Fortinet NSE5_FMG-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE5_FMG-7.0 Online Questions & Answers

• Question 41:

  An administrator, Trainer, who is assigned the Super_User profile, is trying to approve a workflow session that was submitted by another administrator, Student. However, Trainer is unable to approve the workflow session. What can prevent an admin account that has Super_User rights over the device from approving a workflow session?

  

  A. Trainer is not a part of workflow approval group
  B. Trainer does not have full rights over this ADOM
  C. Trainer must close Student's workflow session before approving the request
  D. Student, who submitted the workflow session, must first self-approve the request
  A. Trainer is not a part of workflow approval group

  ---

  Reference: https://help.fortinet.com/fmgr/50hlp/56/5-6-1/FMG-FAZ/0800_ADOMs/1800_Workflow/0600_Workflow%20sessions.htm

• Question 42:

  Refer to the exhibit.

  

  Which two statements about an ADOM set in Normal mode on FortiManager are true? (Choose two.)

  A. It supports the FortiManager script feature
  B. It allows making configuration changes for managed devices on FortiManager panes
  C. FortiManager automatically installs the configuration difference in revisions on the managed FortiGate
  D. You cannot assign the same ADOM to multiple administrators
  A. It supports the FortiManager script feature
  B. It allows making configuration changes for managed devices on FortiManager panes

  ---

  "FortiGate units in the ADOM will query their own configuration every 5 seconds. If there has been a configuration change, the FortiGate unit will send a diff revision on the change to the FortiManager using the FGFM protocol."

• Question 43:

  Refer to the exhibit.

  

  An administrator has created a firewall address object, Training which is used in the Local-FortiGate policy package.

  When the installation operation is performed, which IP/Netmask will be installed on the Local-FortiGate, for the Training firewall address object?

  A. 192.168.0.1/24
  B. 10.200.1.0/24
  C. It will create a firewall address group on Local-FortiGate with 192.168.0.1/24 and 10.0.1.0/24 object values.
  D. Local-FortiGate will automatically choose an IP/Netmask based on its network interface settings.
  B. 10.200.1.0/24

  ---

  FortiManager_6.4_Study_Guide-Online ?page 209

  In the example, the dynamic address object LocalLan refers to the internal network address of the managed firewalls. The object has a default value of 192.168.1.0/24. The mapping rules are defined per device. For Remote-FortiGate, the address object LocalLan referes to 10.10.11.0/24. The devices in the ADOM that do not have dynamic mapping for LocalLan have a default value of 192.168.1.0/2.

• Question 44:

  Which two settings must be configured for SD-WAN Central Management? (Choose two.)

  A. SD-WAN must be enabled on per-ADOM basis
  B. You can create multiple SD-WAN interfaces per VDOM
  C. When you configure an SD-WAN, you must specify at least two member interfaces.
  D. The first step in creating an SD-WAN using FortiManager is to create two SD-WAN firewall policies.
  A. SD-WAN must be enabled on per-ADOM basis
  C. When you configure an SD-WAN, you must specify at least two member interfaces.

• Question 45:

  Which of the following statements are true regarding VPN Gateway configuration in VPN Manager? (Choose two.)

  A. Managed gateways are devices managed by FortiManager in the same ADOM
  B. External gateways are third-party VPN gateway devices only
  C. Protected subnets are the subnets behind the device that you don't want to allow access to over the IPsec VPN
  D. Managed devices in other ADOMs must be treated as external gateways
  A. Managed gateways are devices managed by FortiManager in the same ADOM
  D. Managed devices in other ADOMs must be treated as external gateways

  ---

  Reference: http://help.fortinet.com/fmgr/50hlp/56/5-6-1/FMG-FAZ/1300_VPN_Manager/0800_IPsec_VPN_Gateway/0400_Create_mngd_gateway.htm

• Question 46:

  Which of the following statements are true regarding VPN Manager? (Choose three.)

  A. VPN Manager must be enabled on a per ADOM basis.
  B. VPN Manager automatically adds newly-registered devices to a VPN community.
  C. VPN Manager can install common IPsec VPN settings on multiple FortiGate devices at the same time.
  D. Common IPsec settings need to be configured only once in a VPN Community for all managed gateways.
  E. VPN Manager automatically creates all the necessary firewall policies for traffic to be tunneled by IPsec.
  A. VPN Manager must be enabled on a per ADOM basis.
  C. VPN Manager can install common IPsec VPN settings on multiple FortiGate devices at the same time.
  D. Common IPsec settings need to be configured only once in a VPN Community for all managed gateways.

• Question 47:

  An administrator has enabled Service Access on FortiManager.

  What is the purpose of Service Access on the FortiManager interface?

  A. Allows FortiManager to download IPS packages
  B. Allows FortiManager to respond to request for FortiGuard services from FortiGate devices
  C. Allows FortiManager to run real-time debugs on the managed devices
  D. Allows FortiManager to automatically configure a default route
  B. Allows FortiManager to respond to request for FortiGuard services from FortiGate devices

  ---

  FortiManager 6.2 Study guide page 350

• Question 48:

  An administrator would like to authorize a newly-installed AP using AP Manager. What steps does the administrator need to perform to authorize an AP?

  A. Authorize the new AP using AP Manager and wait until the change is updated on the FortiAP. Changes to the AP's state do not require installation.
  B. Changes to the AP's state must be performed directly on the managed FortiGate.
  C. Authorize the new AP using AP Manager and install the policy package changes on the managed FortiGate.
  D. Authorize the new AP using AP Manager and install the device level settings on the managed FortiGate.
  D. Authorize the new AP using AP Manager and install the device level settings on the managed FortiGate.

• Question 49:

  In the event that the primary FortiManager fails, which of the following actions must be performed to return the FortiManager HA to a working state?

  A. Secondary device with highest priority will automatically be promoted to the primary role, and manually reconfigure all other secondary devices to point to the new primary device
  B. Reboot one of the secondary devices to promote it automatically to the primary role, and reconfigure all other secondary devices to point to the new primary device.
  C. Manually promote one of the secondary devices to the primary role, and reconfigure all other secondary devices to point to the new primary device.
  D. FortiManager HA state transition is transparent to administrators and does not require any reconfiguration.
  C. Manually promote one of the secondary devices to the primary role, and reconfigure all other secondary devices to point to the new primary device.

  ---

  FortiManager_6.4_Study_Guide-Online ?page 346

  FortiManager HA doesn't support IP takeover where an HA state transition is transparent to administrators. If a failure of the primary occurs, the administrator must take corrective action to resolve the problem that may include invoking the state transition. If the primary device fails, the administrator must do the following in order to return the FortiManager HA to a working state:

  1.

  Manually reconfigure one of the secondary devices to become the primary device

  2.

  Reconfigure all other secondary devices to point to the new primary device

• Question 50:

  View the following exhibit:

  

  An administrator used the value shown in the exhibit when importing a Local-FortiGate into FortiManager. What name will be used to display the firewall policy for port1?

  A. port1 on FortiGate and WAN on FortiManager
  B. port1 on both FortiGate and FortiManager
  C. WAN zone on FortiGate and WAN zone on FortiManager
  D. WAN zone on FortiGate and WAN interface on FortiManager
  A. port1 on FortiGate and WAN on FortiManager