QUESTION 30
Refer to the exhibit.

Which route will be selected when trying to reach 10.20.30.254?

QUESTION 31
Which inspection mode does FortiGate use for application profiles if it is configured as a profile-based next- generation firewall (NGFW)?

QUESTION 32
Which timeout setting can be responsible for deleting SSL VPN associated sessions?

QUESTION 33
What are three key routing principles in SD-WAN? (Choose three.)

QUESTION 34
Which two statements about SSL VPN between two FortiGate devices are true? (Choose two.)

QUESTION 35
Which two statements are correct about NGFW Policy-based mode? (Choose two.)

QUESTION 36
Which three statements about security associations (SA) in IPsec are correct? (Choose three.)

QUESTION 37
Refer to the exhibit.

Why did FortiGate drop the packet?

QUESTION 38
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is outbound traffic but no response from the peer.
Which DPD mode on FortiGate meets this requirement?

QUESTION 39
Which inspection mode does FortiGate use for application profiles if it is configured as a profile-based next- generation firewall (NGFW)?

QUESTION 40
Which two statements are correct about SLA targets? (Choose two.)

QUESTION 41
Refer to the web filter raw logs.

Based on the raw logs shown in the exhibit, which statement is correct?

QUESTION 42
Which three actions are valid for static URL filtering? (Choose three.)

QUESTION 43
Which type of logs on FortiGate record information about traffic directly to and from the FortiGate management IP addresses?

QUESTION 44
Which inspection mode does FortiGate use for application profiles if it is configured as a profile-based next-generation firewall (NGFW)?

QUESTION 45
Examine this FortiGate configuration:

Examine the output of the following debug command:

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?

QUESTION 46
Which two attributes are required on a certificate so it can be used as a CA certificate on SSL inspection? (Choose two.)

QUESTION 47
Refer to the exhibit.

Review the intrusion prevention system (IPS) profile signature settings shown in the exhibit.
What do you conclude when adding the FTP.Login.Failed signature to the IPS sensor profile?

QUESTION 48
Refer to the exhibit.

The exhibit shows theFortiGuard Category Based Filtersection of a corporate web filter profile.
An administrator must block access todownload.com, which belongs to theFreeware and Software Downloadscategory. The administrator must also allow other websites in the same category.
What are two solutions for satisfying the requirement? (Choose two.)

QUESTION 49
Refer to the exhibit, which shows the IPS sensor configuration.

If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

QUESTION 50
Which two statements describe how the RPF check is used? (Choose two.)

QUESTION 51
A network administrator is configuring a new IPsec VPN tunnel on FortiGate. The remote peer IP address is dynamic. In addition, the remote peer does not support a dynamic DNS update service.
Which type of remote gateway should the administrator configure on FortiGate for the new IPsec VPN tunnel to work?

QUESTION 52
What is the primary FortiGate election process when the HA override setting is disabled?