Question 1

Refer to the exhibit.

Examine the IPsec VPN phase 1 configuration shown in theexhibit An administrator wants to use certificate-based authentication for an IPsec VPN user Which three configuration changes must you make on FortiGate to perform certificate-based authentication for the IPsec VPN user? (Choose three)

Options :

A :

Create a PKI user for the IPsec VPN user, and then configure the IPsec VPN tunnel to accept the PKI user as peer certificate

B :

In the Authentication section of the IPsec VPN tunnel in the Method drop-down list select Signature and then select the certificate that FortiGate will use for IPsec VPN

C : In the IKE section of the IPsec VPN tunnel in the Mode field select Main (ID protection)

D : Import the CA that signed the user certificate

E : Enable XAUTH on the IPsec VPN tunnel

Answer: B,D,E

Question 2

Which two statements about FortiSwitch manager are true1? (Choose two)

Options :

A : Per-device management is the default management mode on FortiManager

B :

FortiManager obtains the FortiSwitch status information by querying the FortiGate REST API every three minutes

C :

If the administrator makes any changes on FortiSwitch manager they must also install those changes on FortiGate so that those changes are applied on the managed switches

D : Any switch discovered or authorized on FortiGate must be added manually on FortiSwitch manager

Answer: B,C

Question 3

Refer to the exhibit.

Examine the debug output shown in the exhibit Which two statements about the RADIUS debug output are true'' (Choose two)

Options :

A : The user student belongs to the SSLVPN group

B : User authentication failed

C : The RADIUS server sent a vendor-specific attribute in the RADIUS response

D : User authentication succeeded using MSCHAP

Answer: A,D

Question 4

Which CLI command should an administrator use to view the certificate verification process in real time?

Options :

A : diagnose debug application foauthd -1

B : diagnose debug application radiusd -1

C : diagnose debug application authd -1

D : diagnose debug application fnbamd -1

Answer: A

Question 5

Refer to the exhibits

The exhibits show the wireless network (VAP) SSID profiles defined on FortiManager and an AP profile assigned to a group of APs that are supported by FortiGate None of the APs are broadcasting the SSlDs defined by the AP profile Which changes do you need to make to enable the SSIDs to broadcast?

Options :

A : In the SSIDs section enable Tunnel

B : Enable one channel in the Channels section

C : Enable multiple channels in the Channels section and enable Radio Resource Provision

D : In the SSIDs section enable Manual and assign the networks manually

Answer: B