Question 1

Which statement about NGFW policy-based application filtering is true?

AAfter the application has been identified, the kernel uses only the Layer 4 header to match the traffic.

BThe IPS security profile is the only security option you can apply to the security policy with the action set to ACCEPT.

CAfter IPS identifies the application, it adds an entry to a dynamic ISDB table.

DFortiGate will drop all packets until the application can be identified.

Answer : D

Question 2

Which statement about the designated router (DR) and backup designated router (BDR) in an OSPF multi-access network is true?

AFortiGate first checks the OSPF ID to elect a DR.

BNon-DR and non-BDR routers will form full adjacencies to DR and BDR only.

CBDR is responsible for forwarding link state information from one router to another.

DOnly the DR receives link state information from non-DR routers.

Answer : B

Question 3

Refer to the exhibits.

Which contain the partial configurations of two VPNs on FortiGate.

An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovered that FortiGate is not matching the user-2 VPN for members of the Users-2 group.

Which two changes must administrator make to fix the issue? (Choose two.)

AUse different pre-shared keys on both VPNs

BEnable Mode Config on both VPNs.

CSet up specific peer IDs on both VPNs.

DChange to aggressive mode on both VPNs.

Answer : C, D

Question 4

Refer to the exhibit, which shows a partial routing table.

Assuming all the appropriate firewall policies are configured, which two pings will FortiGate route? (Choose two.)

ASource IP address: 10.1.0.10. Destination IP address: 10.64.1.52

BSource IPaddress: 10.72.3.52. Destination IP address: 10.1.0.254

CSource IPaddress: 10.10.4.24, Destination IPaddress: 10.72.3.20

DSource IPaddress: 10.73.9.10, Destination IPaddress: 10.72.3.15

Answer : A, B

Question 5

Exhibits:

Refer to the exhibits, which contain the network topology and BGP configuration for a hub.

An administrator is trying to configure ADVPN with a hub-spoke VPN setup using iBGP. All the VPNs are up and connected to the hub. The hub is receiving route information from both spokes over iBGP; however, the spokes are not receiving route information from each other.

What change must the administrator make to the hub BGP configuration so that the routes learned by one spoke are forwarded to the other spokes?

AConfigure an individual neighbor and remove neighbor-range configuration.

BConfigure the hub as a route reflector client.

CChange the router id to 10.1.0.254.

DMake the configuration of remote-as different from the configuration of local-as.