Refer to the exhibit.

Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

• A.This security fabric topology is a logical topology view.
• B.There are 19 security recommendations for the security fabric.
• C.There are five devices that are part of the security fabric.
• D.Device detection is disabled on all FortiGate devices.

Comment: *

Name: *

Email: *

Verification: *

What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?

• A.FortiGate automatically negotiates different local and remote addresses with the remote peer.
• B.FortiGate automatically negotiates a new security association after the existing security association expires.
• C.FortiGate automatically negotiates different encryption and authentication algorithms with the remote peer.
• D.FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.

Comment: *

Name: *

Email: *

Verification: *

Which statement regarding the firewall policy authentication timeout is true?

• A.It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source MAC.
• B.It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address after this timer has expired.
• C.It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after this timer has expired.
• D.It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source IP.

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements about central NAT are true? (Choose two.)

• A.Central NAT can be enabled or disabled from the CLI only.
• B.IP tool references must be removed from existing firewall policies before enabling central NAT.
• C.Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.
• D.Source NAT, using central NAT, requires at least one central SNAT policy.

Comment: *

Name: *

Email: *

Verification: *

Examine this FortiGate configuration:

How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

• A.It always authorizes the traffic without requiring authentication.
• B.It drops the traffic.
• C.It authenticates the traffic using the authentication scheme SCHEME2.
• D.It authenticates the traffic using the authentication scheme SCHEME1.

Comment: *

Name: *

Email: *

Verification: *