NEW QUESTION 1

What is the primary FortiGate election process when the HA override setting is disabled?

• A. Connected monitored ports > System uptime > Priority > FortiGate Serial number
• B. Connected monitored ports > HA uptime > Priority > FortiGate Serial number
• C. Connected monitored ports > Priority > HA uptime > FortiGate Serial number
• D. Connected monitored ports > Priority > System uptime > FortiGate Serial number

Answer: B

Explanation:
Reference: http://myitmicroblog.blogspot.com/2018/11/what-should-you-know-about-ha-override.html

NEW QUESTION 2

Refer to the exhibit, which contains a static route configuration.

An administrator created a static route for Amazon Web Services. What CLI command must the administrator use to view the route?

• A. get router info routing-table all
• B. get internet service route list
• C. get router info routing-table database
• D. diagnose firewall proute list

Answer: D

Explanation:
Reference: https://docs.fortinet.com/document/fortigate/latest/administration-guide/139692/routing-concepts

NEW QUESTION 3

Which two VDOMs are the default VDOMs created when FortiGate is set up in split VDOM mode? (Choose two.)

• A. FG-traffic
• B. Mgmt
• C. FG-Mgmt
• D. Root

Answer: AD

Explanation:
Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/758820/split-task-vdom-mode

NEW QUESTION 4

Refer to the exhibit.

Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

• A. There are five devices that are part of the security fabric.
• B. Device detection is disabled on all FortiGate devices.
• C. This security fabric topology is a logical topology view.
• D. There are 19 security recommendations for the security fabric.

Answer: CD

Explanation:
References: https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/761085/results
https://docs.fortinet.com/document/fortimanager/6.2.0/new-features/736125/security-fabric-topology

NEW QUESTION 5

Refer to the exhibit.

The global settings on a FortiGate device must be changed to align with company security policies. What does the Administrator account need to access the FortiGate global settings?

• A. Change password
• B. Enable restrict access to trusted hosts
• C. Change Administrator profile
• D. Enable two-factor authentication

Answer: C

Explanation:
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD34502

NEW QUESTION 6

Refer to the exhibit.

Examine the intrusion prevention system (IPS) diagnostic command.
Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?

• A. The IPS engine was inspecting high volume of traffic.
• B. The IPS engine was unable to prevent an intrusion attack.
• C. The IPS engine was blocking all traffic.
• D. The IPS engine will continue to run in a normal state.

Answer: A

Explanation:
Reference:
https://docs.fortinet.com/document/fortigate/6.2.3/cookbook/232929/troubleshooting-high-cpu-usage

NEW QUESTION 7

Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)

• A. DNS
• B. ping
• C. udp-echo
• D. TWAMP

Answer: CD

NEW QUESTION 8

In which two ways can RPF checking be disabled? (Choose two )

• A. Enable anti-replay in firewall policy.
• B. Disable the RPF check at the FortiGate interface level for the source check
• C. Enable asymmetric routing.
• D. Disable strict-arc-check under system settings.

Answer: CD

Explanation:
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD33955

NEW QUESTION 9

Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)

• A. Log downloads from the GUI are limited to the current filter view
• B. Log backups from the CLI cannot be restored to another FortiGate.
• C. Log backups from the CLI can be configured to upload to FTP as a scheduled time
• D. Log downloads from the GUI are stored as LZ4 compressed files.

Answer: AB

NEW QUESTION 10

Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?

• A. Subject Key Identifier value
• B. SMMIE Capabilities value
• C. Subject value
• D. Subject Alternative Name value

Answer: A

NEW QUESTION 11

Refer to the exhibit, which contains a session diagnostic output.

Which statement is true about the session diagnostic output?

• A. The session is a UDP unidirectional state.
• B. The session is in TCP ESTABLISHED state.
• C. The session is a bidirectional UDP connection.
• D. The session is a bidirectional TCP connection.

Answer: C

NEW QUESTION 12

A team manager has decided that, while some members of the team need access to a particular website, the majority of the team does not Which configuration option is the most effective way to support this request?

• A. Implement a web filter category override for the specified website
• B. Implement a DNS filter for the specified website.
• C. Implement web filter quotas for the specified website
• D. Implement web filter authentication for the specified website.

Answer: D

NEW QUESTION 13

An administrator has a requirement to keep an application session from timing out on port 80. What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)

• A. Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy.
• B. Create a new service object for HTTP service and set the session TTL to never
• C. Set the TTL value to never under config system-ttl
• D. Set the session TTL on the HTTP policy to maximum

Answer: BC

NEW QUESTION 14

Which statement regarding the firewall policy authentication timeout is true?

• A. It is an idle timeou
• B. The FortiGate considers a user to be “idle” if it does not see any packets coming from the user’s source IP.
• C. It is a hard timeou
• D. The FortiGate removes the temporary policy for a user’s source IP address after this timer has expired.
• E. It is an idle timeou
• F. The FortiGate considers a user to be “idle” if it does not see any packets coming from the user’s source MAC.
• G. It is a hard timeou
• H. The FortiGate removes the temporary policy for a user’s source MAC address after this timer has expired.

Answer: A

NEW QUESTION 15

When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?

• A. Log ID
• B. Universally Unique Identifier
• C. Policy ID
• D. Sequence ID

Answer: B

Explanation:
Reference: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/554066/firewall-policies

NEW QUESTION 16

Refer to the exhibit.


The exhibits show a network diagram and the explicit web proxy configuration.
In the command diagnose sniffer packet, what filter can you use to capture the traffic between the client and the explicit web proxy?

• A. ‘host 192.168.0.2 and port 8080’
• B. ‘host 10.0.0.50 and port 80’
• C. ‘host 192.168.0.1 and port 80’
• D. ‘host 10.0.0.50 and port 8080’

Answer: A

NEW QUESTION 17
......