Refer to the exhibit that shows VPN debugging output.

The VPN tunnel between headquarters and the branch office is not being established.
What is causing the problem?

• A.The Phase-1 encryption algorithms are not matching.
• B.There is no matching Diffie-Hellman Group.
• C.HQ is using IKE v1 and the branch office is using with IKE v2.
• D.There is a mismatch in the ISAKMP SA lifetime.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibits.
Dictionary

Recipient

Topology

The exhibits show a FortiMail network topology, Inbound configuration settings, and a Dictionary Profile.
You are required to integrate a third-party's host service (srv.thirdparty.com) into the e-mail processing path.
All inbound e-mails must be processed by FortiMail antispam and antivirus with FortiSandbox integration. If the email is clean, FortiMail must forward it to the third-party service, which will send the email back to FortiMail for final delivery. FortiMail must not scan the e-mail again.
Which three configuration tasks must be performed to meet these requirements? (Choose three.)

• A.Apply the Catch-All profile to the CF_Inbound profile and configure a content action profile to deliver to the srv.thirdparty.com FQDN
• B.Apply the Catch-All profile to the AS_Inbound profile and configure an access delivery rule to deliver to the 100.64.0.72 host
• C.Create an IP policy with a Source value of 100.64.0.72/32, enable precedence, and place the policy at the top of the list
• D.Change the scan order in FML-GW to antispam-sandbox-content
• E.Create an access receive rule with a Sender value of srv.thirdparty.com, Recipient value of
  *@acme.com, and action value of Safe

Comment: *

Name: *

Email: *

Verification: *

A customer is planning on moving their secondary data center to a cloud-based IaaS. They want to place all the Oracle-based systems on Oracle Cloud, while the other systems will be on Microsoft Azure with ExpressRoute service to their main data center.
They have about 200 branches with two internet services as their only WAN connections. As a security consultant you are asked to design an architecture using Fortinet products with security, redundancy, and performance as a priority.
Which two design options are true based on these requirements? (Choose two.)

• A.Systems running on Azure will need to go through the main data center to access the services on Oracle Cloud.
• B.Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure.
• C.Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs.
• D.Two ExpressRoute services to the main data center are required to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge.

Comment: *

Name: *

Email: *

Verification: *

The FortiGate is an IPsec VPN hub. A VPN spoke protecting subnet 192.168.222.0/24 has successfully brought up a tunnel with the FortiGate.
This remote network is present in the FortiGate routing table as shown in the exhibit.
Which statement is true?

• A.This subnet was learned during quick-mode negotiation and was dynamically injected into the routing table.
• B.The FortiGate administrator configured this subnet as a locally connected subnet on the
  "BranchOffice" phase1 interface.
• C.The route in the exhibit is bound to "BranchOffice_0" which is a tunnel other than "BranchOffice".
• D.The FortiGate administrator configured a static route for 192.168.222.0/24.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit. To facilitate a large-scale deployment of SD-WAN/ADVPN with FortiGate devices, you are tasked with configuring the FortiGate devices to support injecting of IKE routes on the ADVPN shortcut tunnels.
Which three commands must be added or changed to the FortiGate spoke config vpn ipsec phase1-interface options referenced in the exhibit for the VPN interface to enable this capability?
(Choose three.)

• A.set net-device disable
• B.set mode-cfg enable
• C.set ike-version 1
• D.set add-route enable
• E.set mode-cfg-allow-client-selector enable

Comment: *

Name: *

Email: *

Verification: *