Sopa_de_banana

A company that acquired multiple branches across different countries needs to install new FortiGate devices on each of those branches. However, the IT staff lacks sufficient knowledge to implement the initial configuration on the FortiGate devices. Which three approaches can the company take to successfully deploy advanced initial configurations on remote branches? (Choose three.). A. Use metadata variables to dynamically assign values according to each FortiGate device. B. Use provisioning templates and install configuration settings at the device layer. C. Use the Global ADOM to deploy global object configurations to each FortiGate device. D. Apply Jinja in the FortiManager scripts for large-scale and advanced deployments. E. Add FortiGate devices on FortiManager as model devices, and use ZTP or LTP to connect to FortiGate devices.

An administrator is checking an enterprise network and sees a suspicious packet with the MAC address e0:23:ff:fc:00:86. What two conclusions can the administrator draw? (Choose two.). A. The suspicious packet is related to a cluster that has VDOMs enabled. B. The network includes FortiGate devices configured with the FGSP protocol. C. The suspicious packet is related to a cluster with a group-id value lower than 255. D. The suspicious packet corresponds to port 7 on a FortiGate device.

A user reports that their computer was infected with malware after accessing a secured HTTPS website. However, when the administrator checks the FortiGate logs, they do not see that the website was detected as insecure despite having an SSL certificate and correct profiles applied on the policy. How can an administrator ensure that FortiGate can analyze encrypted HTTPS traffic on a website?. A. The administrator must enable reputable websites to allow only SSL/TLS websites rated by FortiGuard web filter. B. The administrator must enable URL extraction from SNI on the SSL certificate inspection to ensure the TLS three-way handshake is correctly analyzed by FortiGate. C. The administrator must enable DNS over TLS to protect against fake Server Name Indication (SNI) that cannot be analyzed in common DNS requests on HTTPS websites. D. The administrator must enable full SSL inspection in the SSL/SSH Inspection Profile to decrypt packets and ensure they are analyzed as expected.

What is the initial step performed by FortiGate when handling the first packets of a session?. A. Installation of the session key in the network processor (NP). B. Data encryption and decryption. C. Security inspections such as ACL, HPE, and IP integrity header checking. D. Offloading the packets directly to the content processor (CP).

An administrator applied a block-all IPS profile for client and server targets to secure the server, but the database team reported the application stopped working immediately after. How can an administrator apply IPS in a way that ensures it does not disrupt existing applications in the network?. A. Use an IPS profile with all signatures in monitor mode and verify patterns before blocking. B. Limit the IPS profile to server targets only to avoid blocking connections from the server to clients. C. Select flow mode in the IPS profile to accurately analyze application patterns. D. Set the IPS profile signature action to default to discard all possible false positives.

An administrator is extensively using VXLAN on FortiGate. Which specialized acceleration hardware does FortiGate need to improve its performance?. A. NP7. B. SP5. C. СР9. D. NTurbo.

Refer to the exhibit, which shows a LAN interface connected from FortiGate to two FortiSwitch devices. A. The LAN interface must use a 802.3ad type interface. B. This connection is using a FortiLInk to manage VLANs on FortiGate. C. FortiGate is using an SD-WAN-type interface to connect to a FortiSwitch device with MCLAG. D. You must enable STP or RSTP on FortiGate and FortiSwitch to avoid layer 2 loopbacks.

Refer to the exhibit, which shows a network diagram showing the addition of site 2 with an overlapping network segment to the existing VPN IPsec connection between the hub and site 1. Which IPsec phase 2 configuration must an administrator make on the FortiGate hub to enable equal-cost multi-path (ECMP) routing when multiple remote sites connect with overlapping subnets?. A. Set route-overlap to either use-new or use-old. B. Set net-device to ecmp. C. Set single-source to enable. D. Set route-overlap to allow.

Refer to the exhibit, which shows the HA status of an active-passive cluster. An administrator wants FortiGate_B to handle the Core2 VDOM traffic. Which modification must the administrator apply to achieve this?. A. The administrator must disable override on FortiGate_A. B. The administrator must change the priority from 100 to 160 for FortiGate_B. C. The administrator must change the load balancing method on FortiGate_B. D. The administrator must change the priority from 128 to 200 for FortiGate_B.

Refer to the exhibit, which shows the packet capture output of a three-way handshake between FortiGate and FortiManager Cloud. A. FortiGate will receive a certificate that supports multiple domains because FortiManager operates in a cloud computing environment. B. FortiGate is connecting to the same IP server and will receive an independent certificate for its connection between FortiGate and FortiManager Cloud. C. If the TLS handshake contains 17 cipher suites it means the TLS version must be 1.0 on this three-way handshake. D. The wildcard for the domain *.fortinet-ca2.support.fortinet.com must be supported by FortiManager Cloud.

Refer to the exhibit, which shows the FortiGuard Distribution Network of a FortiGate device. FortiGuard Distribution Network on FortiGate An administrator is trying to find the web filter database signature on FortiGate to resolve issues with websites not being filtered correctly in a flow-mode web filter profile. Why is the web filter database version not visible on the GUI, such as with IPS definitions?. A. The web filter database is stored locally, but the administrator must run over CLI diagnose autoupdate versions. B. The web filter database is stored locally on FortiGate, but it is hidden behind the GUI. It requires enabling debug mode to make it visible. C. The web filter database is not hosted on FortiGate: FortiGate queries FortiGuard or FortiManager for web filter ratings on demand. D. The web filter database is only accessible after manual syncing with a valid FDS server using diagnose test update info.

An administrator must minimize CPU and RAM use on a FortiGate firewall while also enabling essential security features, such as web filtering and application control for HTTPS traffic. Which SSL inspection setting helps reduce system load while also enabling security features, such as web filtering and application control for encrypted HTTPS traffic?. A. Use full SSL inspection to thoroughly inspect encrypted payloads. B. Disable SSL inspection entirely to conserve resources. C. Configure SSL inspection to handle HTTPS traffic efficiently. D. Enable SSL certificate inspection mode to perform basic checks without decrypting traffic.

What is the primary function of segmentation in network management?. A. To encrypt data traffic across the network. B. To connect multiple physical switches in a single logical interface. C. To divide a network into smaller, isolated segments for enhanced security. D. To enhance the decryption and encryption speeds within the network.

An administrator must standardize the deployment of FortiGate devices across branches with consistent interface roles and policy packages using FortiManager. What is the recommended best practice for interface assignment in this scenario?. A. Create normalized interface types per-platform to automatically recognize device layer interfaces based on the FortiGate model and interface name. B. Enable metadata variables to use dynamic configurations in the standard interfaces of FortiManager. C. Use the Install On feature in the policy package to automatically assign different interfaces based on the branch. D. Create interfaces using device database scripts to use them on the same policy package of FortiGate devices.

Refer to the exhibit, which shows a corporate network and a new remote office network. An administrator must integrate the new remote office network with the corporate enterprise network. What must the administrator do to allow routing between the two networks?. A. The administrator must implement BGP to inject the new remote office network into the corporate FortiGate device. B. The administrator must configure a static route to the subnet 192.168.l.0/24 on the corporate FortiGate device. C. The administrator must configure virtual links on both FortiGate devices. D. The administrator must implement OSPF over IPsec on both FortiGate devices.

An administrator is designing an ADVPN network for a large enterprise with spokes that have varying numbers of internet links. They want to avoid a high number of routes and peer connections at the hub. Which method should be used to simplify routing and peer management?. A. Deploy a full-mesh VPN topology to eliminate hub dependency. B. Implement static routing over IPsec interfaces for each spoke. C. Use a dynamic routing protocol using loopback interfaces to streamline peers and routes. D. Establish a traditional hub-and-spoke VPN topology with policy routes.

Refer to the exhibit, which shows an OSPF network. Which configuration must the administrator apply to optimize the OSPF database?. A. Set a route map in the AS boundary FortiGate. B. Set the area 0.0.0.1 to the type STUB in the area border FortiGate. C. Set an access list in the AS boundary FortiGate. D. Set the area 0.0.0.1 to the type NSSA in the area border FortiGate.

What action can be taken on a FortiGate to block traffic using IPS protocol decoders, focusing on network transmission patterns and application signatures?. A. Use the DNS filter to block application signatures and protocol decoders. B. Use application control to limit non-URL-based software handling. C. Enable application detection-based SD-WAN rules. D. Configure a web filter profile in flow mode.

A FortiGate device with UTM profiles is reaching the resource limits, and the administrator expects the traffic in the enterprise network to increase. The administrator has received an additional FortiGate of the same model. Which two protocols should the administrator use to integrate the additional FortiGate device into this enterprise network? (Choose two.). A. FGSP with external load balancers. B. FGCP in active-active mode and with switches. C. FGCP in active-passive mode and with VDOM disabled. D. VRRP with switches.

Refer to the exhibit, which shows the ADVPN network topology and partial BGP configuration. Which two parameters must an administrator configure in the config neighbor range for spokes shown in the exhibit? (Choose two.). A. set max-neighbor-num 2. B. set neighbor-group advpn. C. set route-reflector-client enable. D. set prefix 172.16.1.0 255.255.255.0.

Refer to the exhibit, which shows a partial enterprise network. An administrator would like the area 0.0.0.0 to detect the external network. What must the administrator configure?. A. Enable RIP redistribution on FortiGate B. B. Configure a distribute-route-map-in on FortiGate B. C. Configure a virtual link between FortiGate A and B. D. Set the area 0.0.0.l type to stub on FortiGate A and B.

Refer to the exhibit, which shows a partial troubleshooting command output. An administrator is extensively using IPsec on FortiGate. Many tunnels show information similar to the output shown in the exhibit. What can the administrator conclude?. A. IPsec SAs cannot be offloaded. B. The two IPsec SAs, inbound and outbound, are copied to the NPU. C. Only the outbound IPsec SA is copied to the NPU. D. Only the inbound IPsec SA is copied to the NPU.

Refer to the exhibit, which shows an enterprise network connected to an internet service provider. The administrator must configure the BGP section of FortiGate A to give internet access to the enterprise network. Which command must the administrator use to establish a connection with the internet service provider?. A. config neighbor. B. config redistribute bgp. C. config router route-map. D. config redistribute ospf.

An administrator must enable direct communication between multiple spokes in a company's network. Each spoke has more than one internet connection. The requirement is for the spokes to connect directly without passing through the hub, and for the links to automatically switch to the best available connection. How can this automatic detection and optimal link utilization between spokes be achieved?. A. Set up OSPF routing over static VPN tunnels between spokes. B. Utilize ADVPN 2.0 to facilitate dynamic direct tunnels and automatic link optimization. C. Establish static VPN tunnels between spokes with predefined backup routes. D. Implement SD-WAN policies at the hub to manage spoke link quality.

Refer to the exhibits. The exhibits show a network topology, a firewall policy, and an SSL/SSH inspection profile configuration. Why is FortiGate unable to detect HTTPS attacks on firewall policy ID 3 targeting the Linux server?. A. The administrator must set the policy to inspection mode to analyze the HTTPS packets as expected. B. The administrator must enable HTTPS in the protocol port mapping of the deep-inspection SSL/SSH inspection profile. C. The administrator must enable SSL inspection of the SSL server and upload the certificate of the Linux server website to the SSL/SSH inspection profile. D. The administrator must enable cipher suites in the SSL/SSH inspection profile to decrypt the message.

While configuring the BGP protocol, an administrator applies the set network-import-check disable command under config network. What will FortiGate do as a result of this command?. A. FortiGate will advertise only the corresponding prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table. B. FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table. C. FortiGate will not advertise any imported routes received from one BGP neighbor to another. D. FortiGate will not advertise the prefixes, if it is not in the routing table.

Refer to the exhibits. The configuration of a user's Windows PC, which has a default MTU of 1500 bytes, along with FortiGate interfaces set to an MTU of 1000 bytes, and the results of PC1 pinging server 172.16.0.254 are shown. Why is the user in Windows PC1 unable to ping server 172.16.0.254 and is seeing the message: Packet needs to be fragmented but DF set?. A. Option ip.flags.mf must be set to enable on FortiGate. The user has to adjust the ping MTU to 1000 to succeed. B. Fragmented packets must be encrypted. To connect any application successfully, the user must install the Fortinet_CA certificate in the Microsoft Management Console. C. FortiGate honors the do not fragment bit and the packets are dropped. The user has to adjust the ping MTU to 972 to succeed. D. The user must trigger different traffic because path MTU discovery techniques do not recognize ICMP payloads.

An administrator configured the FortiGate devices in an enterprise network to join the Fortinet Security Fabric. The administrator has a list of IP addresses that must be blocked by the data center firewall. This list is updated daily. How can the administrator automate a firewall policy with the daily updated list?. A. With FortiNAC. B. With FortiAnalyzer. C. With a Security Fabric automation. D. With an external connector from Threat Feeds.

Refer to the exhibit, which shows a physical topology and a traffic log: The administrator is checking on FortiAnalyzer traffic from the device with IP address 10.1.10.1, located behind the FortiGate ISFW device. The firewall policy in on the ISFW device does not have UTM enabled and the administrator is surprised to see a log with the action Malware, as shown in the exhibit. What are the two reasons FortiAnalyzer would display this log? (Choose two.). A. Security rating is enabled in ISFW. B. ISFW is in a Security Fabric environment. C. ISFW is not connected to FortiAnalyzer and must go through NGFW-1. D. The firewall policy in NGFW-1 has UTM enabled.

A policy package conflict status and information from the import device wizard in the Core1 VDOM are shown. When you import a policy package, the following message appears for the Web_restrictions web filter profile and the deep-inspection SSL-SSH profile: The following objects were found having conflicts. Please confirm your settings, then continue. The Web_restrictions and deep-inspection profiles are used by other FortiGate devices within FortiManager. Which step must you take to resolve the issue?. A. Create uniquely named objects on FortiGate and reimport them into the policy package. B. Retrieve the FortiGate configuration to automatically export correct objects and policies. C. Use non-default object values because FortiManager is unable to alter default values. D. Select the FortiManager configuration that accepts changes on FortiManager and preserves existing configurations on FortiGate devices.

An enterprise administrator wants to automate the response to compromised internal hosts using the Fortinet Security Fabric. The goal is to immediately quarantine a host when an Indicator of Compromise (IoC) is detected by FortiAnalyzer, while also notifying the network team via a CLI script execution. Which component configuration is required to achieve this multi-device orchestration?. A. Configure a local Event Handler on the root FortiGate that triggers a webhook to FortiAnalyzer. B. Create an Automation Stitch entirely managed on a downstream FortiGate VDOM using local triggers. C. Configure an Automation Stitch on the root FortiGate utilizing FortiAnalyzer as the trigger source and adding both "Quarantine Host" and "CLI Script" as sequential actions. D. Implement a FortiNDR external connector mapping directly to dynamic firewall addresses without involving FortiAnalyzer.

A company has two Internet links configured in an SD-WAN zone. Business-critical traffic must always use ISP1 when latency is below 80 ms. If ISP1 exceeds the SLA threshold, traffic should automatically fail over to ISP2. Which SD-WAN configuration best meets this requirement?. A. Manual priority route with ECMP enabled. B. Performance SLA combined with a Best Quality strategy. C. Static routes with different administrative distances only. D. OSPF cost manipulation.

A firewall administrator deploys Active-Passive HA. During testing, established sessions are interrupted after failover. Which feature should be enabled to preserve existing sessions?. A. FGSP. B. Session Pickup. C. Device Detection. D. Virtual Clustering.

A security architect wants branch offices to dynamically establish IPsec tunnels without manually configuring every peer. Authentication must rely on certificates instead of pre-shared keys. Which VPN deployment best satisfies these requirements?. A. Policy-based VPN. B. Dial-up IPsec VPN with PKI certificates. C. Manual IPsec tunnels. D. GRE over IPsec using pre-shared keys.

An organization wants Internet-bound traffic inspected by the firewall while Microsoft 365 traffic exits locally whenever Microsoft's endpoints are detected. Which feature provides this capability?. A. Explicit Proxy. B. SD-WAN Internet Service Database (ISDB). C. NAT64. D. Reverse Proxy.

A FortiGate participates in OSPF with multiple routers. The administrator notices route instability caused by frequent interface flapping. Which configuration most effectively minimizes unnecessary routing recalculations?. A. Increase administrative distance. B. Configure BFD. C. Configure OSPF interface dampening using dead and hello timers. D. Disable route redistribution.

A company wants to block unknown malware without affecting performance for trusted business applications. Which inspection profile provides the most appropriate balance?. A. Flow-based inspection with sandbox submission for suspicious files. B. Proxy inspection only. C. Antivirus disabled. D. Deep inspection disabled.

An administrator creates a local-in policy but SSH access to the firewall is still denied. Which condition should be verified first?. A. The local-in policy destination interface matches the management interface. B. NAT is enabled. C. VIP objects are configured. D. SSL inspection is disabled.

Multiple BGP paths exist to the same destination. The administrator wants traffic to leave through ISP-A while keeping ISP-B as backup. Which BGP attribute should be modified?. A. MED. B. Local Preference. C. Origin. D. Router ID.

A firewall administrator wants configuration changes to be automatically logged, approved, and recoverable. Which solution best satisfies these requirements?. A. FortiAnalyzer reports. B. FortiManager with Workflow Mode and Revision History. C. CLI scripting. D. SNMP monitoring.

A company uses dynamic cloud workloads that frequently change IP addresses. Security policies should automatically adapt without manual updates. Which object type should be used?. A. Static Address Objects. B. Internet Service Database Objects. C. Dynamic Address Objects using Fabric Connectors. D. Geography Objects.