Examine the IPsec configuration shown in the exhibit; then answer the question below.

An administrator wants to monitor the VPN by enabling theIKE real time debug using these commands:
diagnose vpn ike log-filter src-addr4 10.0.10.1
diagnose debug application ike -1
diagnose debug enable
The VPN is currently up, there is no traffic crossing the tunnel and DPD packets are beinginterchanged between both IPsec gateways. However, the IKE real time debug does NOT show any output. Why isn't there any output?

• A.The IKE real time debug shows the phase 1 negotiation only. For information after that, the administrator must use the IPsec real time debug instead: diagnose debug application ipsec -1.
• B.The IKE real time debug shows error messages only. If it does not provide any output, it indicates that the tunnel is operating normally.
• C.The IKE real time shows the phases 1 and 2 negotiations only. It does not show any more output once the tunnel is up.
• D.The log-filter setting is set incorrectly. The VPN's traffic does not match this filter.

Comment: *

Name: *

Email: *

Verification: *

What does the dirty flag mean in a FortiGate session?

• A.Traffic has been blocked by the antivirus inspection.
• B.The next packet must be re-evaluated against the firewall policies.
• C.The session must be removed from the former primary unit after an HA failover.
• D.Traffic has been identified as from an application that is not allowed.

Comment: *

Name: *

Email: *

Verification: *

View the exhibit, which contains a session entry, and then answer the question below.

Which statement is correct regarding this session?

• A.It is a TCP session in ESTABLISHED state from 10.1.10.10 to 10.200.5.1.
• B.It is an ICMP session from 10.1.10.10 to 10.200.5.1.
• C.It is a TCP session in CLOSE_WAIT state from 10.1.10.10 to 10.200.1.1.
• D.It is an ICMP session from 10.1.10.10 to 10.200.1.1.

Comment: *

Name: *

Email: *

Verification: *

Which configuration can be used to reduce the number of BGP sessions in an IBGP network?

• A.Neighbor range
• B.Route reflector
• C.Next-hop-self
• D.Neighbor group

Comment: *

Name: *

Email: *

Verification: *

An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device. The administrator decides to enable the setting link-failed-signal to fix the problem.
Which statement about this setting is true?

• A.It sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.
• B.It forces the former primary device to shut down all its non-heartbeat interfaces for one second, while the failover occurs.
• C.It sends a link failed signal to all connected devices.
• D.It disabled all the non-heartbeat interfaces in all HA members for two seconds after a failover.

Comment: *

Name: *

Email: *

Verification: *