Knowledge Check Questions Flashcards
(174 cards)
1
Q
Which is more accurate description of a modern firewall?
a. A device that inspects network traffic at an entry point to the internet and within a simple, easily defined network perimeter
b. A multifunctional device that inspects network from the perimeter or internally, within a network that has many different entry points
A
b. A multifunctional device that inspects network from the perimeter or internally, within a network that has many different entry points
2
Q
Which solution, specific to Fortinet, enhances performance and reduces latency for specific features and traffic?
a. Acceleration hardware, call SPUs
b. Increased RAM and CPU power
A
a. Acceleration hardware, call SPUs
3
Q
Which protocol does FortiGate use to download antivirus and IPS packages?
a. UDP
b. TCP
A
b. TCP
Larger packages to download = TCP
4
Q
How does FortiGate check content for spam or malicious websites?
a. Live queries to FortiGate over UDP or HTTPS
b. Local verification using a downloaded web filter database locally on the FortiGate
A
a. Live queries to FortiGate over UDP or HTTPS
5
Q
How do you restrict logins to FortiGate from only specific IP addresses?
a. Change FortiGate management interface IP address
b. Configure trusted host
A
b. Configure trusted host
6
Q
As a best security practice when configuring administrative access to the FortiGate, which protocol should you disable?
a. Telnet
b. SSH
A
a. Telnet
7
Q
When configuring FortiGate as a DHCP server, to restrict access by MAC address, what does the Assign IP option do?
a. Assigns a specific IP address to a MAC address
b. Dynamically assigns an IP to a MAC address
A
b. Dynamically assigns an IP to a MAC address
8
Q
When configuring FortiGate as a DNS server which resolution method uses the FortiGate DNS database to try to resolve queries?
a. Non-recursive
b. Recursive
A
a. Non-recursive
9
Q
When restoring an encrypted system configuration file, in addition to needing the FortiGate model and firmware version from the time the configuration was produced, what must you also provide?
a. The password to decrypt the file
b. The private decryption key to decrypt the file
A
a. The password to decrypt the file
10
Q
Which document should you consult to increase the changes or success before upgrading or downgrading firmware?
a. Cookbook
b. Release Notes
A
b. Release Notes
11
Q
What is the Fortinet Security Fabric?
a. A device that can manage all your firewalls
b. A Fortinet solution that enables communication and visibility among devices of your network
A
b. A Fortinet solution that enables communication and visibility among devices of your network
12
Q
Which combination of devices must participate in the Security Fabric?
a. A FortiAnalyzer and two or more FortiGate devices
b. a FortiMail and two or more FortiGate devices
A
a. A FortiAnalyzer and two or more FortiGate devices
13
Q
What are the two mandatory settings of the Security Fabric configuration?
a. Fabric name and Security Fabric role
b. Fabric name and FortiManager IP address
A
a. Fabric name and Security Fabric role
14
Q
From where do you authorize a device to participate in the Security Fabric?
a. From the downstream FortiGate
b. From the root FortiGate
A
b. From the root FortiGate
15
Q
Why should an administrator extend the Security Fabric to other devices?
a. To provide a single pane of glass for management and reporting purposes
b. To eliminate the need to purchase licenses for FortiGate devices in the Security Fabric
A
a. To provide a single pane of glass for management and reporting purposes
16
Q
What is the purpose of Security Fabric external connectors?
a. External connectors allow you to integrate multi-cloud support with the Security Fabric
b. External connectors allow you to connect the FortiGate command line interface (CLI)
A
a. External connectors allow you to integrate multi-cloud support with the Security Fabric
17
Q
Which one is a part of the Security Rating scorecard?
a. Firewall Policy
b. Optimization
A
b. Optimization
18
Q
From which view can an administrator deauthorize a device from the Security Fabric?
a. From the physical topology view
b. From the Fortiview
A
a. From the physical topology view
19
Q
What criteria does FortiGate use to match traffic to a firewall policy?
a. Source and destination interfaces
b. Security profiles
A
a. Source and destination interfaces
20
Q
What must be selected in the Source field of a firewall policy?
a. At least one address object or ISDB
b. At least one source user and one source address object.
A
a. At least one address object or ISDB
21
Q
To configure a firewall policy, you must include a firewall policy name when configuring using the ….
a. CLI
b. GUI
A
b. GUI
22
Q
What is the purpose of applying security profiles to a firewall policy?
a. To allow access to specific subnets
b. To protect your network from threats, and control access to specific applications and URLs.
A
b. To protect your network from threats, and control access to specific applications and URLs.
23
Q
If you configure a firewall policy with the any interface, you can view the firewall policy list only in which view?
a. The By Sequence View
b. The Interface Pair View
A
a. The By Sequence View
24
Q
Which of the following naming formats is correct when configuring a name for a firewall address object?
a. Good_Training
b. Good(Training)
A
a. Good_Training
25
What is the purpose of the policy lookup feature on the FortiGate?
a. To find a matching policy based on input criteria
b. To block traffic based on input criteria
a. To find a matching policy based on input criteria
26
What is NAT used for?
a. Preserving IP addresses
b. Traffic shaping
a. Preserving IP addresses
27
What statement about NAT66 is true?
a. It is NAT between two IPv6 networks?
b. It is NAT between two IPv4 networks?
a. It is NAT between two IPv6 networks?
28
What is the default IP pool type?
a. One-to-one
b. Overload
b. Overload
29
Which of the following is the default VIP type?
a. static-nat
b. load-balance
a. static-nat
30
Which statement is true?
a. Central NAT is not enabled by default
b. Both central NAT and firewall policy NAT can be enabled together
a. Central NAT is not enabled by default
31
What happens if there is no matching central SNAT policy or no central SNAT policy configured?
a. The egress interface IP will be used
b. NAT will not be applied to the firewall session
b. NAT will not be applied to the firewall session
32
Which method would you use for advanced application tracking and control?
a. session helper
b. Application Layer Gateway
b. Application Layer Gateway
33
Which profile is an example of application layer gateway?
a. WAF Profile
b. VOIP Profile
b. VOIP Profile
34
If session diagnostic output indicates that a TCP protocol state is in proto_state=01, which is true?
a. The session is established
b. The session is not established
a. The session is established
35
An administrator wants to check the total number of TCP session for an IP pool named INTERNAL. Which CLI command should the administrator use?
a. diagnose firewall ippool-all stats INTERNAL
b. diagnose firewall ippool-all list INTERNAL
a. diagnose firewall ippool-all stats INTERNAL
36
Which firewall authentication method does FortiGate support?
a. Local password authentication
b. Biometric authentication
a. Local password authentication
37
Which type of token can generate OTPs to provide two-factor authentication to users in your network?
a. FortiToken Mobile
b. USB FortiToken
a. FortiToken Mobile
38
When FortiGate uses a RADIUS server for remote authentication, which statement about RADIUS is true?
a. FortiGate must query the remote RADIUS server using the distinguished name (dn)
b. RADIUS group memberships are provided by vendor-specific attributes (VSAs) configured on the RADIUS server.
b. RADIUS group memberships are provided by vendor-specific attributes (VSAs) configured on the RADIUS server.
39
Which is a valid reply from a RADIUS server to an ACCESS-REQUEST packet from FortiGate?
a. ACCESS-PENDING
b. ACCESS-REJECT
b. ACCESS-REJECT
40
A remote LDAP user is trying to authenticate with a username and password. How does FortiGate verify the login credentials?
a. FortiGate queries its own database for user credentials
b. FortiGate sends the user-entered credential to the remote server for verification
b. FortiGate sends the user-entered credential to the remote server for verification
41
Which statement about guest user groups is true?
a. Guest user group accounts are temporary
b. Guest user group account passwords are temporary?
a. Guest user group accounts are temporary
42
Guest accounts are most commonly user for which purposes?
a. To provide temporary visitor access to corporate network resources
b. To provide temporary visitor access to wireless networks
b. To provide temporary visitor access to wireless networks
43
Firewall policies dictate whether a user or device can or cannot authenticate on a network. Which statement about firewall authentication is true?
a. Firewall policies can be configured to authenticate certificate users
b. The order of the firewall policies always determines whether a user's credentials are determined actively or passively.
a. Firewall policies can be configured to authenticate certificate users
44
Which statement about active authentication is true?
a. Active authentication is always used before passive authentication
b. The firewall policy must allow HTTP, HTTPS, FTP and/or Telnet protocols in order for the user to be prompted for credentials
b. The firewall policy must allow HTTP, HTTPS, FTP and/or Telnet protocols in order for the user to be prompted for credentials
45
Which statement about captive portal is true?
a. Captive portal must be hosted on a FortiGate device?
b. Captive portal can exempt specific devices from authenticating
b. Captive portal can exempt specific devices from authenticating
46
Which statement best describes the authentication idle timeout feature on FortiGate?
a. The length of time FortiGate waits for the user to enter their authentication credentials
b. The length of time an authenticated user is allowed to remain authenticated without any packets being generated by the host device.
b. The length of time an authenticated user is allowed to remain authenticated without any packets being generated by the host device.
47
Which command would you use to identify the IP addresses of all authenticated users?
a. diagnose firewall auth clear
b. diagnose firewall auth list
b. diagnose firewall auth list
48
Which type of logs are application control, web filter, antivirus, and DLP?
a. Event
b. Security
b. Security
49
The log ____ contains fields that are common to all log types, such as originating date and time, log identifier, log category and VDOM
a. header
b. body
a. header
50
Which storage type is preferred for logging?
a. Remote logging
b. Hard drive
a. Remote logging
51
Which protocol does FortiGate use to send encrypted logs to FortiAnalyzer?
a. OFTPS
b. SSL
a. OFTPS
52
If you enable reliable logging, which transport protocol will FortiGate use?
a. UDP
b. TCP
b. TCP
53
In your firewall policy, which setting must you enable to generate logs on traffic sent through that firewall policy?
a. Log Allowed Traffic
b. Event Logging
a. Log Allowed Traffic
54
With email alerts, you can trigger alert emails based on _____ or log severity level.
a. event
b. threat weight
a. event
55
What happens when logs roll?
a. It lowers the space requirements needed to contain those logs.
b. They are uploaded to a TFP server?
a. It lowers the space requirements needed to contain those logs.
56
When you download logs on the GUI, ___
a. all logs in the SQL database are downloaded
b. only your current view, including any filters set are downloaded
b. only your current view, including any filters set are downloaded
57
Which attribute or extension identifies the owner of a certificate?
a. The subject name in the certificate
b. The unique serial number in the certificate
a. The subject name in the certificate
58
How does FortiGate determine if a certificate has been revoked?
a. It checked the CRL that resides on the FortiGate
b. It retrieves the CRL from a directory server
a. It checked the CRL that resides on the FortiGate
59
Which certificate extension and value is required in the FortiGate CA certificate in order to enable full SSL inspection?
a. CRL DP=ca_arl.arl
b. cA=True
b. cA=True
60
Which configuration requires FortiGate to act as a CA for full SSL inspection?
a. Multiple clients connecting to multiple servers
b. Protecting the SSL server
a. Multiple clients connecting to multiple servers
61
Which is the default inspection mode on a firewall policy?
a. Proxy based
b. Flow based
b. Flow based
62
How does NGFW policy-based mode differ from profile-based mode?
a. Policy-based flow inspection supports web profile overrides.
b. Policy-based flow inspection defines URL filters directly in the firewall policy
b. Policy-based flow inspection defines URL filters directly in the firewall policy
63
Which statement about proxy-based web filtering is true?
a. It requires more resources than flow-based
b. It transparently analyzes the TCP flow of the traffic
a. It requires more resources than flow-based
64
Which is a valid action for FortiGuard web category filtering?
a. Allow
b. Deny
a. Allow
65
Which is a valid action for static URL filtering?
a. Exempt
b. Warning
a. Exempt
66
Which action can be used with the FortiGuard quota feature?
a. Monitor
b. Shape
a. Monitor
67
Which statement about web profile overrides is true?
a. It is used to change the website category
b. Configured users can activate this setting through an override link on the FortiGuard block page.
b. Configured users can activate this setting through an override link on the FortiGuard block page.
68
Which is required to configure YouTube video filtering?
a. YouTube API key
b. Username
a. YouTube API key
69
Which action can be used with the video FortiGuard categories?
a. Authenticate
b. Monitor
b. Monitor
70
Which statement about blocking the known botnet command and control domains is true?
a. DNS lookups are checked against the botnet command and control database
b. The botnet command and control domains can be enabled on the web filter profile
a. DNS lookups are checked against the botnet command and control database
71
Which security profile inspects only the fully qualified domain name?
a. Web Filter
b. DNS Filter
b. DNS Filter
72
You have configured your security profiles, but they are not performing web or DNS inspection. Why?
a. The certificate is not installed correctly
b. the profile is not associated with the correct firewall policy
b. the profile is not associated with the correct firewall policy
73
Which statement about application control is true?
a. Application control uses the IPS engine to scan traffic for application patterns
b. Application control is unable to scan P2P architecture traffic
a. Application control uses the IPS engine to scan traffic for application patterns
74
Which statement about the application control database is true?
a. The application control database is separate from the IPS database
b. The application control database must be manually updated
a. The application control database is separate from the IPS database
75
Which statement about application control in an NGFW policy-based configuration is true?
a. Applications are applied directly to the security policies
b. The application control profile must be applied to firewall policies
a. Applications are applied directly to the security policies
76
Which statement about the HTTP block page for application control is true?
a. It can be used only for web applications
b. It works for all types of applications
a. It can be used only for web applications
77
Where do you enable logging of application control events?
a. Application control logs are enabled in the firewall policy configuration
b. Application control logs are enabled on the FortiView Applications page on FortiGate
a. Application control logs are enabled in the firewall policy configuration
78
Which piece of information is not included in the application event log when using NGFW policy-based mode?
a. Application control profile name
b. Application name
a. Application control profile name
79
Which protocol does FortiGate use with FortiGuard to receive updates for application control?
a. UDP
b. TCP
b. TCP
80
Which SSL/SSH inspection method is recommended for use with application control scanning to improve application detection?
a. Certificate-based inspection profile
b. Deep-inspection profile
b. Deep-inspection profile
81
If antivirus, grayware, and AI scans enabled, in what order are they performed?
a. AI scan, followed by grayware scan, followed by antivirus scan
b. Antivirus scan, followed by grayware scan, followed by AI scan
b. Antivirus scan, followed by grayware scan, followed by AI scan
82
Which databases can be manually selected for use in antivirus scanning?
a. Extended and Extreme
b. Quick, Normal and Extreme
a. Extended and Extreme
83
What three additional features of an antivirus profile are available in proxy-based inspection mode?
a. MAPI, SSH and CDR
b. Full and quick
a. MAPI, SSH and CDR
84
What antivirus database is limited to specific FortiGate models>
a. Extended
b. Extreme
b. Extreme
85
What is the default scanning behavior for files over 10MB?
a. Allow the file without scanning
b. Block all large files that exceed the buffer threshold
a. Allow the file without scanning
86
Which type of inspection mode can be offloaded using NTurbo hardware acceleration?
a. Proxy-based
b. Flow-based
b. Flow-based
87
What does the logging of oversized files option do?
a. Enables logging of all files that cannot be scanned because of oversize limit
b. Log all files that are over 5MB
a. Enables logging of all files that cannot be scanned because of oversize limit
88
What command do you use to force FortiGate to check for new antivirus updates?
a. execute update antivirus
b. execute update-av
b. execute update-av
89
Which IPS action allows traffic and logs the activity?
a. Allow
b. Monitor
b. Monitor
90
Which IPS component is updated most frequently?
a. Protocol decoders
b. IPS signature database
b. IPS signature database
91
Which behavior is a characteristic of a DoS attack?
a. Attempts to exploit a known application vulnerability
b. Attempts to overload a server with TCP SYN packets
b. Attempts to overload a server with TCP SYN packets
92
Which DoS anomaly sensor can be used to detect and block the probing attempts of a port scanner?
a. tcp_syn_flood
b. tcp_port_scan
b. tcp_port_scan
93
WAF protocol constraints protect against which type of attacks?
a. Buffer overflow
b. ICMP Sweep
a. Buffer overflow
94
To use the WAF feature, which inspection mode should be used in the firewall policy?
a. Flow
b. Proxy
b. Proxy
95
Which chipset uses NTurbo to accelerate IPS sessions?
a. CP9
b. SoC4
b. SoC4
96
Which feature requires full SSL inspection to maximize its detection capability?
a. WAF
b. DoS
a. WAF
97
Which FQDN does FortiGate use to obtain IPS updates?
a. update.fortiguard.net
b. service.fortiguard.com
a. update.fortiguard.net
98
When IPS fail open is triggered, what is the expected behavior, if the IPS fail-open option is set to enabled?
a. New packets pass through without inspection
b. New packets dropped
a. New packets pass through without inspection
99
What does a VPN do?
a. Extends a private network across a public network
b. Protects a network from external attacks
a. Extends a private network across a public network
100
Which statement about SSL VPNs is true?
a. A SSL VPN can be established between workstation and a FortiGate device only.
b. A SSL VPN can be established between an end-user workstation and a FortiGate device or two FortiGate devices
b. A SSL VPN can be established between an end-user workstation and a FortiGate device or two FortiGate devices
101
A web-mode SSL VPN user connects to a remote web server. What is the source IP address of the HTTP request the web server receives?
a. The remote user IP address
b. The FortiGate device internal IP address
b. The FortiGate device internal IP address
102
Which statement about tunnel-mode SSL VPN is correct?
a. It supports split tunneling
b. It requires bookmarks
a. It supports split tunneling
103
A web-mode SSL VPN user uses ____ to access internal network resources
a. bookmarks
b. FortiClient
a. bookmarks
104
Which step is necessary to configure SSL VPN connections?
a. Create a firewall policy from the SSL VPN interface to the internal interface
b. Enable event logs for SSL VPN traffic: users, VPN and endpoints
a. Create a firewall policy from the SSL VPN interface to the internal interface
105
Which action may allow internet access in tunnel mode, if the remote network does not allow internet access to SSL VPN users?
a. Enable split tunneling
b. Configure the DNS server to use the same DNS server as the client system DNS
a. Enable split tunneling
106
What does the SSL VPN monitor feature allow you to do?
a. Monitor SSL VPN user actions, such as authentication
b. Force SSL VPN user disconnections
b. Force SSL VPN user disconnections
107
Which statement about SSL VPN timers is correct?
a. SSL VPN timers can prevent logouts when SSL VPN users experience long network latency
b. The login timeout is a non-customizable hard value
a. SSL VPN timers can prevent logouts when SSL VPN users experience long network latency
108
Which component issues and signs the client certificate?
a. FortiClient EMS
b. FortiClient
a. FortiClient EMS
109
Which internet browser supports Fortinet ZTNA?
a. Firefox
b. Chrome
b. Chrome
110
What does FortiClient EMS integration ensure?
a. Device identification
b. User identification
a. Device identification
111
Which objects can you use to create static routes?
a. ISDB objects
b. Service objects
a. ISDB objects
112
When the STOP POLICY ROUTING action is used in a policy route, which behavior is expected?
a. FortiGate skips over this policy route and tries to match another in the list
b. FortiGate routes the traffic based on the regular routing table
b. FortiGate routes the traffic based on the regular routing table
113
The PRIORITY attribute applies to which type of routes?
a. Static
b. Dynamic
a. Static
114
Which attribute does FortiGate use to determine the 'best' route for a packet, if it matches multiple dynamic routes that have the same DISTANCE?
a. Priority
b. Metric
b. Metric
115
Which static route attribute does not appear on the GUI routing monitor?
a. Distance
b. Priority
b. Priority
116
What is the default ECMP method on FortiGate?
a. Weighted
b. Source IP
b. Source IP
SSWU - Source IP (default), Source-Dest IP, Weighted, Usage (spillover)
117
How does FortiGate load balance traffic when using the spillover method in ECMP routing?
a. Sessions are distributed based on interface threshold
b. Sessions are distributed based on route weight
a. Sessions are distributed based on interface threshold
SSWU - Source IP (default), Source-Dest IP, Weighted, Usage (spillover)
118
What is the default RPF check method on FortiGate?
a. Loose
b. Strict
a. Loose
119
Which route lookup scenario satisfies the RPF check for a packet?
a. Routing table has an active route for the destination IP of the packet
b. Route table has an active route for the source IP of the packet
b. Route table has an active route for the source IP of the packet
120
What is the purpose of the link health monitor setting 'update-static-route'?
a. It creates a new static route for the backup interface
b. It removes all static routes associated with the link health monitor's interface
b. It removes all static routes associated with the link health monitor's interface
121
When using link health monitoring, which route attribute must you also configure to achieve route failover protection?
a. Distance
b. Metric
a. Distance
122
What is the distance value for this route?
10. 200.2.0/24 [110/2] via 10.200.2.254, [25/0]
a. 110
b. 2
a. 110
123
Which CLI commands can you use to view standby and inactive routes?
a. get router info routing-table all
b. get router info routing-table database
b. get router info routing-table database
124
Which CLI packet capture verbosity level prints interface names?
a. 3
b. 4
b. 4
125
What do SSL VPN realms facilitate?
SSL VPN realms allow access to different SSL VPN portals by user groups.
126
Which FortiGate interface allows administrators to create user-specific bookmarks?
a. CLI
b. GUI
a. CLI
127
Why is it necessary to run a client integrity check (host-check)?
a. To check whether specific security software is running on SSL VPN user computers
b. To check whether a specific security certificate is running on a SSL VPN user web browsers
a. To check whether specific security software is running on SSL VPN user computers
128
Which security action restricts SSL VPN connections from users located in a specific country or region?
a. Restricting hosts by MAC address
b. Restricting hosts by IP address
b. Restricting hosts by IP address
129
Which traffic is always generated from the management VDOM?
a. Link Health Monitor
b. FortiGuard
b. FortiGuard
130
Which statement about the management VDOM is true?
a. It is root by default and cannot be changed in multi-vdom mode?
b. it is root by default, but can be changed to any VOM in multi-vdom mode.
b. it is root by default, but can be changed to any VOM in multi-vdom mode.
131
Which type of administrator can make changes to all VDOMs?
a. A custom VDOM administrator
b. An administrator with the super_admin profile
b. An administrator with the super_admin profile
132
Which statement about VDOM administrator is true?
a. There can be only one administrator per VDOM
b. Each VDOM can have multiple administrators
b. Each VDOM can have multiple administrators
133
Which configuration settings are global settings?
a. Firewall policies
b. FortiGuard settings?
b. FortiGuard settings?
134
Which configuration settings are per-VDOM settings?
a. Host name
b. NGFW mode
b. NGFW mode
135
What is a requirement for creating an inter-VDOM link between two VDOMs?
a. The NGFW mode of at least one VDOM must be profile based
b. At least one of the VDOMs must be operating in NAT mode
b. At least one of the VDOMs must be operating in NAT mode
136
Which type of VDOM link requires that both sides of the link be assigned an IP address within the same subnet?
a. NAT-to-transparent
b. NAT-to-NAT
b. NAT-to-NAT
137
Of these options, what is a possible reason why an administrator might not be able to gain access to a specific VDOM?
a. The administrator is using an IP address that is not specified as a trusted host
b. The administrator is using the super_admin profile
a. The administrator is using an IP address that is not specified as a trusted host
138
Which troubleshooting tool is most suitable when trying to verify the firewall policy used by an inter-VDOM link?
a. Sniffer trace
b. Packet flow trace
b. Packet flow trace
139
Which mode must the FortiGate VDOM be operating in, to route traffic between VLANs?
a. Transparent mode
b. NAT mode
b. NAT mode
140
What is the default STP mode for FortiGate?
a. FortiGate passively forwards BPDUs
b. FortiGate has all STP functions disabled?
b. FortiGate has all STP functions disabled?
141
Which statement about FortiGate operating in transparent mode is true?
a. It has a management IP address
b. Each interface has its own IP address
a. It has a management IP address
142
How can an administrator configure FortiGate to have four interfaces in the same broadcast domain?
a. Create a firewall policy on each of the four interfaces?
b. Configure the operation mode as transparent and use the same forward domain ID
b. Configure the operation mode as transparent and use the same forward domain ID
143
Which configuration setting must be enabled to allow VLAN-tagged traffic through a virtual wire pair?
a. Transparent bridging
b. Wildcard VLAN
b. Wildcard VLAN
144
How is traffic handled in a virtual wire pair?
a. Incoming traffic to one interface is always forwarded out through the other interface.
b. Traffic is forwarded based on the destination MAC address.
a. Incoming traffic to one interface is always forwarded out through the other interface.
145
In which operating mode is the software switch function supported?
a. Transparent mode
b. NAT mode
b. NAT mode
146
Which interface can be a member of a software switch?
a. VLAN interface
b. Wireless interface
b. Wireless interface
147
In FSSO, FortiGate allows network access based on
a. Active authentication with username and password
b. Passive user identification by user ID, IP address and group membership
b. Passive user identification by user ID, IP address and group membership
148
Which working mode is used for monitoring user sign-on activities in Windows AD?
a. Polling mode (collector agent-based or agentless)
b. eDirectory agent mode
a. Polling mode (collector agent-based or agentless)
149
Which is the recommended mode for FSSO deployments?
a. DC agent mode
b. Polling mode: Agentless
a. DC agent mode
150
Which FSSO mode requires more FortiGate system resources (CPU and RAM)?
a. Polling mode: Collector agent-based
b. Polling mode: Agentless
b. Polling mode: Agentless
151
What may cause an NTLM authentication to occur?
a. Traffic coming from an IP on the FSSO user list
b. Traffic coming from an IP not on the FSSO user list
b. Traffic coming from an IP not on the FSSO user list
152
When performing NTLM authentication, what information does the web browser supply to the FortiGate?
a. The user's credentials (username and password)
b. The user's user ID, IP address and group membership
a. The user's credentials (username and password)
153
If you have collector agents using either the DC agent mode or the collector agent-based polling mode, which fabric connector should you select on the Fortigate?
a. Poll Active Directory Server
b. Fortinet Single Sign-On Agent
b. Fortinet Single Sign-On Agent
154
Which naming conventions does the FSSO collector agent use to access the Windows AD in Standard access mode?
a. Windows convention - NetBios: Domain\groups
b. LDAP convention: CN=User, OU=Name, DC=Domain
a. Windows convention - NetBios: Domain\groups
155
Which logging level shows the login events on the collector agent?
a. Information
b. Warning
a. Information
156
The command 'diagnose debug fsso-polling details' displays information for which mode of FSSO?
a. Agentless polling
b. Collector agent-based polling
a. Agentless polling
157
To form a HA cluster, 'all' FortiGate devices that will be included in the cluster must have which of the following?
a. The same FortiGate hostname
b. The same firmware
b. The same firmware
158
What is the default criteria (override disabled) for selecting the HA primary device in a HA cluster?
a. Connected monitored ports > HA uptime > priority > serial number
b. Priority > HA uptime > connected monitored ports > serial number
a. Connected monitored ports > HA uptime > priority > serial number
159
Which information is synchronized between two FortiGate devices that below to the same HA cluster?
a. Firewall policies and objects
b. FortiGate hostname
a. Firewall policies and objects
160
Which one of the following session types can be synchronized in a HA cluster?
a. SSL VPN sessions
b. IPsec VPN sessions
b. IPsec VPN sessions
161
An HA failover occurs when the link status of a monitored interface on the ___ goes down.
a. Primary FortiGate
b. Secondary FortiGate
a. Primary FortiGate
162
You can configure virtual clustering between only ___ FortiGate devices with multiple VDOMs in an active-passive HA cluster.
a. Two
b. Four
a. Two
163
The heartbeat interface IP address 169.254.0.1 is assigned to which FortiGate in a HA cluster?
a. The FortiGate with the highest serial number
b. The FortiGate with the highest priority
a. The FortiGate with the highest serial number
164
Which statement about the firmware upgrade process on a HA cluster is true?
a. You need to upload the new firmware only to the primary FortiGate to upgrade a HA Cluster
b. The cluster members are not rebooted
a. You need to upload the new firmware only to the primary FortiGate to upgrade a HA Cluster
165
Which CLI command can be used to diagnose a physical layer problem?
a. execute traceroute
b. get hardware nic
b. get hardware nic
166
Which CLI command can be used to determine the MAC address of a FortiGate default gateway?
a. get system arp
b. get hardware nic
a. get system arp
167
Which information is displayed in the output of a debug flow?
a. Incoming interface and matching firewall policy
b. Matching security profile and traffic log
a. Incoming interface and matching firewall policy
168
When is a new TCP session allocated?
a. When a SYN packet is allowed
b. When a SYN/ACK packet is allowed
a. When a SYN packet is allowed
169
Which action does FortiGate take during memory conserve mode?
a. Configuration changes are not allowed
b. Administrative access is denied
a. Configuration changes are not allowed
170
Which threshold is used to determine when FortiGate enters conserve mode?
a. Green
b. Red
b. Red
171
Which types of information are stored in the crash log?
a. Process crashes and conserve mode events
b. Traffic logs and security logs
a. Process crashes and conserve mode events
172
Which protocol is used to upload new firmware from the console?
a. HTTP/HTTPS
b. TFTP
b. TFTP
173
What IPsec protocol is not support by FortiGate?
a. IKEv2
b. AH
b. AH
174
Which VPN topology is the most fault tolerant?
a. Full mesh
b. Hub-and-spoke
a. Full mesh
