Fortinet Certified Network Security Professional Set 3

Question - 15 Maximum mark : - 27

Home
All Exams
Fortinet Certified Network Security Professional Online Practice Exams
Fortinet Certified Network Security Professional Set 3

An administrator configures a VPN and selects the Enable IPSec Interface Mode option in the phase 1 settings. Which of the following statements are correct regarding the IPSec VPN configuration?

To complete the VPN configuration, the administrator must manually create a virtual IPSec interface in Web Config under System > Network.

✘ The virtual IPSec interface is automatically created after the phase1 configuration. ✘ The IPSec policies must be placed at the top of the list. ✘ This VPN cannot be used as part of a hub and spoke topology. ✔ Routes were automatically created based on the address objects in the firewall policies. ✔

Answer & Solution Discuss in Board Save for Later

Answer & Solution

Answer: Option B

Solution:

It provides fallback for IE8.

What advantages are there in using a hub-and-spoke IPSec VPN configuration instead of a fully- meshed set of IPSec tunnels? (Select all that apply.)

Using a hub and spoke topology is required to achieve full redundancy. Using a hub and spoke topology simplifies configuration. Using a hub and spoke topology provides stronger encryption. Using a hub and spoke topology reduces the number of tunnels.

Answer & Solution Discuss in Board Save for Later

Answer & Solution

Answer: Option B

Solution:

It provides fallback for IE8.

What advantages are there in using a fully Meshed IPSec VPN configuration instead of a hub and spoke set of IPSec tunnels?

Using a hub and spoke topology is required to achieve full redundancy. ✘ Using a full mesh topology simplifies configuration. ✘ Using a full mesh topology provides stronger encryption. ✘ Full mesh topology is the most fault-tolerant configuration. ✔

Answer & Solution Discuss in Board Save for Later

Answer & Solution

Answer: Option B

Solution:

It provides fallback for IE8.

A network administrator needs to implement dynamic route redundancy between a FortiGate unit located in a remote office and a FortiGate unit located in the central office. The remote office accesses central resources using IPSec VPN tunnels through two different Internet providers. What is the best method for allowing the remote office access to the resources through the FortiGate unit used at the central office?

Use two or more route-based IPSec VPN tunnels and enable OSPF on the IPSec virtual interfaces. ✘ Use two or more policy-based IPSec VPN tunnels and enable OSPF on the IPSec virtual interfaces. ✘ Use route-based VPNs on the central office FortiGate unit to advertise routes with a dynamic routing protocol and use a policy-based VPN on the remote officewith two or more static default routes. ✘ Dynamic routing protocols cannot be used over IPSec VPN tunnels. ✔

Answer & Solution Discuss in Board Save for Later

Answer & Solution

Answer: Option B

Solution:

It provides fallback for IE8.

A FortiClient fails to establish a VPN tunnel with a FortiGate unit.
The following information is displayed in the FortiGate unit logs:
msg=Initiator: sent 192.168.11.101 main mode message #1 (OK)
msg=Initiator: sent 192.168.11.101 main mode message #2 (OK)
msg=Initiator: sent 192.168.11.101 main mode message #3 (OK)
msg=Initiator: parsed 192.168.11.101 main mode message #3 (DONE)
msg=Initiator: sent 192.168.11.101 quick mode message #1 (OK)
msg=Initiator: tunnel 192.168.1.1/192.168.11.101 install ipsec sa
msg=Initiator: sent 192.168.11.101 quick mode message #2 (DONE)
msg=Initiator: tunnel 192.168.11.101, transform=ESP_3DES, HMAC_MD5
msg=Failed to acquire an IP address
Which of the following statements is a possible cause for the failure to establish the VPN tunnel?

An IPSec DHCP server is not enabled on the external interface of the FortiGate unit. ✘ There is no IPSec firewall policy configured for the policy-based VPN. ✘ There is a mismatch between the FortiGate unit and the FortiClient IP addresses in the phase 2 settings. ✘ The phase 1 configuration on the FortiGate unit uses Aggressive mode while FortiClient uses Main mode. ✔

Answer & Solution Discuss in Board Save for Later

Answer & Solution

Answer: Option B

Solution:

It provides fallback for IE8.

An administrator sets up a new FTP server on TCP port 2121. A FortiGate unit is located between the FTP clients and the server. The administrator has created a policy for TCP port 2121. Users have been complaining that when downloading data they receive a 200 Port command successful message followed by a 425 Cannot build data connection message. Which of the following statements represents the best solution to this problem?

Create a new session helper for the FTP service monitoring port 2121. ✘ Enable the ANY service in the firewall policies for both incoming and outgoing traffic. ✘ Place the client and server interface in the same zone and enable intra-zone traffic. ✘ Disable any protection profiles being applied to FTP traffic. ✔

Answer & Solution Discuss in Board Save for Later

Answer & Solution

Answer: Option B

Solution:

It provides fallback for IE8.

Which of the following Session TTL values will take precedence?

Session TTL specified at the system level for that port number ✘ Session TTL specified in the matching firewall policy ✘ Session TTL dictated by the application control list associated with the matching firewall policy ✘ The default session TTL specified at the system level ✔

Answer & Solution Discuss in Board Save for Later

Answer & Solution

Answer: Option B

Solution:

It provides fallback for IE8.

Which of the following items is NOT a packet characteristic matched by a firewall service object?

ICMP type and code ✘ TCP/UDP source and destination ports ✘ IP protocol number ✘ TCP sequence number ✔

Answer & Solution Discuss in Board Save for Later

Answer & Solution

Answer: Option B

Solution:

It provides fallback for IE8.

When configuring a server load balanced virtual IP, which of the following is the best distribution algorithm to be used in applications where the same physical destination server must be maintained between sessions?

Static ✘ Round robin ✘ Weighted round robin ✘ Least connected ✔

Answer & Solution Discuss in Board Save for Later

Answer & Solution

Answer: Option B

Solution:

It provides fallback for IE8.

10.

A network administrator connects his PC to the INTERNAL interface on a FortiGate unit. The administrator attempts to make an HTTPS connection to the FortiGate unit on the VLAN1 interface at the IP address of 10.0.1.1, but gets no connectivity.
The following troubleshooting commands are executed from the DOS prompt on the PC and from
the CLI.

C:\>ping 10.0.1.1
Pinging 10.0.1.1 with 32 bytes of data:
Reply from 10.0.1.1: bytes=32 time=1ms TTL=255
Reply from 10.0.1.1: bytes=32 time<1ms TTL=255
Reply from 10.0.1.1: bytes=32 time<1ms TTL=255
Reply from 10.0.1.1: bytes=32 time<1ms TTL=255

user1 # get system interface
== [ internal ]
namE. internal modE. static ip: 10.0.1.254 255.255.255.128 status: up
netbios-forwarD. disable typE. physical mtu-overridE. disable
== [ vlan1 ]
namE. vlan1 modE. static ip: 10.0.1.1 255.255.255.128 status: up netb
ios-forwarD. disable typE. vlan mtu-overridE. disable
user1 # diagnose debug flow trace start 100
user1 # diagnose debug ena
user1 # diagnose debug flow filter daddr 10.0.1.1 10.0.1.1
id=20085 trace_id=274 msg=vd-root received a packet(proto=6, 10.0.1.130:47927->10.0.1.1:443) from internal.
id=20085 trace_id=274 msg=allocate a new session-00000b1b
id=20085 trace_id=274 msg=find SNAT: IP-10.0.1.1, port-43798
id=20085 trace_id=274 msg=iprope_in_check() check failed, drop
Based on the output from these commands, which of the following s is a possible cause of the problem?

The Fortigate unit has no route back to the PC. ✘ The PC has an IP address in the wrong subnet. ✘ The PC is using an incorrect default gateway IP address. ✘ The FortiGate unit does not have the HTTPS service configured on the VLAN1 interface. ✔

There is no firewall policy allowing traffic from INTERNAL-> VLAN1.

✔

Answer & Solution Discuss in Board Save for Later

Answer & Solution

Answer: Option B

Solution:

It provides fallback for IE8.

Prev Next

Congratulations

you have successfully completed the test

Back to Question View Result

Detail Form

We will send your result on your email id and phone no. please fill detail

Name

Email ID Note: Report will be send to the above Email ID

Phone No

Fortinet Certified Network Security Professional Set 3

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Congratulations

COMPANY

Products

OTHERS

Partner