EMT Practice Test

1. Question Content...

---

Question1: A network administrator is configuring a new IPsec VPN tunnel on FortiGate. The remote peer IP address is dynamic, in addition, the remote peer does not support a dynamic DNS update service. What type of remote gateway should tie administrator configure on FortiGate for the new IPsec VPN tunnel to work?

Question2: An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check?

Question3: An administrator has configured the following settings:

What are the two results of this configuration? (Choose two.)

Question4: Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)

Question5: Examine the exhibit, which contains a virtual IP and firewall policy configuration.



The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address 10.0.1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

Question6: Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).


Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

Question7: Which of the following SD-WAN load balancing method use interface weight value to distribute traffic? (Choose two.)

Question8: Which three authentication timeout types are availability for selection on FortiGate? (Choose three.)

Question9: Examine this FortiGate configuration:

Examine the output of the following debug command:

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?

Question10: Refer to the exhibit.

The exhibit shows a CLI output of firewall policies, proxy policies, and proxy addresses.
How does FortiGate process the traffic sent to http://www.fortinet.com?

Question11: Which of the following services can be inspected by the DLP profile? (Choose three.)

Question12: Which three statements about security associations (SA) in IPsec are correct? (Choose three.)

Question13: Refer to the exhibits.


The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) tor Facebook.
Users are given access to the Facebook web application. They can play video content hosted on Facebook but they areunableto leavereactions on videos or other types ofposts.
Which part ofthe policy configuration must you change to resolve the issue?

Question14: Refer to the exhibit.

The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10 .0.1.254. /24.
The first firewall policy has NAT enabled using IP Pool.
The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0.1.10?

Question15: Which of the following statements about central NAT are true? (Choose two.)

Question16: An administrator Is configuring an IPsec VPN between site A and site B. The Remote Gateway setting in both sites has been configured as Static IP Address. For site A. the local quick mode selector is 192.160.1.0/24 and the remote quick mode selector is 192.168.2.0/24.
Which subnet must the administrator configure for the local quick mode selector for site B?

Question17: Refer to the exhibit.


The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check.
Which interface will be selected as an outgoing interface?

Question18: Refer to the exhibit.

The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.
The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access internet. TheTo_lnternet VDOM is the only VDOM with internet access and is directly connected to ISP modem.
Which two statements are true? (Choose two.)

Question19: How do you format the FortiGate flash disk?

Question20: Which two statements are correct regarding FortiGate FSSO agentless polling mode? (Choose two.)

Question21: Which statement regarding the firewall policy authentication timeout is true?

Question22: To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?

Question23: Refer to the exhibit.

Which contains a PerformanceSLA configuration.
An administrator has configured a performance SLA on FortiGate. Which failed to generate any traffic. Why is FortiGate not generating any traffic for the performance SLA?

Question24: Examine the following web filtering log.

Which statement about the log message is true?

Question25: Refer to the exhibit.

The global settings on a FortiGate device must be changed to align with company security policies. What does the Administrator account need to access the FortiGate global settings?

Question26: View the exhibit. Which the FortiGate handle web proxy traffic rue? (Choose two.)

Question27: Which of the following statements are best practices for troubleshooting FSSO? (Choose two.)

Question28: Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)

Question29: Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.

When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?

Question30: Refer to the exhibit. Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?

Question31: An administrator has configured a route-based IPsec VPN between two FortiGate devices. Which statement about this IPsec VPN configuration is true?

Question32: Refer to the exhibit.

Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?

Question33: Refer to the exhibit showing a debug flow output.

Which two statements about the debug flow output are correct? (Choose two.)

Question34: Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

Question35: What information is flushed when the chunk-size value is changed in the config dlp settings?

Question36: Which three statements about a flow-based antivirus profile are correct? (Choose three.)

Question37: Which statements about antivirus scanning mode are true? (Choose two.)

Question38: Which configuration objects can be selected for the Source field of a firewall policy? (Choose two.)

Question39: If the Servicesfield is configured in a Virtual IP (VIP), which statement is true when central NAT is used?