FCNSP.V5 Online Practice Questions and Answers

In HA, the option Reserve Management Port for Cluster Member is selected as shown in the Exhibit below.

Which of the following statements are correct regarding this setting? (Select all that apply.)

A. Interface settings on port7 will not be synchronized with other cluster members.

B. The IP address assigned to this interface must not overlap with the IP address subnet assigned to another interface.

C. Port7 appears in the routing table.

D. A gateway address may be configured for port7.

E. When connecting to port7 you always connect to the master device.

Review the configuration for FortiClient IPsec shown in the Exhibit below.

Which of the following statements is correct regarding this configuration?

A. The connecting VPN client will install a route to a destination corresponding to the STUDENT_INTERNAL address object

B. The connecting VPN client will install a default route

C. The connecting VPN client will install a route to the 172.20.1.[1-5] address range

D. The connecting VPN client will connect in web portal mode and no route will be installed

Examine the Exhibit shown below; then answer the question following it.

In this scenario, the Fortigate unit in Ottawa has the following routing table: S* 0.0.0.0/0 [10/0] via 172.20.170.254, port2 C 172.20.167.0/24 is directly connected, port1 C 172.20.170.0/24 is directly connected, port2

Sniffer tests show that packets sent from the Source IP address 172.20.168.2 to the Destination IP address 172.20.169.2 are being dropped by the FortiGate unit located in Ottawa. Which of the following correctly describes the cause for the dropped packets?

A. The forward policy check.

B. The reverse path forwarding check.

C. The subnet 172.20.169.0/24 is NOT in the Ottawa FortiGate unit's routing table.

D. The destination workstation 172.20.169.2 does NOT have the subnet 172.20.168.0/24 in its routing table.

In the case of TCP traffic, which of the following correctly describes the routing table lookups performed by a FortiGate unit when searching for a suitable gateway?

A. A look-up is done only when the first packet coming from the client (SYN) arrives.

B. A look-up is done when the first packet coming from the client (SYN) arrives, and a second is performed when the first packet coming from the server (SYNC/ACK) arrives.

C. A look-up is done only during the TCP 3-way handshake (SYNC, SYNC/ACK, ACK).

D. A look-up is always done each time a packet arrives, from either the server or the client side.

Shown below is a section of output from the debug command diag ip arp list.

index=2 ifname=port1 172.20.187.150 00:09:0f:69:03:7e state=00000004 use=4589 confirm=4589 update=2422 ref=1

In the output provided, which of the following best describes the IP address 172.20.187.150?

A. It is the primary IP address of the port1 interface.

B. It is one of the secondary IP addresses of the port1 interface.

C. It is the IP address of another network device located in the same LAN segment as the FortiGate unit's port1 interface.

Which of the following statements are TRUE for Port Pairing and Forwarding Domains? (Select all that apply.)

A. They both create separate broadcast domains.

B. Port Pairing works only for physical interfaces.

C. Forwarding Domains only apply to virtual interfaces.

D. They may contain physical and/or virtual interfaces.

E. They are only available in high-end models.

A FortiGate unit is configured with multiple VDOMs. An administrative account on the device has been assigned a Scope value of VDOM:root.

Which of the following items would an administrator logging in using this account NOT be able to configure?

A. Firewall addresses

B. DHCP servers

C. FortiGuard Distribution Network configuration

D. PPTP VPN configuration

The FortiGate Server Authentication Extensions (FSAE) provide a single sign on solution to authenticate users transparently to a FortiGate unit using credentials stored in Windows Active Directory.

Which of the following statements are correct regarding FSAE in a Windows domain environment when NTLM is not used? (Select all that apply.)

A. An FSAE Collector Agent must be installed on every domain controller.

B. An FSAE Domain Controller Agent must be installed on every domain controller.

C. The FSAE Domain Controller Agent will regularly update user logon information on the FortiGate unit.

D. The FSAE Collector Agent will retrieve user information from the Domain Controller Agent and will send the user logon information to the FortiGate unit.

E. For non-domain computers, an FSAE client must be installed on the computer to allow FSAE authentication.

A firewall policy has been configured for the internal email server to receive email from external parties through SMTP. Exhibits A and B show the AntiVirus and Email Filter profiles applied to this policy.

What is the correct behavior when the email attachment is detected as a virus by the FortiGate AntiVirus engine?

A. The FortiGate unit will remove the infected file and deliver the email with a replacement message to alert the recipient that the original attachment was infected.

B. The FortiGate unit will reject the infected email and notify both the sender and recipient.

C. The FortiGate unit will remove the infected file and add a replacement message. Both sender and recipient are notified that the infected file has been removed.

D. The FortiGate unit will reject the infected email and notify the sender.

An administrator is examining the attack logs and notices the following entry:

type=ips subtype=signature pri=alert vd=root serial=1995 attack_id=103022611 src=69.45.64.22 dst=192.168.1.100 src_port=80 dst_port=4887 src_int=wlan dst_int=internal status=detected proto=6 service=4887/tcp user=N/A group=N/A msg=web_client: IE.IFRAME.BufferOverflow.B

Based on the information displayed in this entry, which of the following statements are correct? (Select all that apply.)

A. This is an HTTP server attack.

B. The attack was detected and blocked by the FortiGate unit.

C. The attack was against a FortiGate unit at the 192.168.1.100 IP address.

D. The attack was detected and passed by the FortiGate unit.

The following ban list entry is displayed through the CLI.

get user ban list id cause src-ip-addr dst-ip-addr expires created 531 protect_client 10.177.0.21 207.1.17.1 indefinite Wed Dec 24 :21:33 2008 Based on this command output, which of the following statements is correct?

A. The administrator has specified the Attack and Victim Address method for the quarantine.

B. This diagnostic entry results from the administrator running the diag ips log test command. This command has no effect on traffic.

C. A DLP rule has been matched.

D. An attack has been repeated more than once during the holddown period; the expiry time has been reset to indefinite.

SSL Proxy is used to decrypt the SSL-encrypted traffic. After decryption, where is the traffic buffered in preparation for content inspection?

A. The file is buffered by the application proxy.

B. The file is buffered by the SSL proxy.

C. In the upload direction, the file is buffered by the SSL proxy. In the download direction, the file is buffered by the application proxy.

D. No file buffering is needed since a stream-based scanning approach is used for SSL content inspection.

An administrator wishes to generate a report showing Top Traffic by service type, but wants to exclude SMTP traffic from the report.

Which of the following statements best describes how to do this?

A. In the Service field of the Data Filter, type 25/smtp and select the NOT checkbox.

B. Add the following entry to the Generic Field section of the Data Filter: service="!smtp".

C. When editing the chart, uncheck mlog to indicate that Mail Filtering data is being excluded when generating the chart.

D. When editing the chart, enter 'dns' in the Exclude Service field.

A FortiClient fails to establish a VPN tunnel with a FortiGate unit.

The following information is displayed in the FortiGate unit logs:

msg="Initiator: sent 192.168.11.101 main mode message #1 (OK)" msg="Initiator: sent 192.168.11.101 main mode message #2 (OK)" msg="Initiator: sent 192.168.11.101 main mode message #3 (OK)" msg="Initiator: parsed 192.168.11.101 main mode message #3 (DONE)" msg="Initiator: sent

192.168.11.101 quick mode message #1 (OK)" msg="Initiator: tunnel 192.168.1.1/192.168.11.101 install ipsec sa" msg="Initiator: sent 192.168.11.101 quick mode message #2 (DONE)" msg="Initiator: tunnel 192.168.11.101, transform=ESP_3DES, HMAC_MD5" msg="Failed to acquire an IP address

Which of the following statements is a possible cause for the failure to establish the VPN tunnel?

A. An IPSec DHCP server is not enabled on the external interface of the FortiGate unit.

B. There is no IPSec firewall policy configured for the policy-based VPN.

C. There is a mismatch between the FortiGate unit and the FortiClient IP addresses in the phase 2 settings.

D. The phase 1 configuration on the FortiGate unit uses Aggressive mode while FortiClient uses Main mode.

Which of the following items is NOT a packet characteristic matched by a firewall service object?

A. ICMP type and code

B. TCP/UDP source and destination ports

C. IP protocol number

D. TCP sequence number