Practice Test

How can you modify the security settings of a VPN tunnel created from a template in FortiGate? *Choose a different template for the tunnel *Use the custom tunnel creation option *Convert the template to a custom tunnel *Edit the template directly

*

Which two additional features and settings can you apply to traffic after it is accepted by a firewall policy? (Choose two) *Antivirus scanning *User authentication x *Application control *Packet filtering

Antivirus scanning

Which action can you take to improve the security rating provided by the Fortinet Security Fabric? *Upgrade FortiGate to the latest mature version available *Run the integrity check on all end devices *Apply one or more of the suggested best practices *Create a configuration revision or back up the configuration

Apply one or more of the suggested best practices

Which two steps are involved in configuring web filtering based on FortiGuard category filters? *Create a web filtering security profile using FortiGuard category-based filters *Apply the web filter security profile to the appropriate firewall policy *Identify the specific websites to be blocked or allowed *Upgrade FortiOS to obtain the latest database from FortiGuard

Apply the web filter security profile to the appropriate firewall policy

What is a scenario where automation is used in the Fortinet Security Fabric? *Assigning security ratings to newly added devices *Monitoring disk space utilization on FortiAnalyzer *Generating weekly reports for management review *Automatically quarantining a computer with malicious activity

Automatically quarantining a computer with malicious activity

How can administrators track successful authentication attempts in FortiGate? *By utilizing advanced threat intelligence feeds *By reviewing the logs and dashboards *By analyzing network traffic patterns *By monitoring security events in real-time

By reviewing the logs and dashboards

What are some of the features provided by IPSec VPNs? *Bandwidth optimization and antireplay protection *Data authentication and data integrity *Network segmentation and packet inspection *Data encryption and load balancing

Data authentication and data integrity

Which two options can you use for centralized logging when you configure the Fortinet Security Fabric? (choose two) *FortiSOAR *FortiGate Cloud *Syslog server x *FortiAnalyzer

FortiGate Cloud

Which two configuration settings are global settings? *FortiGuard settings *User & Device settings *HA settings *Firewall policies

HA settings -

Which two security profiles are handled by the IPS engine? *Application Control *IPS *AntiVirus X *Web Filter

IPS -

Which two statements about antivirus scanning in a firewall policy set to proxy-based inspection mode, are true? (Choose two) *A file does not need to be buffered completely before it is moved to the antivirus engine for scanning X *FortiGate sends a reset packet to the client if antivirus reports the file as infected *If a virus is detected, a block replacement message is displayed immediately.

If a virus is detected, a block replacement message is displayed immediately. -

Which two items should you configure as the source of a firewall policy, to allow all internal users in a small office to access the internet? (Choose two) *Users or user groups *Application signatures *The IP subnet of the LAN *Security profiles x

Users or user groups

What functionality does FortiGate provide to establish secure connections between a main office and its remote branches, over the internet? *Virtual Private networks *Monitoring and logging *Firewall authentication *Security scanning

Virtual private networks

Which statement about the HA override setting in FortiGate HA clusters is true? *It synchronizes device priority on all cluster members *You must configure override settings manually and separately for each cluster member *It enables monitored ports *It reboots FortiGate

You must configure override settings manually and separately for each cluster member

What is the potential security risk associated with HTTPS? *Increased network latency *Certificate errors during the SSL handshake *Incompatibility with certain web browsers *Encrypted malicious traffic

encrypted malicious traffic

What is the purpose of firewall policies on FortiGate *To encrypt network traffic *To block all incoming traffic *To monitor network traffic *To control network traffic

to control network traffic

How are websites filtered using FortiGuard category filters? *By scanning the website for malware in real time *By denying access based on the website IP address *By blocking access based on the website content *By examining the HTTP headers from the website

By blocking access based on the website content

How does FortiGate application control address evasion techniques used by peer-to-peer protocols? *By analyzing flow-based inspection *By examining a URL block list *By monitoring traffic for known patterns *By allowing traffic from only well-known ports

By monitoring traffic for known patterns

Which two statements about advanced AD access mode for the FSSO collector agent, are true? (Choose two) *It uses Windows convention for naming; that is, Domain\Username *FortiGate can act as an LDAP client to configure the group filters *It is only supported if DC agents are deployed. *It supports monitoring of nested groups

FortiGate can act as an LDAP client to configure the group filters It supports monitoring of nested groups

What is a characteristic of a firewall policy used to allow the traffic from Secure Socket Layer Virtual Private Network (SSL VPN)? *It uses a virtual tunnel interface in the source field *It encapsulates the traffic using the VPN settings configured *It defines the port number used for the SSL VPN portal *It assigns SSL certificates to user groups trying to connect

It uses a virtual tunnel interface in the source field

Which two statements about the application control profile mode are true? (Choose two) *It can be selected in either flow-based or proxy-based firewall policy *It cannot be used in conjunction with IPS scanning X *It can scan only unsecure protocols *It uses flow-based scanning techniques, regardless of the inspection mode used

It uses flow-based scanning techniques, regardless of the inspection mode used -

What are two benefits of performing regular maintenance on FortiGate firewalls? *Minimize costs during upgrades *Ensure you have the latest hardware *Prevent security breaches in your organization *Meet compliance and legal requirements

Prevent security breaches in your organization Meet compliance and legal requirements

Which two statements about FortiGate antivirus databases are true? *The quick scan database is part of the normal database *The extended database is available only if AI scanning is enabled x *The extreme database is available only on certain FortiGate models *The extended database is available on all FortiGate models

The extended database is available on all FortiGate models -

Which two statements correctly describe the differences between IPSec main mode and IPSec aggressive mode? *The first packet of aggressive mode contains the peer ID, while the first packet of main mode does not *Main Mode cannot be used for dialup VPNs, while aggressive mode can *Agressive mode supports XAuth, while main mode does not *Six packets are usually exchanged during main mode, while only three packets are exchanged during aggressive mode

The first packet of aggressive mode contains the peer ID, while the first packet of main mode does not -

Why is it recommended that you use user groups instead of individual user accounts in a firewall policy? *User groups provide stronger encryption for authentication *User groups contain all individual user accounts by default *User groups make it easier to monitor authenticated users *User groups simplify the firewall configuration

User groups simplify the firewall configuration

What is the security rating in the Fortinet Security Fabric, and how is it calculated? *It indicates the level of compatibility with third-party devices *It represents the current level of network performance *It is calculated based on the number of security logs generated *It is a numerical value based on device settings and best practices

It is a numerical value based on device settings and best practices

What are two consequences of allowing a FortiGate license to expire? (choose two) *Disruption of network services and potential legal issues *Inability to monitor system logs and generate network reports *Loss of access to software updates and technical support *Reduced FortiGate performance and increased vulnerability to security threats x

Loss of access to software updates and technical support

Which actions can you apply to application categories in the Application Control profile? *Monitor, optimize, redirect, or shape *Authenticate, log, encrypt, or back up *Monitor, allow, block, or quarantine *Allow, encrypt, compress, or redirect

Monitor, allow, block, or quarantine

In addition to central processing unit (CPU) and memory usage, what are two other key performance parameters you should monitor on FortiGate (choose two) *Number of SSL sessions *Number of days for licenses to expire x *Number of active VPN tunnels *Number of local users and user groups

Number of SSL sessions

What is the key difference between SSL certificate inspection and SSL deep inspection? *SSL certificate inspection requires a trusted certificate authority (CA), while SSL deep inspection uses the FortiGate CL certificate *SSL certificate inspection applies to only HTTPS traffic, while SSL deep inspection applies to multiple SSL encrypted protocols *SSL certificated inspection decrypts and inspects encrypted content, while SSL deep inspection verifies the identity of the web server *SSL certificate inspection introduces certificate errors, while SSL deep inspection prevents certificate warnings

SSL certificate inspection applies to only HTTPS traffic, while SSL deep inspection applies to multiple SSL encrypted protocols

Why is SSL inspection necessary for the intrusion prevention system (IPS) to detect threats in encrypted traffic? *Without SSL inspection, encrypted traffic is automatically blocked by IPS *SSL inspection improves network performance by bypassing encrypted traffic *The IPS engine can inspect only legacy encryption algorithms, by default. *SSL inspection allows the IPS to detect and analyze encrypted threats

SSL inspection allows the IPS to detect and analyze encrypted threats

Which statement about traffic, flow in an active-active HA cluster is true? *The secondary device responds to the primary device with a SYN/ACK, and then the primary device forwards the SYN/ACK to the client *All FortiGate devices are assigned the same virtual MAC addresses for the HA heartbeat interfaces to redistribute to the sessions. *The SYN packet from the client always arrives at the primary device first. *The ACK from the client is received on the physical MAC address of the primary device

The SYN packet from the client always arrives at the primary device first. -

When configuring a static route on FortiGate, what does the destination represent? *The IP address of the next-hop router *The IP address of the remote DNS server *The local interface on FortiGate for the outgoing traffic *The network or host to which traffic will be forwarded

The network or host to which traffic will be forwarded

Which piece of information does FortiGate know about the user without firewall authentication? *The originating domain name *The source IP address *The user login name *The application being used

The source IP address

FortiGate is configured for firewall authentication. When attempting to access an external website, the user is not presented with a login prompt. *The user is using a super user admin account *The user was authenticated using passive authentication *The user is using a guest account profile *No matching user account exists for this user

The user was authenticated using passive authentication

What is the purpose of the FortiGuard Labs signature database? *To provide secure configuration templates to FortiGate firewalls *To keep FortiGate firewalls protected against the latest malware variants *To identify and correct vulnerabilities in FortiGate firewalls *To give FortiGate firewalls the ability to track network traffic and usage patterns

To keep FortiGate firewalls protected against the latest malware variants

What are two reasons why organizations and individuals use web filtering? (choose two) *To increase network bandwidth *To prevent network congestion *To preserve employee productivity *To To enhance their users' experience

To prevent network congestion To preserve employee productivity

Why is it important to back up FortiGate System configurations regularly? *To prevent unexpected configuration changes *To save time and effort in case of a hardware failure *To avoid errors while upgrading FortiOS *To ensure optimal performance of FortiGate

To save time and effort in case of a hardware failure

What is grayware? *Unsolicited programs installed without user consent *New and unknown malware variants *Known malware with existing signatures *Malicious files sent to the sandbox for inspection

Unsolicited programs installed without user consent

How does FortiGate handle blocked websites in web filtering using FortiGuard category filters? *Users are prompted to provide a valid username and password for access *Users receive a warning message but can choose to continue accessing the website *Users are allowed to access the website, but their activity is recorded in the FortiGate logs *Users are redirected to a replacement message indicating the website is blocked

Users are redirected to a replacement message indicating the website is blocked