

B. Exempt

Correct selection

C. Allow

D. Learn

Overall explanation

Correct answer: AC

A. Warning

C. Allow

In a FortiGuard category-based filter in a web filter profile using proxy-based inspection mode,
"Warning" can be used to display a warning message to users attempting to access blocked content, and
"Allow" permits access to URLs that match the selected categories.

Exempt is not FortiGuard category action.

In the context of FortiGate's web filter profile under proxy-based inspection mode, the valid actions for
FortiGuard category-based filter include:

A. Warning

C. Allow

So, both warning and allow are valid actions for FortiGuard category-based filtering in this scenario.

Proxy: Allow, Block, Monitor, Warning, and Authenticate.