Security And VPN

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?

You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

What is the purpose of the 'Any' interface in a firewall policy?

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

Which FortiGate feature should be enabled to prevent internal users from accessing malicious websites based on real-time threat intelligence?

When using an IPS sensor, what is the difference between 'Protect' and 'Monitor' mode?

Which command is used to troubleshoot connectivity by checking the routing table of a specific IP address on the FortiGate?

What is the primary function of the FortiGate Security Fabric?

What does the 'FortiGuard' service provide to the FortiGate?

Which method is the most secure for managing FortiGate devices remotely?

What is the effect of changing the IPS 'buffer' size on a FortiGate device?

You need to inspect traffic between two internal VLANs. How do you ensure this traffic is processed by the FortiGate?

Which TWO of the following are necessary to successfully deploy an SSL VPN in tunnel mode?

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

Which THREE types of traffic are typically inspected by an IPS policy?

In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?

Which TWO of the following are valid methods for user authentication on a FortiGate?

Which TWO of the following can be used to optimize IPsec VPN performance?

A FortiGate is configured as a dial-up IPsec VPN server. Remote users connect using FortiClient. The administrator wants to ensure that each remote user receives an IP address from a dedicated pool and that only specific internal subnets are accessible. Which TWO actions are required on the FortiGate to meet these requirements? (Choose two.)

A FortiGate is configured with a route-based IPsec VPN to a remote branch. The administrator wants to monitor the VPN tunnel status and bring it up automatically. Which interface must be referenced in the firewall policy to allow traffic through the tunnel?

A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that only traffic from the 10.0.0.0/24 subnet is encrypted and sent over the tunnel. Which configuration element must be defined on both FortiGates to match this traffic?

A network administrator is configuring a new FortiGate firewall policy to allow HTTP traffic from the internal network to the internet. The policy is configured with NAT enabled and uses the outgoing interface's IP address. Which statement describes the source IP address seen by the external web server?

A security administrator is configuring a new SSL inspection profile on a FortiGate. The administrator wants to inspect HTTPS traffic for malware but must ensure that banking websites are not inspected due to privacy concerns. Which feature should be used to exempt specific websites from SSL inspection?

You are configuring a route-based IPsec VPN between two FortiGates. The VPN is up, but traffic from the local subnet is not being encrypted and sent over the tunnel; instead, it is being sent unencrypted out of the WAN interface. You have verified that the phase 1 and phase 2 selectors match on both sides. What is the most likely cause?

An administrator is configuring a FortiGate to perform SSL deep inspection for outbound HTTPS traffic. Which TWO actions are required to ensure that users can browse HTTPS sites without certificate errors? (Choose two.)

A FortiGate is configured with an IPsec VPN to a remote peer. The administrator wants to ensure that only specific subnets are allowed over the tunnel, and that traffic from any other subnet is dropped. Which configuration element on the FortiGate directly enforces this?

A FortiGate is configured with a route-based IPsec VPN to a remote peer. The tunnel is up, but users report that traffic to the remote subnet intermittently fails. You suspect that the VPN is not being used for all traffic because of a routing issue. Which FortiGate CLI command would you use to verify which route is selected for a specific destination IP address?

You are deploying a new FortiGate in transparent mode. Users report that they cannot access the internet, but they can access internal servers. You have verified that the FortiGate is in transparent mode and that the management IP is reachable. What is the most likely cause?

An administrator is troubleshooting an IPsec VPN tunnel that frequently goes down. The logs show 'NO_PROPOSAL_CHOSEN' errors during phase 2 negotiations. Which action should the administrator take to resolve this issue?

A network administrator needs to allow remote users to access internal resources securely using FortiClient. The administrator wants to use certificate-based authentication for the VPN. Which component must be installed on the FortiClient endpoints to enable certificate authentication?

An administrator is configuring SSL inspection on a FortiGate to inspect traffic to a web server that uses a certificate signed by an internal CA. The FortiGate must decrypt and inspect the traffic without generating certificate errors on client browsers. What must be installed on the client devices?

You are configuring a FortiGate to perform deep inspection of HTTPS traffic. After enabling SSL inspection on a firewall policy, users report that some websites show certificate warnings. You have installed the FortiGate's CA certificate on all user workstations. What is the most likely reason for the warnings?

A network administrator is configuring a FortiGate to perform deep inspection of SSL traffic for a group of users. The administrator wants to ensure that the FortiGate can decrypt and inspect the traffic without generating certificate warnings for the users. Which certificate must be installed on the client endpoints to prevent certificate warnings?

A company uses a FortiGate as their main firewall. They want to implement a security profile that blocks malicious files downloaded via HTTP. Which FortiGate feature should they use to scan files for viruses and other malware?

A FortiGate is deployed in transparent mode between two routers. The administrator wants to enable IPS inspection on traffic passing through the FortiGate. Which configuration is required to inspect traffic in transparent mode?

A FortiGate is configured with a site-to-site IPsec VPN to a branch office. The administrator notices that the tunnel is up, but traffic is not passing. After checking, they find that the phase 2 selectors on both peers match, and firewall policies allow the traffic. What is a likely cause?

A network administrator is troubleshooting a FortiGate firewall policy. Traffic that should be allowed is being blocked, and the administrator suspects that the policy is not matching because of the order of policies. Which FortiGate feature can be used to verify which policy a specific traffic flow matches?

A network administrator wants to allow only specific users to access a web application through the FortiGate. The users are stored in an LDAP directory. Which FortiGate feature should be used to enforce this?

An administrator wants to allow remote users to access the corporate network using SSL VPN. The administrator needs to ensure that users can only access specific internal web servers. Which SSL VPN configuration mode should be used to provide granular access control to specific applications?

An administrator is troubleshooting an IPsec VPN tunnel that is not establishing. The phase 1 configuration uses pre-shared keys, and both peers are FortiGates. Which command would provide the most detailed information about the IKE negotiation?

A FortiGate is configured with a site-to-site IPsec VPN to a remote peer. The VPN is up, but traffic is not passing. You run 'diagnose vpn tunnel list' and see that the tunnel is up, but the phase-2 selectors show no traffic. You suspect a routing issue. Which command would you use to verify that traffic is being routed correctly through the tunnel?

A FortiGate is configured with a firewall policy that includes multiple security profiles: antivirus, IPS, and web filter. The administrator notices that some traffic that should be blocked by the IPS is being allowed. The IPS sensor is set to 'Monitor' mode. What is the most likely reason for this behavior?

A network administrator is deploying a dial-up IPsec VPN on a FortiGate to allow remote employees to connect. The administrator wants to ensure that the VPN tunnel can be established even when the client is behind a NAT device. Which configuration setting must be enabled on the FortiGate to achieve this?

A security administrator is configuring an SSL inspection profile on a FortiGate to inspect HTTPS traffic. The administrator wants to ensure that the FortiGate can decrypt and inspect traffic without causing certificate errors on client browsers. Which certificate must be installed on the client endpoints to prevent certificate warnings?

A network administrator is configuring a new SSL VPN on a FortiGate to allow remote users to access internal resources. The administrator wants to ensure that only authorized users can connect and that they can reach the internal network. Which TWO configurations are required to achieve this? (Choose two.)

An administrator wants to configure a FortiGate to perform deep inspection of SSL traffic for a specific web server. The goal is to detect and block malicious content in HTTPS sessions. What must be installed on the client devices to allow this inspection?

An administrator is deploying a new IPsec VPN between two FortiGates. They want to ensure that the VPN can recover quickly from network disruptions and that only specific subnets are allowed over the tunnel. Which TWO configuration steps are required to meet these requirements? (Choose two.)

An administrator has configured a FortiGate with two WAN interfaces and wants to ensure that outbound traffic is load-balanced across both links while maintaining session persistence. They have enabled SD-WAN and created two members. Which SD-WAN load-balancing algorithm should they use to distribute traffic based on source IP and ensure that each source IP consistently uses the same link?

A network administrator is configuring a firewall policy on a FortiGate to allow internal users to access the internet. The administrator wants to log all traffic that matches the policy. Which action should be taken to enable logging for this policy?

An administrator is configuring an IPS sensor on a FortiGate to protect an internal web server. The administrator wants to block attacks while minimizing false positives. Which IPS sensor action should be configured for signatures that are known to produce false positives in the internal network?

You are configuring a site-to-site IPsec VPN between two FortiGates. The VPN must be highly available, and you want to use two ISP links on each side. You configure two phase 1 interfaces on each FortiGate, each bound to a different WAN interface. You want the VPN to fail over automatically if one ISP link goes down. Which configuration is required to achieve this?

A FortiGate is configured with a route-based IPsec VPN to a remote office. The tunnel interface is named 'vpn1'. The administrator wants to allow only HTTP and HTTPS traffic from the local subnet 10.1.1.0/24 to the remote subnet 10.2.2.0/24 over the tunnel. Which firewall policy configuration achieves this requirement?

An administrator is configuring a FortiGate to use LDAP authentication for SSL VPN users. The LDAP server requires a bind DN and password for queries. Which configuration is required on the FortiGate to successfully authenticate users?

A FortiGate is configured with a static route to 192.168.1.0/24 via 10.0.0.1 on port1. The administrator wants to verify that the FortiGate will use this route for a packet destined to 192.168.1.10. Which command should the administrator use?

A network administrator is deploying a new FortiGate in a Security Fabric with multiple FortiGates and FortiSwitches. The administrator wants to ensure that the Security Fabric can automatically discover and authorize new devices. Which two configuration steps are required on the root FortiGate? (Choose two.)

A FortiGate 200F running FortiOS 7.4 is configured as a dial-up IPsec VPN server for remote users. The administrator assigns each user a unique pre-shared key (PSK) by creating separate phase-1 interfaces with different peer IDs and PSKs. A new user reports that the VPN fails to connect, and the debug output shows 'no matching gateway for new request'. What is the most likely cause?

A network administrator is configuring an IPsec VPN on a FortiGate to connect to a third-party vendor's Cisco ASA. The tunnel fails to establish. The administrator verifies that the pre-shared keys match and the phase-1 proposals are identical. What is the most likely cause of the failure?

A FortiGate is configured with a route-based IPsec VPN to a remote site. The tunnel is up, and the routing table shows a route to the remote subnet via the VPN interface. However, traffic from the local subnet is not reaching the remote subnet. The administrator runs a packet capture and sees that packets are leaving the FortiGate but not returning. What is the most likely cause?

A FortiGate is configured as a dial-up IPsec VPN server for remote users. The administrator notices that some users connect successfully, but their traffic is not being routed to the internal network. The administrator has verified that the phase 2 selectors are correct and that the firewall policy allowing the tunnel traffic is present. Which configuration step is most likely missing to allow the remote users to access internal resources?

An administrator has configured a FortiGate to perform deep inspection of SSL traffic. Users report that when they access a banking website, the browser shows a certificate warning and the connection is blocked. The administrator has imported the FortiGate's CA certificate into the browsers' trusted root store. Which action should the administrator take to allow access to the banking site while maintaining SSL inspection for other sites?

A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that only specific subnets are allowed through the tunnel, and that traffic to other subnets is dropped. Which configuration element directly defines the traffic selectors for the VPN?

An administrator wants to allow remote users to access the corporate network using FortiClient VPN. The administrator has configured an IPsec VPN with mode-cfg to assign IP addresses to clients. Which additional configuration is required to allow the clients to access internal resources?