EMT Practice Test

1. Question Content...

---

Question1: What statements are true regarding Administrative Domains (ADOMs)? (Choose three.)

Question2: An end user logs into the full-access SSL VPN portal and selects the Tunnel Mode option by clicking on the "Connect" button. The administrator has enabled split tunneling.

Given that the user authenticates against the SSL VPN policy shown in the image below, which statement below identifies the route that is added to the client's routing table.

Question3: For Data Leak Prevention, which of the following describes the difference between the block and quarantine actions?

Question4: A user selects Install Config for a managed FortiGate device, as shown in the exhibit.

Which two statements are true regarding this action? (Choose two.)

Question5: A network administrator needs to implement dynamic route redundancy between a FortiGate unit located in a remote office and a FortiGate unit located in the central office.
The remote office accesses central resources using IPSec VPN tunnels through two different Internet providers.
What is the best method for allowing the remote office access to the resources through the FortiGate unit used at the central office?

Question6: Which of the following statements is correct based on the firewall configuration illustrated in the exhibit?

Question7: Which of the following statements are true regarding Local User Authentication? (Select all that apply.)

Question8: A FortiGate administrator configures a Virtual Domain (VDOM) for a new customer. After creating the VDOM, the administrator is unable to reassign the dmz interface to the new VDOM as the option is greyed out in Web Config in the management VDOM.
What would be a possible cause for this problem?

Question9: Which two statements describe a "modified" device settings' status in the Configuration and Installation Status widget of a managed FortiGate device? (Choose two.)

Question10: Which of the following statements best describes the green status indicators that appear next to different FortiGuard Distribution Network services as illustrated in the exhibit?

Question11: By default the Intrusion Protection System (IPS) on a FortiGate unit is set to perform which action?

Question12: What is 'hot swapping'?

Question13: Review the static route configuration for IPsec shown in the Exhibit below; then answer the question following it.

Which of the following statements are correct regarding this configuration? (Select all that apply).

Question14: Because changing the operational mode to Transparent resets device (or vdom) to all defaults, which precautions should an Administrator take prior to performing this? (Select all that apply.)

Question15: Which statement is correct? FortiAnalyzer collects and aggregates log data from:

Question16: Which of the following options can you use to update the virus definitions on a FortiGate unit? (Select all that apply.)

Question17: In which of the following report templates would you configure the charts to be included in the report?

Question18: What is the purpose of locking an ADOM revision?

Question19: Select the answer that describes what the CLI command diag debug authd fsso list is used for.

Question20: An administrator logs into a FortiGate unit using an account which has been assigned a super_admin profile. Which of the following operations can this administrator perform?

Question21: Users may require access to a web site that is blocked by a policy. Administrators can give users the ability to override the block.
Which of the following statements regarding overrides are correct? (Select all that apply.)

Question22: Which of the following statements describes the method of creating a policy to block access to an FTP site?

Question23: You wish to create a firewall policy that applies only to traffic intended for your web server.
The web server has an IP address of 192.168.2.2 and a /24 subnet mask.
When defining the firewall address for use in this policy, which one of the following addresses is correct?

Question24: A firewall policy has been configured for the internal email server to receive email from external parties through SMTP. Exhibits A and B show the AntiVirus and Email Filter profiles applied to this policy.


What is the correct behavior when the email attachment is detected as a virus by the FortiGate AntiVirus engine?

Question25: Which task categories can you select from view drop-down list in task monitor on the FortiManager?

Question26: What statements are true regarding disk log quota? (Choose two.)

Question27: Which of the following DLP actions will override any other action?

Question28: What advantages are there in using a hub-and-spoke IPSec VPN configuration instead of a fully-meshed set of IPSec tunnels? (Select all that apply.)

Question29: Which of the following statements is correct regarding the NAC Quarantine feature?

Question30: Which of the following pieces of information can be included in the Destination Address field of a firewall policy? (Select all that apply.)

Question31: An issue could potentially occur when clicking Connect to start tunnel mode SSL VPN. The tunnel will start up for a few seconds, then shut down.
Which of the following statements best describes how to resolve this issue?

Question32: Which two statements are correct regarding header and footer policies? (Choose two.)

Question33: Which of the following items is NOT a packet characteristic matched by a firewall service object?

Question34: Examine the exhibit shown below; then answer the question following it.

Which of the following statements best describes the green status indicators that appear next to the different FortiGuard Distribution Network services as illustrated in the exhibit?

Question35: Data Leak Prevention archiving gives the ability to store files and message data onto a FortiAnalyzer unit for which of the following types of network traffic? (Select all that apply.)

Question36: Which of the following statements is correct regarding the antivirus scanning function on the FortiGate unit?

Question37: Which of the following statements is correct regarding a FortiGate unit operating in NAT/Route mode?

Question38: Which of the following statements correctly describe Transparent Mode operation? (Select all that apply.)

Question39: Which of the following logging options are supported on a FortiGate unit? (Select all that apply.)

Question40: Which of the following statements correctly describes how a FortiGate unit functions in Transparent mode?

Question41: Which Fortinet products & features could be considered part of a comprehensive solution to monitor and prevent the leakage of senstive data? (Select all that apply.)

Question42: Under the System Information widget on the dashboard, which of the following actions are available for the system configuration? (Select all that apply.)

Question43: Which two statements are correct concerning the revision history functionality? (Choose two.)

Question44: Review the IKE debug output for IPsec shown in the Exhibit below.

Which one of the following statements is correct regarding this output?

Question45: Which of the following network protocols can be used to access a FortiGate unit as an administrator?

Question46: An administrator wishes to generate a report showing Top Traffic by service type. They notice that web traffic overwhelms the pie chart and want to exclude the web traffic from the report.
Which of the following statements best describes how to do this?

Question47: Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with IPsec? (Choose two.)

Question48: Which of the following statements are correct regarding URL filtering on the FortiGate unit?
(Select all that apply.)

Question49: Examine the static route configuration shown below; then answer the question following it.
config router static
edit 1
set dst 172.20.1.0 255.255.255.0
set device port1
set gateway 172.11.12.1
set distance 10
set weight 5
next
edit 2
set dst 172.20.1.0 255.255.255.0
set blackhole enable
set distance 5
set weight 10
next
end
Which of the following statements correctly describes the static routing configuration provided? (Select all that apply.)

Question50: Which of the following methods can be used to access the CLI? (Select all that apply.)

Question51: A DLP rule with an action of Exempt has been matched against traffic passing through the FortiGate unit.
Which of the following statements is correct regarding how this transaction will be handled by the FortiGate unit?

Question52: Examine the Exhibits shown below, then answer the question that follows.
Review the following DLP Sensor (Exhibit 1):

Review the following File Filter list for rule #1 (Exhibit 2):

Review the following File Filter list for rule #2 (Exhibit 3):

Review the following File Filter list for rule #3 (Exhibit 4):

An MP3 file is renamed to 'workbook.exe' and put into a ZIP archive. It is then sent through the FortiGate device over HTTP. It is intercepted and processed by the configuration shown in the above Exhibits 1-4.
Assuming the file is not too large for the File scanning threshold, what action will the FortiGate unit take?

Question53: Which two statements are correct regarding recovery logic used by FortiGate-FortiManager (FGFM) protocol when a configuration install is performed from the FortiManager to the managed FortiGate? (Choose two.)

Question54: Which of the following statements regarding Banned Words are correct? (Select all that apply.)

Question55: CORRECT TEXT
The __________ CLI command is used on the FortiGate unit to run static commands such as ping or to reset the FortiGate unit to factory defaults.

Question56: Examine the Exhibit shown below; then answer the question following it.

The Vancouver FortiGate unit initially had the following information in its routing table:
S 172.20.0.0/16 [10/0] via 172.21.1.2, port2
C 172.21.0.0/16 is directly connected, port2
C 172.11.11.0/24 is directly connected, port1
Afterwards, the following static route was added:
config router static
edit 6
set dst 172.20.1.0 255.255.255.0
set priority 0
set device port1
set gateway 172.11.12.1
next
end
Since this change, the new static route is NOT showing up in the routing table. Given the information provided, which of the following describes the cause of this problem?

Question57: Which statements are true about Offline mode on the FortiManager? (Choose two.)

Question58: An administrator is configuring a DLP rule for FTP traffic. When adding the rule to a DLP sensor, the administrator notes that the Ban Sender action is not available (greyed-out), as shown in the exhibit.

Which of the following is the best explanation for the Ban Sender action NOT being available?

Question59: Which of the following are valid FortiGate device interface methods for handling DNS requests? (Select all that apply.)

Question60: What effect do administrative domains (ADOM) have on report settings? (Choose two.)

Question61: The following diagnostic output is displayed in the CLI:
diag firewall auth list
policy iD. 9, srC. 192.168.3.168, action: accept, timeout: 13427
user: forticlient_chk_only, group:
flag (80020): auth timeout_ext, flag2 (40): exact
group iD. 0, av group: 0
----- 1 listed, 0 filtered ------
Based on this output, which of the following statements is correct?

Question62: A network administrator connects his PC to the INTERNAL interface on a FortiGate unit.
The administrator attempts to make an HTTPS connection to the FortiGate unit on the VLAN1 interface at the IP address of 10.0.1.1, but gets no connectivity.
The following troubleshooting commands are executed from the CLI:
user1 # get system interface
= = [ internal ]
name. internal mode. static ip: 10.0.1.254 255.255.255.128 status: up
netbios-forward. disable type. physical mtu-override. disable
= = [ vlan1 ]
name. vlan1 mode. static ip: 10.0.1.1 255.255.255.128 status: up netb
ios-forward. disable type. vlan mtu-override. disable
user1 # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default
S 10.0.0.0/8 [10/0] is a summary, Null
C 10.0.1.0/25 is directly connected, vlan1
C 10.0.1.128/25 is directly connected, internal
user1 # diagnose debug flow trace start 100
user1 # diagnose debug ena
user1 # diagnose debug flow filter daddr 10.0.1.1 10.0.1.1
id=20085 trace_id=277 msg="vd-root received a packet(proto=6, 10.0.1.130
:47922->10.0.1.1:443) from internal."
id=20085 trace_id=277 msg="allocate a new session-00000b21"
id=20085 trace_id=277 msg="iprope_in_check() check failed, drop"
Based on the output from these commands, which of the following is a possible cause of the problem?

Question63: Review the output of the command get router info routing-table all shown in the Exhibit below; then answer the question following it.

Which one of the following statements correctly describes this output?

Question64: Which two statements are correct regarding synchronization between primary and secondary devices in a FortiManager HA cluster? (Choose two.)

Question65: A client can create a secure connection to a FortiGate device using SSL VPN in web-only mode.
Which one of the following statements is correct regarding the use of web-only mode SSL VPN?

Question66: On the Device Manager tab, what does a red circle in the Logs field of a device indicate?

Question67: Which of the following methods does the FortiGate unit use to determine the availability of a web cache using Web Cache Communication Protocol (WCCP)?

Question68: A user creates a policy package with two installation targets, as shown in the exhibit. When the install operation is performed, which two statements are correct concerning the Install On column in the policy configuration? (Choose two.)

Question69: Which of the following products can be installed on a computer running Windows XP to provide personal firewall protection, antivirus protection, web and mail filtering, spam filtering, and VPN functionality?

Question70: How does the Log View page display logs when ADOMs are enabled?

Question71: When configuring FortiGuard on FortiManager, which two statements are correct regarding Allow Push Update settings configured in the FortiGuard Antivirus and IPS Settings?
(Choose two.)

Question72: Which of the following cannot be used in conjunction with the endpoint compliance check?

Question73: Which of the following statements correctly describes the deepscan option for HTTPS?

Question74: Which spam filter is not available on a FortiGate device?

Question75: Which of the following tasks fall under the responsibility of the SSL proxy in a typical HTTPS connection? (Select all that apply.)

Question76: What are the requirements for a cluster to maintain TCP connections after device or link failover? (Select all that apply.)

Question77: The command structure of the FortiGate CLI consists of commands, objects, branches, tables, and parameters.
Which of the following items describes user?

Question78: The ordering of firewall policies is very important. Policies can be re-ordered within the FortiGate unit's GUI and also using the CLI. The command used in the CLI to perform this function is __________ .

Question79: What is the problem with the following SQL SELECT statement?
SELECT dstip as "Destination IP", count(*) as session FROM $log-traffic GROUP BY dstip WHERE $filter and dstip is not null

Question80: What statements are true regarding RAID? (Choose three.)

Question81: Which of the following methods can be used to access the CLI? (Select all that apply.)

Question82: A FortiGate unit is configured to receive push updates from the FortiGuard Distribution Network, however, updates are not being received.
Which of the following statements are possible reasons for this? (Select all that apply.)

Question83: Workflow mode includes which new permissions for Super_Admin administrative users?

Question84: When backing up the configuration file on a FortiGate unit, the contents can be encrypted by enabling the encrypt option and supplying a password.
If the password is forgotten, the configuration file can still be restored using which of the following methods?

Question85: Identify the statement which correctly describes the output of the following command:
diagnose ips anomaly list

Question86: What are the limitations when creating a chart using the Custom Chart wizard? (Choose two.)

Question87: Which statement is true regarding the import/export feature?

Question88: Which two statements are correct for configuration changes made by FortiManager scripts?
(Choose two.)

Question89: Which of the following Session TTL values will take precedence?

Question90: Which statements are true regarding encryption settings and levels? (Choose three.)

Question91: What is the primary difference between raw format logs and formatted format logs?

Question92: The Host Check feature can be enabled on the FortiGate unit for SSL VPN connections.
When this feature is enabled, the FortiGate unit probes the remote host computer to verify that it is "safe" before access is granted.
Which of the following items is NOT an option as part of the Host Check feature?

Question93: If no firewall policy is specified between two FortiGate interfaces and zones are not used, which of the following statements describes the action taken on traffic flowing between these interfaces?

Question94: Which of the following statements is correct regarding the FortiGuard Services Web Filtering Override configuration as illustrated in the exhibit?

Question95: In the Tunnel Mode widget of the web portal, the administrator has configured an IP Pool and enabled split tunneling.
Which of the following statements is true about the IP address used by the SSL VPN client?

Question96: Encrypted backup files provide which of the following benefits? (Select all that apply.)

Question97: Which of the following represents the method used on a FortiGate unit running FortiOS version 4.2 to apply traffic shaping to P2P traffic, such as BitTorrent?

Question98: Which of the following methods is best suited to changing device level settings on existing and future managed FortiGate devices?

Question99: Which of the following items does NOT support the Logging feature?

Question100: In the case of TCP traffic, which of the following correctly describes the routing table lookups performed by a FortiGate unit when searching for a suitable gateway?

Question101: Refer to the exhibit. Examine the logs from the FortiView > Log View page:

What is one possible reason this search result yields no results?

Question102: If Routing Information Protocol (RIP) version 1 or version 2 has already been configured on a FortiGate unit, which of the following statements is correct if the routes learned through RIP need to be advertised into Open Shortest Path First (OSPF)?

Question103: The FortiGate Server Authentication Extensions (FSAE) provide a single sign on solution to authenticate users transparently to a FortiGate unit using credentials stored in Windows Active Directory.
Which of the following statements are correct regarding FSAE in a Windows domain environment when NTLM is not used? (Select all that apply.)

Question104: Two FortiGate devices fail to form an HA cluster, the device hostnames are STUDENT and REMOTE. Exhibit A shows the command output of 'show system ha' for the STUDENT device. Exhibit B shows the command output of 'show system ha' for the REMOTE device.
Exhibit A:

Exhibit B:

Which one of the following is the most likely reason that the cluster fails to form?

Question105: Which of the following statements are correct regarding the configuration of a FortiGate unit as an SSL VPN gateway? (Select all that apply.)

Question106: A portion of the device listing for a FortiAnalyzer unit is displayed in the exhibit.

Which of the following statements best describes the reason why the FortiGate 60B unit is unable to archive data to the FortiAnalyzer unit?

Question107: How can DLP file filters be configured to detect Office 2010 files? (Select all that apply.)

Question108: What are the three different methods you can employ to send event notifications when an event occurs that matches a configured event handler? (Choose three.)

Question109: Which of the following components are contained in all FortiGate units from the FG50 models and up? (Select all that apply.)

Question110: A static route is configured for a FortiGate unit from the CLI using the following commands:
config router static
edit 1
set device "wan1"
set distance 20
set gateway 192.168.100.1
next
end
Which of the following conditions is NOT required for this static default route to be displayed in the FortiGate unit's routing table?

Question111: The following ban list entry is displayed through the CLI.
get user ban list
id cause src-ip-addr dst-ip-addr expires created
531 protect_client 10.177.0.21 207.1.17.1 indefinite Wed Dec 24 :21:33 2008 Based on this command output, which of the following statements is correct?

Question112: Refer to the output below. Which statement is correct concerning the duplicate objects?
Start to import config from device (STUDENT-2) vdom (root) to adom (root), package (STUDENT-2)
"firewall service category", SUCCESS, "(name=General, oid=370, DUPLICATE)"
"firewall schedule recurring", SUCCESS, "(name=always, oid=466, DUPLICATE)"
"firewall address", SUCCESS, "(name=all, oid=358, DUPLICATE)"
"firewall service custom", SUCCESS, "(name=ALL, oid=419, DUPLICATE)"
"firewall vip", SUCCESS, "(name=FTP, oid=468, DUPLICATE)"

Question113: Which of the following statements regarding Banned Words are correct? (Select all that apply.)

Question114: What are the main management wizards used in Device Manager?

Question115: What are the methods available to register a device? (Choose two.)

Question116: Which statement is correct regarding provisioning templates?

Question117: Which of the following email spam filtering features is NOT supported on a FortiGate unit?

Question118: If Open Shortest Path First (OSPF) has already been configured on a FortiGate unit, which of the following statements is correct if the routes learned through OSPF need to be announced by Border Gateway Protocol (BGP)?

Question119: Refer to the exhibit. An administrator created a new interface object named Dev and configured dynamic mapping for the wan2 interface on the HeadOffice FortiGate. A new policy from internal to Dev is configured.
Which statement is correct regarding the installation of the HeadOffice policy package?

Question120: Which of the following are valid authentication user group types on a FortiGate unit?
(Select all that apply.)

Question121: Both the FortiGate and FortiAnalyzer units can notify administrators when certain alert conditions are met.
Considering this, which of the following statements is NOT correct?

Question122: An administrator wants to assign a set of UTM features to a group of users. Which of the following is the correct method for doing this?

Question123: What is the FortiGate unit password recovery process?

Question124: A FortiGate unit is configured with multiple VDOMs. An administrative account on the device has been assigned a Scope value of VDOM:root.
Which of the following items would an administrator logging in using this account NOT be able to configure?

Question125: In NAT/Route mode when there is no matching firewall policy for traffic to be forwarded by the Firewall, which of the following statements describes the action taken on traffic?

Question126: Review the IPsec diagnostics output of the command diag vpn tunnel list shown in the Exhibit below.

Which of the following statements are correct regarding this output? (Select all that apply.)

Question127: A firewall policy has been configured such that traffic logging is disabled and a UTM function is enabled. In addition, the system setting 'utm-incident-traffic-log' has been enabled.
In which log will a UTM event message be stored?

Question128: When the SSL proxy inspects the server certificate for Web Filtering only in SSL Handshake mode, which certificate field is being used to determine the site rating?

Question129: Which two statements are correct regarding the "Import all Objects" setting in the import policy wizard? (Choose two.)

Question130: With FSSO, a domain user could authenticate either against the domain controller running the Collector Agent and Domain Controller Agent, or a domain controller running only the Domain Controller Agent.
If you attempt to authenticate with the Secondary Domain Controller running only the Domain Controller Agent, which of the following statements are correct? (Select all that apply.)

Question131: Alert emails enable the FortiGate unit to send email notifications to an email address upon detection of a pre-defined event type.
Which of the following are some of the available event types in Web Config? (Select all that apply.)

Question132: When firewall policy authentication is enabled, only traffic on supported protocols will trigger an authentication challenge.
Select all supported protocols from the following:

Question133: Two-factor authentication is supported using the following methods? (Select all that apply.)

Question134: Which tabs are available on the FortiManager Web-based manager? (Choose two.)

Question135: Which statements are true of Administrative Domains (ADOMs) in FortiAnalyzer? (Choose two.)

Question136: An organization wishes to protect its SIP Server from call flooding attacks. Which of the following configuration changes can be performed on the FortiGate unit to fulfill this requirement?

Question137: Which of the following statements are true of the FortiGate unit's factory default configuration?

Question138: A FortiGate 100 unit is configured to receive push updates from the FortiGuard Distribution Network, however, updates are not being received.
Which of the following statements are possible reasons for this? (Select all that apply.)

Question139: The FortiGate Web Config provides a link to update the firmware in the System > Status window. Clicking this link will perform which of the following actions?

Question140: When creating administrative users which of the following configuration objects determines access rights on the FortiGate unit?

Question141: Which two statements are correct regarding the FortiManager HA cluster? (Choose two.)

Question142: Review the IPsec Phase2 configuration shown in the Exhibit; then answer the question following it.

Which of the following statements are correct regarding this configuration? (Select all that apply).

Question143: In a High Availability cluster operating in Active-Active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a subordinate unit?

Question144: An end user logs into the SSL VPN portal and selects the Tunnel Mode option by clicking on the "Connect" button. The administrator has not enabled split tunneling and so the end user must access the Internet through the SSL VPN Tunnel.
Which firewall policies are needed to allow the end user to not only access the internal network but also reach the Internet?
Exhibit A.

Exhibit B.

Exhibit C.

Exhibit D.

Question145: The eicar test virus is put into a zip archive, which is given the password of "Fortinet" in order to open the archive. Review the configuration in the exhibits shown below; then answer the question that follows.
Exhibit A - Antivirus Profile:

Exhibit B - Non-default UTM Proxy Options Profile:

Exhibit C - DLP Profile:

Which of one the following profiles could be enabled in order to prevent the file from passing through the FortiGate device over HTTP on the standard port for that protocol?

Question146: Which of the following pieces of information can be included in the Destination Address field of a firewall policy?