Q1. - (Topic 1) 

What are valid options for handling DNS requests sent directly to a FortiGates interface IP? (Choose three.) 

A. Conditional-forward. 

B. Forward-only. 

C. Non-recursive. 

D. Iterative. 

E. Recursive. 

View Answer

Q2. - (Topic 16) 

Review the IPS sensor filter configuration shown in the exhibit 

Based on the information in the exhibit, which statements are correct regarding the filter? (Choose two.) 

A. It does not log attacks targeting Linux servers. 

B. It matches all traffic to Linux servers. 

C. Its action will block traffic matching these signatures. 

D. It only takes effect when the sensor is applied to a policy. 

View Answer

Q3. - (Topic 13) 

Examine the following spanning tree configuration on a FortiGate in transparent mode: 

config system interface 

edit <interface name> 

set stp-forward enable 

end 

Which statement is correct for the above configuration? 

A. The FortiGate participates in spanning tree. 

B. The FortiGate device forwards received spanning tree messages. 

C. Ethernet layer-2 loops are likely to occur. 

D. The FortiGate generates spanning tree BPDU frames. 

View Answer

Q4. - (Topic 4) 

Which statement regarding the firewall policy authentication timeout is true? 

A. It is an idle timeout. The FortiGate considers a user to be “idle” if it does not see any packets coming from the user’s source IP. 

B. It is a hard timeout. The FortiGate removes the temporary policy for a user’s source IP address after this timer has expired. 

C. It is an idle timeout. The FortiGate considers a user to be “idle” if it does not see any packets coming from the user’s source MAC. 

D. It is a hard timeout. The FortiGate removes the temporary policy for a user’s source MAC address after this timer has expired. 

View Answer

Q5. - (Topic 8) 

Examine the following FortiGate web proxy configuration; then answer the question below: config web-proxy explicit set pac-file-server-status enable set pac-file-server-port 8080 set pac-file-name wpad.dat end Assuming that the FortiGate proxy IP address is 10.10.1.1, which URL must an Internet 

browser use to download the PAC file? 

A. https://10.10.1.1:8080 

B. https://10.10.1.1:8080/wpad.dat 

C. http://10.10.1.1:8080/ 

D. http://10.10.1.1:8080/wpad.dat 

View Answer

Q6. - (Topic 12) 

A FortiGate is operating in NAT/Route mode and configured with two virtual LAN (VLAN) sub-interfaces added to the same physical interface. 

Which one of the following statements is correct regarding the VLAN IDs in this scenario? 

A. The two VLAN sub-interfaces can have the same VLAN ID only if they have IP addresses in different subnets. 

B. The two VLAN sub-interfaces must have different VLAN IDs. 

C. The two VLAN sub-interfaces can have the same VLAN ID only if they belong to different VDOMs. 

D. The two VLAN sub-interfaces can have the same VLAN ID if they are connected to different L2 IEEE 802.1Q compliant switches. 

View Answer

Q7. - (Topic 10) 

How do you configure a FortiGate to apply traffic shaping to P2P traffic, such as BitTorrent? 

A. Apply a traffic shaper to a BitTorrent entry in an application control list, which is then applied to a firewall policy. 

B. Enable the shape option in a firewall policy with service set to BitTorrent. 

C. Define a DLP rule to match against BitTorrent traffic and include the rule in a DLP sensor with traffic shaping enabled. 

D. Apply a traffic shaper to a protocol options profile. 

View Answer

Q8. - (Topic 18) 

Bob wants to send Alice a file that is encrypted using public key cryptography. 

Which of the following statements is correct regarding the use of public key cryptography in this scenario? 

A. Bob will use his private key to encrypt the file and Alice will use her private key to decrypt the file. 

B. Bob will use his public key to encrypt the file and Alice will use Bob's private key to decrypt the file. 

C. Bob will use Alice's public key to encrypt the file and Alice will use her private key to decrypt the file. 

D. Bob will use his public key to encrypt the file and Alice will use her private key to decrypt the file. 

View Answer

Q9. - (Topic 21) 

Which statements are correct regarding an IPv6 over IPv4 IPsec configuration? (Choose two.) 

A. The source quick mode selector must be an IPv4 address. 

B. The destination quick mode selector must be an IPv6 address. 

C. The Local Gateway IP must be an IPv4 address. 

D. The remote gateway IP must be an IPv6 address. 

View Answer

Q10. - (Topic 10) 

Which statements are correct regarding application control? (Choose two.) 

A. It is based on the IPS engine. 

B. It is based on the AV engine. 

C. It can be applied to SSL encrypted traffic. 

D. Application control cannot be applied to SSL encrypted traffic. 

View Answer