EMT Practice Test

1. Question Content...

---

Question1: View the following exhibit:

Which two statements about the BGP peer are true? (Choose two.)

Question2: Refer to the exhibit, which shows partial outputs from two routing debug commands.


Why is the port2 default route not in the second command output?

Question3: Examine the partial output from the IKE real time debug shown in the exhibit; then answer the question below.


Why didn't the tunnel come up?

Question4: Which statement is true regarding File description (FD) conserve mode?

Question5: View the exhibit, which contains a session entry, and then answer the question below.

What statements are correct regarding this session? (Choose two.)

Question6: Refer to the exhibit, which contains the partial output of an IKE real-time debug.


The administrator does not have access to the remote gateway. Based on the debug output, which configuration change can the administrator make to the local gateway to resolve the phase 1 negotiation error?

Question7: View the following exhibit, which contains the sniffer output for a passive mode FTP request.

An administrator has created the following custom IPS signature to block all FTP requests for passive mode: F-SBID (--attack_id 1002; --name "Block.FTP "; --protocol tcp; --flow from_client; --pattern
"PASV"; --no_case;) Soon after the signature is enabled in an active IPS sensor, some false positive detections are generated.
Which option and value pair will allow more specific detection?

Question8: Which two events can trigger an HA failover? (Choose two.)

Question9: Refer to the exhibit, which shows the output of a diagnose command.

What can be concluded about the debug output in this scenario?

Question10: View the exhibit, which contains the sniffer output for a passive mode FTP request, and then answer the question below.

An administrator has created the following custom IPS signature to block all FTP requests for passive mode:
F-SBID (--attack_id 1002; --name "Block.FTP "; --protocol tcp; --flow from_client; --pattern "PASV"; -- no_case;) Soon after the signature is enabled in an active IPS sensor, some false positive detections are generated.
Which of the following option and value pairs will allow more specific detection?

Question11: Refer to the exhibits.





The exhibits show a network diagram, the output from the command config system ha, and a firewall policy.
What source MAC address does the web server detect when a user accesses it?

Question12: In which two states is a given session categorized as ephemeral? (Choose two.)

Question13: Refer to the exhibit, which shows a partial web filter profile configuration.


Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?

Question14: Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)

Question15: Refer to the exhibit, which contains partial outputs from two routing debug commands.

Which outbound interface will FortiGate use to route web traffic from internal users to the Internet?

Question16: Which layer of the FortiOS architecture does an application process or daemon run on?

Question17: View the following exhibit:

Given the output showing a real-time debug, which statement describes why the update is failing?

Question18: What is an OSPF area border router?

Question19: A static route is configured for a FortiGate unit from the CLI using the following commands.
config router static
edit 1
set device "wan1"
set distance 20
set gateway 192.168.100.1
next
end
Which of the following conditions are required for this static default route to be displayed in the FortiGate unit's routing table? (Choose two.)

Question20: Refer to the exhibit, which shows the output of a debug command.

Which two statements about the output are true? (Choose two.)

Question21: Refer to the exhibits, which show the configuration on FortiGate and partial internet session information from a user on the internal network.

An administrator would like to test session failover between the two service provider connections.
What changes must the administrator make to force this existing session to immediately start using the other interface? (Choose two.)

Question22: Which statement about administrative domains (ADOMs) on FortiManager is true?

Question23: View the exhibit, which contains the output of a real-time debug, and then answer the question below.

Which of the following statements is true regarding this output? (Choose two.)

Question24: Refer to the exhibits, which show the configuration on FortiGate and partial session information for internet traffic from a user on the internal network.

If the priority on route ID 2 were changed from 10 to 0, what would happen to traffic matching that user session?

Question25: Examine the following partial outputs from two routing debug commands; then answer the question below.
# get router info kernel
tab=254 vf=0 scope=0type=1 proto=11 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.1.254 dev=2(port1) tab=254 vf=0 scope=0type=1 proto=11 prio=10 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.2.254 dev=3(port2) tab=254 vf=0 scope=253type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/.->10.0.1.0/24 pref=10.0.1.254 gwy=0.0.0.0 dev=4(port3)
# get router info routing-table all s*0.0.0.0/0 [10/0] via 10.200.1.254, portl [10/0] via 10.200.2.254, port2,
[10/0] dO.0.1.0/24 is directly connected, port3 dO.200.1.0/24 is directly connected, portl d0.200.2.0/24 is directly connected, port2 Which outbound interface or interfaces will be used by this FortiGate to route web traffic from internal users to the Internet?

Question26: Which three steps are executed to get antivirus and IPS updates using the pull method? (Choose three.)

Question27: Refer to the exhibit, which contains a CLI script configuration on FortiManager.

An administrator configured the CLI script on FortiManager, but the script failed to apply any changes to the managed device after being executed.
What are two reasons why the script did not make any changes to the managed device? (Choose two.)

Question28: Two independent FortiGate HA clusters are connected to the same broadcast domain. The administrator has reported that both clusters are using the same HA virtual MAC address. This creates a duplicated MAC address problem in the network.
What HA setting must be changed in one of the HA clusters to fix the problem?

Question29: An LDAP user cannot authenticate against a FortiGate device.
Examine the real time debug output shown in the exhibit when the user attempted the authentication; then answer the question below.


Based on the output in the exhibit, what can cause this authentication problem?

Question30: Which two configuration commands change the default behavior for content-inspected traffic while FortiGate is in conserve mode? (Choose two.)

Question31: View the IPS exit log, and then answer the question below.

What is the status of IPS on this FortiGate?

Question32: Refer to the exhibit, which shows the output of a diagnose command.

What can you conclude from the output shown in the exhibit? (Choose two.)

Question33: An administrator must ensure that users cannot access sites containing malware and spyware, while also protecting them from phishing attempts.
What is the most resource-efficient method to block access to these sites?

Question34: Which two statements correctly describe the characteristics of the Fortinet Security Fabric? (Choose two.)

Question35: Which statement about IKE and IKE NAT-T is true?

Question36: An administrator added the following Ipsec VPN to a FortiGate configuration:
configvpn ipsec phasel -interface
edit "RemoteSite"
set type dynamic
set interface "portl"
set mode main
set psksecret ENC LCVkCiK2E2PhVUzZe
next
end
config vpn ipsec phase2-interface
edit "RemoteSite"
set phasel name "RemoteSite"
set proposal 3des-sha256
next
end
However, the phase 1 negotiation is failing. The administrator executed the IKF real time debug while attempting the Ipsec connection.
The output is shown in the exhibit.

What is causing the IPsec problem in the phase 1?

Question37: View the exhibit, which contains the output of a diagnose command, and the answer the question below.

Which statements are true regarding the Weight value?

Question38: A FortiGate device has the following LDAP configuration:

The administrator executed the 'dsquery' command in the Windows LDAp server 10.0.1.10, and got the following output:
>dsquery user -samid administrator
"CN-Administrator, CN-Users, DC=trainingAD, DC-training, DC-lab"
Based on the output, what FortiGate LDAP setting is configured incorrectly?

Question39: The CLI command set intelligent-mode <enable | disable> ontrols the IPS engine's adaptive scanning behavior.
Which of the following statements describes IPS adaptive scanning?

Question40: A FortiGate is configured as an explicit web proxy. Clients using this web proxy are reposting DNS errors when accessing any website.
The administrator executes the following debug commands and observes that the n-dns-timeout counter is increasing:

What should the administrator check to fix the problem?

Question41: What global configuration setting changes the behavior for content-inspected traffic while FortiGate is in system conserve mode?

Question42: Which of the following statements are correct regarding application layer test commands? (Choose two.)

Question43: Refer to the exhibit, which shows a FortiGate configuration.

An administrator is troubleshooting a web filter issue on FortiGate. The administrator has configured a web filter profile and applied it to a policy; however, the web filter is not inspecting any traffic that is passing through the policy.
What must the administrator change to fix the issue?

Question44: An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage.
However, after the changes, one network application started to have problems.
During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs.
When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions.
Which TCP session timer must be increased to fix this problem?

Question45: Refer to the exhibit, which shows the output of a diagnose command

What can you conclude from the RTT value?

Question46: What does DHCP snooping MAC verification do?

Question47: Which statement about memory conserve mode is true?

Question48: Which the following events can trigger the election of a new primary unit in a HA cluster? (Choose two.)

Question49: Examine the following routing table and BGP configuration; then answer the question below.

The BGP connection is up, but the local peer is NOT advertising the prefix 192.168.1.0/24.
Which configuration change will make the local peer advertise this prefix?

Question50: Refer to the exhibits, which contain configuration on FortiGate and partial session information.


All traffic to the Internet currently egresses from port1. The exhibit shows partial session information for Internet traffic from a user on the internal network.
If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user's session?

Question51: An administrator must automate a weekly backup of all the FortiGate devices in an enterprise network.
Which two steps must the administrator follow to implement this? (Choose two.)

Question52: When a FortiLink interface is configured on a FortiGate, which VLAN is typically set as the default allowed VLAN on all connected FortiSwitch ports?

Question53: Refer to the exhibit, which shows the output of a debug command.

What can be concluded from the debug command output?

Question54: Four FortiGate devices configured for OSPF connected to the same broadcast domain. The first unit is elected as the designated router.
The second unit is elected as the backup designated router.
Under normal operation, how many OSPF full adjacencies are formed to each of the other two units?

Question55: When does a RADIUS server send an Access-Challenge packet?

Question56: Which three conditions are required for two FortiGate devices to form an OSP adjacency? (Choose three.)

Question57: Which two statements about application layer test commands are true? (Choose two.)

Question58: Examine the output of the 'get router info bgp summary' command shown in the exhibit; then answer the question below.

Which statements are true regarding the output in the exhibit? (Choose two.)

Question59: Which statements regarding banned words are correct? (Choose two.)

Question60: Which setting must be enabled in an in a spoke IPsec phase 1 configuration, to indicate that it wants to participate in ADVPN?

Question61: In which of the following states is a given session categorized as ephemeral? (Choose two.)

Question62: View the exhibit, which contains a partial output of an IKE real-time debug, and then answer the question below.


Based on the debug output, which phase-1 setting is enabled in the configuration of this VPN?

Question63: Examine the IPsec configuration shown in the exhibit; then answer the question below.

An administrator wants to monitor the VPN by enable the IKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are being interchanged between both Ipsec gateways. However, the IKE rea time debug does NOT show any output.
Why isn't there any output?

Question64: An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device.
What can the administrator do to fix this problem?

Question65: An administrator is deploying APs that are connecting over an IPsec network. All APs have been configured to connect to FortiGate manually. FortiGate can discover the APs and authorize them.
However, FortiGate is unable to establish CAPWAP tunnels to manage the APs.
Which configuration setting can the administrator perform to resolve the problem?

Question66: What are two functions of automation stitches? (Choose two.)

Question67: What are valid options for handling DNS requests sent directly to a FortiGates interface IP? (Choose three.)

Question68: View the exhibit, which contains a session entry, and then answer the question below.

Which statement is correct regarding this session?

Question69: What does the dirty flag mean in a FortiGate session?

Question70: Which of the following statements about administrative domains (ADOMs) on FortiManager is true?

Question71: You have configured FortiManager as a local FDS to provide FortiGate AV and IPS updates, but FortiGate devices are not receiving updates to their AV signature databases, IPS engines, or IPS signature databases.
Which two settings need to be verified for these features to function? (Choose two.)

Question72: Which of the following statements is true regarding a FortiGate configured as an explicit web proxy?

Question73: View the exhibit, which contains the output of get sys ha status, and then answer the question below.


Which statements are correct regarding the output? (Choose two.)

Question74: How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?

Question75: One firewall policy in an enterprise firewall is essentially used for IPS.
Which configuration must the administrator check in this firewall policy to validate optimum performance for IPS?

Question76: Which statement about NGFW policy-based application filtering is true?

Question77: Which two configuration settings change the behavior for content-inspected traffic while FortiGate is in conserve mode? (Choose two.)

Question78: What are two impacts on applications if adjusting the TCP Maximum Segment Size (MSS) on FortiGate? (Choose two.)

Question79: Exhibits:



Refer to the exhibits, which contain the network topology and BGP configuration for a hub.
An administrator is trying to configure ADVPN with a hub-spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however, the spokes are not receiving route information from each other.
What change must the administrator make to the hub BGP configuration so that the routes learned by one spoke are forwarded to the other spokes?

Question80: Examine the following partial output from a sniffer command; then answer the question below.

What is the meaning of the packets dropped counter at the end of the sniffer?

Question81: View the central management configuration shown in the exhibit, and then answer the question below.

Which server will FortiGate choose for antivirus and IPS updates if 10.0.1.243 is experiencing an outage?

Question82: Which two statements about FortiManager is true when it is deployed as a local FDS? (Choose two.)

Question83: Refer to the exhibit, which shows the output of a BGP debug command.

What can be concluded about the router in this scenario?

Question84: The logs in a FSSO collector agent (CA) are showing the following error:
failed to connect to registry: PIKA1026 (192.168.12.232)
What can be the reason for this error?

Question85: View the exhibit, which contains the output of a debug command, and then answer the question below.

Which one of the following statements about this FortiGate is correct?

Question86: View the exhibit, which contains the output of a BGP debug command, and then answer the question below.

Which of the following statements about the exhibit are true? (Choose two.)

Question87: In which two ways does FortiManager function when it is deployed as a local FDS? (Choose two.)

Question88: View the partial crashlog output, and then answer the question below.
# diagnose debug crashlog read
2017-04-20 16:23:10 <00114> IPS enter fail open mode: engines=21 socketsize=123425682
2017-04-20 16:23:10 sessionact=pass
2017-04-20 16:24:09 <00114> IPS exit fail open mode
Which of the following statements are true regarding this FortiGate's fail-open configuration? (Choose two.)

Question89: What action does FortiSwitch take when it receives a loop guard data packet (LGDP) that was sent by itself?

Question90: Examine the output of the 'get router info ospf neighbor' command shown in the exhibit; then answer the question below.

Which statements are true regarding the output in the exhibit? (Choose two.)

Question91: Refer to the exhibit, which contains the output of the diagnose vpn tunnel list.


Which command will capture ESP traffic for the VPN named DialUp_0?

Question92: View the exhibit, then answer the question below.

Which of the following commands will bring up the tunnel?

Question93: A FortiGate's port1 is connected to a private network. Its port2 is connected to the Internet. Explicit web proxy is enabled in port1 and only explicit web proxy users can access the Internet. Web cache is NOT enabled. An internal web proxy user is downloading a file from the Internet via HTTP.
Which statements are true regarding the two entries in the FortiGate session table related with this traffic? (Choose two.)

Question94: A FortiGate device has the following LDAP configuration:

The LDAP user student cannot authenticate.
The exhibit shows the output of the authentication real time debug while testing the student account:

Based on the above output, what FortiGate LDAP settings must the administer check? (Choose two.)

Question95: Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.

Which statement are true regarding the output in the exhibit? (Choose two.)

Question96: View the following exhibit:

What two statements about this session are correct? (Choose two.)

Question97: View the global IPS configuration, and then answer the question below.

Which of the following statements is true regarding this configuration?