Push updates are failing on a FortiGate device located behind a network address translation (NAT) device?
Which two settings should the administrator check to correct this problem? (Choose two.)

• A.Make sure the NAT device IP address and the correct ports are configured on FortiManager.
• B.Make sure FortiGuard updates and web service are enabled on the FortiGuard service interface.
• C.Make sure the virtual IP address and the correct ports are configured on the NAT device.
• D.Make sure the Bind to IP address option on the FortiGuard service interface is set to the virtual IP address from the NAT device.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit. An administrator has assigned the default system template to install all devices with the FortiAnalyzer IP address 10.0.13.12.
However, not all FortiGate devices can reach FortiAnalyzer using the default interface. Some devices may use the LAN interface, while others may use the WAN interface.
How can the administrator change the source interface for FortiGate devices using the default system template?

• A.Use per-device dynamic object configurations at the ADOM level and apply them in the template.
• B.Configure a metadata variable at the ADOM level and use it in the template.
• C.Create a different system template for each FortiGate, if the configuration is different.
• D.Create a meta field on FortiManager system settings of type Device and use it in the template.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibits.



FortiGate HQ-NGFW-1 downloads and validates FortiGuard databases from FortiManager which acts as a local FortiGuard Distribution Server (FDS) in a closed network. An administrator pushes a new firewall policy with an intrusion prevention system (IPS) profile from FortiManager to FortiGate HQ- NGFW-1 However, FortiGate does not recognize the new IPS signature from FortiManager.
What is the most likely reason why FortiGate HQ-NGFW-1 does not recognize the new IPS signature?

• A.FortiGate must enable rating for the FortiManager IP address, 192.168.1.120, in server list 1.
• B.FortiManager and FortiGate have different IPS database versions.
• C.The administrator must enable IPv6 connections for FortiGuard services on FortiManager.
• D.The administrator must enable the fortiguard-anycast option to correctly download all signatures from the local FDS.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit. Which two statements about the configuration shown in the exhibit are true?
(Choose two.)

• A.An administrator can lock the Local-FortiGate_root policy package.
• B.The administrator created a snapshot of the Remote-FortiGate policy package.
• C.The FortiManager ADOM workspace mode is set to normal.
• D.The FortiManager is in workflow mode.

Comment: *

Name: *

Email: *

Verification: *

After correcting a policy package configuration issue, you want to prevent administrators from repeating the mistake that caused the issue.
Which FortiManager approach best meets this need?

• A.Configure an TCL script to run locally on FortiManager for each FortiGate.
• B.Restrict administrators with an administration profile from viewing the revision history to limit who can make changes.
• C.Enable the change note to require administrators to add a note whenever they change object configurations.
• D.Enable a workflow requiring approval before installing policy packages on any FortiGate.

Comment: *

Name: *

Email: *

Verification: *