scenario questions

What is the benefit of using 'CLI Templates' in FortiManager?

Which THREE steps are involved in the 'Policy Package Installation' workflow?

An administrator needs to ensure that a FortiGate can be managed via SSH only from the internal network, while also allowing SNMP polling from a management server. The administrator wants to restrict access to the management interface. Which configuration should be applied?

An administrator is configuring a FortiGate in transparent mode. The FortiGate will be placed between an internal network and a router. The administrator wants to ensure that the FortiGate can be managed remotely and that it can still perform security inspections. Which two configurations are required? (Choose two.)

A company uses FortiManager to manage a large number of FortiGates. They want to enforce a strict change control process where any configuration change must be reviewed and approved before being deployed. Which FortiManager feature should they use?

A network administrator is configuring an IPsec VPN on a FortiGate to connect to a third-party vendor's Cisco ASA. The tunnel fails to establish. The administrator verifies that the pre-shared keys match and the phase-1 proposals are identical. What is the most likely cause of the failure?

A network administrator is using FortiManager to manage a FortiGate. The administrator needs to make a configuration change that requires immediate effect on the FortiGate, but the change is currently in a workspace and not yet committed. What should the administrator do to apply the change?

A FortiGate is configured with a static route to a destination network via a next-hop IP. The administrator wants to ensure that if the next-hop becomes unreachable, the route is removed from the routing table. Which feature should be configured?

You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?

A security administrator needs to ensure that all FortiGate devices in a specific ADOM receive the same set of firewall addresses and services, but these objects should not be available to devices in other ADOMs. What is the most efficient way to achieve this in FortiManager?

What is the result of 'Pushing' a policy package from FortiManager to a FortiGate?

A security administrator is using FortiManager to manage a large number of FortiGates. The administrator needs to ensure that when a policy package is installed, the installation is performed efficiently and only to devices that require the changes. Which two actions should the administrator take to optimize the installation process? (Choose two.)

An administrator is configuring an HA cluster of two FortiGates in Active-Passive mode. The cluster must maintain session continuity for TCP traffic when a failover occurs, and the administrator wants to minimize unnecessary failovers caused by link flaps on a monitored interface. (Choose two.)

You need to inspect traffic between two internal VLANs. How do you ensure this traffic is processed by the FortiGate?

A FortiGate is configured with a route-based IPsec VPN to a remote branch. The administrator wants to monitor the VPN tunnel status and bring it up automatically. Which interface must be referenced in the firewall policy to allow traffic through the tunnel?

Which component of FortiManager allows for the centralized management of firmware across multiple devices?

A FortiGate is configured with a site-to-site IPsec VPN to a branch office. The administrator notices that the tunnel is up, but traffic is not passing. After checking, they find that the phase 2 selectors on both peers match, and firewall policies allow the traffic. What is a likely cause?

Which TWO types of reports can be generated in the FortiAnalyzer module of FortiManager?

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

You are configuring a site-to-site IPsec VPN between two FortiGates. The VPN must be highly available, and you want to use two ISP links on each side. You configure two phase 1 interfaces on each FortiGate, each bound to a different WAN interface. You want the VPN to fail over automatically if one ISP link goes down. Which configuration is required to achieve this?

An administrator is configuring a new FortiManager installation and needs to add a FortiGate device for centralized management. Which protocol does FortiManager use to communicate with the FortiGate for management and configuration tasks?

A network administrator is configuring a new SSL VPN on a FortiGate to allow remote users to access internal resources. The administrator wants to ensure that only authorized users can connect and that they can reach the internal network. Which TWO configurations are required to achieve this? (Choose two.)

A FortiGate is deployed as an internal segmentation firewall with VDOMs for each department. The administrator needs to allow a monitoring server in the 'IT' VDOM to reach a syslog server in the 'Mgmt' VDOM over TCP 514. No inter-VDOM links currently exist. What must the administrator configure to permit this traffic while keeping the VDOMs isolated?

A FortiGate is configured with a route-based IPsec VPN to a remote site. The tunnel is up, and the routing table shows a route to the remote subnet via the VPN interface. However, traffic from the local subnet is not reaching the remote subnet. The administrator runs a packet capture and sees that packets are leaving the FortiGate but not returning. What is the most likely cause?

A FortiManager administrator is configuring a new ADOM for a region. The administrator wants to restrict the ADOM to only manage FortiGate devices running FortiOS 7.0. Which ADOM version should be selected?

A security administrator is setting up a new FortiManager to manage several FortiGate devices. The administrator wants to group devices that share the same security policies and objects. What should the administrator create to achieve this?

Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?

A network administrator needs to allow remote users to access internal resources securely using FortiClient. The administrator wants to use certificate-based authentication for the VPN. Which component must be installed on the FortiClient endpoints to enable certificate authentication?

A network security administrator is using FortiManager to manage a FortiGate cluster. The administrator needs to ensure that when a policy change is made in FortiManager, it is automatically synchronized to all cluster members. Which FortiManager feature should be configured to achieve this?

A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that only specific subnets are allowed through the tunnel, and that traffic to other subnets is dropped. Which configuration element directly defines the traffic selectors for the VPN?

An administrator wants to configure a FortiGate to perform deep inspection of SSL traffic for a specific web server. The goal is to detect and block malicious content in HTTPS sessions. What must be installed on the client devices to allow this inspection?

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

A network administrator is configuring a new FortiGate firewall policy to allow HTTP traffic from the internal network to the internet. The policy is configured with NAT enabled and uses the outgoing interface's IP address. Which statement describes the source IP address seen by the external web server?

When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?

A network administrator wants to allow only specific users to access a web application through the FortiGate. The users are stored in an LDAP directory. Which FortiGate feature should be used to enforce this?

An administrator is configuring a FortiGate to use a redundant interface for WAN connectivity. The redundant interface consists of two physical interfaces, port1 and port2. The administrator wants to ensure that if port1 fails, traffic automatically fails over to port2 without manual intervention. Which configuration is required?

A FortiGate is configured with two VDOMs: 'root' and 'vdom1'. The administrator wants to allow a server in 'vdom1' to be accessed from the internet via a VIP configured in 'root'. The server's default gateway is the FortiGate's interface in 'vdom1'. What must be configured to ensure return traffic from the server to the internet is handled correctly?

You are managing FortiGates across multiple ADOMs. How can you share common firewall objects (e.g., mail servers, common IP ranges) across these ADOMs?

You are configuring a FortiGate to perform deep inspection of HTTPS traffic. After enabling SSL inspection on a firewall policy, users report that some websites show certificate warnings. You have installed the FortiGate's CA certificate on all user workstations. What is the most likely reason for the warnings?

A FortiGate is configured with two VDOMs: 'root' and 'internal'. The administrator wants to assign a physical interface to the 'internal' VDOM and then create a VLAN subinterface on that physical interface within the same VDOM. Which VDOM mode must be enabled, and what is the correct sequence of steps?

An administrator is troubleshooting an IPsec VPN tunnel that is not establishing. The phase 1 configuration uses pre-shared keys, and both peers are FortiGates. Which command would provide the most detailed information about the IKE negotiation?

You are a FortiManager administrator. You need to configure a new ADOM to manage a set of FortiGates that will be used for a new branch office. The branch office requires a specific set of firewall objects and policies that are different from the headquarters. Which two actions must you perform when creating the new ADOM? (Choose two.)

A FortiGate is configured with an IPsec VPN to a remote peer. The administrator wants to ensure that only specific subnets are allowed over the tunnel, and that traffic from any other subnet is dropped. Which configuration element on the FortiGate directly enforces this?

An administrator wants to use FortiManager to push a configuration change to 50 FortiGates simultaneously. Which method minimizes downtime and ensures consistency?

A network administrator is configuring a FortiGate in transparent mode. The FortiGate is deployed between an internal network and a router. The administrator wants to ensure that the FortiGate forwards traffic without modifying the source or destination IP addresses. Which statement describes the correct behavior of a FortiGate in transparent mode?

A network administrator is troubleshooting a FortiGate HA cluster. The administrator notices that the primary unit's configuration is not synchronizing to the secondary unit. Which CLI command should the administrator use to verify the HA synchronization status and identify any configuration differences?

A security administrator is using FortiManager to manage a large number of FortiGates. The administrator needs to ensure that when a new FortiGate is added to FortiManager, it automatically receives a base configuration including system settings and administrative accounts. Which FortiManager feature should be used?

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new firmware version is released, they can test it on a few devices before rolling it out to all. Which two FortiManager features or steps are required to accomplish this? (Choose two.)

An administrator wants to allow remote users to access the corporate network using SSL VPN. The administrator needs to ensure that users can only access specific internal web servers. Which SSL VPN configuration mode should be used to provide granular access control to specific applications?

Which FortiGate feature should be enabled to prevent internal users from accessing malicious websites based on real-time threat intelligence?

A security administrator is configuring an SSL inspection profile on a FortiGate to inspect HTTPS traffic. The administrator wants to ensure that the FortiGate can decrypt and inspect traffic without causing certificate errors on client browsers. Which certificate must be installed on the client endpoints to prevent certificate warnings?

You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?

A FortiGate is deployed in a large enterprise network with multiple VDOMs. The administrator needs to configure a firewall policy that allows traffic from any source to any destination while logging all sessions. However, the administrator wants to ensure that the policy does not match traffic that is already being handled by a more specific policy. What is the correct order of policy evaluation in FortiOS?

An administrator is configuring a new FortiManager installation and needs to set up administrative access. The administrator wants to ensure that only authorized personnel can log in and that their actions are logged. Which two configurations are required to achieve this? (Choose two.)

A security administrator is preparing to push a configuration change from FortiManager to a managed FortiGate. Before installing, the administrator wants to preview exactly which CLI commands will be sent to the device. Which FortiManager feature should the administrator use?

A FortiManager administrator needs to ensure that when a new firmware version is released, it is automatically downloaded to FortiManager and made available for installation on managed FortiGates. The administrator wants to minimize manual intervention. Which FortiManager feature should be configured?

A network administrator is configuring an IPsec VPN between two FortiGates. The administrator wants to ensure that only traffic from the 10.0.0.0/24 subnet is encrypted and sent over the tunnel. Which configuration element must be defined on both FortiGates to match this traffic?

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

A FortiGate is configured with two VDOMs: 'root' and 'dmz'. The administrator wants to use a single physical interface to carry traffic for both VDOMs, keeping the traffic logically separated. Which interface type must be configured to achieve this?

An administrator is using FortiManager to manage a FortiGate. The administrator needs to make a configuration change that requires a reboot of the FortiGate. After installing the configuration from FortiManager, the FortiGate reboots. What is the expected behavior of FortiManager during this process?

A security administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new FortiGate is added to FortiManager, it automatically receives a specific set of global security profiles and firewall objects. Which FortiManager feature should they configure?

You are configuring a route-based IPsec VPN between two FortiGates. The VPN is up, but traffic from the local subnet is not being encrypted and sent over the tunnel; instead, it is being sent unencrypted out of the WAN interface. You have verified that the phase 1 and phase 2 selectors match on both sides. What is the most likely cause?

An administrator needs to back up the FortiGate configuration to a USB drive for disaster recovery. The FortiGate has a USB port and the administrator inserts a USB drive. Which command should the administrator use to perform the backup?

An administrator wants to delegate management of a specific FortiGate to a regional IT team while retaining overall control in FortiManager. The regional team should only be able to manage firewall policies for that device, not system settings or other devices. What should the administrator configure?

A company has a FortiManager managing multiple FortiGates. The administrator needs to ensure that when a new FortiGate is added to the FortiManager, it automatically receives a base configuration including interface settings, static routes, and administrative accounts. Which FortiManager feature should be used to accomplish this?

An administrator is configuring a new FortiManager and needs to add a FortiGate device for management. They want to ensure that the FortiGate appears in the correct ADOM and that the administrator can immediately manage its policies. Which step must be performed first?

You need to inspect traffic between two VDOMs. Which mechanism is required?

Which THREE items are included in the configuration file of a FortiGate?

Which TWO of the following can be used to optimize IPsec VPN performance?

A network administrator is configuring a FortiGate to perform deep inspection of SSL traffic for a group of users. The administrator wants to ensure that the FortiGate can decrypt and inspect the traffic without generating certificate warnings for the users. Which certificate must be installed on the client endpoints to prevent certificate warnings?

An administrator is using FortiManager to manage a FortiGate cluster (HA). They need to ensure that when a policy package is installed, both the primary and secondary units receive the configuration. What must be configured in FortiManager to achieve this?

A network administrator is configuring a new FortiGate to replace an existing firewall at the network edge. The administrator wants to ensure that the FortiGate can be managed remotely via HTTPS on its WAN interface. Which configuration step is required to allow this access?

A network administrator is using FortiManager to manage several FortiGate devices. The administrator needs to ensure that all devices receive the same firewall policy for blocking malicious traffic, but each device has a different WAN IP address. Which FortiManager feature should be used to dynamically assign the correct WAN IP address to each device's policy?

When using an IPS sensor, what is the difference between 'Protect' and 'Monitor' mode?

A network engineer has just added a new FortiGate to FortiManager and wants FortiManager to automatically retrieve the device's current configuration so it can be managed centrally. Which action accomplishes this?

A FortiGate is configured as a dial-up IPsec VPN server. Remote users connect using FortiClient. The administrator wants to ensure that each remote user receives an IP address from a dedicated pool and that only specific internal subnets are accessible. Which TWO actions are required on the FortiGate to meet these requirements? (Choose two.)

An administrator is troubleshooting a FortiGate that is not applying a security profile to traffic. The administrator suspects that the traffic is being offloaded to a network processor (NP6) and bypassing the CPU. Which CLI command can be used to verify whether traffic is being offloaded and which sessions are affected?

A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?

An administrator has configured a FortiGate with two WAN interfaces and wants to ensure that outbound traffic is load-balanced across both links while maintaining session persistence. They have enabled SD-WAN and created two members. Which SD-WAN load-balancing algorithm should they use to distribute traffic based on source IP and ensure that each source IP consistently uses the same link?

In a VDOM-enabled environment, how are administrative accounts managed?

An administrator edits a shared firewall policy in FortiManager that is assigned to multiple FortiGates, but one FortiGate is currently offline. What happens when the administrator attempts to install the policy package to all assigned devices?

You are using FortiManager to manage a FortiGate cluster. You need to create a firewall policy that allows traffic from the internal network to the internet, but you want to ensure that the policy is only installed on the primary unit of the cluster. How can you achieve this in FortiManager?

An administrator needs to provide access to FortiManager for a junior team member who should only be able to view logs and reports. Which feature is used to define this access?

An administrator is using FortiManager to manage a large enterprise network with multiple ADOMs. The administrator needs to ensure that certain firewall objects are available across all ADOMs. Which two steps must be performed to share objects across ADOMs? (Choose two.)

What is the primary purpose of an ADOM in FortiManager?

A FortiManager administrator is configuring a new ADOM for a multi-tenant environment. The administrator needs to ensure that each tenant's FortiGates are isolated and that tenants cannot view or modify each other's configurations. Which two actions should the administrator take to achieve this? (Choose two.)

What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?

What is the primary function of the FortiGate Security Fabric?

An administrator is configuring a new FortiGate device in FortiManager. They need to ensure that the device's configuration is automatically backed up daily and that they can revert to a previous configuration if needed. Which FortiManager feature should be enabled?

A network administrator is troubleshooting a FortiGate firewall policy. Traffic that should be allowed is being blocked, and the administrator suspects that the policy is not matching because of the order of policies. Which FortiGate feature can be used to verify which policy a specific traffic flow matches?

An administrator needs to configure a FortiGate to send logs to a FortiAnalyzer device. The FortiAnalyzer is reachable via the management interface. Which CLI command sequence correctly configures the FortiGate to send logs to the FortiAnalyzer?

A network administrator is deploying a new FortiGate in a Security Fabric with multiple FortiGates and FortiSwitches. The administrator wants to ensure that the Security Fabric can automatically discover and authorize new devices. Which two configuration steps are required on the root FortiGate? (Choose two.)

A FortiGate is configured with a redundant interface (also known as a link aggregation group) using two physical interfaces. The administrator notices that traffic is not being distributed evenly across the two links; one link is heavily utilized while the other is nearly idle. Which factor is most likely causing this imbalance?

A network administrator is using FortiManager to manage several FortiGate devices. The administrator wants to ensure that all devices receive the current configuration from FortiManager without manually logging into each FortiGate. Which FortiManager feature should the administrator use?

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new FortiGate is added to FortiManager, it is automatically placed into the correct ADOM based on its model and firmware version. Which FortiManager feature should be configured to achieve this?

You want to automate the onboarding of new FortiGate units. Which FortiManager feature allows you to pre-configure devices before they connect to the network?

Which command is used to troubleshoot connectivity by checking the routing table of a specific IP address on the FortiGate?

A FortiGate 200F running FortiOS 7.4 is configured as a dial-up IPsec VPN server for remote users. The administrator assigns each user a unique pre-shared key (PSK) by creating separate phase-1 interfaces with different peer IDs and PSKs. A new user reports that the VPN fails to connect, and the debug output shows 'no matching gateway for new request'. What is the most likely cause?

Which command allows you to view the current routing table for a specific VDOM?

A network administrator is troubleshooting a FortiGate 300E that is experiencing high CPU usage. The administrator suspects that a large amount of traffic is being processed by the CPU instead of being offloaded to the NP6 processor. Which type of traffic is typically NOT offloaded by the NP6 processor and therefore may contribute to high CPU usage?

Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?

An administrator has a FortiGate 600E running FortiOS 7.4 with NP6 processors. They enable hardware acceleration on a firewall policy that matches TCP port 445 traffic between two internal subnets. After enabling it, they notice that session setup is offloaded but the first few packets are still processed by the CPU. Which setting should they verify to ensure that the NP6 can accelerate the entire session from the first packet?

An administrator is configuring a FortiGate in transparent mode. The FortiGate is placed between a router and a switch, and it must inspect traffic without changing IP addresses. The administrator wants to enable broadcast forwarding to allow DHCP broadcasts to pass through. Which statement is correct regarding broadcast forwarding in transparent mode?

A FortiGate is deployed in a VDOM-enabled configuration. The administrator needs to allow inter-VDOM routing between the 'LAN' VDOM and the 'DMZ' VDOM without sending traffic to an external device. Which action must be performed?

An administrator has a FortiGate 600E running FortiOS 7.2 with VDOMs enabled. The 'root' VDOM is in NAT mode and a 'dmz' VDOM is also in NAT mode. The administrator needs to allow HTTP traffic from the 'dmz' VDOM to a web server in the 'root' VDOM, and wants the traffic to be inspected by the firewall policy in the 'root' VDOM. Which configuration is required to accomplish this?

A FortiManager administrator is troubleshooting why a configuration change made directly on a managed FortiGate is not appearing in the FortiManager policy package. The administrator wants to retrieve the FortiGate's current configuration and compare it with the FortiManager database to identify the differences. Which action should the administrator take in FortiManager?

A network administrator is new to FortiManager and wants to understand how to organize managed FortiGates for a multi-tenant environment. They need to ensure that each tenant's devices, policies, and objects are completely isolated from one another. What is the primary FortiManager construct that provides this isolation?

A network administrator is using FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration has been changed directly via CLI, causing a mismatch with the policy package in FortiManager. What is the recommended first step to resolve this configuration drift?

Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?

You are troubleshooting a policy installation failure where the FortiManager reports a 'Configuration conflict'. Which action should you perform to identify the root cause of the mismatch?

A FortiGate is deployed in a VDOM-enabled configuration with three VDOMs: root, finance, and engineering. The administrator needs to inspect traffic flowing between the finance and engineering VDOMs using a security profile. Which action must be taken to allow inter-VDOM traffic to be inspected?

An administrator is configuring a FortiGate to use LDAP authentication for SSL VPN users. The LDAP server requires a bind DN and password for queries. Which configuration is required on the FortiGate to successfully authenticate users?

A network security administrator is deploying a FortiGate 600E in a data center. The requirement is that the device must be able to inspect traffic flowing between two different VDOMs (VDOM-A and VDOM-B) that are configured on the same physical FortiGate. The administrator has already created both VDOMs and assigned interfaces to them. Which additional configuration is required to allow traffic to pass between these VDOMs?

A network administrator is using FortiManager to manage a FortiGate. The administrator wants to make a change to a firewall policy that is currently installed on the FortiGate. After editing the policy in FortiManager, what must the administrator do to make the change take effect on the FortiGate?

Which TWO components are synchronized between HA members?

A FortiManager administrator needs to delegate management of a specific ADOM to a subordinate administrator. The subordinate should only be able to view and modify firewall addresses and policies within that ADOM, and should not have access to other ADOMs or system settings. Which FortiManager feature should the administrator configure?

A FortiGate is configured with a route-based IPsec VPN to a remote office. The tunnel interface is named 'vpn1'. The administrator wants to allow only HTTP and HTTPS traffic from the local subnet 10.1.1.0/24 to the remote subnet 10.2.2.0/24 over the tunnel. Which firewall policy configuration achieves this requirement?

An administrator is using FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration in FortiManager is different from the actual configuration on the device. To resolve this, the administrator wants to update FortiManager with the current configuration from the FortiGate. Which action should the administrator take?

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

A network administrator is configuring a new FortiGate 100F for the first time. The administrator wants to set the hostname, configure the administrative timeout, and enable SSH access on the WAN interface. Which command-line interface (CLI) command should the administrator use to enter the configuration mode for system settings?

A FortiGate is configured with a static route to 192.168.1.0/24 via 10.0.0.1 on port1. The administrator wants to verify that the FortiGate will use this route for a packet destined to 192.168.1.10. Which command should the administrator use?

An administrator is troubleshooting a FortiGate HA cluster in Active-Passive mode. The primary unit unexpectedly failed over to the secondary, and the administrator needs to verify which configuration settings are synchronized between the nodes. Which two configuration elements are synchronized by default in an HA cluster? (Choose two.)

Which THREE types of traffic are typically inspected by an IPS policy?

A network administrator is configuring a firewall policy on a FortiGate to allow internal users to access the internet. The administrator wants to log all traffic that matches the policy. Which action should be taken to enable logging for this policy?

What is the purpose of the 'Any' interface in a firewall policy?

An administrator is migrating a standalone FortiGate into an existing FortiManager. What happens to the existing firewall policies on the FortiGate during the import process?

An administrator is configuring a FortiManager to manage a FortiGate. The administrator wants to ensure that the FortiGate can be managed and that configuration changes can be installed. Which two settings must be configured on the FortiGate to allow FortiManager management? (Choose two.)

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a new FortiGate is added to an ADOM, it automatically receives a base configuration that includes specific administrative settings, such as DNS servers and NTP servers. Which two FortiManager features can be used to accomplish this? (Choose two.)

In a high availability (HA) cluster, which THREE settings are synchronized between the primary and secondary units?

An administrator is configuring a FortiGate to perform SSL deep inspection for outbound HTTPS traffic. Which TWO actions are required to ensure that users can browse HTTPS sites without certificate errors? (Choose two.)

A network administrator manages two FortiGate HA clusters (cluster A and cluster B) from a single FortiManager. They need to push a new firewall policy to both clusters without affecting the other cluster's configuration. Which FortiManager feature should they use to ensure that the policy is installed only to the intended cluster and that the clusters remain independent?

A FortiGate is configured with a firewall policy that includes multiple security profiles: antivirus, IPS, and web filter. The administrator notices that some traffic that should be blocked by the IPS is being allowed. The IPS sensor is set to 'Monitor' mode. What is the most likely reason for this behavior?

What is the purpose of 'dedicated HA' interfaces?

What is the effect of changing the IPS 'buffer' size on a FortiGate device?

A network administrator is setting up a new FortiGate and needs to configure the device to send alert emails for high-severity events. The administrator wants to use the FortiGate's built-in email client and ensure that emails are sent from a specific address. Which configuration step is required to enable email notifications?

An administrator uses FortiManager to manage a large number of FortiGates. They need to ensure that when a new firewall address object is created in the global database, it is automatically available in all ADOMs that require it, without manual duplication. Which FortiManager feature should be used?

An administrator is setting up a new FortiManager and needs to add a FortiGate device for management. The FortiGate is behind a NAT device and does not have a public IP address. Which FortiManager feature allows the FortiGate to connect to FortiManager without requiring inbound access?

An administrator notices that logs are not appearing in FortiManager for a specific FortiGate. What is the first thing to check to ensure log forwarding is active?

An administrator is setting up a new FortiManager to manage several FortiGates. The administrator wants to ensure that only authorized personnel can make changes to firewall policies. Which FortiManager feature should be used to control administrative access and permissions?

Which TWO options are available when configuring an SD-WAN rule in FortiManager?

Where can an administrator check the status of the connection between a FortiGate and FortiManager?

A FortiGate is configured with a route-based IPsec VPN to a remote peer. The tunnel is up, but users report that traffic to the remote subnet intermittently fails. You suspect that the VPN is not being used for all traffic because of a routing issue. Which FortiGate CLI command would you use to verify which route is selected for a specific destination IP address?

Which TWO administrative actions require a 'Workspace Mode' enabled in FortiManager?

An administrator wants to back up the configuration of a FortiGate to a USB drive connected to the device. Which CLI command should the administrator use to perform this backup?

What is the default behavior for 'override' in FortiGate HA?

A network administrator is configuring a new FortiGate and needs to set up an administrator account that can only view logs and monitor system status, without making any configuration changes. Which administrator profile should be assigned to this account?

A FortiGate administrator configured a redundant interface named 'RED1' using 'config system interface' with 'set type redundant'. The interface is up, but traffic is not passing. Which additional step is required to make the redundant interface operational?

You are the security administrator for a large enterprise with multiple FortiGate devices managed by FortiManager. You need to create a new firewall policy that references an address object that already exists in the ADOM's global object database. However, you want to ensure that the policy is only installed on a specific subset of FortiGates. Which FortiManager feature should you use to accomplish this?

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

A FortiGate is deployed in transparent mode between two routers. The administrator wants to enable IPS inspection on traffic passing through the FortiGate. Which configuration is required to inspect traffic in transparent mode?

A security administrator is responsible for managing a FortiManager appliance that oversees multiple FortiGate devices. The administrator needs to create a new administrative user who should only be able to view firewall policies and device status but not make any changes. Which FortiManager administrative profile should be assigned to this user?

A FortiGate is configured with a site-to-site IPsec VPN to a remote peer. The VPN is up, but traffic is not passing. You run 'diagnose vpn tunnel list' and see that the tunnel is up, but the phase-2 selectors show no traffic. You suspect a routing issue. Which command would you use to verify that traffic is being routed correctly through the tunnel?

A FortiGate is configured as a dial-up IPsec VPN server for remote users. The administrator notices that some users connect successfully, but their traffic is not being routed to the internal network. The administrator has verified that the phase 2 selectors are correct and that the firewall policy allowing the tunnel traffic is present. Which configuration step is most likely missing to allow the remote users to access internal resources?

An administrator manages multiple FortiGates in a single ADOM using normalized interfaces. A new policy must reference an interface that has different names on each device (port1 on one, wan1 on another). Which FortiManager object should the administrator use in the policy to ensure correct per-device mapping?

An administrator wants to allow remote users to access the corporate network using FortiClient VPN. The administrator has configured an IPsec VPN with mode-cfg to assign IP addresses to clients. Which additional configuration is required to allow the clients to access internal resources?

An administrator is deploying a FortiGate in Transparent mode between an internal router and the ISP edge router. The FortiGate must forward IPv4 traffic without modifying source or destination addresses, and must be reachable at 10.10.10.1 for management from the internal network. Which configuration step is required?

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

An administrator is using FortiManager to manage a large number of FortiGates. They need to ensure that when a policy change is made, it is properly validated and installed without causing downtime. Which TWO actions should be taken before installing the policy package? (Choose two.)

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

Which method is the most secure for managing FortiGate devices remotely?

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

An administrator is configuring an IPS sensor on a FortiGate to protect an internal web server. The administrator wants to block attacks while minimizing false positives. Which IPS sensor action should be configured for signatures that are known to produce false positives in the internal network?

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

An administrator is using FortiManager to manage a FortiGate device. The administrator notices that the FortiGate's configuration has drifted from the FortiManager policy package. What is the most likely cause of this configuration drift?

An administrator is configuring SSL inspection on a FortiGate to inspect traffic to a web server that uses a certificate signed by an internal CA. The FortiGate must decrypt and inspect the traffic without generating certificate errors on client browsers. What must be installed on the client devices?

A FortiManager administrator needs to delegate management of a specific ADOM to a junior administrator. The junior administrator should be able to create firewall policies and install them to devices, but must not be able to modify ADOM-level settings or manage other ADOMs. Which FortiManager feature should the administrator configure to achieve this?

You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?

A network security administrator manages 40 FortiGate appliances from a single FortiManager. The administrator needs to provision a new FortiGate that will be installed at a remote branch office. The branch office uses a private MPLS circuit with no direct internet access for management. The FortiGate must be pre-configured with its management IP, administrative credentials, and initial firewall policy before it is shipped to the site. Which FortiManager feature should the administrator use to accomplish this?

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

What does the 'FortiGuard' service provide to the FortiGate?

A security administrator needs to ensure that all managed FortiGates in a specific ADOM receive a new security profile. They create the profile in the ADOM and want to assign it to all firewall policies in a policy package. However, some policies already use a different profile, and they want to replace it. Which action should they take in FortiManager to efficiently update all relevant policies?

A network administrator is configuring a FortiGate HA cluster and wants to prevent ARP cache issues on connected switches by using a virtual MAC address. Which configuration mode should be used?

An administrator is troubleshooting a FortiGate that is experiencing high CPU usage. The administrator suspects that the IPS engine is the cause. Which command should be used to verify the CPU usage of the IPS engine process?

A FortiManager administrator is troubleshooting a policy installation failure on a managed FortiGate. The installation fails with an error indicating a duplicate object name. Which FortiManager feature can the administrator use to identify and resolve the conflict?

When using SD-WAN, how does the 'member' configuration interact with physical interfaces?

A security administrator is using FortiManager to manage a large number of FortiGate devices. The administrator wants to ensure that when a policy change is made in FortiManager, it is automatically validated for compliance with corporate security standards before being installed. Which FortiManager feature should be used to achieve this?

A network administrator has two FortiManager appliances in HA mode. The primary FortiManager fails over to the secondary. After failover, the administrator notices that some managed FortiGates show as 'Unreachable' in the secondary FortiManager. What is the most likely cause?

A FortiManager administrator is configuring a new policy package for a managed FortiGate. The administrator wants to ensure that the policy package can be installed successfully and that the FortiGate will enforce the policies as intended. Which two actions must be performed before installing the policy package? (Choose two.)

Which THREE factors influence log storage efficiency on a FortiAnalyzer/FortiManager?

An administrator manages 25 FortiGates in a single ADOM. A new compliance rule requires that all managed devices use NTP servers 10.1.1.1 and 10.1.1.2. The administrator wants to push this change to all devices with minimal effort and ensure consistency. What is the most efficient way to accomplish this in FortiManager?

A network administrator needs to configure a FortiGate to send logs to a FortiAnalyzer. The administrator wants to ensure that logs are sent securely and that the FortiGate can verify the FortiAnalyzer's identity. Which protocol should be used for log transmission?

Which TWO of the following are necessary to successfully deploy an SSL VPN in tunnel mode?

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

An administrator has configured a FortiManager to manage a FortiGate. The administrator notices that the FortiGate's configuration is out of sync with FortiManager. After reviewing the revision history, the administrator sees that the FortiGate has a configuration change that was not installed from FortiManager. What is the most likely cause?

A company uses a FortiGate as their main firewall. They want to implement a security profile that blocks malicious files downloaded via HTTP. Which FortiGate feature should they use to scan files for viruses and other malware?

A network security engineer is deploying a FortiGate in transparent mode. The engineer needs to ensure that the FortiGate can be managed remotely via HTTPS from the management network, while still passing all other traffic transparently. Which configuration is required?

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

A network administrator is configuring a FortiGate 600E to manage bandwidth for a critical VoIP VLAN. The administrator needs to guarantee 2 Mbps for SIP signaling and allow burst up to 4 Mbps, while ensuring that unused bandwidth can be shared with other traffic when not needed. Which QoS method should the administrator use to meet these requirements?

A network administrator needs to configure a FortiGate to send logs to a FortiAnalyzer device. The administrator wants to ensure that logs are encrypted during transmission. Which protocol should be used for log forwarding?

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

An administrator is configuring a new FortiGate cluster in an HA environment. The administrator wants to ensure that if the primary unit fails, the secondary unit takes over with minimal disruption to existing sessions. Which HA setting should be configured to allow the secondary unit to maintain session state?

A FortiGate is deployed in transparent mode between an internal network and a router. Users behind the FortiGate cannot reach the internet, but the FortiGate can ping external addresses. The administrator confirms the forwarding domain is enabled on both interfaces. Which action should the administrator take next to allow traffic to pass through the FortiGate?

A network administrator is deploying a dial-up IPsec VPN on a FortiGate to allow remote employees to connect. The administrator wants to ensure that the VPN tunnel can be established even when the client is behind a NAT device. Which configuration setting must be enabled on the FortiGate to achieve this?

An administrator has configured a FortiGate to perform deep inspection of SSL traffic. Users report that when they access a banking website, the browser shows a certificate warning and the connection is blocked. The administrator has imported the FortiGate's CA certificate into the browsers' trusted root store. Which action should the administrator take to allow access to the banking site while maintaining SSL inspection for other sites?

A network administrator is setting up a new FortiGate and wants to back up the configuration to a TFTP server at 192.168.1.50 before making changes. The administrator is logged into the CLI as the admin user. Which command correctly performs the backup?

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

You are deploying a new FortiGate in transparent mode. Users report that they cannot access the internet, but they can access internal servers. You have verified that the FortiGate is in transparent mode and that the management IP is reachable. What is the most likely cause?

Which TWO of the following are valid methods for user authentication on a FortiGate?

A security administrator is configuring a new SSL inspection profile on a FortiGate. The administrator wants to inspect HTTPS traffic for malware but must ensure that banking websites are not inspected due to privacy concerns. Which feature should be used to exempt specific websites from SSL inspection?

An administrator is deploying a new IPsec VPN between two FortiGates. They want to ensure that the VPN can recover quickly from network disruptions and that only specific subnets are allowed over the tunnel. Which TWO configuration steps are required to meet these requirements? (Choose two.)

An administrator is troubleshooting an IPsec VPN tunnel that frequently goes down. The logs show 'NO_PROPOSAL_CHOSEN' errors during phase 2 negotiations. Which action should the administrator take to resolve this issue?

Which feature allows an administrator to offload SSL inspection to the hardware?

A company uses FortiManager to manage multiple FortiGates. They have a requirement to ensure that all devices in a specific ADOM use the same set of firewall addresses and services. However, they also need to allow some devices to have additional, unique objects. Which FortiManager feature should they use to achieve this?

A security engineer is troubleshooting why a policy change made in FortiManager was not applied to a managed FortiGate. The engineer confirms the policy package was installed successfully, but the FortiGate shows no change. Which FortiManager feature should the engineer check first?