Fortinet Network Security Expert - FortiOS 5.4

1.

What does the command diagnose debug fsso-polling refresh-user do?

It refreshes user group information form any servers connected to the FortiGate using a collector agent. It refreshes all users learned through agentless polling. It displays status information and some statistics related with the polls done by FortiGate on each DC. It enables agentless polling mode real-time debug.

2.

Why must you use aggressive mode when a local FortiGate IPsec gateway hosts multiple dialup tunnels?

The FortiGate is able to handle NATed connections only with aggressive mode. FortiClient supports aggressive mode. The remote peers are able to provide their peer IDs in the first message with aggressive mode. Main mode does not support XAuth for user authentication.

3.

In a high availability (HA) cluster operating in active-active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a secondary FortiGate?

Client > primary FortiGate> secondary FortiGate> primary FortiGate> web server.

Client > secondary FortiGate> web server.

Client >secondary FortiGate> primary FortiGate> web server.

Client> primary FortiGate> secondary FortiGate> web server.

4.

A FortiGate is operating in NAT/Route mode and configured with two virtual LAN (VLAN) sub-interfaces added to the same physical interface. Which statement about the VLAN IDs in this scenario is true?

The two VLAN sub-interfaces can have the same VLAN ID only if they belong to different VDOMs. The two VLAN sub-interfaces must have different VLAN IDs. The two VLAN sub-interfaces can have the same VLAN ID only if they have IP addresses in the same subnet. The two VLAN sub-interfaces can have the same VLAN ID only if they have IP addresses in different subnets.

5.

Which of the following statements about the FSSO collector agent timers is true?

The dead entry timeout interval is used to age out entries with an unverified status. The workstation verify interval is used to periodically check if a workstation is still a domain member. The user group cache expiry is used to age out the monitored groups. The IP address change verify interval monitors the server IP address where the collector agent is installed, and updates the collector agent configuration if itchanges.

Fortinet Network Security Expert - FortiOS 5.4

Congratulations

COMPANY

Products

OTHERS

Partner

Fortinet Network Security Expert - FortiOS 5.4

Congratulations

Detail Form

COMPANY

Products

OTHERS

Partner