Q1. - (Topic 6) 

You are the administrator in charge of a FortiGate acting as an IPsec VPN gateway using route-based mode. Users from either side must be able to initiate new sessions. There is only 1 subnet at either end and the FortiGate already has a default route. 

Which two configuration steps are required to achieve these objectives? (Choose two.) 

A. Create one firewall policy. 

B. Create two firewall policies. 

C. Add a route to the remote subnet. 

D. Add two IPsec phases 2. 

View Answer

Q2. - (Topic 8) 

What is a valid reason for using session based authentication instead of IP based authentication in a FortiGate web proxy solution? 

A. Users are required to manually enter their credentials each time they connect to a different web site. 

B. Proxy users are authenticated via FSSO. 

C. There are multiple users sharing the same IP address. 

D. Proxy users are authenticated via RADIUS. 

View Answer

Q3. - (Topic 16) 

Which statement correctly describes the output of the command diagnose ips anomaly list? 

A. Lists the configured DoS policy. 

B. List the real-time counters for the configured DoS policy. 

C. Lists the errors captured when compiling the DoS policy. 

D. Lists the IPS signature matches. 

View Answer

Q4. - (Topic 2) 

What is the maximum number of FortiAnalyzer/FortiManager devices a FortiGate unit can be configured to send logs to? 

A. 1 

B. 2 

C. 3 

D. 4 

View Answer

Q5. - (Topic 12) 

A FortiGate is operating in NAT/Route mode and configured with two virtual LAN (VLAN) sub-interfaces added to the same physical interface. 

Which one of the following statements is correct regarding the VLAN IDs in this scenario? 

A. The two VLAN sub-interfaces can have the same VLAN ID only if they have IP addresses in different subnets. 

B. The two VLAN sub-interfaces must have different VLAN IDs. 

C. The two VLAN sub-interfaces can have the same VLAN ID only if they belong to different VDOMs. 

D. The two VLAN sub-interfaces can have the same VLAN ID if they are connected to different L2 IEEE 802.1Q compliant switches. 

View Answer

Q6. - (Topic 22) 

Which IP packets can be hardware-accelerated by a NP6 processor? (Choose two.) 

A. Fragmented packet. 

B. Multicast packet. 

C. SCTP packet. 

D. GRE packet. 

View Answer

Q7. - (Topic 3) 

In which order are firewall policies processed on a FortiGate unit? 

A. From top to down, according with their sequence number. 

B. From top to down, according with their policy ID number. 

C. Based on best match. 

D. Based on the priority value. 

View Answer

Q8. - (Topic 15) 

Which statement is an advantage of using a hub and spoke IPsec VPN configuration 

instead of a fully-meshed set of IPsec tunnels? 

A. Using a hub and spoke topology provides full redundancy. 

B. Using a hub and spoke topology requires fewer tunnels. 

C. Using a hub and spoke topology uses stronger encryption protocols. 

D. Using a hub and spoke topology requires more routes. 

View Answer

Q9. - (Topic 21) 

Which statements are correct regarding an IPv6 over IPv4 IPsec configuration? (Choose two.) 

A. The source quick mode selector must be an IPv4 address. 

B. The destination quick mode selector must be an IPv6 address. 

C. The Local Gateway IP must be an IPv4 address. 

D. The remote gateway IP must be an IPv6 address. 

View Answer

Q10. - (Topic 1) 

What are valid options for handling DNS requests sent directly to a FortiGates interface IP? (Choose three.) 

A. Conditional-forward. 

B. Forward-only. 

C. Non-recursive. 

D. Iterative. 

E. Recursive. 

View Answer