An administrator has configured the following CLI script on FortiManager, which failed to apply any changes to the managed device after being executed.  Why didn't the script make any changes to the managed device?
-
A
Commands that start with the # sign are not executed.
-
B
CLI scripts will add objects only if they are referenced by policies.
-
C
Incomplete commands are ignored in CLI scripts.
-
D
Static routes can only be added using TCL scripts.
Reveal answer details
Close answer details
Correct answerA
Explanationhttps://help.fortinet.com/fmgr/50hlp/56/5-6-2/FortiManager_Admin_Guide/1000_Device%20Manager/2400_Scripts/1000_Script%20samples/0200_CLI%20scripts+.htm#Error_MessagesAsequenceofFortiGateCLIcommands,asyouwouldtypethematthecommandline.Acommentlinestartswiththenumbersign(#).Acommentlinewillnotbeexecuted.
Question 2
Multiple choice
Which the following events can trigger the election of a new primary unit in a HA cluster? (Choose two.)
-
A
Primary unit stops sending HA heartbeat keepalives.
-
B
The FortiGuard license for the primary unit is updated.
-
C
One of the monitored interfaces in the primary unit is disconnected.
-
D
A secondary unit is removed from the HA cluster.
Reveal answer details
Close answer details
An administrator has configured a dial-up IPsec VPN with one phase 2, extended authentication (XAuth) and IKE mode configuration. The administrator has also enabled the IKE real time debug:
diagnose debug application ike-1
diagnose debug enable In which order is each step and phase displayed in the debug output each time a new dial-up user is connecting to the VPN?
-
A
Phase1; IKE mode configuration; XAuth; phase 2.
-
B
Phase1; XAuth; IKE mode configuration; phase2.
-
C
Phase1; XAuth; phase 2; IKE mode configuration.
-
D
Phase1; IKE mode configuration; phase 2; XAuth.
Reveal answer details
Close answer details
Correct answerB
Explanationhttps://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-ipsecvpn-54/IPsec_VPN_Concepts/IKE_Packet_Processing.htm
Question 4
Multiple choice
Examine the following partial output from two system debug commands; then answer the question below.   Which of the following statements are true regarding the above outputs? (Choose two.)
-
A
The unit is running a 32-bit FortiOS
-
B
The unit is in kernel conserve mode
-
C
The Cached value is always the Active value plus the Inactive value
-
D
Kernel indirectly accesses the low memory (LowTotal) through memory paging
Reveal answer details
Close answer details
An administrator has enabled HA session synchronization in a HA cluster with two members. Which flag is added to a primary unit's session to indicate that it has been synchronized to the secondary unit?
-
A
-
B
-
C
-
D
Reveal answer details
Close answer details
Correct answerC
ExplanationThe synced sessions have the `synced' flag. The command `diag sys session list' can be used to see the sessions on the member, with the associated flags.
Question 6
Multiple choice
An administrator cannot connect to the GIU of a FortiGate unit with the IP address 10.0.1.254. The administrator runs the debug flow while attempting the connection using HTTP. The output of the debug flow is shown in the exhibit:  Based on the error displayed by the debug flow, which are valid reasons for this problem? (Choose two.)
-
A
HTTP administrative access is disabled in the FortiGate interface with the IP address 10.0.1.254.
-
B
Redirection of HTTP to HTTPS administrative access is disabled.
-
C
HTTP administrative access is configured with a port number different than 80.
-
D
The packet is denied because of reverse path forwarding check.
Reveal answer details
Close answer details
Question 7
Multiple choice
Which of the following conditions must be met for a static route to be active in the routing table? (Choose three.)
-
A
The next-hop IP address is up.
-
B
There is no other route, to the same destination, with a higher distance.
-
C
The link health monitor (if configured) is up.
-
D
The next-hop IP address belongs to one of the outgoing interface subnets.
-
E
The outgoing interface is up.
Reveal answer details
Close answer details
Correct answersC, D, E
ExplanationA configured static route only goes to routing table from routing database when all the following are met : The outgoing interface is up
There is no other matching route with a lower distance.
The link health monitor (if configured) is successful
The next-hop IP address belongs to one of the outgoing interface subnets
Question 8
Multiple choice
Refer to the exhibit, which contains the partial output of a diagnose command.  Based on the output, which two statements are correct? (Choose two.)
-
A
-
B
-
C
Remote gateway IP is 10.200.4.1.
-
D
Quick mode selectors are disabled.
Reveal answer details
Close answer details
Question 9
Multiple choice
Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)
-
A
Preview pending configuration changes for managed devices.
-
B
Add devices to FortiManager.
-
C
Import policy packages from managed devices.
-
D
Install configuration changes to managed devices.
-
E
Import interface mappings from managed devices.
Reveal answer details
Close answer details
Correct answersA, D
Explanationhttps://help.fortinet.com/fmgr/50hlp/56/5-6-2/FortiManager_Admin_Guide/1000_Device%20Manager/1200_install_to%20devices/0400_Install%20wizard-device%20settings.htmThereare4mainwizards:AddDevice:isusedtoadddevicestocentralmanagementandimporttheirconfigurations.Install:isusedtoinstallconfigurationchangesfromDeviceManagerorPolicies&Objectstothemanageddevices.Itallowsyoutopreviewthechangesand,iftheadministratordoesn'tagreewiththechanges,cancelandmodifythem.Importpolicy:isusedtoimportinterfacemapping,policydatabase,andobjectsassociatedwiththemanageddevicesintoapolicypackageunderthePolicy&Objecttab.ItrunswiththeAddDevicewizardbydefaultandmayberunatanytimefromthemanageddevicelist.Re-installpolicy:isusedtoperformaquickinstallofthepolicypackage.Itdoesn'tgivetheabilitytopreviewthechangesthatwillbeinstalledtothemanageddevice.
Question 10
Single choice
View these partial outputs from two routing debug commands:  Which outbound interface will FortiGate use to route web traffic from internal users to the Internet?
-
A
-
B
-
C
-
D
Reveal answer details
Close answer details
Question 11
Multiple choice
View the exhibit, which contains the output of a diagnose command, and then answer the question below.  Which statements are true regarding the output in the exhibit? (Choose two.)
-
A
FortiGate will probe 121.111.236.179 every fifteen minutes for a response.
-
B
Servers with the D flag are considered to be down.
-
C
Servers with a negative TZ value are experiencing a service outage.
-
D
FortiGate used 209.222.147.3 as the initial server to validate its contract.
Reveal answer details
Close answer details
Correct answersA, D
ExplanationA ?because flag is Failed so fortigate will check if server is available every 15 min D-state is I , contact to validate contract info
Question 12
Single choice
View the exhibit, which contains the partial output of an IKE real time debug, and then answer the question below.
The administrator does not have access to the remote gateway.
Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?
-
A
Change phase 1 encryption to AESCBC and authentication to SHA128.
-
B
Change phase 1 encryption to 3DES and authentication to CBC.
-
C
Change phase 1 encryption to AES128 and authentication to SHA512.
-
D
Change phase 1 encryption to 3DES and authentication to SHA256.
Reveal answer details
Close answer details
Question 13
Single choice
Four FortiGate devices configured for OSPF connected to the same broadcast domain.
The first unit is elected as the designated router The second unit is elected as the backup designated router Under normal operation, how many OSPF full adjacencies are formed to each of the other two units?
-
A
-
B
-
C
-
D
Reveal answer details
Close answer details
Question 14
Multiple choice
View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.  Which statements about this debug output are correct? (Choose two.)
-
A
The remote gateway IP address is 10.0.0.1.
-
B
It shows a phase 1 negotiation.
-
C
The negotiation is using AES128 encryption with CBC hash.
-
D
The initiator has provided remote as its IPsec peer ID.
Reveal answer details
Close answer details
Question 15
Single choice
View the exhibit, which contains the output of a web diagnose command, and then answer the question below.  Which one of the following statements explains why the cache statistics are all zeros?
-
A
The administrator has reallocated the cache memory to a separate process.
-
B
There are no users making web requests.
-
C
The FortiGuard web filter cache is disabled in the FortiGate's configuration.
-
D
FortiGate is using a flow-based web filter and the cache applies only to proxy-based inspection.
Reveal answer details
Close answer details
Question 16
Multiple choice
In which two states is a given session categorized as ephemeral? (Choose two.)
-
A
A TCP session waiting to complete the three-way handshake.
-
B
A TCP session waiting for FIN ACK.
-
C
A UDP session with packets sent and received.
-
D
A UDP session with only one packet received.
Reveal answer details
Close answer details
|