Q28. Refer to the exhibit.

The exhibits show a network diagram and the explicit web proxy configuration.
In the command diagnose sniffer packet, what filter can you use to capture the traffic between the client and the explicit web proxy?

Q29. Which two statements are true about collector agent standard access mode? (Choose two.)

Q30. What types of traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)

Q31. Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)

Q32. Which security feature does FortiGate provide to protect servers located in the internal networks from attacks such as SQL injections?

Q33. Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection?
(Choose two.)

Q34. When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?

Q35. Refer to the exhibit.

According to the certificate values shown in the exhibit, which type of entity was the certificate issued to?

Q36. Which Security rating scorecard helps identify configuration weakness and best practice violations in your network?

Q37. Examine the IPS sensor configuration shown in the exhibit, and then answer the question below.


An administrator has configured the WINDOWS_SERVERS IPS sensor in an attempt to determine whether the influx of HTTPS traffic is an attack attempt or not. After applying the IPS sensor, FortiGate is still not generating any IPS logs for the HTTPS traffic.
What is a possible reason for this?

Q38. An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)

Q39. View the exhibit.

A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games). Based on this configuration, which statement is true?

Q40. An administrator wants to configure timeouts for users. Regardless of the user’s behavior, the timer should start as soon as the user authenticates and expire after the configured value.
Which timeout option should be configured on FortiGate?

Q41. An administrator is configuring an Ipsec between site A and siteB. The Remotes Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.16.1.0/24 and the remote quick mode selector is 192.16.2.0/24. How must the administrator configure the local quick mode selector for site B?

Q42. Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)

Q43. View the exhibit:

Which the FortiGate handle web proxy traffic rue? (Choose two.)

Q44. Refer to the exhibit.




The exhibit contains a network diagram, central SNAT policy, and IP pool configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
A firewall policy is configured to allow to destinations from LAN (port3) to WAN (port1).
Central NAT is enabled, so NAT settings from matching Central SNAT policies will be applied.
Which IP address will be used to source NAT the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?

Q45. Refer to the exhibit.

The exhibit shows a CLI output of firewall policies, proxy policies, and proxy addresses.
How does FortiGate process the traffic sent to http://www.fortinet.com?