You want to improve reliability over a lossy IPSec tunnel.
Which combination of IPSec phase 1 parameters should you configure?
Afec-ingress and fsc-egrsss
Bdpd and dpd-retryinterval
Cfragmentation and fragmentation-mtu
Dkeepalive and keylive
Refer to the exhibit, which contains a TCL script configuration on FortiManager.
An administrator has configured the TCL script on FortiManager, but the TCL script failed to apply any changes to the managed device after being run.
Why did the TCL script fail to make any changes to the managed device?
AThe TCL procedure run_cmd has not been created.
BThe TCL script must start with #include.
CThere is no corresponding #! to signify the end of the script.
DThe TCL procedure lacks the required loop statements to iterate through the changes.
How are bulk configuration changes made using FortiManager CLI scripts? (Choose two.)
AWhen run on the Device Database, changes are applied directly to the managed FortiGate device.
BWhen run on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.
CWhen run on the All FortiGate in ADOM, changes are automatically installed without the creation of a new revision history.
DWhen run on the Policy Package, ADOM database, you must use the installation wizard to apply the changes to the managed FortiGate device.
Refer to the exhibit, which contains a partial configuration of the global system.
What can you conclude from this output?
AOnly NPs are disabled
BOnly CPs are disabled
CNPs and CPs are enabled
DNPs and CPs are disabled
Which two statements about the neighbor-group command are true? (Choose two.)
AIt applies common settings in an OSPF area
BYou can apply it in Internal BGP (IBGP) and External BGP (EBGP)
CYou can configure it on the GUI
DIt is combined with the neighbor-range parameter
Refer to the exhibits, which show the configurations of two address objects from the same FortiGate.
Engineering address object -
Finance address object -
Why can you modify the Engineering address object, but not the Finance address object?
AYou have read-only access.
BAnother user is editing the Finance address object in workspace mode.
CFortiGate joined the Security Fabric and the Finance address object was configured on the root FortiGate.
DFortiGate is registered on FortiManager.
Which two statements about IKE version 2 fragmentation are true? (Choose two.)
AOnly some IKE version 2 packets are considered fragmentable
BThe reassembly timeout default value is 30 seconds
CIt is performed at the IP layer
DThe maximum number of IKE version 2 fragments is 128
Refer to the exhibit, which contains information about an IPsec VPN tunnel.
What two conclusions can you draw from the command output? (Choose two.)
ADead peer detection is set to enable
BThe IKE version is 2
CBoth IPsec SAs are loaded on the kernel
DForward error correction in phase 2 is set to enable
An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device.
What can the administrator do to fix this problem?
AConfigure set link-failed-signal enable under config system ha on both cluster members
BConfigure set send-garp-on-failover enable under config system ha on both cluster members.
CConfigure remote link monitoring to detect an issue in the forwarding path.
DVerify that the speed and duplex settings match between the FortiGate interfaces and the connected switch ports.
Refer to the exhibit, which shows a custom signature.
Which two modifications must you apply to the configuration of this custom signature so that you can save it on FortiGate? (Choose two.)
AEnsure that the header syntax is F-SBID.
BAdd severity.
CAdd attack_id.
DStart options with --.
Refer to the exhibit, which shows the output of a BGP summary.
What two conclusions can you draw from this BGP summary? (Choose two.)
AThe BGP session with peer 10.127.0.75 is established.
CThe router 100.64.3.1 has the parameter bfd set to enable.
DThe neighbors displayed are linked to a local router with the neighbor-range set to a value of 4.
What are two functions of automation stitches? (Choose two.)
AAutomation stitches can be created to run diagnostic commands and email the results when CPU or memory usage exceeds specified thresholds.
BAn automation stitch configured to execute actions in parallel can be set to insert a specific delay between actions.
CAutomation stitches can be configured on any FortiGate device in a Security Fabric environment.
DAn automation stitch configured to execute actions sequentially can take parameters from previous actions as input for the current action.
Refer to the exhibit which shows config system central-management information.
Which setting must you configure for the web filtering feature to function?
ASet update-server-location to automatic
BAdd server.fortiguard.net to the Server list
CConfigure securewf.fortiguard.net on the default servers
DConfigure server-type with the rating option
Refer to the exhibit which shows two configured FortiGate devices and peering over
FGSP.
The main link directly connects the two FortiGate devices and is configured using the set session-syn-dev <interface> command.
What is the primary reason to configure the main link?
ATo have only configuration synchronization in layer 3
BTo load balance both sessions and configuration synchronization between layer 2 and 3
CTo have both sessions and configuration synchronization in layer 3
DTo have both sessions and configuration synchronization in layer 2
Which two statements about the Security Fabric are true? (Choose two.)
AFortiGate uses the FortiTelemetry protocol to communicate with FortiAnalyzer
BOnly the root FortiGate sends logs to FortiAnalyzer
COnly FortiGate devices with configuration-sync set to default receive and synchronize global CMDB objects that the root FortiGate sends
DOnly the root FortiGate collects network topology information and forwards it to FortiAnalyzer
Refer to the exhibit, which shows a network diagram.
Which protocol should you use to configure the FortiGate cluster?
Preview
