EMT Practice Test

1. Question Content...

---

Question1: Consider the topology:
Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server.
An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.
The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.
What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)

Question2: If Internet Service is already selected as Source in a firewall policy, which other configuration objects can be added to the Source filed of a firewall policy?

Question3: Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

Question4: Refer to the exhibit showing a debug flow output.

Which two statements about the debug flow output are correct? (Choose two.)

Question5: A network administrator has enabled SSL certificate inspection and antivirus on FortiGate. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and the file can be downloaded.
What is the reason for the failed virus detection by FortiGate?

Question6: Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

Question7: Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

Question8: Which of the following are valid actions for FortiGuard category based filter in a web filter profile ui proxy-based inspection mode? (Choose two.)

Question9: Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)

Question10: Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)

Question11: Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

Question12: What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?

Question13: Refer to the exhibits.


The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) for Facebook .
Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.
Which part of the policy configuration must you change to resolve the issue?

Question14: If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT is used?

Question15: Refer to the exhibits.
The exhibits show the firewall policies and the objects used in the firewall policies.
The administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit.

Which policy will be highlighted, based on the input criteria?

Question16: An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)

Question17: A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
* All traffic must be routed through the primary tunnel when both tunnels are up
* The secondary tunnel must be used only if the primary tunnel goes down
* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

Question18: Refer to the exhibit.

The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.
The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access the internet. The To_Internet VDOM is the only VDOM with internet access and is directly connected to ISP modem .
With this configuration, which statement is true?

Question19: What are two scanning techniques supported by FortiGate? (Choose two.)

Question20: Refer to the exhibit showing a debug flow output.

What two conclusions can you make from the debug flow output? (Choose two.)

Question21: An administrator must disable RPF check to investigate an issue.
Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?

Question22: Refer to the exhibit.

Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)

Question23: Refer to the exhibit, which contains a session diagnostic output.

Which statement is true about the session diagnostic output?

Question24: Which statement is correct regarding the security fabric?

Question25: Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up.

Based on the phase 2 configuration shown in the exhibit, which configuration change will bring phase 2 up?

Question26: Refer to the exhibit.
Refer to the FortiGuard connection debug output.

Based on the output shown in the exhibit, which two statements are correct? (Choose two.)

Question27: If Internet Service is already selected as Destination in a firewall policy, which other configuration object can be selected for the Destination field of a firewall policy?

Question28: FortiGate is operating in NAT mode and is configured with two virtual LAN (VLAN) subinterfaces added to the same physical interface.
In this scenario, what are two requirements for the VLAN ID? (Choose two.)

Question29: Which three methods are used by the collector agent for AD polling? (Choose three.)

Question30: Refer to the exhibit, which contains a static route configuration.
An administrator created a static route for Amazon Web Services.

Which CLI command must the administrator use to view the route?

Question31: Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)

Question32: Which statement about the policy ID number of a firewall policy is true?

Question33: Which of statement is true about SSL VPN web mode?

Question34: Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?

Question35: What are two functions of ZTNA? (Choose two.)

Question36: Refer to the exhibit.

Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?

Question37: Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

Question38: Refer to the exhibits.
Exhibit A shows a network diagram. Exhibit B shows the firewall policy configuration and a VIP object configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
The administrator disabled the WebServer firewall policy.


Which IP address will be used to source NAT the traffic, if a user with address 10.0.1.10 connects over SSH to the host with address 10.200.3.1?

Question39: Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)

Question40: Refer to the exhibit.
The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device.

Which two actions does FortiGate take on internet traffic sourced from the subscribers? (Choose two.)

Question41: An administrator wants to simplify remote access without asking users to provide user credentials.
Which access control method provides this solution?

Question42: An employee needs to connect to the office through a high-latency internet connection.
Which SSL VPN setting should the administrator adjust to prevent SSL VPN negotiation failure?

Question43: Which statement about the deployment of the Security Fabric in a multi-VDOM environment is true?

Question44: Refer to the exhibit to view the firewall policy
Why would the firewall policy not block a well-known virus, for
example eicar?

Question45: Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)

Question46: Which two statements describe how the RPF check is used? (Choose two.)

Question47: FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy. Which two other security profiles can you apply to the security policy? (Choose two.)

Question48: When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?

Question49: Which two types of traffic are managed only by the management VDOM? (Choose two.)

Question50: What inspection mode does FortiGate use if it is configured as a policy-based next-generation firewall (NGFW)?

Question51: Which statement describes a characteristic of automation stitches?

Question52: Which two statements are correct regarding FortiGate FSSO agentless polling mode? (Choose two.)

Question53: Which three statements explain a flow-based antivirus profile? (Choose three.)

Question54: If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?

Question55: Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

Question56: What is the primary FortiGate election process when the HA override setting is disabled?

Question57: Which two statements about FortiGate FSSO agentless polling mode are true? (Choose two.)

Question58: Refer to the exhibit.


The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check . Which interface will be selected as an outgoing interface?

Question59: Which of the following are valid actions for FortiGuard category based filter in a web filter profile ui proxy-based inspection mode? (Choose two.)

Question60: The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile. What order must FortiGate use when the web filter profile has features enabled, such as safe search?

Question61: Refer to the exhibits.


Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)

Question62: Refer to the exhibits.
Exhibit A shows the application sensor configuration. Exhibit B shows the Excessive-Bandwidth and Apple filter details.


Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?

Question63: Which two statements ate true about the Security Fabric rating? (Choose two.)

Question64: Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)

Question65: Refer to the exhibit.

The exhibit shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

Question66: FortiGuard categories can be overridden and defined in different categories. To create a web rating override for example.com home page, the override must be configured using a specific syntax.
Which two syntaxes are correct to configure web rating for the home page? (Choose two.)

Question67: Which two types of traffic are managed only by the management VDOM? (Choose two.)

Question68: Which two statements are correct about SLA targets? (Choose two.)

Question69: An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings.
What is true about the DNS connection to a FortiGuard server?

Question70: You have enabled logging on a FortiGate device for event logs and all security logs, and you have set up logging to use the FortiGate local disk.
What is the default behavior when the local disk is full?

Question71: Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?

Question72: Refer to the exhibit.

Based on the raw log, which two statements are correct? (Choose two.)

Question73: What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

Question74: A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.

Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

Question75: An administrator is running the following sniffer command:
Which three pieces of Information will be Included in me sniffer output? {Choose three.)

Question76: Examine the exhibit, which contains a virtual IP and firewall policy configuration.


The WAN (port1) interface has the IP address 10.200. 1. 1/24. The LAN (port2) interface has the IP address 10.0. 1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address. Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0. 1. 10/24?

Question77: Refer to the exhibits.
Exhibit A shows a topology for a FortiGate HA cluster that performs proxy-based inspection on traffic. Exhibit B shows the HA configuration and the partial output of the get system ha status command.


Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose two.)

Question78: Refer to the exhibit.

Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

Question79: Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)

Question80: Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).


Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

Question81: Which two statements explain antivirus scanning modes? (Choose two.)