Fortinet Certified Network Security Professional (FCNSP.v5)

QUESTION NO: 1
A FortiClient fails to establish a VPN tunnel with a FortiGate unit.
The following information is displayed in the FortiGate unit logs:
msg="Initiator: sent 192.168.11.101 main mode message #1 (OK)"
msg="Initiator: sent 192.168.11.101 main mode message #2 (OK)"
msg="Initiator: sent 192.168.11.101 main mode message #3 (OK)"
msg="Initiator: parsed 192.168.11.101 main mode message #3 (DONE)"
msg="Initiator: sent 192.168.11.101 quick mode message #1 (OK)"
msg="Initiator: tunnel 192.168.1.1/192.168.11.101 install ipsec sa"
msg="Initiator: sent 192.168.11.101 quick mode message #2 (DONE)"
msg="Initiator: tunnel 192.168.11.101, transform=ESP_3DES, HMAC_MD5" msg="Failed to acquire an IP address
Which of the following statements is a possible cause for the failure to establish the VPN tunnel?

A. There is a mismatch between the FortiGate unit and the FortiClient IP addresses in the phase 2 settings. B. There is no IPSec firewall policy configured for the policy-based VPN. C. The phase 1 configuration on the FortiGate unit uses Aggressive mode while FortiClient uses Main mode. D. An IPSec DHCP server is not enabled on the external interface of the FortiGate unit.

Correct Answer: D

QUESTION NO: 2
WAN optimization is configured in Active/Passive mode. When will the remote peer accept an attempt to initiate a tunnel?

A. The attempt will be accepted when there is a matching WAN optimization passive rule. B. The attempt will be accepted when the request comes from a known peer. C. The attempt will be accepted when the request comes from a known peer and there is a matching WAN optimization passive rule. D. The attempt will be accepted when a user on the remote peer accepts the connection request.

Correct Answer: C

QUESTION NO: 3
Which of the following statements correctly describes the deepscan option for HTTPS?

A. When deepscan is disabled, only the web server certificate is inspected; no decryption of content occurs. B. Enabling deepscan will perform further checks on the server certificate. C. With deepscan enabled, archived files will be decompressed before scanning for a more comprehensive file inspection. D. Deepscan is only applicable to mail protocols, where all IP addresses in the header are checked.

Correct Answer: A

QUESTION NO: 4
Review the IPsec diagnostics output of the command diag vpn tunnel list shown in the Exhibit.

Which of the following statements is correct regarding this output? (Select one answer).

A. Two tunnels are rekeying B. Two tunnels are up C. One tunnel is rekeying D. One tunnel is up

Correct Answer: B

QUESTION NO: 5
You are the administrator in charge of a FortiGate unit which acts as a VPN gateway. You have chosen to use Interface Mode when configuring the VPN tunnel and you want users from either side to be able to initiate new sessions. There is only 1 subnet at either end and the FortiGate unit already has a default route.
Which of the following configuration steps are required to achieve these objectives? (Select all that apply.)

A. Add a route for the remote subnet. B. Create a phase 1 definition. C. Create one firewall policy. D. Create two firewall policies. E. Create a phase 2 definition. F. Add a route for incoming traffic.

Correct Answer: A,B,D,E

QUESTION NO: 6
Which of the following statements correctly describe Transparent Mode operation? (Select all that apply.)

A. All interfaces must be on different IP subnets. B. The device is transparent to network hosts. C. Permits inline traffic inspection and firewalling without changing the IP scheme of the network. D. Ethernet packets are forwarded based on destination MAC addresses NOT IPs. E. The FortiGate unit acts as transparent bridge and routes traffic using Layer-2 forwarding.

Correct Answer: B,C,D,E

QUESTION NO: 7
A FortiGate unit is operating in NAT/Route mode and is configured with two Virtual LAN (VLAN) sub-interfaces added to the same physical interface.
Which of the following statements is correct regarding the VLAN IDs in this scenario?

A. The two VLAN sub-interfaces must have different VLAN IDs. B. The two VLAN sub-interfaces can have the same VLAN ID if they are connected to different L2 IEEE 802.1Q compliant switches. C. The two VLAN sub-interfaces can have the same VLAN ID only if they belong to different VDOMs. D. The two VLAN sub-interfaces can have the same VLAN ID only if they have IP addresses in different subnets.

Correct Answer: A

QUESTION NO: 8
An administrator has formed a High Availability cluster involving two FortiGate 310B units.
[Multiple upstream Layer 2 switches] -- [ FortiGate HA Cluster ] -- [ Multiple downstream Layer 2 switches ]
The administrator wishes to ensure that a single link failure will have minimal impact upon the overall throughput of traffic through this cluster.
Which of the following options describes the best step the administrator can take?
The administrator should...

A. set up a full-mesh design which uses redundant interfaces. B. increase the number of FortiGate units in the cluster and configure HA in Active-Active mode. C. configure the HA ping server feature to allow for HA failover in the event that a path is disrupted. D. enable monitoring of all active interfaces.

Correct Answer: A

QUESTION NO: 9
FSSO provides a single sign on solution to authenticate users transparently to a FortiGate unit using credentials stored in Windows Active Directory.
Which of the following statements are correct regarding FSSO in a Windows domain environment when NTLM and Polling Mode are not used? (Select all that apply.)

A. An FSSO Domain Controller Agent must be installed on every domain controller. B. The FSSO Collector Agent will retrieve user information from the Domain Controller Agent and will send the user logon information to the FortiGate unit. C. An FSSO Collector Agent must be installed on every domain controller. D. For non-domain computers, the only way to allow FSSO authentication is to install an FSSO client. E. The FSSO Domain Controller Agent will regularly update user logon information on the FortiGate unit.

Correct Answer: A,B

QUESTION NO: 10
A network administrator needs to implement dynamic route redundancy between a FortiGate unit located in a remote office and a FortiGate unit located in the central office.
The remote office accesses central resources using IPSec VPN tunnels through two different Internet providers.
What is the best method for allowing the remote office access to the resources through the FortiGate unit used at the central office?

A. Use two or more route-based IPSec VPN tunnels and enable OSPF on the IPSec virtual interfaces. B. Dynamic routing protocols cannot be used over IPSec VPN tunnels. C. Use route-based VPNs on the central office FortiGate unit to advertise routes with a dynamic routing protocol and use a policy-based VPN on the remote office with two or more static default routes. D. Use two or more policy-based IPSec VPN tunnels and enable OSPF on the IPSec virtual interfaces.

Correct Answer: A

Fortinet Certified Network Security Professional (FCNSP.v5) - FCNSP.v5 Exam Questions