Free NSE6_FAD-6.2: Fortinet NSE 6 - FortiADC 6.2 Exam Questions and Answers

A company has two ISP links connected to a FortiADC. ISP1 is a flat-rate 200 Mbps circuit and ISP2 is a metered 50 Mbps circuit. The administrator wants outbound traffic to use ISP2 only after ISP1 reaches its configured bandwidth threshold. Which load-balancing method should the administrator select in the link group?

• AA. Weighted round robin with weights of 4 and 1
• BB. Least connections
• CC. Spillover
• DD. Shortest response time

Refer to the exhibit. Exhibit: Real server pool: web-pool Load-balancing method: Weighted Round Robin Persistence: none Member Address Port Weight Backup Status rs1 10.0.1.11 80 4 No Up rs2 10.0.1.12 80 2 No Up rs3 10.0.1.13 80 1 Yes Up Twelve new client requests arrive at a virtual server that uses this pool. All members stay up. Which statement describes the expected distribution?

• AA. rs1 receives 7 requests, rs2 receives 4 requests and rs3 receives 1 request
• BB. rs1 receives 4 requests, rs2 receives 4 requests and rs3 receives 4 requests
• CC. rs1 receives 8 requests, rs2 receives 4 requests and rs3 receives 0 requests
• DD. rs1 receives 6 requests, rs2 receives 3 requests and rs3 receives 3 requests

A FortiADC has a static default route through 203.0.113.1. The administrator needs traffic that originates from the 10.0.2.0/24 server subnet to leave through the gateway 192.0.2.1, while all other traffic keeps using the default route. What should the administrator configure?

• AA. A policy route that matches source 10.0.2.0/24 and uses 192.0.2.1 as the gateway
• BB. A static route for 10.0.2.0/24 through 192.0.2.1 on the interface facing the servers
• CC. A second default route through 192.0.2.1 with a higher administrative distance
• DD. An OSPF area that advertises 10.0.2.0/24 to the router at 192.0.2.1

A company runs FortiADC at two data centres and publishes shop.northwind.example through global load balancing. Each site has a virtual server for the application, and FortiADC answers DNS queries for the zone. Which two statements are correct? (Choose two.)

Select 2 answers.

• AA. Client HTTP traffic to the chosen site passes through the FortiADC that answered the DNS query.
• BB. FortiADC chooses a site for each HTTP request rather than for each DNS query.
• CC. The parent domain must delegate the zone to FortiADC so that clients can reach it for DNS resolution.
• DD. A site whose virtual servers all fail health checks is left out of the DNS responses.

An administrator must distribute outbound client traffic across two ISP connections on FortiADC. Which two configuration objects are required? (Choose two.)

Select 2 answers.

• AA. A link group that contains the gateway links for both ISPs
• BB. A Layer 4 virtual server whose real server pool contains the ISP next-hop routers
• CC. A global load balancing host entry that maps the client subnet to each ISP address
• DD. A link policy that matches the outbound traffic and selects the link group

An administrator is configuring two FortiADC units as an active-passive HA cluster, but the units do not form a cluster. Which setting must have the same value on both units?

• AA. Hostname
• BB. HA priority
• CC. Group ID
• DD. Management IP address

A link group on FortiADC contains two ISP links and uses the weighted round robin method. When the ISP1 upstream connection fails, the ISP1 router still answers on its directly connected address, so FortiADC keeps sending outbound sessions to ISP1 and users lose access. Which configuration change allows FortiADC to detect this failure?

• AA. Enable source IP persistence on the link policy that references the link group
• BB. Reduce the ARP timeout on the interface connected to the ISP1 router
• CC. Assign an ICMP health check that targets a public IP address beyond ISP1 to the ISP1 member
• DD. Change the link group method from weighted round robin to round robin

Two FortiADC appliances run in active-passive HA mode. The uplink port on the primary node connects to the upstream switch. When that uplink is unplugged, the primary node stays primary and traffic is dropped, even though the heartbeat link is healthy. What should the administrator configure so that the secondary node takes over in this situation?

• AA. A higher node priority value on the secondary node
• BB. A shorter heartbeat interval on the heartbeat interface
• CC. The uplink port added to the HA monitored interfaces list
• DD. Override enabled on the secondary node

Refer to the exhibit. Exhibit: Link group: LG-OUT, method Weighted Round Robin Member ISP1: weight 5, health check HC-PING (target 192.0.2.10), status: down Member ISP2: weight 1, health check HC-PING (target 192.0.2.10), status: up Both members use the same health check target, 192.0.2.10. Which two statements are correct? (Choose two.)

Select 2 answers.

• AA. The ISP1 link may be working normally if the target is not reachable through that link.
• BB. New outbound sessions that match the link policy are sent through ISP2.
• CC. The ISP1 member is deleted from the link group until an administrator adds it again.
• DD. The ISP1 member still receives one of every six new sessions as a probe.

Refer to the exhibit. Exhibit: Virtual server: VS-WEB Type: Layer 4, protocol TCP Address: 192.0.2.50, port 80 Packet forwarding method: Direct Routing Real server pool: POOL-WEB rs1 10.1.1.21 port 80, health check: passed rs2 10.1.1.22 port 80, health check: passed The real servers are on the same subnet as the FortiADC interface. All health checks pass, but clients cannot load the site through 192.0.2.50. Which statement is correct?

• AA. A source NAT pool must be applied to the virtual server for the return traffic
• BB. The virtual server address must also be configured on a loopback interface of each real server
• CC. Direct Routing is supported only for Layer 7 virtual servers
• DD. The real servers must be placed on a different subnet from the FortiADC interface