EMT Practice Test

1. Question Content...

---

Question1: An administrator wants to assign a set of UTM features to a group of users. Which of the following is the correct method for doing this?

Question2: Which of the following statements are correct regarding virtual domains (VDOMs)? (Select all that apply.)

Question3: An administrator configures a VPN and selects the Enable IPSec Interface Mode option in the phase 1 settings.
Which of the following statements are correct regarding the IPSec VPN configuration?

Question4: Review the CLI configuration below for an IPS sensor and identify the correct statements regarding this configuration from the choices below. (Select all that apply.) config ips sensor
edit "LINUX_SERVER"
set comment ''
set replacemsg-group ''
set log enable
config entries
edit 1
set action default
set application all
set location server
set log enable
set log-packet enable
set os Linux
set protocol all
set quarantine none
set severity all
set status default
next
end
next
end

Question5: An intermittent connectivity issue is noticed between two devices located behind the FortiGate dmz and internal interfaces. A continuous sniffer trace is run on the FortiGate unit that the administrator will convert into a .cap file for an off-line analysis with a sniffer application.

Given the high volume of global traffic on the network, which of the following CLI commands will best allow the administrator to perform this troubleshooting operation?

Question6: The FortiGate unit can be configured to allow authentication to a RADIUS server. The RADIUS server can use several different authentication protocols during the authentication process.
Which of the following are valid authentication protocols that can be used when a user authenticates to the RADIUS server? (Select all that apply.)

Question7: Which of the following methods does the FortiGate unit use to determine the availability of a web cache using Web Cache Communication Protocol (WCCP)?

Question8: Which part of an email message exchange is NOT inspected by the POP3 and IMAP proxies?

Question9: Review the IPsec Phase2 configuration shown in the Exhibit; then answer the question following it.

Which of the following statements are correct regarding this configuration? (Select all that apply).

Question10: Which statement is correct regarding virus scanning on a FortiGate unit?

Question11: A portion of the device listing for a FortiAnalyzer unit is displayed in the exhibit.

Which of the following statements best describes the reason why the FortiGate 60B unit is unable to archive data to the FortiAnalyzer unit?

Question12: An end user logs into the full-access SSL VPN portal and selects the Tunnel Mode option by clicking on the "Connect" button. The administrator has enabled split tunneling.

Given that the user authenticates against the SSL VPN policy shown in the image below, which statement below identifies the route that is added to the client's routing table.

Question13: Based on the web filtering configuration illustrated in the exhibit,

which one of the following statements is not a reasonable conclusion?

Question14: Refer to the exhibit. Examine the logs from the FortiView > Log View page:

What is one possible reason this search result yields no results?

Question15: Which of the following statements is correct about how the FortiGate unit verifies username and password during user authentication?

Question16: The FortiGate unit's GUI provides a link to update the firmware.
Clicking this link will perform which of the following actions?

Question17: Which of the following options can you use to update the virus definitions on a FortiGate unit? (Select all that apply.)

Question18: Each UTM feature has configurable UTM objects such as sensors, profiles or lists that define how the feature will function.
An administrator must assign a set of UTM features to a group of users.
Which of the following is the correct method for doing this?

Question19: Which of the following features could be used by an administrator to block FTP uploads while still allowing FTP downloads?

Question20: DLP archiving gives the ability to store session transaction data on a FortiAnalyzer unit for which of the following types of network traffic? (Select all that apply.)

Question21: Users may require access to a web site that is blocked by a policy. Administrators can give users the ability to override the block. Which of the following statements regarding overrides are correct? (Select all that apply.)

Question22: WAN optimization is configured in Active/Passive mode. When will the remote peer accept an attempt to initiate a tunnel?

Question23: In order to load-share traffic using multiple static routes, the routes must be configured with ...

Question24: Which task categories can you select from view drop-down list in task monitor on the FortiManager?

Question25: Administrators can send alerts to multiple recipients through which methods? (Choose three.)

Question26: Alert emails enable the FortiGate unit to send email notifications to an email address upon detection of a pre-defined event type. Which of the following are some of the available event types in Web Config?
(Select all that apply.)

Question27: The default administrator profile that is assigned to the default "admin" user on a FortGate device is:____________________.

Question28: Which of the following statements is correct regarding URL Filtering on the FortiGate unit?

Question29: Refer to the exhibit. What does the clock icon denote beside the Bandwidth and Applications Report?

Question30: What statements are true regarding Administrative Domains (ADOMs)? (Choose three.)

Question31: Which of the following regular expression patterns will make the terms "confidential data" case insensitive?

Question32: What is the effect of using CLI "config system session-ttl" to set session_ttl to 1800 seconds?

Question33: Which of the following Regular Expression patterns will make the term "bad language" case insensitive?

Question34: Shown below is a section of output from the debug command diag ip arp list.
index=2 ifname=port1 172.20.187.150 00:09:0f:69:03:7e state=00000004 use=4589 confirm=4589 update=2422 ref=1 In the output provided, which of the following best describes the IP address 172.20.187.150?

Question35: A FortiClient fails to establish a VPN tunnel with a FortiGate unit.
The following information is displayed in the FortiGate unit logs:
msg="Initiator: sent 192.168.11.101 main mode message #1 (OK)"
msg="Initiator: sent 192.168.11.101 main mode message #2 (OK)"
msg="Initiator: sent 192.168.11.101 main mode message #3 (OK)"
msg="Initiator: parsed 192.168.11.101 main mode message #3 (DONE)"
msg="Initiator: sent 192.168.11.101 quick mode message #1 (OK)"
msg="Initiator: tunnel 192.168.1.1/192.168.11.101 install ipsec sa"
msg="Initiator: sent 192.168.11.101 quick mode message #2 (DONE)"
msg="Initiator: tunnel 192.168.11.101, transform=ESP_3DES, HMAC_MD5"
msg="Failed to acquire an IP address
Which of the following statements is a possible cause for the failure to establish the VPN tunnel?

Question36: Which of the following statements are correct regarding URL filtering on the FortiGate unit? (Select all that apply.)

Question37: Review the IKE debug output for IPsec shown in the Exhibit below.

Which one of the following statements is correct regarding this output?

Question38: An administrator configures a FortiGate unit in Transparent mode on the 192.168.11.0 subnet. Automatic Discovery is enabled to detect any available FortiAnalyzers on the network.
Which of the following FortiAnalyzers will be detected? (Select all that apply.)

Question39: Which two statements describe a "modified" device settings' status in the Configuration and Installation Status widget of a managed FortiGate device? (Choose two.)

Question40: What effect do administrative domains (ADOM) have on report settings? (Choose two.)

Question41: SIMULATION
The __________CLI command is used on the FortiGate unit to run static commands such as ping or to reset the FortiGate unit to factory defaults.

Question42: Which of the following network protocols can be used to access a FortiGate unit as an administrator?

Question43: Users may require access to a web site that is blocked by a policy. Administrators can give users the ability to override the block. Which of the following statements regarding overrides is NOT correct?

Question44: Under the System Information widget on the dashboard, which of the following actions are available for the system configuration? (Select all that apply.)

Question45: In which order are firewall policies processed on the FortiGate unit?

Question46: Which of the following statements best decribes the proxy behavior on a FortiGate unit during an FTP client upload when FTP splice is disabled?

Question47: Which tabs do not appear when FortiAnalyzer is operating in Collector mode? (Choose two.)

Question48: Which of the following statements describes the method of creating a policy to block access to an FTP site?

Question49: Which of the following Session TTL values will take precedence?

Question50: Which of the following describes the best custom signature for detecting the use of the word "Fortinet" in chat applications?


The sample packet trace illustrated in the exhibit provides details on the packet that requires detection.

Question51: Examine the exhibit shown below then answer the question that follows it.

Within the UTM Proxy Options, the CA certificate Fortinet_CA_SSLProxy defines which of the following:

Question52: Two devices are in an HA cluster, the device hostnames are STUDENT and REMOTE. Exhibit A shows the command output of 'diag sys session stat' for the STUDENT device. Exhibit B shows the command output of 'diag sys session stat' for the REMOTE device.
Exhibit A:

Exhibit B:

Given the information provided in the exhibits, which of the following statements are correct? (Select all that apply.)

Question53: Which of the following statements is correct regarding the antivirus scanning function on the FortiGate unit?

Question54: Which of the following items is NOT a packet characteristic matched by a firewall service object?

Question55: Which of the following methods can be used to access the CLI? (Select all that apply.)

Question56: Workflow mode includes which new permissions for Super_Admin administrative users?

Question57: The Host Check feature can be enabled on the FortiGate unit for SSL VPN connections. When this feature is enabled, the FortiGate unit probes the remote host computer to verify that it is "safe" before access is granted.
Which of the following items is NOT an option as part of the Host Check feature?

Question58: Which statements are true of Administrative Domains (ADOMs) in FortiAnalyzer? (Choose two.)

Question59: Which of the following statements are correct regarding Application Control?

Question60: In HA, the option Reserve Management Port for Cluster Member is selected as shown in the Exhibit below.

Which of the following statements are correct regarding this setting? (Select all that apply.)

Question61: Which of the following are valid authentication user group types on a FortiGate unit? (Select all that apply.)

Question62: Which ports are commonly used by FortiManager? (Choose two.)

Question63: A DLP rule with an action of Exempt has been matched against traffic passing through the FortiGate unit.
Which of the following statements is correct regarding how this transaction will be handled by the FortiGate unit?

Question64: Data Leak Prevention archiving gives the ability to store files and message data onto a FortiAnalyzer unit for which of the following types of network traffic? (Select all that apply.)

Question65: What advantages are there in using a hub-and-spoke IPSec VPN configuration instead of a fully-meshed set of IPSec tunnels? (Select all that apply.)

Question66: An organization wishes to protect its SIP Server from call flooding attacks. Which of the following configuration changes can be performed on the FortiGate unit to fulfill this requirement?

Question67: What is the effect of using CLI "config system session-ttl" to set session_ttl to 1800 seconds?

Question68: An ADOM has two device modes: normal (default) and advanced.
What is the main difference between the two modes?

Question69: An administrator has configured a FortiGate unit so that end users must authenticate against the firewall using digital certificates before browsing the Internet. What must the user have for a successful authentication? (Select all that apply.)

Question70: Which of the following pieces of information can be included in the Destination Address field of a firewall policy?

Question71: Which of the following must be configured on a FortiGate unit to redirect content requests to remote web cache servers?

Question72: What are the three different methods you can employ to send event notifications when an event occurs that matches a configured event handler? (Choose three.)

Question73: Examine the exhibit shown below; then answer the question following it.

Which of the following statements best describes the green status indicators that appear next to the different FortiGuard Distribution Network services as illustrated in the exhibit?

Question74: What advantages are there in using a hub-and-spoke IPSec VPN configuration instead of a fully-meshed set of IPSec tunnels? (Select all that apply.)

Question75: Which of the following statements is correct regarding the FortiGuard Services Web Filtering Override configuration as illustrated in the exhibit?

Question76: Which of the statements below are true regarding firewall policy disclaimers? (Select all that apply.)

Question77: What statements are true regarding FortiAnalyzer's treatment of high availability (HA) clusters? (Choose two.)

Question78: Which spam filter is not available on a FortiGate device?

Question79: Which two statements are correct regarding synchronization between primary and secondary devices in a FortiManager HA cluster? (Choose two.)

Question80: Which of the following statements is correct based on the firewall configuration illustrated in the exhibit?

Question81: Select the answer that describes what the CLI command diag debug authd fsso list is used for.

Question82: In an IPSec gateway-to-gateway configuration, two FortiGate units create a VPN tunnel between two separate private networks.
Which of the following configuration steps must be performed on both FortiGate units to support this configuration? (Select all that apply.)

Question83: When firewall policy authentication is enabled, only traffic on supported protocols will trigger an authentication challenge.
Select all supported protocols from the following:

Question84: The ordering of firewall policies is very important. Policies can be re-ordered within the FortiGate Web Config and also using the CLI. The command used in the CLI to perform this function is __________.

Question85: By default the Intrusion Protection System (IPS) on a FortiGate unit is set to perform which action?

Question86: An administrator sets up a new FTP server on TCP port 2121. A FortiGate unit is located between the FTP clients and the server. The administrator has created a policy for TCP port 2121.
Users have been complaining that when downloading data they receive a 200 Port command successful message followed by a 425 Cannot build data connection message.
Which of the following statements represents the best solution to this problem?

Question87: The command structure of the FortiGate CLI consists of commands, objects, branches, tables, and parameters. Which of the following items describes user?

Question88: Which of the following statements regarding Banned Words are correct? (Select all that apply.)

Question89: A user selects Install Config for a managed FortiGate device, as shown in the exhibit.

Which two statements are true regarding this action? (Choose two.)

Question90: An administrator has formed a High Availability cluster involving two FortiGate 310B units.
[Multiple upstream Layer 2 switches] -- [ FortiGate HA Cluster ] -- [ Multiple downstream Layer 2 switches ] The administrator wishes to ensure that a single link failure will have minimal impact upon the overall throughput of traffic through this cluster.
Which of the following options describes the best step the administrator can take?
The administrator should...

Question91: A FortiGate unit can create a secure connection to a client using SSL VPN in tunnel mode.
Which of the following statements are correct regarding the use of tunnel mode SSL VPN? (Select all that apply.)

Question92: Examine the static route configuration shown below; then answer the question following it.
config router static
edit 1
set dst 172.20.1.0 255.255.255.0
set device port1
set gateway 172.11.12.1
set distance 10
set weight 5
next
edit 2
set dst 172.20.1.0 255.255.255.0
set blackhole enable
set distance 5
set weight 10
next
end
Which of the following statements correctly describes the static routing configuration provided? (Select all that apply.)

Question93: Which statement correctly identified the APIs supported by FortiManager?

Question94: Which of the following are FortiManager features? (Choose two.)

Question95: Which of the following statements is correct regarding the NAC Quarantine feature?

Question96: With FSSO, a domain user could authenticate either against the domain controller running the Collector Agent and Domain Controller Agent, or a domain controller running only the Domain Controller Agent.
If you attempt to authenticate with the Secondary Domain Controller running only the Domain Controller Agent, which of the following statements are correct? (Select all that apply.)

Question97: Which of the following statements are true regarding Local User Authentication? (Select all that apply.)

Question98: Encrypted backup files provide which of the following benefits? (Select all that apply.)

Question99: Identify the statement which correctly describes the output of the following command:
diagnose ips anomaly list

Question100: Review the IPsec diagnostics output of the command diag vpn tunnel list shown in the Exhibit below.

Which of the following statements are correct regarding this output? (Select all that apply.)

Question101: When creating administrative users which of the following configuration objects determines access rights on the FortiGate unit?

Question102: Which of the following antivirus and attack definition update options are supported by FortiGate units?
(Select all that apply.)

Question103: In a High Availability cluster operating in Active-Active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a subordinate unit?

Question104: Both the FortiGate and FortiAnalyzer units can notify administrators when certain alert conditions are met.
Considering this, which of the following statements is NOT correct?

Question105: A client can establish a secure connection to a corporate network using SSL VPN in tunnel mode.
Which of the following statements are correct regarding the use of tunnel mode SSL VPN? (Select all that apply.)

Question106: A FortiGate unit is configured with multiple VDOMs. An administrative account on the device has been assigned a Scope value of VDOM:root.
Which of the following items would an administrator logging in using this account NOT be able to configure?

Question107: Which two statements are correct for configuration changes made by FortiManager scripts? (Choose two.)

Question108: Which of the following methods can be used to access the CLI? (Select all that apply.)

Question109: What is the FortiGate unit password recovery process?

Question110: The Idle Timeout setting on a FortiGate unit applies to which of the following?

Question111: Two-factor authentication is supported using the following methods? (Select all that apply.)

Question112: Which statement correctly names the Administrative Domains modes supported on FortiManager?

Question113: Which of the following statements correctly describes the deepscan option for HTTPS?

Question114: When viewing the Banned User monitor in Web Config, the administrator notes the entry illustrated in the exhibit.

Which of the following statements is correct regarding this entry?

Question115: Which Fortinet products & features could be considered part of a comprehensive solution to monitor and prevent the leakage of senstive data? (Select all that apply.)

Question116: The FortiGate Server Authentication Extensions (FSAE) provide a single sign on solution to authenticate users transparently to a FortiGate unit using credentials stored in Windows Active Directory.
Which of the following statements are correct regarding FSAE in a Windows domain environment when NTLM is not used? (Select all that apply.)

Question117: Which of the following email spam filtering features is NOT supported on a FortiGate unit?

Question118: Which of the following methods is best suited to changing device level settings on existing and future managed FortiGate devices?

Question119: Setting workspace-mode to normal, as shown in the exhibit, allows what on FortiManager? (Choose two.) config system global set workspace-mode normal
end

Question120: What are the limitations when creating a chart using the Custom Chart wizard? (Choose two.)

Question121: A FortiGate unit is configured to receive push updates from the FortiGuard Distribution Network, however, updates are not being received.
Which of the following statements are possible reasons for this? (Select all that apply.)

Question122: Which of the following tasks fall under the responsibility of the SSL proxy in a typical HTTPS connection?
(Select all that apply.)

Question123: An administrator logs into a FortiGate unit using an account which has been assigned a super_admin profile. Which of the following operations can this administrator perform?

Question124: The diag sys session list command is executed in the CLI. The output of this command is shown in the exhibit.

Based on the output from this command, which of the following statements is correct?

Question125: Which two statements are correct regarding recovery logic used by FortiGate-FortiManager (FGFM) protocol when a configuration install is performed from the FortiManager to the managed FortiGate?
(Choose two.)

Question126: You wish to create a firewall policy that applies only to traffic intended for your web server. The web server has an IP address of 192.168.2.2 and a /24 subnet mask. When defining the firewall address for use in this policy, which one of the following addresses is correct?

Question127: Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with IPsec? (Choose two.)

Question128: Which of the following spam filtering methods are supported on the FortiGate unit? (Select all that apply.)

Question129: Examine the Exhibits shown below, then answer the question that follows.
Review the following DLP Sensor (Exhibit 1):

Review the following File Filter list for rule #1 (Exhibit 2):

Review the following File Filter list for rule #2 (Exhibit 3):

Review the following File Filter list for rule #3 (Exhibit 4):

An MP3 file is renamed to 'workbook.exe' and put into a ZIP archive. It is then sent through the FortiGate device over HTTP. It is intercepted and processed by the configuration shown in the above Exhibits 1-4.
Assuming the file is not too large for the File scanning threshold, what action will the FortiGate unit take?

Question130: Which statements are true about Offline mode on the FortiManager? (Choose two.)

Question131: An administrator is configuring a DLP rule for FTP traffic. When adding the rule to a DLP sensor,

the administrator notes that the Ban Sender action is not available (greyed-out), as shown in the exhibit.
Which of the following is the best explanation for the Ban Sender action NOT being available?

Question132: What two statements are correct regarding administrative users and accounts? (Choose two.)

Question133: FortiGate units are preconfigured with four default protection profiles. These protection profiles are used to control the type of content inspection to be performed.
What action must be taken for one of these profiles to become active?

Question134: Which two statements are correct concerning the revision history functionality? (Choose two.)

Question135: Which statements are true regarding content archiving, also known as Data Leak Prevention (DLP) archiving? (Choose two.)

Question136: Which of the following items are considered to be advantages of using the application control features on the FortiGate unit?
Application control allows an administor to:

Question137: What are the valid sub-types for a Firewall type policy? (Select all that apply)

Question138: Which of the following is an advantage of using SNMP v3 instead of SNMP v1/v2 when querying the FortiGate unit?

Question139: Which two statements are correct regarding FortiGate-FortiManager (FGFM) management protocol?
(Choose two.)

Question140: In which of the following report templates would you configure the charts to be included in the report?

Question141: In the example dataset, where does it state to limit the results to a specific time period?
SELECT dstip as domain, count(*) as session
FROM $log
WHERE $filter and dstip is not null
GROUP BY dstip
ORDER BY session desc
LIMIT 7
OFFSET 1

Question142: Which of the following products can be installed on a computer running Windows XP to provide personal firewall protection, antivirus protection, web and mail filtering, spam filtering, and VPN functionality?

Question143: Which of the following statements regarding Banned Words are correct? (Select all that apply.)

Question144: Which of the following statements best describes the proxy behavior on a FortiGate unit during an FTP client upload when FTP splice is disabled?

Question145: Which two statements are correct regarding FortiGuard features on FortiManager? (Choose two.)

Question146: Examine the firewall configuration shown below; then answer the question following it.

Which of the following statements are correct based on the firewall configuration illustrated in the exhibit?
(Select all that apply.)

Question147: Examine the Exhibit shown below; then answer the question following it.

In this scenario, the Fortigate unit in Ottawa has the following routing table:
S* 0.0.0.0/0 [10/0] via 172.20.170.254, port2
C 172.20.167.0/24 is directly connected, port1
C 172.20.170.0/24 is directly connected, port2
Sniffer tests show that packets sent from the Source IP address 172.20.168.2 to the Destination IP address 172.20.169.2 are being dropped by the FortiGate unit located in Ottaw

Question148: A FortiGate unit is configured with three Virtual Domains (VDOMs) as illustrated in the exhibit.

Which of the following statements are true if the network administrator wants to route traffic between all the VDOMs? (Select all that apply.)

Question149: In NAT/Route mode when there is no matching firewall policy for traffic to be forwarded by the Firewall, which of the following statements describes the action taken on traffic?

Question150: The eicar test virus is put into a zip archive, which is given the password of "Fortinet" in order to open the archive. Review the configuration in the exhibits shown below; then answer the question that follows.
Exhibit A - Antivirus Profile:

Exhibit B - Non-default UTM Proxy Options Profile:

Exhibit C - DLP Profile:

Which of one the following profiles could be enabled in order to prevent the file from passing through the FortiGate device over HTTP on the standard port for that protocol?

Question151: Because changing the operational mode to Transparent resets device (or vdom) to all defaults, which precautions should an Administrator take prior to performing this? (Select all that apply.)

Question152: If a FortiGate unit has a dmz interface IP address of 210.192.168.2 with a subnet mask of 255.255.255.0, what is a valid dmz DHCP addressing range?

Question153: What is the problem with the following SQL SELECT statement?

Question154: Which of the following logging options are supported on a FortiGate unit? (Select all that apply.)

Question155: A firewall policy has been configured for the internal email server to receive email from external parties through SMTP. Exhibits A and B show the antivirus and email filter profiles applied to this policy.
Exhibit A:

Exhibit B:

What is the correct behavior when the email attachment is detected as a virus by the FortiGate antivirus engine?

Question156: Review the output of the command get router info routing-table all shown in the Exhibit below; then answer the question following it.

Which one of the following statements correctly describes this output?

Question157: Which of the following Fortinet products can receive updates from the FortiGuard Distribution Network?
(Select all that apply.)

Question158: Which statements are correct regarding FortiAnalyzer reports? (Choose two.)

Question159: Which of the following statements is correct regarding a FortiGate unit operating in NAT/Route mode?

Question160: When a FortiManager HA primary device fails, which two statements are correct for promoting a secondary device to the primary role? (Choose two.)

Question161: Which of the following statements is correct about configuring web filtering overrides?

Question162: For Data Leak Prevention, which of the following describes the difference between the block and quarantine actions?

Question163: A FortiGate unit is operating in NAT/Route mode and is configured with two Virtual LAN (VLAN) sub- interfaces added to the same physical interface.
Which of the following statements is correct regarding the VLAN IDs in this scenario?

Question164: Which of the following statements regarding the firewall policy authentication timeout is true?

Question165: Identify the correct properties of a partial mesh VPN deployment:

Question166: Which of the following statements best describes the green status indicators that appear next to different FortiGuard Distribution Network services as illustrated in the exhibit?

Question167: Which of the following statements are true of the FortiGate unit's factory default configuration?

Question168: View the Exhibit.

Refer to the exhibit. Which two statements are correct? (Choose two.)

Question169: Review the IPsec phase1 configuration in the Exhibit shown below; then answer the question following it.

Which of the following statements are correct regarding this configuration? (Select all that apply).

Question170: Which statement is true regarding the import/export feature?

Question171: Which of the following components are contained in all FortiGate units from the FG50 models and up?
(Select all that apply.)

Question172: When browsing to an internal web server using a web-mode SSL VPN bookmark, from which of the following source IP addresses would the web server consider the HTTP request to be initiated?

Question173: When the SSL proxy inspects the server certificate for Web Filtering only in SSL Handshake mode, which certificate field is being used to determine the site rating?

Question174: Review the output of the command get router info routing-table database shown in the Exhibit below; then answer the question following it.

Which of the following statements are correct regarding this output? (Select all that apply).

Question175: FSSO provides a single sign on solution to authenticate users transparently to a FortiGate unit using credentials stored in Windows Active Directory.
Which of the following statements are correct regarding FSSO in a Windows domain environment when NTLM and Polling Mode are not used? (Select all that apply.)

Question176: Bob wants to send Alice a file that is encrypted using public key cryptography.
Which of the following statements is correct regarding the use of public key cryptography in this scenario?

Question177: Examine the two static routes to the same destination subnet 172.20.168.0/24 as shown below; then answer the question following it.
config router static
edit 1
set dst 172.20.168.0 255.255.255.0
set distance 20
set priority 10
set device port1
next
edit 2
set dst 172.20.168.0 255.255.255.0
set distance 20
set priority 20
set device port2
next
end
Which of the following statements correctly describes the static routing configuration provided above?

Question178: If Routing Information Protocol (RIP) version 1 or version 2 has already been configured on a FortiGate unit, which of the following statements is correct if the routes learned through RIP need to be advertised into Open Shortest Path First (OSPF)?

Question179: In a High Availability configuration operating in Active-Active mode, which of the following correctly describes the path taken by a load-balanced HTTP session?

Question180: Which two statements are correct regarding the "Import all Objects" setting in the import policy wizard?
(Choose two.)

Question181: A network administrator needs to implement dynamic route redundancy between a FortiGate unit located in a remote office and a FortiGate unit located in the central office.
The remote office accesses central resources using IPSec VPN tunnels through two different Internet providers.
What is the best method for allowing the remote office access to the resources through the FortiGate unit used at the central office?

Question182: Which statement correctly compares FortiManager physical and virtual appliances?

Question183: SSL Proxy is used to decrypt the SSL-encrypted traffic. After decryption, where is the traffic buffered in preparation for content inspection?

Question184: Which one of the following statements is correct about raw log messages?

Question185: Which of the following is an advantage of using SNMP v3 instead of SNMP v1/v2 when querying the FortiGate unit?

Question186: Which of the following statements is correct regarding URL Filtering on the FortiGate unit?

Question187: An end user logs into the SSL VPN portal and selects the Tunnel Mode option by clicking on the "Connect" button. The administrator has not enabled split tunneling and so the end user must access the Internet through the SSL VPN Tunnel.
Which firewall policies are needed to allow the end user to not only access the internal network but also reach the Internet?
A:

B:

C:

D:

Question188: A static route is configured for a FortiGate unit from the CLI using the following commands:
config router static
edit 1
set device "wan1"
set distance 20
set gateway 192.168.100.1
next
end
Which of the following conditions is NOT required for this static default route to be displayed in the FortiGate unit's routing table?

Question189: A FortiGate unit can act as which of the following? (Select all that apply.)

Question190: The command structure of the CLI on a FortiGate unit consists of commands, objects, branches, tables and parameters. Which of the following items describes port1?

Question191: A network administrator connects his PC to the INTERNAL interface on a FortiGate unit. The administrator attempts to make an HTTPS connection to the FortiGate unit on the VLAN1 interface at the IP address of
10.0.1.1, but gets no connectivity.
The following troubleshooting commands are executed from the DOS prompt on the PC and from the CLI.
C:\>ping 10.0.1.1
Pinging 10.0.1.1 with 32 bytes of data:
Reply from 10.0.1.1: bytes=32 time=1ms TTL=255
Reply from 10.0.1.1: bytes=32 time<1ms TTL=255
Reply from 10.0.1.1: bytes=32 time<1ms TTL=255
Reply from 10.0.1.1: bytes=32 time<1ms TTL=255
user1 # get system interface
== [ internal ]
namE. internal modE. static ip: 10.0.1.254 255.255.255.128 status: up
netbios-forwarD. disable typE. physical mtu-overridE. disable
== [ vlan1 ]
namE. vlan1 modE. static ip: 10.0.1.1 255.255.255.128 status: up netb
ios-forwarD. disable typE. vlan mtu-overridE. disable
user1 # diagnose debug flow trace start 100
user1 # diagnose debug ena
user1 # diagnose debug flow filter daddr 10.0.1.1 10.0.1.1
id=20085 trace_id=274 msg="vd-root received a packet(proto=6, 10.0.1.130:47927->10.0.1.1:443) from internal." id=20085 trace_id=274 msg="allocate a new session-00000b1b"
id=20085 trace_id=274 msg="find SNAT: IP-10.0.1.1, port-43798"
id=20085 trace_id=274 msg="iprope_in_check() check failed, drop"
Based on the output from these commands, which of the following explanations is a possible cause of the problem?

Question192: Which statement is correct? FortiAnalyzer collects and aggregates log data from:

Question193: Which of the following antivirus and attack definition update features are supported by FortiGate units?
(Select all that apply.)

Question194: An issue could potentially occur when clicking Connect to start tunnel mode SSL VPN. The tunnel will start up for a few seconds, then shut down.
Which of the following statements best describes how to resolve this issue?

Question195: An administrator is examining the attack logs and notices the following entry:
device_id=FG100A3907508962 log_id=18432 subtype=anomaly type=ips timestamp=1270017358 pri=alert itime=1270017893 severity=critical src=192.168.1.52 dst=64.64.64.64 src_int=internal serial=0 status=clear_session proto=6 service=http vd=root count=1 src_port=35094 dst_port=80 attack_id=100663402 sensor=protect-servers ref=http://www.fortinet.com/ids/VID100663402 msg="anomaly: tcp_src_session, 2 > threshold 1" policyid=0 carrier_ep=N/A profile=N/A dst_int=N/A user=N/A group=N/A Based solely upon this log message, which of the following statements is correct?

Question196: When configuring FortiGuard on FortiManager, which two statements are correct regarding Allow Push Update settings configured in the FortiGuard Antivirus and IPS Settings? (Choose two.)

Question197: Which permissions can be configured for a 'Restricted Admin' profile? (Choose three.)

Question198: A FortiGate administrator configures a Virtual Domain (VDOM) for a new customer. After creating the VDOM, the administrator is unable to reassign the dmz interface to the new VDOM as the option is greyed out in Web Config in the management VDOM.
What would be a possible cause for this problem?

Question199: Which two statements are correct regarding header and footer policies? (Choose two.)

Question200: How is traffic routed onto an SSL VPN tunnel from the FortiGate unit side?

Question201: Caching improves performance by reducing FortiGate unit requests to the FortiGuard server.
Which of the following statements are correct regarding the caching of FortiGuard responses? (Select all that apply.)

Question202: Examine the Exhibit shown below; then answer the question following it.

The Vancouver FortiGate unit initially had the following information in its routing table:
S 172.20.0.0/16 [10/0] via 172.21.1.2, port2
C 172.21.0.0/16 is directly connected, port2
C 172.11.11.0/24 is directly connected, port1
Afterwards, the following static route was added:
config router static
edit 6
set dst 172.20.1.0 255.255.255.0
set pririoty 0
set device port1
set gateway 172.11.12.1
next
end
Since this change, the new static route is NOT showing up in the routing table. Given the information provided, which of the following describes the cause of this problem?

Question203: What is 'hot swapping'?

Question204: A firewall policy has been configured for the internal email server to receive email from external parties through SMTP. Exhibits A and B show the AntiVirus and Email Filter profiles applied to this policy.


What is the correct behavior when the email attachment is detected as a virus by the FortiGate AntiVirus engine?

Question205: What statements are true regarding the "store and upload" log transfer option between FortiAnalyzer and FortiGate? (Choose three.)

Question206: A FortiGate 100 unit is configured to receive push updates from the FortiGuard Distribution Network, however, updates are not being received. Which of the following statements are possible reasons for this?
(Select all that apply.)

Question207: When configuring a server load balanced virtual IP, which of the following is the best distribution algorithm to be used in applications where the same physical destination server must be maintained between sessions?

Question208: Which of the following items does NOT support the Logging feature?

Question209: An issue could potentially occur when clicking Connect to start tunnel mode SSL VPN. The tunnel will start up for a few seconds, then shut down.
Which of the following statements best describes how to resolve this issue?

Question210: How can DLP file filters be configured to detect Office 2010 files? (Select all that apply.)

Question211: Which part of an email message exchange is NOT inspected by the POP3 and IMAP proxies?

Question212: Which statements are true regarding encryption settings and levels? (Choose three.)

Question213: Review the configuration for FortiClient IPsec shown in the Exhibit below.

Which of the following statements is correct regarding this configuration?

Question214: What remote authentication servers can you configure to validate your FortiAnalyzer administrator logons?
(Choose three.)

Question215: Which of the following represents the method used on a FortiGate unit running FortiOS version 4.2 to apply traffic shaping to P2P traffic, such as BitTorrent?

Question216: A FortiGate unit can provide which of the following capabilities? (Select all that apply.)

Question217: In Transparent Mode, forward-domain is an attribute of ______________.

Question218: A FortiGate unit can scan for viruses on which types of network traffic? (Select all that apply.)

Question219: If RAID isn't supported, what are other types of backup mechanisms (i.e. methods to preserve your log data in the event of disk failure, deletion, or corruption)? (Choose three.)

Question220: Two FortiGate devices fail to form an HA cluster, the device hostnames are STUDENT and REMOTE.
Exhibit A shows the command output of 'show system ha' for the STUDENT device. Exhibit B shows the command output of 'show system ha' for the REMOTE device.
Exhibit A:

Exhibit B

Which one of the following is the most likely reason that the cluster fails to form?

Question221: SIMULATION
When creating administrative users, the assigned _____________determines user rights on the FortiGate unit.

Question222: Which tabs are available on the FortiManager Web-based manager? (Choose two.)

Question223: The service access settings for a FortiManager network interface relate to which product feature?

Question224: Which of the following represents the correct order of criteria used for the selection of a Master unit within a FortiGate High Availability (HA) cluster when master override is disabled?

Question225: Review the static route configuration for IPsec shown in the Exhibit below; then answer the question following it.

Which of the following statements are correct regarding this configuration? (Select all that apply).

Question226: What are two of the key features of FortiAnalyzer? (Choose two.)

Question227: Which two statements are correct regarding the FortiManager HA cluster? (Choose two.)

Question228: What are the requirements for a cluster to maintain TCP connections after device or link failover? (Select all that apply.)

Question229: Which email filter is NOT available on a FortiGate device?

Question230: What are the operating modes of FortiAnalyzer? (Choose two.)

Question231: Which of the following are valid components of the Fortinet Server Authentication Extensions (FSAE)?
(Select all that apply.)

Question232: Examine the following log message for IPS and identify the valid responses below. (Select all that apply.)
2012-07-01 09:54:28 oid=2 log_id=18433 type=ips subtype=anomaly pri=alert vd=root severity="critical" src="192.168.3.168" dst="192.168.3.170" src_int="port2" serial=0 status="detected" proto=1 service="icmp" count=1 attack_name="icmp_flood" icmp_id="0xa8a4" icmp_type="0x08" icmp_code="0x00" attack_id=16777316 sensor="1" ref="http://www.fortinet.com/ids/VID16777316" msg="anomaly: icmp_flood, 51 > threshold 50"

Question233: What statements are true regarding RAID? (Choose three.)

Question234: Each UTM feature has configurable UTM objects such as sensors, profiles or lists that define how the feature will function. How are UTM features applied to traffic?

Question235: What is the primary difference between raw format logs and formatted format logs?

Question236: An administrator wishes to generate a report showing Top Traffic by service type. They notice that web traffic overwhelms the pie chart and want to exclude the web traffic from the report.
Which of the following statements best describes how to do this?

Question237: A FortiGate AntiVirus profile can be configured to scan for viruses on SMTP, FTP, POP3, and SMB protocols using which inspection mode?

Question238: Which of the following describes the difference between the ban and quarantine actions?

Question239: A network administrator connects his PC to the INTERNAL interface on a FortiGate unit. The administrator attempts to make an HTTPS connection to the FortiGate unit on the VLAN1 interface at the IP address of
10.0.1.1, but gets no connectivity.
The following troubleshooting commands are executed from the CLI:
user1 # get system interface
== [ internal ]
namE. internal modE. static ip: 10.0.1.254 255.255.255.128 status: up
netbios-forwarD. disable typE. physical mtu-overridE. disable
== [ vlan1 ]
namE. vlan1 modE. static ip: 10.0.1.1 255.255.255.128 status: up netb
ios-forwarD. disable typE. vlan mtu-overridE. disable
user1 # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default
S 10.0.0.0/8 [10/0] is a summary, Null
C 10.0.1.0/25 is directly connected, vlan1
C 10.0.1.128/25 is directly connected, internal
user1 # diagnose debug flow trace start 100
user1 # diagnose debug ena
user1 # diagnose debug flow filter daddr 10.0.1.1 10.0.1.1
id=20085 trace_id=277 msg="vd-root received a packet(proto=6, 10.0.1.130
:47922->10.0.1.1:443) from internal."
id=20085 trace_id=277 msg="allocate a new session-00000b21"
id=20085 trace_id=277 msg="iprope_in_check() check failed, drop"
Based on the output from these commands, which of the following is a possible cause of the problem?

Question240: Which of the following network protocols are supported for administrative access to a FortiGate unit?

Question241: What statements are true regarding disk log quota? (Choose two.)

Question242: UTM features can be applied to which of the following items?

Question243: Which of the following cannot be used in conjunction with the endpoint compliance check?

Question244: Which of the following items is NOT a packet characteristic matched by a firewall service object?

Question245: In HA, what is the effect of the Disconnect Cluster Member command as given in the Exhibit.

Question246: A client can create a secure connection to a FortiGate device using SSL VPN in web-only mode.
Which one of the following statements is correct regarding the use of web-only mode SSL VPN?

Question247: If no firewall policy is specified between two FortiGate interfaces and zones are not used, which of the following statements describes the action taken on traffic flowing between these interfaces?

Question248: What are the main management wizards used in Device Manager?

Question249: The transfer of encrypted files or the use of encrypted protocols between users and servers on the internet can frustrate the efforts of administrators attempting to monitor traffic passing through the FortiGate unit and ensuring user compliance to corporate rules.
Which of the following items will allow the administrator to control the transfer of encrypted data through the FortiGate unit? (Select all that apply.)

Question250: What are the methods available to register a device? (Choose two.)

Question251: What is the purpose of locking an ADOM revision?

Question252: Which of the following is true regarding Switch Port Mode?

Question253: Which of the following statements is correct regarding a FortiGate unit operating in NAT/Route mode?

Question254: Which statement is correct regarding provisioning templates?

Question255: Review the IPsec diagnostics output of the command diag vpn tunnel list shown in the Exhibit.

Which of the following statements is correct regarding this output? (Select one answer).

Question256: A firewall policy has been configured such that traffic logging is disabled and a UTM function is enabled.
In addition, the system setting 'utm-incident-traffic-log' has been enabled. In which log will a UTM event message be stored?

Question257: Selecting Create New, as shown in the exhibit, will result in what?

Question258: SSL content inspection is enabled on the FortiGate unit. Which of the following steps is required to prevent a user from being presented with a web browser warning when accessing an SSL-encrypted website?

Question259: Which of the following statements are correct regarding logging to memory on a FortiGate unit? (Select all that apply.)

Question260: Review the output of the command config router ospf shown in the Exhibit below; then answer the question following it.

Which one of the following statements is correct regarding this output?

Question261: Which of the following statements correctly describe Transparent Mode operation? (Select all that apply.)

Question262: If Open Shortest Path First (OSPF) has already been configured on a FortiGate unit, which of the following statements is correct if the routes learned through OSPF need to be announced by Border Gateway Protocol (BGP)?

Question263: A user created a firewall address object, as shown in the exhibit. This object is used in multiple policy packages for multiple FortiGate devices. When the install operation is performed, which two statements are correct for devices referencing this object? (Choose two.)

Question264: In the Tunnel Mode widget of the web portal, the administrator has configured an IP Pool and enabled split tunneling.
Which of the following statements is true about the IP address used by the SSL VPN client?

Question265: File blocking rules are applied before which of the following?

Question266: The following diagnostic output is displayed in the CLI:
diag firewall auth list
policy iD. 9, srC. 192.168.3.168, action: accept, timeout: 13427
user: forticlient_chk_only, group:
flag (80020): auth timeout_ext, flag2 (40): exact
group iD. 0, av group: 0
----- 1 listed, 0 filtered ------
Based on this output, which of the following statements is correct?

Question267: Refer to the exhibit. An administrator created a new interface object named Dev and configured dynamic mapping for the wan2 interface on the HeadOffice FortiGate. A new policy from internal to Dev is configured. Which statement is correct regarding the installation of the HeadOffice policy package?

Question268: How does the Log View page display logs when ADOMs are enabled?

Question269: The FortiGate Web Config provides a link to update the firmware in the System > Status window. Clicking this link will perform which of the following actions?

Question270: A user creates a policy package with two installation targets, as shown in the exhibit. When the install operation is performed, which two statements are correct concerning the Install On column in the policy configuration? (Choose two.)

Question271: By default, what happens when a log file reaches its maximum file size?

Question272: Which of the following pieces of information can be included in the Destination Address field of a firewall policy? (Select all that apply.)

Question273: An administrator is examining the attack logs and notices the following entry:
type=ips subtype=signature pri=alert vd=root serial=1995 attack_id=103022611 src=69.45.64.22 dst=192.168.1.100 src_port=80 dst_port=4887 src_int=wlan dst_int=internal status=detected proto=6 service=4887/tcp user=N/A group=N/A msg=web_client: IE.IFRAME.BufferOverflow.B Based on the information displayed in this entry, which of the following statements are correct? (Select all that apply.)

Question274: Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with SSL? (Choose two.)

Question275: Given the Antivirus and IPS update service is enabled, and the FortiGuard settings as shown in the exhibit.
The desired behavior is for managed devices to use public servers for these updates should FortiManager become unreachable, which is not the case with the current configuration. What two actions are necessary to correct this? (Choose two.)

Question276: Which statement is true regarding FortiAnalyzer models?

Question277: In which order are firewall policies processed on the FortiGate unit?

Question278: What output profiles can you configure for report event notifications? (Choose two.)

Question279: Which of the following are valid FortiGate device interface methods for handling DNS requests? (Select all that apply.)

Question280: A FortiAnalyzer device could use which security method to secure the transfer of log data from FortiGate devices?

Question281: Which two statements are correct regarding the central VPN console? (Choose two.)

Question282: When backing up the configuration file on a FortiGate unit, the contents can be encrypted by enabling the encrypt option and supplying a password.
If the password is forgotten, the configuration file can still be restored using which of the following methods?

Question283: In the case of TCP traffic, which of the following correctly describes the routing table lookups performed by a FortiGate unit when searching for a suitable gateway?

Question284: When performing a log search on a FortiAnalyzer, it is generally recommended to use the Quick Search option.
What is a valid reason for using the Full Search option, instead?

Question285: You wish to create a firewall policy that applies only to traffic intended for your web server. The server has an IP address of 192.168.2.2 and belongs to a class C subnet. When defining the firewall address for use in this policy, which one of the following addressing formats is correct?

Question286: What is the FortiGate unit password recovery process?

Question287: Which of the following statements is not correct regarding virtual domains (VDOMs)?

Question288: An administrator wishes to generate a report showing Top Traffic by service type, but wants to exclude SMTP traffic from the report.
Which of the following statements best describes how to do this?

Question289: Which statement is correct regarding virus scanning on a FortiGate unit?

Question290: The ordering of firewall policies is very important. Policies can be re-ordered within the FortiGate unit's GUI and also using the CLI. The command used in the CLI to perform this function is ______ .

Question291: On the Device Manager tab, what does a red circle in the Logs field of a device indicate?

Question292: Which of the following statements are TRUE for Port Pairing and Forwarding Domains? (Select all that apply.)

Question293: The following ban list entry is displayed through the CLI.
get user ban list
id cause src-ip-addr dst-ip-addr expires created
531 protect_client 10.177.0.21 207.1.17.1 indefinite Wed Dec 24 :21:33 2008 Based on this command output, which of the following statements is correct?

Question294: Which of the following statements are correct regarding the configuration of a FortiGate unit as an SSL VPN gateway? (Select all that apply.)

Question295: Which of the following DLP actions will override any other action?