Refer to the exhibit, which shows the output of a diagnose command.

What can you conclude from the output shown in the exhibit? (Choose two.)

• A.This is a pinhole session created to allow traffic for a protocol that requires additional sessions to operate through FortiGate.
• B.This is an expected session created by the IPS engine.
• C.Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next-hop IP address 10.200.1.1.
• D.Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next-hop IP address 10.0.1.10.

Comment: *

Name: *

Email: *

Verification: *

In which two states is a given session categorized as ephemeral? (Choose two.)

• A.A UDP session with only one packet received
• B.A TCP session waiting for FIN ACK
• C.A UDP session with packets sent and received
• D.A TCP session waiting for the SYN ACK

Comment: *

Name: *

Email: *

Verification: *

Which two statements about the Security Fabric are true? (Choose two.)

• A.Branch FortiGate devices must be configured first.
• B.Only the root FortiGate collects network information and forwards it to FortiAnalyzer.
• C.All FortiGate devices in the Security Fabric must have bidirectional FortiTelemetry connectivity.
• D.FortiGate uses FortiTelemetry protocol to communicate with FortiAnalyzer.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit, which shows the output of a web filtering diagnose command.

Which configuration change would result in non-zero results in the cache statistics section?

• A.set server-type rating under config system central-management
• B.set webfilter-cache enable under config system fortiguard
• C.set webfilter-force-off disable under config system fortiguard
• D.set ngfw-mode policy-based under config system settings

Comment: *

Name: *

Email: *

Verification: *

View the exhibit, which contains a screenshot of some phase-1 settings, and then answer the question below.

The VPN is up, and DPD packets are being exchanged between both IPsec gateways; however, traffic cannot pass through the tunnel. To diagnose, the administrator enters these CLI commands:

However, the IKE real time debug does not show any output. Why?

• A.The debug shows only error messages. If there is no output, then the tunnel is operating normally.
• B.The debug output shows phases 1 and 2 negotiations only. Once the tunnel is up, it does not show any more output.
• C.The debug output shows phase 1 negotiation only. After that, the administrator must enable the following real time debug: diagnose debug application ipsec -1.
• D.The log-filter setting was set incorrectly. The VPN's traffic does not match this filter.

Comment: *

Name: *

Email: *

Verification: *