FCSS_EFW_AD-7.6 practice questions 41–50

1. Question 41 · 66 in bank

   Select 2

   Refer to the exhibit.

   

   An ADVPN network is shown. You must configure an ADVPN using IBGP for each local region and EBGP across regions to connect Overlay 1 with Overlay 2. Which two options must you configure in the Hub2Hub BGP peering? (Choose two.)

   • Aset ebgp-enforce-multihop enable
   • Bset ibgp-enforce-multihop advpn
   • Cset attribute-unchanged next-hop
   • Dset next-hop-self enable

   Show answer

   Answer: AC

   Next question

2. Question 42 · 66 in bank

   Select 2

   Refer to the exhibit.

   

   A LAN interface connected from FortiGate to two FortiSwitch devices is shown. Which two statements about the LAN interface connection shown in the exhibit are correct? (Choose two.)

   • AThe LAN interface must use an 802.3ad type interface.
   • BYou must enable Spanning Tree Protocol (STP) or Rapid STP (RSTP) on FortiGate and FortiSwitch to avoid layer 2 loopbacks.
   • CThe connection is using a FortiLink interface.
   • DFortiGate is using an SD-WAN-type interface to connect to one FortiSwitch device with MCLAG.

   Show answer

   Answer: AC

   Next question

3. Question 43 · 66 in bank

   Refer to the exhibit.

   

   FortiGate_A and FortiGate_B are members of a FortiGate Session Life Support Protocol (FGSP) cluster in an enterprise network. While testing the cluster using the ping command, you monitor packet loss and on FortiGate_B, you see the session list output is shown in the exhibit. What is causing this output on FortiGate_B?

   • Asession-pickup-connectionless is set to disable on FortiGate_B.
   • BThe session synchronization is encrypted.
   • CFortiGate_B is configured in passive mode.
   • Dstandalone-config-sync is set to disable on FortiGate_B.

   Show answer

   Answer: A

   Next question

4. Question 44 · 66 in bank

   Users in your organization who are on an IPsec VPN between FortiGate A and FortiGate B are experiencing intermittent issues since implementing VXLAN. You suspect that packets exceeding the 1500-byte default maximum transmission unit (MTU) are causing the problems. How would you adjust the interface MTU value help resolve issues caused by protocols that add extra headers to IP packets?

   • AAdjust the MTU on interfaces only in wired connections like Point-to-Point Protocol over Ethernet (PPPOE), optic fiber, and Ethernet cable.
   • BAdjust the MTU on interfaces in controlled environments where all devices along the path allow MTU interface changes.
   • CAdjust the MTU on interfaces only on FortiGate A and FortiGate B.
   • DAdjust the MTU on all FortiGate interfaces after adjusting the TCP maximum segment size (MSS).

   Show answer

   Answer: B

   Next question

5. Question 45 · 66 in bank

   Refer to the exhibits.

   

   

   The routing tables of FortiGate A and FortiGate B are shown. FortiGate_A and FortiGate_B are in the same autonomous system. You want to add only route 172.16.1.248/30 on FortiGate_A by updating the BGP configuration. Which configuration must you apply?

   • AThe prefix 172.16.1.248/30 in the BGP Networks section on FortGate_B
   • BA BGP route map in for 172.16.1.248/30 on FortiGate_A.
   • CEnable Redistribute Connected in the BGP section on FortiGate_B.
   • DA BGP route map out for 172.16.1.248/30 on FortiGate_B.

   Show answer

   Answer: A

   Next question

6. Question 46 · 66 in bank

   Refer to the exhibits.

   

   

   

   The routing tables of FortiGate_A and FortiGate_B, and a network topology are shown. Why does FortiGate_B have only one external route available to 100.75.5.1/32?

   • AThe subnet 10.0.11.0/24 is not located in the FortiGate_B area.
   • BFortiGate_A advertises only one external route to FortiGate_B.
   • CThe route to 100.75.5.1/32 shown on FortiGate_B has the lowest cost.
   • Drfc-1583-compatible is not set to enable on FortiGate_B.

   Show answer

   Answer: D

   Next question

7. Question 47 · 66 in bank

   Refer to the exhibit.

   

   A partial enterprise network is shown. What must you configure so that FortiGate A and other OSPF routers in the backbone learn about prefixes generated within the RIP domain?

   • AConfigure a virtual link between FortiGate A and B.
   • BSet the area 0.0.0.1 type to stub on FortiGate A and B.
   • CEnable RIP redistribution on FortiGate B.
   • DConfigure a distribute-route-map-in on FortiGate B.

   Show answer

   Answer: C

   Next question

8. Question 48 · 66 in bank

   Select 2

   A FortiGate device using unified threat management (UTM) profiles is reaching resource limits, and you expect traffic in your enterprise network to increase. You received an additional FortiGate of the same model. Which two options should you consider using to integrate the additional FortiGate into your enterprise network? (Choose two.)

   • AFortiGate Clustering Protocol (FGCP) in active-active (A-A) mode with switches
   • BFortiGate Clustering Protocol (FGCP) in active-passive (A-P) mode with VDOM disabled
   • CFortiGate Session Life Support Protocol (FGSP) with external load balancers
   • DVirtual Router Redundancy Protocol (VRRP) with switches

   Show answer

   Answer: AC

   Next question

9. Question 49 · 66 in bank

   Select 2

   Refer to the exhibit.

   

   The packet capture output of a client hello message is shown. You are updating a firewall policy that includes SSL certificate inspection. You are capturing packets from the traffic passing through this firewall policy. Which two statements about the packet capture are correct? (Choose two.)

   • AThe subject alternative name (SAN) is necessary to apply security profiles.
   • BThe client support only TLS versions 1.2 and 1.3.
   • CYou can effectively apply a web filtering profile to this traffic.
   • DYou can effectively apply an antivirus security profile to this traffic.

   Show answer

   Answer: BC

   Next question

10. Question 50 · 66 in bank

    Select 2

    You are trying to efficiently deploy ADVPN within the enterprise network. Which two approaches can facilitate this deployment? (Choose two.)

    • AOn FortiGate, utilize loopback interfaces to reduce the number of routes and peers.
    • BOn FortiManager, enable ADVPN on VPN Manager.
    • COn FortiGate, connect only the links with the best status.
    • DFortiManager, activate the recommended IPsec tunnel provisioning templates and enable ADVPN.

    Show answer

    Answer: AD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_EFW_AD-7.6 practice, question 41. 66 questions available.