Free FCSS_EFW_AD-7.4: FCSS - Enterprise Firewall 7.4 Administrator Exam Questions and Answers

Which two statements about IKEv2 in an IPsec VPN on FortiGate are true? (Choose two.)

Select 2 answers.

• AA. Main mode and aggressive mode are not available
• BB. Authentication of remote users can be performed with EAP
• CC. Phase 2 selectors are negotiated in a separate quick mode exchange
• DD. Peers with a dynamic IP address must use aggressive mode

Refer to the exhibit, which shows the output of a command on FortiGate_A. FortiGate_A # get router info ospf neighbor OSPF process 0, VRF 0: Neighbor ID Pri State Dead Time Address Interface 10.0.0.2 1 ExStart/DR 00:00:34 10.1.1.2 port3 The administrator verified that the hello interval, dead interval, and authentication settings match on both devices. The neighbor stays in the ExStart state. What is the most likely cause?

• AA. The port3 interfaces on the two devices use different MTU values
• BB. The two devices are configured with different OSPF area IDs
• CC. A firewall policy is blocking OSPF hello packets on port3
• DD. The OSPF router priority is 1 on both devices

Which two statements about administrative domains (ADOMs) on FortiManager are true? (Choose two.)

Select 2 answers.

• AA. A managed FortiGate can be assigned to several ADOMs at the same time
• BB. Each ADOM maintains its own policy packages and object database
• CC. An administrator profile can restrict an administrator to specific ADOMs
• DD. ADOMs are enabled by default on a new FortiManager

Refer to the exhibit, which shows partial IKE debug output on a FortiGate. The IPsec tunnel uses IKEv2 and the IKE SA is established, but no IPsec SA is created. ike 0:Branch1:4: initiator: sent IKE_AUTH request ike 0:Branch1:4: received IKE_AUTH response ike 0:Branch1:4: received notify type TS_UNACCEPTABLE ike 0:Branch1:4: negotiation failure What is the most likely cause?

• AA. The phase 1 encryption algorithms proposed by the peers do not overlap
• BB. The pre-shared keys configured on the two peers do not match
• CC. The phase 2 selectors configured on the two peers do not match
• DD. NAT traversal is disabled on one of the peers

Refer to the exhibit, which shows the ADVPN settings on the hub and on Spoke1. Spoke1 has two overlay tunnels to the hub, and Spoke2 is configured the same way with matching network IDs. Hub: config vpn ipsec phase1-interface edit "OVL-A" set type dynamic set interface "port1" set ike-version 2 set auto-discovery-sender enable set network-overlay enable set network-id 1 next edit "OVL-B" set type dynamic set interface "port2" set ike-version 2 set auto-discovery-sender enable set network-overlay enable set network-id 2 next end Spoke1: config vpn ipsec phase1-interface edit "OVL-A" set interface "port1" set ike-version 2 set remote-gw 198.51.100.1 set auto-discovery-receiver enable set network-overlay enable set network-id 1 next edit "OVL-B" set interface "port2" set ike-version 2 set remote-gw 198.51.100.2 set auto-discovery-receiver enable set network-overlay enable set network-id 2 next end Which two statements about this ADVPN deployment are true? (Choose two.)

Select 2 answers.

• AA. A shortcut between Spoke1 and Spoke2 is negotiated only over the overlay that has the same network ID on both spokes.
• BB. The hub negotiates the shortcut tunnel with each spoke and relays the spoke-to-spoke traffic through it.
• CC. Spoke1 must have auto-discovery-sender enabled before it can send a shortcut offer to Spoke2.
• DD. The auto-discovery-receiver setting lets Spoke1 act on the shortcut offer that the hub sends it.

Refer to the exhibit, which shows the SSL/SSH inspection profile applied to a firewall policy that also has an antivirus profile. config firewall ssl-ssh-profile edit "deep-corp" config https set ports 443 set status deep-inspection end config ftps set status disable end config ssh set status disable end set caname "Fortinet_CA_SSL" next end Security analysts find that malware hosted on an internal web portal listening on TCP 9443 is not detected. The same policy detects malware downloaded from HTTPS servers on TCP 443, and users see no certificate warnings. What must the administrator do to scan the portal traffic?

• AA. Change the https status of the deep-corp profile from deep-inspection to certificate-inspection
• BB. Set the ssh status of the deep-corp profile to deep-inspection
• CC. Add 9443 to the ports list in the https section of the deep-corp profile
• DD. Replace Fortinet_CA_SSL with a CA certificate that the client browsers already trust

An administrator must allow the Sales VLAN to reach only Salesforce on the internet. The list of destination addresses and ports used by the service changes often and must be updated automatically by FortiGuard, without manual maintenance. What should the administrator configure in the firewall policy?

• AA. FQDN address objects for the Salesforce domains as the destination, with the HTTPS service
• BB. A FortiGuard web filter category override for Salesforce, with the destination set to all and the ALL service
• CC. An application control sensor that allows Salesforce, with the destination set to all
• DD. The Salesforce Internet Service Database object as the destination in the firewall policy

Refer to the exhibit. The Corp and Internet VDOMs are connected by the inter-VDOM link vlnk (vlnk0 in Corp, 10.255.1.1/30; vlnk1 in Internet, 10.255.1.2/30). Firewall policies permitting traffic from the Corp VLAN 10 subnet 10.10.0.0/24 to the internet exist in both VDOMs. Users in 10.10.0.0/24 cannot reach the internet. FGT # config vdom FGT (vdom) # edit Internet FGT (Internet) # get router info routing-table all S* 0.0.0.0/0 [10/0] via 203.0.113.1, port1 C 10.255.1.0/30 is directly connected, vlnk1 C 203.0.113.0/29 is directly connected, port1 FGT (Internet) # diagnose debug flow show function-name enable id=20085 trace_id=7 func=print_pkt_detail line=5895 msg="vd-Internet:0 received a packet(proto=1, 10.10.0.5:1->8.8.8.8:2048) from vlnk1. type=8, code=0, id=1, seq=1." id=20085 trace_id=7 func=ip_route_input_slow line=2312 msg="reverse path check fail, drop" What must the administrator do to fix the problem?

• AA. Enable NAT in the firewall policy of the Internet VDOM
• BB. Change the default route of the Internet VDOM to use vlnk1 as the outgoing interface
• CC. Create a second inter-VDOM link between the Corp and Internet VDOMs
• DD. Add a static route in the Internet VDOM for 10.10.0.0/24 via 10.255.1.1 on vlnk1

A FortiGate 1800F inspects HTTPS traffic from the corporate LAN using a firewall policy with a deep SSL/SSH inspection profile. The administrator notices high CPU usage caused by TLS encryption and decryption. Which hardware component should take over this workload?

• AA. The CP9 content processor
• BB. The NP7 network processor
• CC. The NTurbo engine in the NP7
• DD. The integrated switch fabric (ISF)

A FortiGate in AS 65010 has EBGP sessions with two providers: ISP-A (203.0.113.1) and ISP-B (198.51.100.1). Both advertise a default route. The administrator wants all outbound traffic to use ISP-A while ISP-B remains a backup. Which configuration achieves this?

• AA. A route-map applied inbound on the ISP-B neighbor that sets the local preference to 200
• BB. A route-map applied inbound on the ISP-A neighbor that prepends AS 65010 twice to the AS path
• CC. A route-map applied outbound on the ISP-A neighbor that sets the local preference to 200
• DD. A route-map applied inbound on the ISP-A neighbor that sets the local preference to 200