System Configuration

An administrator needs to ensure that a FortiGate can be managed via SSH only from the internal network, while also allowing SNMP polling from a management server. The administrator wants to restrict access to the management interface. Which configuration should be applied?

An administrator is configuring a FortiGate in transparent mode. The FortiGate will be placed between an internal network and a router. The administrator wants to ensure that the FortiGate can be managed remotely and that it can still perform security inspections. Which two configurations are required? (Choose two.)

A FortiGate is configured with a static route to a destination network via a next-hop IP. The administrator wants to ensure that if the next-hop becomes unreachable, the route is removed from the routing table. Which feature should be configured?

An administrator is configuring an HA cluster of two FortiGates in Active-Passive mode. The cluster must maintain session continuity for TCP traffic when a failover occurs, and the administrator wants to minimize unnecessary failovers caused by link flaps on a monitored interface. (Choose two.)

A FortiGate is deployed as an internal segmentation firewall with VDOMs for each department. The administrator needs to allow a monitoring server in the 'IT' VDOM to reach a syslog server in the 'Mgmt' VDOM over TCP 514. No inter-VDOM links currently exist. What must the administrator configure to permit this traffic while keeping the VDOMs isolated?

Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?

An administrator is configuring a FortiGate to use a redundant interface for WAN connectivity. The redundant interface consists of two physical interfaces, port1 and port2. The administrator wants to ensure that if port1 fails, traffic automatically fails over to port2 without manual intervention. Which configuration is required?

A FortiGate is configured with two VDOMs: 'root' and 'vdom1'. The administrator wants to allow a server in 'vdom1' to be accessed from the internet via a VIP configured in 'root'. The server's default gateway is the FortiGate's interface in 'vdom1'. What must be configured to ensure return traffic from the server to the internet is handled correctly?

A FortiGate is configured with two VDOMs: 'root' and 'internal'. The administrator wants to assign a physical interface to the 'internal' VDOM and then create a VLAN subinterface on that physical interface within the same VDOM. Which VDOM mode must be enabled, and what is the correct sequence of steps?

A network administrator is configuring a FortiGate in transparent mode. The FortiGate is deployed between an internal network and a router. The administrator wants to ensure that the FortiGate forwards traffic without modifying the source or destination IP addresses. Which statement describes the correct behavior of a FortiGate in transparent mode?

A network administrator is troubleshooting a FortiGate HA cluster. The administrator notices that the primary unit's configuration is not synchronizing to the secondary unit. Which CLI command should the administrator use to verify the HA synchronization status and identify any configuration differences?

A FortiGate is deployed in a large enterprise network with multiple VDOMs. The administrator needs to configure a firewall policy that allows traffic from any source to any destination while logging all sessions. However, the administrator wants to ensure that the policy does not match traffic that is already being handled by a more specific policy. What is the correct order of policy evaluation in FortiOS?

A FortiGate is configured with two VDOMs: 'root' and 'dmz'. The administrator wants to use a single physical interface to carry traffic for both VDOMs, keeping the traffic logically separated. Which interface type must be configured to achieve this?

An administrator needs to back up the FortiGate configuration to a USB drive for disaster recovery. The FortiGate has a USB port and the administrator inserts a USB drive. Which command should the administrator use to perform the backup?

You need to inspect traffic between two VDOMs. Which mechanism is required?

Which THREE items are included in the configuration file of a FortiGate?

A network administrator is configuring a new FortiGate to replace an existing firewall at the network edge. The administrator wants to ensure that the FortiGate can be managed remotely via HTTPS on its WAN interface. Which configuration step is required to allow this access?

An administrator is troubleshooting a FortiGate that is not applying a security profile to traffic. The administrator suspects that the traffic is being offloaded to a network processor (NP6) and bypassing the CPU. Which CLI command can be used to verify whether traffic is being offloaded and which sessions are affected?

In a VDOM-enabled environment, how are administrative accounts managed?

What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?

An administrator needs to configure a FortiGate to send logs to a FortiAnalyzer device. The FortiAnalyzer is reachable via the management interface. Which CLI command sequence correctly configures the FortiGate to send logs to the FortiAnalyzer?

A FortiGate is configured with a redundant interface (also known as a link aggregation group) using two physical interfaces. The administrator notices that traffic is not being distributed evenly across the two links; one link is heavily utilized while the other is nearly idle. Which factor is most likely causing this imbalance?

Which command allows you to view the current routing table for a specific VDOM?

A network administrator is troubleshooting a FortiGate 300E that is experiencing high CPU usage. The administrator suspects that a large amount of traffic is being processed by the CPU instead of being offloaded to the NP6 processor. Which type of traffic is typically NOT offloaded by the NP6 processor and therefore may contribute to high CPU usage?

Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?

An administrator has a FortiGate 600E running FortiOS 7.4 with NP6 processors. They enable hardware acceleration on a firewall policy that matches TCP port 445 traffic between two internal subnets. After enabling it, they notice that session setup is offloaded but the first few packets are still processed by the CPU. Which setting should they verify to ensure that the NP6 can accelerate the entire session from the first packet?

An administrator is configuring a FortiGate in transparent mode. The FortiGate is placed between a router and a switch, and it must inspect traffic without changing IP addresses. The administrator wants to enable broadcast forwarding to allow DHCP broadcasts to pass through. Which statement is correct regarding broadcast forwarding in transparent mode?

A FortiGate is deployed in a VDOM-enabled configuration. The administrator needs to allow inter-VDOM routing between the 'LAN' VDOM and the 'DMZ' VDOM without sending traffic to an external device. Which action must be performed?

An administrator has a FortiGate 600E running FortiOS 7.2 with VDOMs enabled. The 'root' VDOM is in NAT mode and a 'dmz' VDOM is also in NAT mode. The administrator needs to allow HTTP traffic from the 'dmz' VDOM to a web server in the 'root' VDOM, and wants the traffic to be inspected by the firewall policy in the 'root' VDOM. Which configuration is required to accomplish this?

Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?

A FortiGate is deployed in a VDOM-enabled configuration with three VDOMs: root, finance, and engineering. The administrator needs to inspect traffic flowing between the finance and engineering VDOMs using a security profile. Which action must be taken to allow inter-VDOM traffic to be inspected?

A network security administrator is deploying a FortiGate 600E in a data center. The requirement is that the device must be able to inspect traffic flowing between two different VDOMs (VDOM-A and VDOM-B) that are configured on the same physical FortiGate. The administrator has already created both VDOMs and assigned interfaces to them. Which additional configuration is required to allow traffic to pass between these VDOMs?

Which TWO components are synchronized between HA members?

A network administrator is configuring a new FortiGate 100F for the first time. The administrator wants to set the hostname, configure the administrative timeout, and enable SSH access on the WAN interface. Which command-line interface (CLI) command should the administrator use to enter the configuration mode for system settings?

An administrator is troubleshooting a FortiGate HA cluster in Active-Passive mode. The primary unit unexpectedly failed over to the secondary, and the administrator needs to verify which configuration settings are synchronized between the nodes. Which two configuration elements are synchronized by default in an HA cluster? (Choose two.)

What is the purpose of 'dedicated HA' interfaces?

A network administrator is setting up a new FortiGate and needs to configure the device to send alert emails for high-severity events. The administrator wants to use the FortiGate's built-in email client and ensure that emails are sent from a specific address. Which configuration step is required to enable email notifications?

An administrator wants to back up the configuration of a FortiGate to a USB drive connected to the device. Which CLI command should the administrator use to perform this backup?

What is the default behavior for 'override' in FortiGate HA?

A network administrator is configuring a new FortiGate and needs to set up an administrator account that can only view logs and monitor system status, without making any configuration changes. Which administrator profile should be assigned to this account?

A FortiGate administrator configured a redundant interface named 'RED1' using 'config system interface' with 'set type redundant'. The interface is up, but traffic is not passing. Which additional step is required to make the redundant interface operational?

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

An administrator is deploying a FortiGate in Transparent mode between an internal router and the ISP edge router. The FortiGate must forward IPv4 traffic without modifying source or destination addresses, and must be reachable at 10.10.10.1 for management from the internal network. Which configuration step is required?

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

A network administrator is configuring a FortiGate HA cluster and wants to prevent ARP cache issues on connected switches by using a virtual MAC address. Which configuration mode should be used?

An administrator is troubleshooting a FortiGate that is experiencing high CPU usage. The administrator suspects that the IPS engine is the cause. Which command should be used to verify the CPU usage of the IPS engine process?

When using SD-WAN, how does the 'member' configuration interact with physical interfaces?

A network administrator needs to configure a FortiGate to send logs to a FortiAnalyzer. The administrator wants to ensure that logs are sent securely and that the FortiGate can verify the FortiAnalyzer's identity. Which protocol should be used for log transmission?

A network security engineer is deploying a FortiGate in transparent mode. The engineer needs to ensure that the FortiGate can be managed remotely via HTTPS from the management network, while still passing all other traffic transparently. Which configuration is required?

A network administrator is configuring a FortiGate 600E to manage bandwidth for a critical VoIP VLAN. The administrator needs to guarantee 2 Mbps for SIP signaling and allow burst up to 4 Mbps, while ensuring that unused bandwidth can be shared with other traffic when not needed. Which QoS method should the administrator use to meet these requirements?

A network administrator needs to configure a FortiGate to send logs to a FortiAnalyzer device. The administrator wants to ensure that logs are encrypted during transmission. Which protocol should be used for log forwarding?

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

An administrator is configuring a new FortiGate cluster in an HA environment. The administrator wants to ensure that if the primary unit fails, the secondary unit takes over with minimal disruption to existing sessions. Which HA setting should be configured to allow the secondary unit to maintain session state?

A FortiGate is deployed in transparent mode between an internal network and a router. Users behind the FortiGate cannot reach the internet, but the FortiGate can ping external addresses. The administrator confirms the forwarding domain is enabled on both interfaces. Which action should the administrator take next to allow traffic to pass through the FortiGate?

A network administrator is setting up a new FortiGate and wants to back up the configuration to a TFTP server at 192.168.1.50 before making changes. The administrator is logged into the CLI as the admin user. Which command correctly performs the backup?

Which feature allows an administrator to offload SSL inspection to the hardware?