Question 1

Refer to the exhibit.An IPsec VPN tunnel using IKEv2 was brought up successfully, but when the tunnel rekey takes place the tunnel goes down.The debug command for IKE was enabled and, in the exhibit, you can review the partial output of the debugIKE while attempting to bring the tunnel up.What is causing. The tunnel to be down?

Options :

A : A Diffie-Hellman mismatch

B : Blocked traffic on UDP port 500

C : A mismatch m the Phase 1 negotiations

D : A mismatch in the Phase 2 negotiations

Answer: A

Question 2

A network topology and a partial routing table are shown.FortiGate has already been configured with a firewall policy that allows all ICMP traffic to flow from port1 toport3.Which two changes can the administrator perform to ensure the server at 10.4.0.1/24 receives the ICMP echoreply from the laptop at 10.1.0.1/24? (Choose two.)

Options :

A : Enable asymmetric routing under config system settings.

B : Change the FortiGate configuration from strict RPF check mode to feasible RPF check mode.

C : Modify the default gateway on the laptop from 10.1.0.2 to 10.1.0.254.

D : Add a default static route on FortiGate to forward all traffic to port3.

Answer: A,C

Question 3

Refer to the exhibit, which shows a partial output of the fssod daemon real-time debug command.What two conclusions can you draw from the output? (Choose two.)

Options :

A : The workstation with IP 10.124.2.90 will be polled frequently using TCP port 445 to see if the user is still logged on.

B : The logon event can be seen on the collector agent installed on Windows.

C : FSSO is using DC agent mode to detect logon events.

D : FSSO is using agentless polling mode to detect logon events.

Answer: A,D

Question 4

What are two reasons you might see iprope_in check () check failed, drop when using the debug How? (Choose two.)

Options :

A : The packet was dropped because it is not allowed by any firewall policy.

B : The packet was dropped because there is no route to the source.

C : The packet was dropped because the trusted host list is misconfigured

D : The packet was dropped because the requested service is not enabled on FortiGate

Answer: C,D

Question 5

Refer to the exhibit, which shows the output of diagnose automation test.What can you observe from the output? (Choose two.)

Options :

A : The automation stitch test is not being logged.

B : The automation stitch test failed but the HA failover was successful.

C : An HA failover occurred.

D : The test was unsuccessful.

Answer: A,D