In a BGP deployment, your FortiGate is receiving routes from two different ISPs. You want to influence outbound traffic to prefer ISP1 for specific destinations. Which BGP attribute should you modify?
A FortiGate is configured with an IPsec VPN to a remote peer using IKEv2. The administrator wants to ensure that only traffic from the 10.0.0.0/24 subnet is encrypted and sent over the tunnel, while all other traffic goes directly to the internet. The VPN is up, but traffic from 10.0.0.0/24 is not being routed through the tunnel. Which configuration step is most likely missing?
A FortiGate is configured with two IPsec VPN tunnels to the same remote peer using different WAN links for redundancy. You want the FortiGate to automatically fail over to the secondary tunnel if the primary fails, and to fail back when the primary recovers. Which two configuration steps are required to achieve this? (Choose two.)
A FortiGate is configured with a site-to-site IPsec VPN to a remote peer. The administrator notices that the tunnel is up, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees that the tunnel is established. Which step should the administrator take next to troubleshoot why traffic is not flowing?
A FortiGate is deployed as an IPsec VPN hub with several spokes. The administrator wants to ensure that if the primary WAN link fails, the VPN tunnels automatically re-establish over a secondary WAN link without manual intervention. Which feature should be configured?
A FortiGate is configured with a policy-based IPsec VPN. The administrator notices that traffic to a specific remote subnet is not being encrypted, even though the policy is correctly configured. Which action should the administrator take to troubleshoot this issue?
You are configuring a FortiGate to perform deep inspection of SSL traffic for a specific web server. The server uses a certificate signed by an internal CA. You want to avoid breaking SSL connections to other sites. What must you configure to ensure that the FortiGate only inspects traffic to that specific server?
You are configuring a redundant IPsec VPN setup between two sites using two FortiGates at each site. You want to ensure that if the primary VPN tunnel fails, traffic automatically switches to the secondary tunnel. Which two configurations are required to achieve this? (Choose two.)
An administrator wants to configure a FortiGate to perform deep SSL inspection for traffic to a specific category of websites, while excluding financial websites from inspection to comply with privacy policies. Which FortiGate feature allows this granular control?
A FortiGate is configured with an IPS sensor in monitor mode. The administrator notices that the sensor is detecting attacks but not blocking them. The administrator wants to change the sensor to block attacks while still logging them. Which action should the administrator take?
A FortiGate is configured with a static route to 10.0.0.0/8 via 192.168.1.1. The administrator wants to ensure that if the primary next-hop becomes unreachable, the FortiGate automatically removes the route from the routing table. Which feature should be configured?
A FortiGate is deployed as the hub in a hub-and-spoke IPsec VPN topology. A spoke's dynamic IP address changes, and the hub must re-establish the tunnel without administrator intervention. The spoke is configured with a pre-shared key and a dynamic DNS hostname. Which configuration on the hub allows the tunnel to recover automatically when the spoke's IP changes?
You manage a FortiGate 600E cluster running FortiOS 7.2. A new IPsec VPN tunnel to a remote office is configured with IKEv2 and a pre-shared key. The remote office uses a FortiGate 60F behind a NAT device that performs port address translation. The tunnel fails to establish, and debug output shows that the remote gateway is not responding to the initial IKE packets. You verify that the pre-shared keys match and that UDP 500 and 4500 are allowed on both sides. Which configuration change on your local FortiGate is most likely to resolve the issue?
A security administrator wants to inspect SSL-encrypted traffic for malware without breaking legitimate banking applications that use certificate pinning. The FortiGate is running FortiOS 7.0 and is configured for deep inspection. Which action should the administrator take to exclude the banking applications from SSL inspection while still inspecting all other HTTPS traffic?
You are deploying a new FortiGate 200F in a small office. The office has a single internet connection and a web server that must be accessible from the internet on TCP port 443. You configure a virtual IP (VIP) to map the public IP to the internal web server's private IP. However, external users cannot reach the web server. You verify that the firewall policy allowing traffic from the WAN to the VIP is correct and that the web server is running. Which additional configuration is required on the FortiGate to make the web server accessible?
A FortiGate is configured as a dial-up IPsec VPN server for remote users. The administrator wants to ensure that a specific remote user, when connecting, is assigned the IP address 10.10.10.50 from a dedicated pool, and that this user's traffic is inspected by a specific firewall policy. Which configuration step is required to achieve this?
A network administrator is configuring an IPsec VPN on a FortiGate to connect to a third-party vendor's Cisco ASA. The tunnel fails to establish, and the administrator suspects a phase 1 parameter mismatch. Which two parameters must match exactly on both peers for phase 1 to succeed? (Choose two.)
A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that the VPN tunnel is highly available and can fail over to a secondary interface if the primary interface goes down. Which TWO of the following configurations are required to achieve this? (Choose two.)
A FortiGate is configured with a dial-up IPsec VPN for remote users. The administrator wants to ensure that remote users can access internal resources but are not allowed to communicate with each other over the VPN. Which feature should be enabled on the FortiGate?
A company is using FortiGate SSL VPN with web mode for remote users. The administrator wants to ensure that users can access internal web applications but cannot download files from those applications. Which SSL VPN portal configuration should be used?
A network administrator is configuring an IPsec VPN between two FortiGates. The administrator enables 'auto-negotiate' on the phase-1 interface and sets the 'net-device' option to disable. The VPN tunnel comes up, but traffic from the local subnet is not being encrypted and sent through the tunnel. What is the most likely cause?
An administrator is configuring a FortiGate to perform SSL deep inspection. The administrator wants to ensure that the FortiGate can inspect traffic to a web server that uses a certificate signed by an internal CA. The internal CA certificate is installed on the FortiGate. Which two actions must the administrator take to allow SSL deep inspection to work without certificate errors? (Choose two.)
An administrator is configuring a new SSL inspection profile on a FortiGate. The administrator wants to inspect HTTPS traffic for malware but must avoid decrypting traffic to financial websites due to privacy concerns. What should the administrator do?
A FortiGate is configured with an IPsec VPN tunnel using IKEv2. The administrator wants to ensure that the tunnel uses perfect forward secrecy (PFS) and that the DH group is 14. Which configuration change is required?
A network administrator is configuring a FortiGate to perform deep inspection of SSL traffic for a specific web server. The server uses a certificate signed by an internal certificate authority (CA). The administrator wants to ensure that the FortiGate can inspect the traffic without generating certificate errors for users. What must the administrator do?
An administrator is configuring an SSL VPN on a FortiGate to allow remote users to access internal web applications. The administrator wants to ensure that users can access multiple internal web servers using their IP addresses, but the servers use different ports. Which two configuration steps are required to achieve this? (Choose two.)
You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?
A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?
A FortiGate is configured as a dial-up IPsec VPN server. Remote users connect using FortiClient. The administrator wants to ensure that each remote user receives an IP address from a dedicated pool and that only specific internal subnets are accessible. Which TWO actions are required on the FortiGate to meet these requirements? (Choose two.)
A FortiGate is configured with a route-based IPsec VPN to a remote branch. The administrator wants to monitor the VPN tunnel status and bring it up automatically. Which interface must be referenced in the firewall policy to allow traffic through the tunnel?
A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that only traffic from the 10.0.0.0/24 subnet is encrypted and sent over the tunnel. Which configuration element must be defined on both FortiGates to match this traffic?
A network administrator is configuring a new FortiGate firewall policy to allow HTTP traffic from the internal network to the internet. The policy is configured with NAT enabled and uses the outgoing interface's IP address. Which statement describes the source IP address seen by the external web server?
A security administrator is configuring a new SSL inspection profile on a FortiGate. The administrator wants to inspect HTTPS traffic for malware but must ensure that banking websites are not inspected due to privacy concerns. Which feature should be used to exempt specific websites from SSL inspection?
You are configuring a route-based IPsec VPN between two FortiGates. The VPN is up, but traffic from the local subnet is not being encrypted and sent over the tunnel; instead, it is being sent unencrypted out of the WAN interface. You have verified that the phase 1 and phase 2 selectors match on both sides. What is the most likely cause?
An administrator is configuring a FortiGate to perform SSL deep inspection for outbound HTTPS traffic. Which TWO actions are required to ensure that users can browse HTTPS sites without certificate errors? (Choose two.)
A FortiGate is configured with an IPsec VPN to a remote peer. The administrator wants to ensure that only specific subnets are allowed over the tunnel, and that traffic from any other subnet is dropped. Which configuration element on the FortiGate directly enforces this?
A FortiGate is configured with a route-based IPsec VPN to a remote peer. The tunnel is up, but users report that traffic to the remote subnet intermittently fails. You suspect that the VPN is not being used for all traffic because of a routing issue. Which FortiGate CLI command would you use to verify which route is selected for a specific destination IP address?
You are deploying a new FortiGate in transparent mode. Users report that they cannot access the internet, but they can access internal servers. You have verified that the FortiGate is in transparent mode and that the management IP is reachable. What is the most likely cause?
An administrator is troubleshooting an IPsec VPN tunnel that frequently goes down. The logs show 'NO_PROPOSAL_CHOSEN' errors during phase 2 negotiations. Which action should the administrator take to resolve this issue?
A network administrator needs to allow remote users to access internal resources securely using FortiClient. The administrator wants to use certificate-based authentication for the VPN. Which component must be installed on the FortiClient endpoints to enable certificate authentication?
An administrator is configuring SSL inspection on a FortiGate to inspect traffic to a web server that uses a certificate signed by an internal CA. The FortiGate must decrypt and inspect the traffic without generating certificate errors on client browsers. What must be installed on the client devices?
You are configuring a FortiGate to perform deep inspection of HTTPS traffic. After enabling SSL inspection on a firewall policy, users report that some websites show certificate warnings. You have installed the FortiGate's CA certificate on all user workstations. What is the most likely reason for the warnings?
A network administrator is configuring a FortiGate to perform deep inspection of SSL traffic for a group of users. The administrator wants to ensure that the FortiGate can decrypt and inspect the traffic without generating certificate warnings for the users. Which certificate must be installed on the client endpoints to prevent certificate warnings?
A company uses a FortiGate as their main firewall. They want to implement a security profile that blocks malicious files downloaded via HTTP. Which FortiGate feature should they use to scan files for viruses and other malware?
A FortiGate is deployed in transparent mode between two routers. The administrator wants to enable IPS inspection on traffic passing through the FortiGate. Which configuration is required to inspect traffic in transparent mode?
A FortiGate is configured with a site-to-site IPsec VPN to a branch office. The administrator notices that the tunnel is up, but traffic is not passing. After checking, they find that the phase 2 selectors on both peers match, and firewall policies allow the traffic. What is a likely cause?
A network administrator is troubleshooting a FortiGate firewall policy. Traffic that should be allowed is being blocked, and the administrator suspects that the policy is not matching because of the order of policies. Which FortiGate feature can be used to verify which policy a specific traffic flow matches?
A network administrator wants to allow only specific users to access a web application through the FortiGate. The users are stored in an LDAP directory. Which FortiGate feature should be used to enforce this?
An administrator wants to allow remote users to access the corporate network using SSL VPN. The administrator needs to ensure that users can only access specific internal web servers. Which SSL VPN configuration mode should be used to provide granular access control to specific applications?
An administrator is troubleshooting an IPsec VPN tunnel that is not establishing. The phase 1 configuration uses pre-shared keys, and both peers are FortiGates. Which command would provide the most detailed information about the IKE negotiation?
A FortiGate is configured with a site-to-site IPsec VPN to a remote peer. The VPN is up, but traffic is not passing. You run 'diagnose vpn tunnel list' and see that the tunnel is up, but the phase-2 selectors show no traffic. You suspect a routing issue. Which command would you use to verify that traffic is being routed correctly through the tunnel?
A FortiGate is configured with a firewall policy that includes multiple security profiles: antivirus, IPS, and web filter. The administrator notices that some traffic that should be blocked by the IPS is being allowed. The IPS sensor is set to 'Monitor' mode. What is the most likely reason for this behavior?
A network administrator is deploying a dial-up IPsec VPN on a FortiGate to allow remote employees to connect. The administrator wants to ensure that the VPN tunnel can be established even when the client is behind a NAT device. Which configuration setting must be enabled on the FortiGate to achieve this?
A security administrator is configuring an SSL inspection profile on a FortiGate to inspect HTTPS traffic. The administrator wants to ensure that the FortiGate can decrypt and inspect traffic without causing certificate errors on client browsers. Which certificate must be installed on the client endpoints to prevent certificate warnings?
A network administrator is configuring a new SSL VPN on a FortiGate to allow remote users to access internal resources. The administrator wants to ensure that only authorized users can connect and that they can reach the internal network. Which TWO configurations are required to achieve this? (Choose two.)
An administrator wants to configure a FortiGate to perform deep inspection of SSL traffic for a specific web server. The goal is to detect and block malicious content in HTTPS sessions. What must be installed on the client devices to allow this inspection?
An administrator is deploying a new IPsec VPN between two FortiGates. They want to ensure that the VPN can recover quickly from network disruptions and that only specific subnets are allowed over the tunnel. Which TWO configuration steps are required to meet these requirements? (Choose two.)
An administrator has configured a FortiGate with two WAN interfaces and wants to ensure that outbound traffic is load-balanced across both links while maintaining session persistence. They have enabled SD-WAN and created two members. Which SD-WAN load-balancing algorithm should they use to distribute traffic based on source IP and ensure that each source IP consistently uses the same link?
A network administrator is configuring a firewall policy on a FortiGate to allow internal users to access the internet. The administrator wants to log all traffic that matches the policy. Which action should be taken to enable logging for this policy?
An administrator is configuring an IPS sensor on a FortiGate to protect an internal web server. The administrator wants to block attacks while minimizing false positives. Which IPS sensor action should be configured for signatures that are known to produce false positives in the internal network?
You are configuring a site-to-site IPsec VPN between two FortiGates. The VPN must be highly available, and you want to use two ISP links on each side. You configure two phase 1 interfaces on each FortiGate, each bound to a different WAN interface. You want the VPN to fail over automatically if one ISP link goes down. Which configuration is required to achieve this?
A FortiGate is configured with a route-based IPsec VPN to a remote office. The tunnel interface is named 'vpn1'. The administrator wants to allow only HTTP and HTTPS traffic from the local subnet 10.1.1.0/24 to the remote subnet 10.2.2.0/24 over the tunnel. Which firewall policy configuration achieves this requirement?
An administrator is configuring a FortiGate to use LDAP authentication for SSL VPN users. The LDAP server requires a bind DN and password for queries. Which configuration is required on the FortiGate to successfully authenticate users?
A FortiGate is configured with a static route to 192.168.1.0/24 via 10.0.0.1 on port1. The administrator wants to verify that the FortiGate will use this route for a packet destined to 192.168.1.10. Which command should the administrator use?
A network administrator is deploying a new FortiGate in a Security Fabric with multiple FortiGates and FortiSwitches. The administrator wants to ensure that the Security Fabric can automatically discover and authorize new devices. Which two configuration steps are required on the root FortiGate? (Choose two.)
A FortiGate 200F running FortiOS 7.4 is configured as a dial-up IPsec VPN server for remote users. The administrator assigns each user a unique pre-shared key (PSK) by creating separate phase-1 interfaces with different peer IDs and PSKs. A new user reports that the VPN fails to connect, and the debug output shows 'no matching gateway for new request'. What is the most likely cause?
A network administrator is configuring an IPsec VPN on a FortiGate to connect to a third-party vendor's Cisco ASA. The tunnel fails to establish. The administrator verifies that the pre-shared keys match and the phase-1 proposals are identical. What is the most likely cause of the failure?
A FortiGate is configured with a route-based IPsec VPN to a remote site. The tunnel is up, and the routing table shows a route to the remote subnet via the VPN interface. However, traffic from the local subnet is not reaching the remote subnet. The administrator runs a packet capture and sees that packets are leaving the FortiGate but not returning. What is the most likely cause?
A FortiGate is configured as a dial-up IPsec VPN server for remote users. The administrator notices that some users connect successfully, but their traffic is not being routed to the internal network. The administrator has verified that the phase 2 selectors are correct and that the firewall policy allowing the tunnel traffic is present. Which configuration step is most likely missing to allow the remote users to access internal resources?
An administrator has configured a FortiGate to perform deep inspection of SSL traffic. Users report that when they access a banking website, the browser shows a certificate warning and the connection is blocked. The administrator has imported the FortiGate's CA certificate into the browsers' trusted root store. Which action should the administrator take to allow access to the banking site while maintaining SSL inspection for other sites?
A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that only specific subnets are allowed through the tunnel, and that traffic to other subnets is dropped. Which configuration element directly defines the traffic selectors for the VPN?
An administrator wants to allow remote users to access the corporate network using FortiClient VPN. The administrator has configured an IPsec VPN with mode-cfg to assign IP addresses to clients. Which additional configuration is required to allow the clients to access internal resources?