EFW-7.2

What can you conclude from this configuration? 

A. FortiGate creates separate virtual interfaces for each dial-up client 

B. The VPN should use the dynamic routing protocol to exchange routing information through the tunnels 

C. Dead peer detection is disabled 

D. The routing table shows a single IPSec virtual interface 

What two conclusions can you draw from this command output? (Choose two.) 

A. The interfaces of the OSPF routers match the MTU value that is configured as 1500. 

B. NGFW-1 is the designated router. 

C. The port3 network has more than one OSPF router. 

D. The OSPF routers are in the area ID of 0.0.0.1.

A. It detects only two-way failures. 

B. The two routers must be connected to the same subnet. 

C. It allows failure detection in less than one second.  

D. It is supported for neighbors over multiple hops. 

What step must you take to resolve this issue? 

A. Refresh the device status using the Device Manager so that FortiGate populates the IPSec interfaces. 

B. Install the VPN community and gateway configuration on the FortiGate devices so that the VPN interfaces appear on the Policy Objects on FortiManager. 

C. Configure the phase 1 settings in the VPN community that you didn’t initially configure. FortiGate automatically generates the interfaces 

after you configure the required settings. 

D. Create interface mappings for the IPsec VPN interfaces before you use them in a policy

A. 10.0.1.244  

B. 10.0.1.242 

C. Public FortiGuard servers 

D. 10.0.1.243

A. Only the DR receives link state information from non-DR routers. 

B. Non-DR and non-BDR routers form full adjacencies to DR only. 

C. FortiGate first checks the OSPF ID to elect a DR. 

D. Non-DR and non-BDR routers send link state updates and acknowledgements to 224.0.0.6

Which setting must you configure to allow SSH? 

A. Specify SSH in the Service field. 

B. Select an application control profile corresponding to SSH in the Security Profiles section. 

C. Include SSH in the Application field. 

D. Configure port 22 in the Protocol Options field.

A. FortiGate uses the first entry listed in the SAN field in the server certificate 

B. FortiGate uses the CN information from the Subject field in the server certificate 

C. FortiGate uses the SNI from the user's web browser. 

D. FortiGate closes the connection because this represents an invalid SSL/TLS configuration

A. Neighbors maintain communication with the restarting router. 

B. The restarting router sends gratuitous ARP for 30 seconds. 

C. FortiGate restarts if the topology changes. 

D. The router sends grace LSAs before it restarts

（含图）

A. set neighbor-group advpn 

B. set route-reflector-client enable 

C. set prefix 10.1.0 255.255.254.0 

D. set prefix 172.16.1.0 255.255.255.0 

Which parameter should you enable on both connected FortiGate devices? 

A. distribute-list-in 

B. rfc1583-compatible 

C. restart-on-topology-change 

D. bfd

What can you conclude from this command output? 

A. You must change the AS number to match the remote peer. 

B. BGP is attempting to establish a TCP connection with the BGP peer. 

C. The bfd configuration is set to enable. 

D. The routers are in the same area ID of 0.0.0.0.

A. The hub adds routes based on IKE negotiations. 

B. You must configure phase 2 quick mode selectors to 0.0.0.0 0.0.0.0. 

C. All FortiGate devices must be in the same autonomous system (AS). 

D. You must disable add-route in the hub

A. The NP checks the session key or IPSec SA. 

B. The NP provides IPS signature matching. 

C. You can disable the NP for each firewall policy using the command np-acceleration set to loose. 

D. For TCP traffic, FortiGate CPU offloads the first packets of SYN/ACK and ACK of the three-way handshake to NP.

A. udp is not a protocol option. 

B. fortiguard-anycast is set to enable. 

C. You do not have the corresponding write access. 

D. FortiManager provides FortiGuard.

A. Secondary virtual MAC port1 then physical MAC port1 

B. Secondary virtual MAC port1 

C. Secondary physical MAC port1  

D. Secondary physical MAC port1 then virtual MAC port2

A. route-reflector-peer enable 

B. route-reflector-server enable 

C. route-reflector-client enable 

D. route-reflector enable

A. It can be configured as an update server, a rating server, or both. 

B. It caches available firmware updates for unmanaged devices. 

C. It supports rating requests from non-FortiGate devices. 

D. It provides VM license validation services.

What can you conclude from this configuration about access to www.facebook.com, which is categorized as Social Networking? 

A. The access is blocked, based on the URL Filter configuration. 

B. The access is blocked, based on the Content Filter configuration. 

C. The access is allowed, based on the FortiGuard Category Based Filter configuration. 

D. The access is blocked if the local or the public FortiGuard server does not reply

A. Shortcut forward 

B. Shortcut reply 

C. Shortcut query 

D. Shortcut offer