Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

• A.On HQ-FortiGate, set IKE mode to
• B.On HQ-FortiGate, disable Diffie-Helman group 2
• C.On Remote-FortiGate, set port2
• D.On both FortiGate devices, set

Comment: *

Name: *

Email: *

Verification: *

Consider the topology:
Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server.
An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.
The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.
What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)

• A.Create a new service object for TELNET and set the maximum session TTL.
• B.Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.
• C.Set the maximum session TTL value for the TELNET service object.
• D.Set the session TTL on the SSLVPN policy to maximum, so the idle session timeout will not happen after 90 minutes.

Comment: *

Name: *

Email: *

Verification: *

View the exhibit.

A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games). Based on this configuration, which statement is true?

• A.Addicting.Games is allowed based on the Application Overrides configuration.
• B.Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.
• C.Addicting.Games is blocked on the Filter Overrides configuration.
• D.Addcting.Games is allowed based on the Categories configuration.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

The exhibits show a network diagram and the explicit web proxy configuration.
In the command diagnose sniffer packet, what filter can you use to capture the traffic between the client and the explicit web proxy?

• A.'host 10.0.0.50 and port 8080'
• B.'host 192.168.0.2 and port 8080'
• C.'host 10.0.0.50 and port 80'
• D.'host 192.168.0.1 and port 80'

Comment: *

Name: *

Email: *

Verification: *

Examine the exhibit, which contains a virtual IP and firewall policy configuration.



The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address 10.0.1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

• A.10.200.1.10
• B.Any available IP address in the WAN (port1) subnet 10.200.1.0/24
• C.10.200.1.1
• D.10.0.1.254

Comment: *

Name: *

Email: *

Verification: *