Q1. - (Topic 3) 

Examine the following CLI configuration: config system session-ttl set default 1800 end What statement is true about the effect of the above configuration line? 

A. Sessions can be idle for no more than 1800 seconds. 

B. The maximum length of time a session can be open is 1800 seconds. 

C. After 1800 seconds, the end user must re-authenticate. 

D. After a session has been open for 1800 seconds, the FortiGate sends a keepalive packet to both client and server. 

View Answer

Q2. - (Topic 22) 

Two FortiGate units with NP6 processors form an active-active cluster. The cluster is doing security profile (UTM) inspection over all the user traffic. What statements are true regarding the sessions that the master unit is offloading to the slave unit for inspection? (Choose two.) 

A. They are accelerated by hardware in the master unit. 

B. They are not accelerated by hardware in the master unit. 

C. They are accelerated by hardware in the slave unit. 

D. They are not accelerated by hardware in the slave unit. 

View Answer

Q3. - (Topic 14) 

In HA, the option Reserve Management Port for Cluster Member is selected as shown in the exhibit below. 

Which statements are correct regarding this setting? (Choose two.) 

A. Interface settings on port7 will not be synchronized with other cluster members. 

B. The IP address assigned to this interface must not overlap with the IP address subnet assigned to another interface. 

C. When connecting to port7 you always connect to the master device. 

D. A gateway address may be configured for port7. 

View Answer

Q4. - (Topic 11) 

Examine the exhibit; then answer the question below. 

The Vancouver FortiGate initially had the following information in its routing table: S 172.20.0.0/16 [10/0] via 172.21.1.2, port2 

C 172.21.0.0/16 is directly connected, port2 C 172.11.11.0/24 is directly connected, port1 Afterwards, the following static route was added: config router static edit 6 set dst 172.20.1.0 255.255.255.0 set pririoty 0 set device port1 set gateway 172.11.12.1 next end Since this change, the new static route is NOT showing up in the routing table. Given the 

information provided, which of the following describes the cause of this problem? 

A. The subnet 172.20.1.0/24 is overlapped with the subnet of one static route that is already in the routing table (172.20.0.0/16), so, we need to enable allow-subnet-overlap first. 

B. The 'gateway' IP address is NOT in the same subnet as the IP address of port1. 

C. The priority is 0, which means that the route will remain inactive. 

D. The static route configuration is missing the distance setting. 

View Answer

Q5. - (Topic 5) 

Regarding the use of web-only mode SSL VPN, which statement is correct? 

A. It supports SSL version 3 only. 

B. It requires a Fortinet-supplied plug-in on the web client. 

C. It requires the user to have a web browser that supports 64-bit cipher length. 

D. The JAVA run-time environment must be installed on the client. 

View Answer

Q6. - (Topic 4) 

What methods can be used to deliver the token code to a user that is configured to use two-factor authentication? (Choose three.) 

A. Browser pop-up window. 

B. FortiToken. 

C. Email. 

D. Code books. 

E. SMS phone message. 

View Answer

Q7. - (Topic 2) 

Which is an advantage of using SNMP v3 instead of SNMP v1/v2 when querying a FortiGate unit? 

A. MIB-based report uploads. 

B. SNMP access limited by access lists. 

C. Packet encryption. 

D. Running SNMP service on a non-standard port is possible. 

View Answer

Q8. - (Topic 6) 

You are the administrator in charge of a FortiGate acting as an IPsec VPN gateway using route-based mode. Users from either side must be able to initiate new sessions. There is only 1 subnet at either end and the FortiGate already has a default route. 

Which two configuration steps are required to achieve these objectives? (Choose two.) 

A. Create one firewall policy. 

B. Create two firewall policies. 

C. Add a route to the remote subnet. 

D. Add two IPsec phases 2. 

View Answer

Q9. - (Topic 1) 

Which statements are true regarding the factory default configuration? (Choose three.) 

A. The default web filtering profile is applied to the first firewall policy. 

B. The ‘Port1’ or ‘Internal’ interface has the IP address 192.168.1.99. 

C. The implicit firewall policy action is ACCEPT. 

D. The ‘Port1’ or ‘Internal’ interface has a DHCP server set up and enabled (on device models that support DHCP servers). 

E. Default login uses the username: admin (all lowercase) and no password. 

View Answer

Q10. - (Topic 21) 

Which statements are true regarding IPv6 anycast addresses? (Choose two.) 

A. Multiple interfaces can share the same anycast address. 

B. They are allocated from the multicast address space. 

C. Different nodes cannot share the same anycast address. 

D. An anycast packet is routed to the nearest interface. 

View Answer