Which of the following statements correctly describes FortiGates route lookup behavior when searching for a suitable gateway? (Choose two)

• A.Lookup is done on every packet, regardless of direction
• B.Lookup is done on the last packet sent from the responder
• C.Lookup is done on the trust reply packet from the responder
• D.Lookup is done on the first packet from the session originator

Comment: *

Name: *

Email: *

Verification: *

Examine this output from a debug flow:

Why did the FortiGate drop the packet?

• A.The next-hop IP address is unreachable.
• B.It failed the RPF check.
• C.It matched an explicitly configured firewall policy with the action DENY.
• D.It matched the default implicit firewall policy.

Comment: *

Name: *

Email: *

Verification: *

Which two statements are correct about NGFW Policy-based mode? (Choose two.)

• A.NGFW policy-based mode policies support only flow inspection
• B.NGFW policy-based mode does not require the use of central source NAT policy
• C.NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy
• D.NGFW policy-based mode can only be applied globally and not on individual VDOMs

Comment: *

Name: *

Email: *

Verification: *

Examine the exhibit, which contains a virtual IP and firewall policy configuration.



The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address 10.0.1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

• A.10.200.1.10
• B.Any available IP address in the WAN (port1) subnet 10.200.1.0/24
• C.10.200.1.1
• D.10.0.1.254

Comment: *

Name: *

Email: *

Verification: *

Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

• A.The subject alternative name (SAN) field in the server certificate
• B.The subject field in the server certificate
• C.The server name indication (SNI) extension in the client hello message
• D.The serial number in the server certificate
• E.The host field in the HTTP header

Comment: *

Name: *

Email: *

Verification: *