#@$%%%

transcrever o que esta na imagem Refer to the exhibit. Partial output of a real-time OSPF debug is shown. Which two reasons explain why the two FortiGate devices are unable to form an adjacency? (Choose two answers.). A. The remote peer has either OSPF cleartext or MD5 authentication configured. B. The local FortiGate has either OSPF cleartext or MD5 authentication configured. C. There is an OSPF authentication configuration mismatch. D. The local FortiGate does not have OSPF authentication configured.

Refer to the exhibits. The system administrator settings configured on a root FortiGate and the Security Fabric settings configured on a downstream FortiGate are shown. When prompted to sign in with Security Fabric to the downstream FortiGate, a user enters the single sign-on (SSO) provider credentials. A. The user is prompted to create an administrator account for AdminSSO. B. The downstream FortiGate creates an SSO administrator account for AdminSSO with the super_admin_readonly profile. C. The downstream FortiGate creates an SSO administrator account for AdminSSO with the super_admin profile. D. The downstream FortiGate relies on the root FortiGate and does not create an administrator account.

You want to configure two static routes. One that references a zone and the second one that references an SD-WAN member that belongs to that zone. Which statement about this scenario is true? (Choose one answer). A. You cannot create static routes for individual SD-WAN members. B. You cannot create static routes that reference an SD-WAN zone. C. The destination subnets must be different. D. The source subnets must be different.

Refer to the exhibit. Based on the exhibit, what is the first message that Spoke 1 replies to the hub instructing it to bring up the dynamic tunnel if a client generates traffic destined to Spoke 2? (Choose one answer). A. Shortcut query. B. Shortcut reply. C. Shortcut offer. D. Shortcut forward.

The output of the diagnose session list command is shown. If the HA ID for the primary device is 0, what happens if the primary fails and the secondary becomes the primary? (Choose one answer). A. The session state is preserved, but the kernel will re-evaluate the session because the routing information will be flushed. B. The session continues to permit traffic on the new primary device after failover, without requiring the client to restart the session with the server. C. The session is synchronized with the secondary device; however, because application control is applied, the session is marked dirty and has to be re-evaluated after failover. D. The session will be removed from the session table of the secondary device because the TCP session is not yet fully established.

Refer to the exhibit. The packet capture output of a client hello message is shown. You are updating a firewall policy that includes SSL certificate inspection. You are capturing packets from the traffic passing through this firewall policy. Which two statements about the packet capture are correct? (Choose two answers). A. You can effectively apply an antivirus security profile to this traffic. B. The subject alternative name (SAN) is necessary to apply security profiles. C. The client supports only TLS versions 1.2 and 1.3. D. You can effectively apply a web filtering profile to this traffic.

While troubleshooting a FortiGate web filter issue, users report that they cannot access any websites, even though those sites are not explicitly blocked by any web filter profiles that are applied to firewall policies. What are the three most likely reasons for this behavior? (Choose three answers). A. The SSL/TLS deep inspection was configured but the browsers do not have the FortiGate certificate installed. B. The webfilter-force-off setting has been enabled under config system fortiguard. C. The web filter cache has been cleared causing all websites to take longer to be rated. D. The DNS server is unreachable, preventing URL resolution. E. The FortiGuard Web Filtering license has expired, causing FortiGate to apply the default block action.

Refer to the exhibit. A network topology and the routing table of a FortiGate device is shown. What must the administrator configure in the BGP section to add only the subnet 100.64.2.0/24 in the routing table of FortiGate_A? (Choose one answer). A. The administrator must configure route-map-in on FortiGate_A. B. The administrator must configure connected routes redistribution on FortiGate_C. C. The administrator must configure the 100.64.2.0/24 network on FortiGate_C. D. The administrator must configure BGP route redistribution on FortiGate_B.

If you configure set tcp-mss-sender and set tcp-mss-receiver in a firewall policy, how does it affect the size and handling of TCP packets in the network? (Choose one answer). A. The commands affect the payload size of the packet and the size of the IP header for handling TCP packets. B. The TCP packet modifies the packet size only if no fragmentation occurs. C. Applying commands in a firewall policy determines the largest payload a device can handle in a single TCP segment. D. The maximum segment size permitted in the firewall policy determines whether TCP packets are allowed or denied.

Refer to the exhibits. The SD-WAN zone configuration of an SD-WAN template prepared on FortiManager and the policy package configuration are shown. When you try to install the configuration changes, FortiManager displays an error message. How can you fix the issue? (Choose one answer). A. Configure HUB1 as the destination of policy 3. B. Configure both HUB1-VPN1 and HUB1-VPN2 as the destination of policy 3. C. Configure branch1_fgt as the installation target for policy 3. D. Configure a normalized interface for the IPsec tunnel HUB1-VPN1.

Refer to the exhibit. The ADVPN IPsec interface represents the VPN IPsec phase 1 from Hub A to Spoke 1 and Spoke 2, and from Hub B to Spoke 3 and Spoke 4. You must configure an ADVPN using IBGP and EBGP to connect Overlay 1 with Overlay 2. Which parameters must you configure in the phase 1 VPN IPsec configuration of the ADVPN tunnels? (Choose one answer). A. set auto-discovery-sender enable and set network-id x. B. set auto-discovery-forwarder enable and set remote-as x. C. set auto-discovery-receiver enable and set remote-ip x. D. set auto-discovery-crossover enable and set enforce-multihop enable.

What are three key routing principles of SD-WAN? (Choose three answers). A. Routes to directly connected subnets have precedence over SD-WAN rules. B. Internet Service Database (ISDB) routes have precedence over SD-WAN rules. C. SD-WAN rules are skipped if the best route to the destination is a static route. D. SD-WAN members are skipped if they do not have a valid route to the destination. E. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.

You want to configure SD-WAN on a few FortiGate devices to optimize the use of WAN links and secure internet access. The devices are standalone FortiGate, already centrally managed by FortiManager. Which statement applies? (Choose one answer). A. You can keep the devices in the Device Manager section. You can configure per-device SD-WAN settings. B. You must move the devices to the SD-WAN Manager section and use the SD-WAN standalone wizard. C. You must move the devices to the SD-WAN Manager section before you can configure SD-WAN rules. D. You can keep the devices in the Device Manager section, but you must place them in a dedicated device group.

You use the FortiManager SD-WAN overlay orchestrator to prepare an SD-WAN deployment. Using information provided through the SD-WAN overlay template wizard, FortiManager creates templates that are ready to install on the spoke and hub devices. Which three templates are created by the SD-WAN overlay orchestrator for a spoke device? (Choose three answers). A. Rules template. B. CLI template. C. IPsec tunnel template. D. BGP template. E. Static route template.

Refer to the exhibit. The VDOM configuration on a FortiGate device is shown. You discover that web filtering stopped working in Core1 and Core2 after a maintenance window. What are two reasons why web filtering stopped working? (Choose two answers). A. The root VDOM does not have access to FortiManager in a closed network. B. The root VDOM does not have access to any valid, public Fortinet Distribution Network (FDN). C. The Core1 and Core2 VDOMs must also be enabled as management VDOMs to receive FortiGuard updates. D. The root VDOM does not use a VDOM link to connect with the Core1 and Core2 VDOMs.

Refer to the exhibit. For your ZTP deployment, you review the CSV file shown in the exhibit and note that it is missing important information. Which two elements must you change before you can import it into FortiManager? (Choose two answers). A. You must define a name for each device. B. You must associate a device blueprint with each device. C. You must define a value for each device and each user-defined metadata variable. D. You must define a value for each device and each metadata variable that defines an IP address.

In a transparent VDOM interface, what does the command set forward-domain <domain_ID> do? (Choose one answer). A. It isolates traffic within a specific VLAN by assigning a broadcast domain to an interface based on the VLAN ID. B. It allows the interface to access the configured admin domain. C. It assigns a unique domain ID to the interface, allowing it to operate across multiple VLANs within the same VDOM. D. It restricts the interface to managing traffic from only the specified VLAN, effectively segregating network traffic.

Refer to the exhibit. An SD-WAN zone configuration on the FortiGate GUI is shown. What can you conclude about the zone and member configuration on this device? (Choose one answer). A. You can delete the WAN1 zone. B. You can add the member B-125 to the WAN3 zone and keep it as a member of the Test zone. C. You can delete the virtual-wan-link zone. D. The WAN2 zone contains no member.

Refer to the exhibits. Which two statements are true about the health and performance of SD-WAN members 3 and 4? (Choose two answers). A. Encrypted traffic is not used for the performance measurement. B. The performance is an average of the metrics measured for Facebook and YouTube traffic passing through the member. C. Only related TCP traffic is used for performance measurement. D. FortiGate identifies the member as dead when there is no Facebook and YouTube traffic passing through the member.

In a Security Fabric environment, which three actions must you take to ensure successful communication among the nodes? (Choose three answers). A. You must configure FortiGate in transparent mode. B. You must enable FortiTelemetry on the receiving interface of the upstream FortiGate. C. You must ensure that TCP port 8013 is not blocked along the way. D. You must ensure that the port for Neighbor Discovery has been changed. E. You must authorize the downstream FortiGate on the root FortiGate.

As an IT manager, you want to delegate the installation and management of your SD-WAN deployment to a managed security service provider (MSSP). Each site must maintain direct internet access and be secure. You expect significant traffic flow between the sites and want to delegate as much of the network administration and management as possible to the MSSP. Which two MSSP deployment blueprints address the your requirements? (Choose two answers). A. Install a dedicated hub on the MSSP premises for the customer, and install the spokes on the customer premises. B. Use a shared hub on the MSSP premises with a dedicated VDOM for the customer, and install the spokes on the customer premises. C. Install the hub and spokes on the customer premises, and enable the MSSP to manage the SD-WAN deployment using FortiManager with a dedicated ADOM. D. Use a shared hub on the MSSP premises and a dedicated hub on the customer premises, and install the spokes on the customer premises.

During the last network migration, the IT department discovered that all zero phase selectors in phase 2 IPsec configurations impact network operations. What are two valid recommendations to prevent potential invalid paths during future migrations? (Choose two answers). A. Configure routing protocols to specify allowed subnets over the tunnel. B. Configure the VPN with the exact segments that will be encrypted in the phase two selectors. C. Configure an IP address on the IPsec interface of each firewall to establish unique peer connections and avoid impacting network operations. D. Configure an IPsec aggregate to create redundancy between each firewall peer.

Refer to the exhibits. An administrator is testing application steering in SD-WAN. Before generating test traffic, the administrator collected the information shown in the first exhibit. After generating GoToMeeting test traffic, the administrator examined the corresponding traffic log on FortiAnalyzer, which is shown in the second exhibit. The administrator noticed that the traffic matched the implicit SD-WAN rule, but they expected the traffic to match rule ID 1. Which two reasons explain why some log messages show that the traffic matched the implicit SD-WAN rule? (Choose two answers). A. The session 3-tuple did not match any of the existing entries in the ISDB application cache. B. No configured SD-WAN rule matches the traffic related to the collaboration application GoToMeeting. C. Full SSL inspection is not enabled on the matching firewall policy. D. FortiGate could not refresh the routing information on the session after the application was detected.

The output of a BGP debug command is shown. What is the most likely reason that the local FortiGate is not receiving any prefixes from its neighbors? (Choose one answer). A. The RIB-OUT configuration for router 10.127.0.75 prevents any route advertisement to the local router. B. The local router is waiting for the keepalive message from the router 10.125.0.60. C. None of the three neighbors has successfully established the TCP three-way handshake with the local router. D. The router 100.64.3.1 is waiting for the OPEN message from the local router.

Refer to the exhibit. You update the spokes configuration of an existing auto-discovery VPN (ADVPN) topology by adding the parameters shown in the exhibit. Which is a valid objective of those settings? (Choose one answer). A. Enable the tunnels as overlay links. B. Convert the configuration from ADVPN to ADVPN 2.0. C. Prevent multiple shortcuts from being established over the same overlay. D. Prevent crossoverlay shortcuts.

Which two troubleshooting steps should you perform if you encounter issues with intermittent web filter behavior? (Choose two answers). A. Check that the communication between FortiGate and FortiGuard is stable. B. Check that the inspection mode configured for the web filter profile matches that of the firewall policy where it is applied. C. Check that the correct port is mapped to HTTP in the Protocol Options. D. Check that FortiGate is not entering conserve mode.

Refer to the exhibits. The administrator increases the member priority on port2 to 20. Assuming the route egressing port2 is still valid, upon configuration changes and the receipt of new packets. Which two actions does FortiGate perform on existing sessions established over port2? (Choose two answers). A. FortiGate flags all sessions as dirty. B. FortiGate updates the gateway information of the sessions with SNAT so that they use port1 instead of port2. C. FortiGate continues routing all existing sessions over port2. D. FortiGate flags all source network address translation (SNAT) sessions as dirty only if the administrator has assigned an IP pool to the firewall policies with NAT.

Refer to the exhibit. The output of the command diagnose vpn tunnel list is shown. Reviewing the debug command, what is the current status of the traffic flowing through the tunnel? (Choose one answer). A. The inbound IPsec SA was copied to the NPU. B. NP6 is handling the offloading. C. The inbound and outbound IPsec SAs were copied to the NPU. D. The outbound IPsec SA was copied to the NPU.

Refer to the exhibit. Two hub-and-spoke groups are connected through redundant site-to-site IPsec VPNs between Hub 1 and Hub 2. Which two configuration settings are required for the spoke A1 to establish an ADVPN shortcut with the spoke B2? (Choose two answers). A. On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to spokes. B. On hubs, auto-discovery-sender must be enabled on the IPsec VPNs to spokes. C. On hubs, auto-discovery-receiver must be enabled on the IPsec VPNs to spokes. D. On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to hubs.

Refer to the exhibit. The health-check configuration on a FortiGate device used as a spoke is shown. You notice that the hub FortiGate does not prioritize the traffic as expected. Which two configuration elements should you check on the hub? (Choose two answers). A. The performance SLA uses the same criteria. B. The performance SLA is configured with set embedded-measure accept. C. The performance SLA has the parameter priority-out-sla configured. D. This performance SLA uses the same members.

You want to harden the SSL/SSH Inspection profile for access to HTTPS web servers. Which two configuration changes allow you to remove vulnerabilities? (Choose two answers). A. Set unsupported-ssl-version to block. B. Set Server certificate SNI check to Enable. C. Set Untrusted SSL certificates to Ignore. D. Set min-allowed-ssl-version to ssl-3.0.

Refer to the exhibits. The configuration of an SD-WAN rule and the corresponding rule status and routing table are shown. You want to understand the expected behavior for traffic that matches the SD-WAN rule, at the time the output was collected. Based on the exhibits, which behavior can you expect for traffic that matches the SD-WAN rule? (Choose one answer). A. The traffic will be load balanced across all three overlays. B. The traffic will be routed over HUB1-VPN3. C. The traffic will be routed over HUB1-VPN1. D. The traffic will be routed over HUB1-VPN2.

Which three factors about service-level agreement (SLA) targets and SD-WAN rules should you consider when configuring SD-WAN rules? (Choose three answers). A. SLA targets are used by only SD-WAN rules that are configured with a lowest cost (SLA) strategy. B. Best performance SD-WAN rules cannot use SLA targets. C. When configuring an SD-WAN rule, you can select only one SLA target. D. Member metrics are measured when an SLA target references them. E. When configuring an SD-WAN rule, you can select multiple SLA targets from the same performance SLA.

Refer to the exhibits. You are using FortiManager to manage the branch devices and configure the SD-WAN template. You update the configuration to address new user requirements and set the firewall policies shown in the second exhibit. Then, when you use the install wizard to install the updated configuration and firewall policy package on the branch devices, FortiManager reports the error shown in the third exhibit. Why can't FortiManager install the configuration on the branch devices? (Choose one answer). A. You must direct traffic with the default security profile to a VPN tunnel. B. You cannot install firewall policies for HTTPS traffic with no SSL inspection. C. You cannot install firewall policies that reference an SD-WAN zone. D. You cannot install firewall policies that reference an SD-WAN member.

When you deploy SD-WAN, you can choose from several common designs. Each design best applies to specific contexts. Which two statements correctly associate a common SD-WAN design with its main indication or constraint? (Choose two answers). A. Use a cloud on-ramp topology to improve the performance of cloud applications. B. Use a direct internet access (DIA) design to increases the traffic security and allows local devices with limited capabilities. C. Use a standalone design for sites with only one WAN link to the cloud. D. Use remote breakout to centralize traffic inspection and limit local management requirements.

What are three characteristics of the provisioning templates available on FortiManager? (Choose three answers). A. A CLI template can be of type CLI script or Perl script. B. A template group can include a system template and an SD-WAN template. C. Each template group can contain up to three IPsec tunnel templates. D. A CLI template group can contain CLI templates of different types. E. CLI templates are applied in order, from top to bottom.

You configure the overlay tunnels for an SD-WAN hub-and-spoke topology defined with IPsec tunnels, BGP on loopback, and dynamic BGP. Which are two recommended IPsec settings for this topology? (Choose two answers). A. On the hub, set the tunnel type to static. B. On the hub, set the parameter mode-cfg to enable. C. On the spoke, set the parameter net-device to enable. D. On the spoke, configure the parameter localid.

The partial output of an OSPF command is shown. While checking the OSPF status of FortiGate, you receive the output shown in the exhibit. Based on the output, which two statements about FortiGate are correct? (Choose two answers). A. FortiGate injects external routing information. B. FortiGate is a backup designated router. C. FortiGate is connected to multiple areas. D. FortiGate has OSPF ECMP enabled.

Consider the scenario where the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate. Which two actions will FortiGate take when using the default settings for SSL certificate inspection? (Choose two answers). A. FortiGate uses the CN information from the Subject field in the server certificate. B. FortiGate uses the SNI from the user's web browser. C. FortiGate will automatically rewrite the SNI to match the CN in the certificate. D. FortiGate does not decrypt the traffic if the traffic is allowed by the web filter profile.

An ADVPN network is shown. You must configure an ADVPN using IBGP for each local region and EBGP across regions to connect Overlay 1 with Overlay 2. Which two options must you configure in the Hub2Hub BGP peering? (Choose two answers). A. set ibgp-enforce-multihop advpn. B. set attribute-unchanged next-hop. C. set next-hop-self enable. D. set ebgp-enforce-multihop enable.

Refer to the exhibit. The output of a BGP debug command is shown. Why has the local router at 172.16.23.58 been unable to establish adjacency with its only neighbor? (Choose one answer). A. The neighbor router has become unreachable, which is evident by the low ratio of messages received to messages sent. B. The local router has not received an OPEN message from the neighbor. C. There is no active route to the BGP neighbor. D. The local router has not received a SYN/ACK packet from the neighbor.

In which two ways does FortiGate utilize the Internet Service Database (ISDB) within firewall policies and SD-WAN rules? (Choose two answers). A. The ISDB blocks the IP addresses and ports of an application predefined by FortiGuard. B. The ISDB limits access by URL and domain. C. FortiGate has a predefined list of all IP addresses and ports for specific applications downloaded from FortiGuard. D. The ISDB works in proxy mode only, allowing the analysis of packets in layers 3 and 4 of the OSI model.

Refer to the exhibit. Two hub-and-spoke groups are connected through redundant site-to-site IPsec VPNs between Hub 1 and Hub 2. Which two configuration settings are required for spoke A1 to establish an auto-discovery VPN (ADVPN) shortcut with spoke B2? (Choose two answers). A. On the hubs, auto-discovery-receiver must be enabled on the IPsec VPNs to spokes. B. On the spokes, auto-discovery-receiver must be enabled on the IPsec VPNs to the hub. C. On the spokes, auto-discovery-sender must be enabled on the IPsec VPNs to hubs. D. On the hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to hubs.

You manage an SD-WAN topology and you will soon deploy 50 new branches. Which two tasks can you do in advance to simplify this deployment? (Choose two answers). A. Define metadata variable values for each device. B. Create a policy blueprint. C. Create a zero-touch provisioning (ZTP) template. D. Create model devices.

A FortiGate segmented into VDOMs is shown. You must ensure effective and accelerated internet access for all of the VDOMs in this enterprise network. How can you achieve this? (Choose one answer). A. Create VLANs over network processing unit (NPU) vlinks. B. Create VDOM links. C. Connect a physical interface from each VDOM to the root VDOM. D. Configure network processing unit (NPU) vlinks.

You must use FortiManager to standardize the deployment of same model FortiGate devices across branches with consistent interface roles and policy packages. In this scenario, what is the recommended best practice for interface assignment? (Choose one answer). A. Enable metadata variables to use dynamic configurations on the standard interfaces of FortiManager. B. Create normalized interface types per-platform, to automatically recognize device layer interfaces based on the FortiGate model and interface name. C. Create interfaces using CLI scripts and use those interfaces in FortiGate policy packages. D. Use the install on feature in the policy package to automatically assign the interfaces across branches.

You are checking an enterprise network and see a suspicious packet with the MAC address 00:09:0f:09:18:81. Which two statements about the suspicious packet are correct? (Choose two answers). A. The suspicious packet is related to a cluster configured with the FortiGate Session Life Protocol (FGSP). B. The suspicious packet corresponds to a port with a physical index equal to 2. C. The suspicious packet is related to a cluster with a group-id value lower than 255. D. The suspicious packet is related to a cluster that has VDOMs enabled.

Refer to the exhibit. How does FortiGate handle the traffic with the source IP address 10.0.1.125 and the destination IP address 128.66.0.125? (Choose one answer). A. FortiGate load balances the traffic flow through port7 and port8. B. FortiGate drops the traffic flow. C. FortiGate steers the traffic flow through port7. D. FortiGate routes the traffic flow according to the forwarding information base (FIB).

Refer to the exhibits. The routing tables of FortiGate A and FortiGate B are shown. FortiGate_A and FortiGate_B are in the same autonomous system. You want to add only route 172.16.1.248/30 on FortiGate_A by updating the BGP configuration. Which configuration must you apply? (Choose one answer). A. A BGP route map in for 172.16.1.248/30 on FortiGate_A. B. Enable Redistribute Connected in the BGP section on FortiGate_B. C. The prefix 172.16.1.248/30 in the BGP Networks section on FortiGate_B. D. A BGP route map out for 172.16.1.248/30 on FortiGate_B.

Refer to the exhibit. Which SD-WAN rule and interface uses FortiGate to steer the traffic from the LAN subnet 10.0.1.0/24 to the corporate server 10.2.5.254? (Choose one answer). A. SD-WAN service rule 4 and interface port2. B. SD-WAN service rule 3 and interface HUB1-VPN3. C. SD-WAN service rule 4 and port1 or port2. D. SD-WAN service rule 3 and interface HUB1-VPN2.

Refer to the exhibit. You used the SD-WAN overlay orchestrator to prepare an IPsec tunnels configuration for a hub-and-spoke SD-WAN topology. The exhibit shows the FortiManager installation preview for one FortiGate device. Based on the exhibit, which statement correctly describes the configuration applied to the FortiGate device? (Choose one answer). A. It is a hub device. It will automatically discover the spoke devices and add them to the SD-WAN topology. B. It is a spoke device that establishes dynamic IPsec tunnels to the hub. The local subnet range is 10.10.128.0/23. C. It is a spoke device that establishes dynamic IPsec tunnels to the hub. It can send auto-discovery VPN (ADVPN) shortcut requests. D. It is a hub device. It can send ADVPN shortcut offers.

Refer to the exhibit. A revision history window at the FortiManager device layer is shown. The IT team is trying to identify the administrator responsible for the most recent update to the FortiGate device database. What can the IT team conclude? (Choose one answer). A. To identify the user who created the event, in the FortiManager system logs, they must use the type=script filter in the user field. B. The retrieve process was automatically triggered by a Remote FortiGate Directly (via CLI) script. C. To identify the user who created the event, they must view it on the Configuration and Installation widget on FortiGate at the FortiManager device layer. D. The user script_manager, an API user from the Fortinet Developer Network (FDN), is retrieving a configuration.

You have a FortiGate configuration with three user-defined SD-WAN zones and two members in each of these zones. One SD-WAN member is no longer in use in health-check and SD-WAN rules. You want to delete it. What happens if you delete the SD-WAN member from the FortiGate GUI? (Choose one answer). A. FortiGate displays an error message. SD-WAN zones must contain at least two members. B. FortiGate accepts the deletion and removes static routes as required. C. FortiGate accepts the SD-WAN member deletion with no further action. D. FortiGate accepts the deletion and places the member in the default SD-WAN zone.

Refer to the exhibit. You want to configure SD-WAN on a network, as shown in the exhibit. The network contains many FortiGate devices. Some are used as next-generation firewalls (NGFW), and some are installed with extensions such as FortiSwitch, FortiAP, or FortiExtender. Which factors should you consider when planning your deployment? (Choose one answer). A. You can build an SD-WAN topology that includes all devices. The hubs must be devices without extensions. B. You should exclude the FortiGate devices with FortiLink connection from the SD-WAN topology. C. You should build multiple SD-WAN topologies. Each topology should contain only one type of extension. D. You can build an SD-WAN topology that includes all devices. The hubs can be FortiGate devices with FortiExtender.

FortiManager SD-WAN overlay orchestrator helps prepare SD-WAN deployments. To complete the tasks performed by the SD-WAN overlay orchestrator, you must perform some post-run tasks. Which two mandatory post-run tasks must you perform? (Choose two answers). A. Configure routing through the overlay tunnels created by the SD-WAN overlay template. B. Assign a hub_id metadata variable to each hub device. C. Configure SD-WAN rules. D. Assign an sdwan_id metadata variable to each device (branch and hub). E. Create policy packages and assign them to the branch device.

Refer to the exhibits. An OSPF peer is advertising route 172.16.52.0/24. The local FortiGate is configured with an inbound distribution list that allows the 172.16.0.0/16 network to be injected into its routing table. However, the 172.16.52.0/24 subnet cannot be seen in the FIB. Which two steps can the administrator of the local FortiGate take to ensure that the advertised 172.16.52.0/24 subnet will be injected into the routing table? (Choose two answers). A. Modify the default prefix-list behavior from implicit deny to implicit allow. B. Change the ge value to 17. C. Change the le value to 16. D. Add another entry to the prefix list to specifically allow the 172.16.52.0/24 network.

Refer to the exhibit. The network diagram shows the addition of Site 2 with an overlapping network segment to the existing VPN IPsec connection between the hub and Site 1. Which IPsec phase 2 configuration must you make on the FortiGate hub to enable equal-cost multi-path (ECMP) routing when multiple remote sites connect with overlapping subnets? (Choose one answer). A. set net-device to ecmp. B. Set multipath to enable. C. Set route-overlap to allow. D. Set route-overlap to either use-new or use-old.

In which order does FortiGate consider the following elements during the route lookup process? (Choose one answer). A. Policy routes, ISDB routes, SD-WAN rules, static routes. B. SD-WAN rules, ISDB routes, policy routes, BGP routes. C. SD-WAN rules, policy routes, static routes, ISDB routes. D. Policy routes, SD-WAN rules, Internet Service Database (ISDB) routes, BGP routes.

In the context of SD-WAN, the terms underlay and overlay are commonly used to categorize links. Which two statements about underlay and overlay links are correct? (Choose two answers). A. Overlay links provide routing flexibility. B. Only wired connections can be used as underlay links. C. A VLAN is a type of overlay link. D. FortiLink interface is considered an underlay link. E. Wireless connections can be used to build overlay links.