EMT Practice Test

1. Question Content...

---

Question1: Click the Exhibit button. An administrator implements a multi-chassis link aggregation (MCLAG) solution using two FortiSwitch 448Ds and one FortiGate 3700D. As describes in the network topology shown in the exhibit, two links are connected to each FortiSwitch. What is requires to implement this solution? (Choose two.)

Question2: A FortiOS device is used for termination of VPNs for a number of remote spoke VPN units (designated Group A spokes) using a phase 1 main mode dial-up tunnel using pre-shared keys. Your company recently acquired another organization. You are asked to establish VPN connectivity for the newly acquired organization's sites for which new devices will be provisioned (designated Group B spokes). Both existing (Group A) and new (Group B) spoke units are dynamically addressed. You are asked to ensure that spokes from the acquired organization (Group B) have different access permissions that your existing VPN spokes units (Group A).
Which two solutions meet the requirements for the new spoke group? (Choose two.)

Question3: You have a customer experiencing problems with a legacy L3/L4 firewall device and the IPv6 SIP VoIP traffic. Their device is dropping SIP packets, consequently, it cannot process SIP voice calls. Which solution would solve the customer's problem?

Question4: FortiMail is configured with the protected domain "internal.lab".
Which two envelope addresses will need an access control rule to relay e-mail sent for unauthenticated users? (Choose two.)

Question5: Click the exhibit.
A VPN IPsec is connecting the headquarters office (HQ) with a branch office (BO) and OSPF is used to redistribute routes between the offices. After deployment, a server with IP address 10.10.10.35 located on the DMZ network of the BO FortiGate, was reported unreachable from hosts located on the LAN network of the same FortiGate.

Referring to the exhibit, which statement is true?

Question6: Click the Exhibit button.
An Administrator reports continuous high CPU utilization on a FortiGate device due to the IPS engine. The exhibit shows the global IPS configuration. Which two configuration actions will reduce the CPU usage?
(Choose two.)

Question7: Click the Exhibit button.

You log into FortiManager, look at the Device Manager window and notice that one of your managed devices is not in normal status.
Referring to the exhibit, which two statements correctly describe the affected device's status and result?
(Choose two.)

Question8: Click the exhibit.
You created an aggregate interface between your FortiGate and a switch consisting of two 1 Gbps links as shown in the exhibit. However, the maximum bandwidth never exceeds. 1 Gbps and employees are complaining that the network is slow. After troubleshooting, you notice only one member interface is being used. The configuration for the aggregate interface is shown in the exhibit.
In this scenario, which command will solve this problem?

Question9: Click to the Exhibit button.
You need to apply the security features below to the network shown in the exhibit.
-high grade DDoS protection
-Web security and load balancing for Server1 and Server2
-Solution must be PCI DSS compliant
-Enhanced security to DNS 1 and DNS 2

What are three solutions for this scenario? (Choose three.)

Question10: You deploy a FortiGate device in a remote office based on the requirements shown below.
-Due to company's security policy, management IP of your FortiGate is not allowed to access the Internet.
- Apply Web Filtering, AntiVirus, IPS and Application control to the protected subnet.
- Be managed by a central FortiManager on the head office.
Which action will help to achieve the requirements?

Question11: Click the Exhibit button.
Your organization has a FortiGate cluster that is connected to two independent ISPs. You must configure the FortiGate failover for a single ISP failure to occur without disruption. Referring to the exhibit, which two FortiGate BGP features would be used to accomplish this task? (Choose two.)

Question12: You cannot ping the FortiGate's default gateway 10.10.10.1 from the FortiGate CLI. The FortiGate's interface facing the default gateway is wan1 and its IP address is 10.10.10.254/24. During the initial troubleshooting tests, you confirmed that you can ping other IP addresses in the 10.10.10.0/24 subnet from the FortiGate CLI without packets lost.
Which two CLI commands will help you to troubleshoot this problem? (Choose two.)

Question13: Click the Exhibit button.
The exhibit shows a full-mesh topology between FortiGates and FortiSwitches. To deploy this configuration, two requirements must be met:
-20 Gbps full duplex connectivity is available between each FortiGate and the FortiSwitches
-The FortiGate HA must be in AP mode.

Referring to the exhibit, what are two actions that will fulfill the requirements? (Choose two.)

Question14: You are building a FortiGate cluster which is stretched over two locations. The HA connections for the cluster are terminated on the local switches in the data centers. Once the FortiGates have booted, they do not form a cluster. The network operations inform you that CRC errors are present on the switches where the FortiGates are connected.
What should you do to solve this problem?

Question15: You must create a High Availability deployment with two FortiWebs in Amazon Web Services (AWS), each on different Availability Zones (AZ) from the same region. At the same time, each FortiWeb should be able to deliver content from the Web servers of both of the AZs.
Which deployment would fulfill this requirement?

Question16: In FortiGate 5000 series, two FortiControllers are working as an SLBC cluster in a-p mode. The configuration shown below is applied.
config load-balance session-setup
set tcp-ingress enable
end
Which statement is true on how new TCP sessions are handled by the Distributor Processor (DP)?

Question17: Click the Exhibit button. When deploying a new FortiGate-VMX Security node, an administrator received the error message shown in the exhibit.
In this scenario, which statement is correct?

Question18: You have deployed a FortiGate in NAT/Route mode as a Secure Web Gateway with a few IP-based authentication firewall policies. Your customer reports that some users now have different browsing permissions from what is expected. All these users are browsing using Internet Explorer through a Remote Desktop Connection to a Terminal Server.
When you look at the FortiGate logs, the username for the Terminal Server IP is not consistent.
Which action will correct this problem?

Question19: Click the Exhibit button.
The exhibit shows the configuration of a service protection profile (SPP) in a FortiDDoS device.
Which two statements are true about the traffic matching being inspected by this SPP? (Choose two.)

Question20: Click the Exhibit button.
You have deployed several perimeter FortiGates with internal segmentation FortiGates behind them. All FortiGate devices are logging to FortiAnalyzer. When you search the logs in FortiAnalyzer for denied traffic, you see numerous log messages, as shown in the exhibit, on your perimeter FortiGates only.

Which two actions would reduce the number of these log messages? (Choose two.)

Question21: You are administering the FortiGate 5000 and FortiGate 7000 series products. You want to access the HTTPS GUI on the blade located in logical slot 3 of the secondary chassis in a high-availability cluster.
Which URL will accomplish this task?

Question22: You are asked to implement a single FortiGate 5000 chassis using Session-aware Load Balance Cluster (SLBC) with Active - Passive FortinControllers. Both FortiControllers have the configuration shown below, with the rest of the configuration set to the default values:
сonfig system ha
set mode dual
set password fortinetnse8
set group-id 5
set chassis-id 1
set minimize-chassis-failover enable
set hbdev "b1"
end
Both FortiControllers show Master status. What is the problem in this scenario?

Question23: Click the Exhibit button. Referring to the exhibit, which two behaviors will the FortiClient endpoint have after receiving the profile update from the FortiClient EMS? (Choose two.)

Question24: You want to manage a FortiGate with the FortiCloud service.
The FortiGate shows up in your list of devices on the FortiGate Web Site, but all management functions are either missing or grayed out. Which statement is correct in this scenario?

Question25: An old router has been replaced by a FortiWAN device. The FortiWAN has inherited the router's management IP address and now the network administrator needs to remove the old router from the FortiSIEM configuration.
Which two statements are true about this operation? (Choose two.)

Question26: Click the Exhibit button.
Only users authenticated in FortiGate-B can reach the server. A customer wants to deploy a single sign-on solution for IPsec VPN users. Once a user is connected and authenticated to the VPN in FortiGate-A, the user does not need to authenticate again in FortiGate -B to reach the server.
Which two actions satisfy this requirement? (Choose two.)

Question27: Refer to the Exhibit button.
You need to run a script in FortiManager against managed FortiGate devices in your organization to install a configuration for a new static route. Which two scripts will successfully configure the static route on the managed device? (Choose two.)

Question28: Click the Exhibit button.
Referring to the exhibit, which command-line option for deep inspection SSL would have the FortiGate re- sign all untrusted self-signed certificates with the trusted Fortinet_CA_SSL certificate?

Question29: Click the Exhibit button.

Referring to the exhibit, which two statements are true about local authentication? (Choose two.)