You are running a diagnose command continuously as traffic flows through a platform with NP6 and you obtain the following output: Given the information shown in the output, which two statements are true? (Choose two.)

The output is showing a packet descriptor queue accumulated counter

There are packet drops at the XAUI.

Enabling bandwidth control between the ISF and the NP will change the output

The output is showing a packet descriptor queue accumulated counter

Enable HPE shaper for the NP6 will change the output

There are packet drops at the XAUI.

What is the benefit of using FortiGate NAC LAN Segments?

It provides physical isolation without changing the IP address of hosts.

It provides support for multiple DHCP servers within the same VLAN.

It provides physical isolation without changing the IP address of hosts.

It provides support for IGMP snooping between hosts within the same VLAN

It allows for assignment of dynamic address objects matching NAC policy.

You are troubleshooting a FortiMail Cloud service integrated with Office 365 where outgoing emails are not reaching the recipients' mail What are two possible reasons for this problem? (Choose two.)

The FortiMail access control rule to relay from Office 365 servers FQDN is missing.

The FortiMail access control rules to relay from Office 365 servers public IPs are missing.

The FortiMail access control rule to relay from Office 365 servers FQDN is missing.

The FortiMail DKIM key was not set using the Auto Generation option.

The FortiMail access control rules to relay from Office 365 servers public IPs are missing.

A Mail Flow connector from the Exchange Admin Center has not been set properly to the FortiMail Cloud FQDN.

Refer to the exhibit. FortiManager is configured with the Jinja Script under CLI Templates shown in the exhibit.Which two statements correctly describe the expected behavior when running this template? (Choose two.)

The administrator must first manually map the interface for each device with a meta field.

The template will fail because this configuration can only be applied with a CLI or TCL script.

The Jinja template will automatically map the interface with 'WAN' role on the managed FortiGate.

The template will work if you change the variable format to $(WAN).

The template will work if you change the variable format to {{ WAN }}.

The administrator must first manually map the interface for each device with a meta field.

The template will fail because this configuration can only be applied with a CLI or TCL script.

SD-WAN is configured on a FortiGate. You notice that when one of the internet links has high latency the time to resolve names using DNS from FortiGate is very high.You must ensure that the FortiGate DNS resolution times are as low as possible with the least amount of work.What should you configure?

Configure local out traffic to use the outgoing interface based on SD-WAN rules with the interface IP and configure an SD-WAN rule to the DNS server.

Configure local out traffic to use the outgoing interface based on SD-WAN rules with a manual defined IP associated to a loopback interface and configure an SD-WAN rule from the loopback to the DNS server.

Configure an SD-WAN rule to the DNS server and use the FortiGate interface IPs in the source address.

Configure two DNS servers and use DNS servers recommended by the two internet providers.

Configure local out traffic to use the outgoing interface based on SD-WAN rules with the interface IP and configure an SD-WAN rule to the DNS server.

Refer to the exhibit. You have deployed a security fabric with three FortiGate devices as shown in the exhibit. FGT_2 has the following configuration: FGT_1 and FGT_3 are configured with the default setting. Which statement is true for the synchronization of fabric-objects?

Objects from the root FortiGate will only be synchronized to FGT_3.

Objects from the FortiGate FGT_2 will be synchronized to the upstream FortiGate.

Objects from the root FortiGate will only be synchronized to FGT__2.

Objects from the root FortiGate will not be synchronized to any downstream FortiGate.

Objects from the root FortiGate will only be synchronized to FGT_3.

A retail customer with a FortiADC HA cluster load balancing five webservers in L7 Full NAT mode is receiving reports of users not able to access their website during a sale event. But for clients that were able to connect, the website works fine.CPU usage on the FortiADC and the web servers is low, application and database servers are still able to handle more traffic, and the bandwidth utilization is under 30%.Which two options can resolve this situation? (Choose two.)

Change the persistence rule to LB_PERSIS_SSL_SESSJD.

Add a connection-pool to the FortiADC virtual server

Change the persistence rule to LB_PERSIS_SSL_SESSJD.

Add more web servers to the real server poof

Disable SSL between the FortiADC and the web servers

Add a connection-pool to the FortiADC virtual server

Refer to the CLI output: Given the information shown in the output, which two statements are correct? (Choose two.)

Attackers can be blocked before they target the servers behind the FortiWeb.

Reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored

Geographical IP policies are enabled and evaluated after local techniques.

Attackers can be blocked before they target the servers behind the FortiWeb.

The IP Reputation feature has been manually updated

An IP address that was previously used by an attacker will always be blocked

Reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored

Refer to the exhibit. You are deploying a FortiGate 6000F. The device should be directly connected to a switch. In the future, a new hardware module providing higher speed will be installed in the switch, and the connection to the FortiGate must be moved to this higher-speed port.You must ensure that the initial FortiGate interface connected to the switch does not affect any other port when the new module is installed and the new port speed is defined.How should the initial connection be made?

Connect the switch on any interface between ports 25 to 28

Connect the switch on any interface between ports 21 to 24

Connect the switch on any interface between ports 25 to 28

Connect the switch on any interface between ports 1 to 4

Connect the switch on any interface between ports 5 to 8.

Refer to the exhibit, which shows a Branch1 configuration and routing table. In the SD-WAN implicit rule, you do not want the traffic load balance for the overlay interface when all members are available.In this scenario, which configuration change will meet this requirement?

Configure the priority in each overlay member to 10.

Change the load-balance-mode to source-ip-based.

Create a new static route with the internet sdwan-zone only

Configure the cost in each overlay member to 10.

Configure the priority in each overlay member to 10.

Refer to the exhibits. An administrator has configured a FortiGate and Forti Authenticator for two-factor authentication with FortiToken push notifications for their SSL VPN login. Upon initial review of the setup, the administrator has discovered that the customers can manually type in their two-factor code and authenticate but push notifications do not workBased on the information given in the exhibits, what must be done to fix this?

On FAC-1, the FortiToken public IP setting must point to 100.64.1 41

On FG-1 port1, the ftm access protocol must be enabled.

FAC-1 must have an internet routable IP address for push notifications.

On FG-1 CLI, the ftm-push server setting must point to 100.64.141.

On FAC-1, the FortiToken public IP setting must point to 100.64.1 41

Refer to the exhibit. A customer has deployed a FortiGate 300E with virtual domains (VDOMs) enabled in the multi-VDOM mode. There are three VDOMs: Root is for management and internet access, while VDOM 1 and VDOM 2 are used for segregating internal traffic. AccountVInk and SalesVInk are standard VDOM links in Ethernet mode.Given the exhibit, which two statements below about VDOM behavior are correct? (Choose two.)

You can apply OSPF routing on the VDOM link in either PPP or Ethernet mode

Traffic on AccountVInk and SalesVInk will not be accelerated.

You can apply OSPF routing on the VDOM link in either PPP or Ethernet mode

Traffic on AccountVInk and SalesVInk will not be accelerated.

The VDOM links are in Ethernet mode because they have IP addressed assigned on both sides.

Root VDOM is an Admin type VDOM, while VDOM 1 and VDOM 2 are Traffic type VDOMs.

OSPF routing can be configured between VDOM 1 and Root VDOM without any configuration changes to AccountVInk

You are responsible for recommending an adapter type for NICs on a FortiGate VM that will run on an ESXi Hypervisor. Your recommendation must consider performance as the main concern, cost is not a factor. Which adapter type for the NICs will you recommend?

Physical Function (PF) PCI Passthrough

Native ESXi Networking with E1000

Virtual Function (VF) PCI Passthrough

Native ESXi Networking with VMXNET3

Physical Function (PF) PCI Passthrough

You are deploying a FortiExtender (FEX) on a FortiGate-60F. The FEX will be managed by the FortiGate. You anticipate high utilization. The requirement is to minimize the overhead on the device for WAN traffic.Which action achieves the requirement in this scenario?

Change connectivity between the FortiGate and the FortiExtender to use VLAN Mode

Add a switch between the FortiGate and FEX.

Enable CAPWAP connectivity between the FortiGate and the FortiExtender.

Change connectivity between the FortiGate and the FortiExtender to use VLAN Mode

Add a VLAN under the FEX-WAN interface on the FortiGate.

Refer to the exhibits. A customer is looking for a solution to authenticate the clients connected to a hardware switch interface of a FortiGate 400E.Referring to the exhibits, which two conditions allow authentication to the client devices before assigning an IP address? (Choose two.)

Devices connected directly to ports 3 and 4 can perform 802 1X authentication.

Client devices must have 802 1X authentication enabled

FortiGate devices with NP6 and hardware switch interfaces cannot support 802.1X authentication.

Devices connected directly to ports 3 and 4 can perform 802 1X authentication.

Ports 3 and 4 can be part of different switch interfaces.

Client devices must have 802 1X authentication enabled

You want to use the MTA adapter feature on FortiSandbox in an HA-Cluster. Which statement about this solution is true?

The MTA adapter is only available in the primary node.

The configuration of the MTA Adapter Local Interface is different than on port1.

The MTA adapter is only available in the primary node.

The MTA adapter mode is only detection mode.

The configuration is different than on a standalone device.

Refer to the exhibit showing the history logs from a FortiMail device. Which FortiMail email security feature can an administrator enable to treat these emails as spam?

Impersonation analysis in an antispam profile

DKIM validation in a session profile

Sender domain validation in a session profile

Impersonation analysis in an antispam profile

Soft fail SPF validation in an antispam profile

Refer to the exhibits, which show a firewall policy configuration and a network topology. An administrator has configured an inbound SSL inspection profile on a FortiGate device (FG-1) that is protecting a data center hosting multiple web pages-Given the scenario shown in the exhibits, which certificate will FortiGate use to handle requests to xyz.com?

FortiGate will use the first certificate in the server-cert list---the abc.com certificate

FortiGate will fall-back to the default Fortinet_CA_SSL certificate.

FortiGate will reject the connection since no certificate is defined.

FortiGate will use the Fortinet_CA_Untrusted certificate for the untrusted connection,

FortiGate will use the first certificate in the server-cert list---the abc.com certificate

You are migrating the branches of a customer to FortiGate devices. They require independent routing tables on the LAN side of the network.After reviewing the design, you notice the firewall will have many BGP sessions as you have two data centers (DC) and two ISPs per DC while each branch is using at least 10 internal segments.Based on this scenario, what would you suggest as the more efficient solution, considering that in the future the number of internal segments, DCs or internet links per DC will increase?

Redesign the SD-WAN deployment to only use a single VPN tunnel and segment traffic using VRFs on BGP

No change in design is needed as even small FortiGate devices have a large memory capacity.

Acquire a FortiGate model with more capacity, considering the next 5 years growth.

Implement network-id, neighbor-group and increase the advertisement-interval

Redesign the SD-WAN deployment to only use a single VPN tunnel and segment traffic using VRFs on BGP

A customer is planning on moving their secondary data center to a cloud-based laaS. They want to place all the Oracle-based systems Oracle Cloud, while the other systems will be on Microsoft Azure with ExpressRoute service to their main data center.They have about 200 branches with two internet services as their only WAN connections. As a security consultant you are asked to design an architecture using Fortinet products with security, redundancy and performance as a priority.Which two design options are true based on these requirements? (Choose two.)

Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure.

Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs.

Systems running on Azure will need to go through the main data center to access the services on Oracle Cloud.

Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure.

Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs.

Two ExpressRoute services to the main data center are required to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge

Refer to the exhibit, which shows the high availability configuration for the FortiAuthenticator (FAC1). Based on this information, which statement is true about the next FortiAuthenticator (FAC2) member that will join an HA cluster with this FortiAuthenticator (FAC1)?

FAC2 can have its HA interface on a different network than FAC1.

FAC2 can only process requests when FAC1 fails.

FAC2 can have its HA interface on a different network than FAC1.

The FortiToken license will need to be installed on the FAC2.

FSSO sessions from FAC1 will be synchronized to FAC2.

Which two statements are correct on a FortiGate using the FortiGuard Outbreak Protection Service (VOS)? (Choose two.)

The antivirus database queries FortiGuard with the hash of a scanned file

The hash signatures are obtained from the FortiGuard Global Threat Intelligence database.

The FortiGuard VOS can be used only with proxy-base policy inspections.

If third-party AV database returns a match the scanned file is deemed to be malicious.

The antivirus database queries FortiGuard with the hash of a scanned file

The AV engine scan must be enabled to use the FortiGuard VOS feature

The hash signatures are obtained from the FortiGuard Global Threat Intelligence database.

A remote worker requests access to an SSH server inside the network. You deployed a ZTNA Rule to their FortiClient. You need to follow the security requirements to inspect this traffic.Which two statements are true regarding the requirements? (Choose two.)

FortiGate can perform SSH access proxy host-key validation.

SSH traffic is tunneled between the client and the access proxy over HTTPS

FortiGate can perform SSH access proxy host-key validation.

You need to configure a FortiClient SSL-VPN tunnel to inspect the SSH traffic.

SSH traffic is tunneled between the client and the access proxy over HTTPS

Traffic is discarded as ZTNA does not support SSH connection rules

Refer to the CLI configuration of an SSL inspection profile from a FortiGate device configured to protect a web server: Based on the information shown, what is the expected behavior when an HTTP/2 request comes in?

FortiGate will strip the ALPN header and forward the traffic.

FortiGate will reject all HTTP/2 ALPN headers.

FortiGate will strip the ALPN header and forward the traffic.

FortiGate will rewrite the ALPN header to request HTTP/1.

FortiGate will forward the traffic without modifying the ALPN header.

Refer to the exhibits. The exhibits show a FortiGate network topology and the output of the status of high availability on the FortiGate.Given this information, which statement is correct?

The cluster members are on the same network and the IP addresses were statically assigned.

The ethertype values of the HA packets are 0x8890, 0x8891, and 0x8892

The cluster mode can support a maximum of four (4) FortiGate VMs

The cluster members are on the same network and the IP addresses were statically assigned.

FGVMEVLQOG33WM3D and FGVMEVGCJNHFYI4A share a virtual MAC address.

A customer's cybersecurity department needs to implement security for the traffic between two VPCs in AWS, but these belong to different departments within the company. The company uses a single region for all their VPCs.Which two actions will achieve this requirement while keeping separate management of each department's VPC? (Choose two.)

Create a transit VPC with a FortiGate HA cluster, connect to the other two using VPC peering, and use routing tables to force traffic through the FortiGate cluster.

Create a VPC with a FortiGate auto-scaling group with a Transit Gateway attached to the three VPC to force routing through the FortiGate cluster

Create a transit VPC with a FortiGate HA cluster, connect to the other two using VPC peering, and use routing tables to force traffic through the FortiGate cluster.

Create an 1AM account for the cybersecurity department to manage both existing VPC, create a FortiGate HA Cluster on each VPC and IPSEC VPN to force traffic between the VPCs through the FortiGate clusters

Migrate all the instances to the same VPC and create 1AM accounts for each department, then implement a new subnet for a FortiGate auto-scaling group and use routing tables to force the traffic through the FortiGate cluster.

Create a VPC with a FortiGate auto-scaling group with a Transit Gateway attached to the three VPC to force routing through the FortiGate cluster

Refer to the exhibit. The exhibit shows the forensics analysis of an event detected by the FortiEDR coreIn this scenario, which statement is correct regarding the threat?

This is a ransomware attack and has not been stopped by FortiEDR.

This is an exfiltration attack and has been stopped by FortiEDR.

This is an exfiltration attack and has not been stopped by FortiEDR

This is a ransomware attack and has not been stopped by FortiEDR.

This is a ransomware attack and has been stopped by FortiEDR

An automation stitch was configured using an incoming webhook as the trigger named 'my_incoming_webhook'. The action is configured to execute the CLI Script shown:

data: '{ ''hostname'': ''bad_host_1'', ''ip'': [''1.1.1.1'']}' url: http://192.168.226.129/api/v2/monitor/system/automation-stitch/webhook/my_incoming_webhook

data: '{ ''hostname'': ''bad_host_1'', ''ip'': ''1.1.1.1''}' url: http://192.168.226.129/api/v2/monitor/system/automation-stitch/webhook/my_incoming_webhook

data: '{ ''hostname'': ''bad_host_1'', ''ip'': [''1.1.1.1'']}' url: http://192.168.226.129/api/v2/cmdb/system/automation-stitch/webhook/my_incoming_webhook

data: '{ ''hostname'': ''bad_host_1'', ''ip'': ''1.1.1.1''}' url: http://192.168.226.129/api/v2/cmdb/system/automation-stitch/webhook/my_incoming_webhook