A customer wants to implement a RADIUS Single Sign On (RSSO) solution for multiple FortiGate devices. The customer's network already includes a RADIUS server that can generate the logon and logoff accounting records. However, the RADIUS server can send those records to only one destination. What should the customer do to overcome this limitation?

• A.Send the RADIUS records to an LDAP server and add the LDAP server to the FortiGate configuration .
• B.Send the RADIUS records to an RSSO Collector Agent.
• C.Use the RADIUS accounting proxy feature available in FortiAuthenticator devices.
• D.Send the RADIUS records to one of the FortiGate devices, which can replicate them to the other FortiGate units.

Comment: *

Name: *

Email: *

Verification: *

An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the OCSP server.
Part of the FortiGate configuration is shown below:

Based on this configuration, which authentication scenario will FortiGate deny?

• A.The user certificate does not contain the OCSP URL.
• B.FortiAuthenticator responds to an OCSP request that the user certificate authority is untrusted.
• C.FortiAuthenticator responds to an OCSP request that the user certificate status is unknown.
• D.The user certificate does not contain User Principal Name (UPN) information.

Comment: *

Name: *

Email: *

Verification: *

Which two statements are correct on a FortiGate using the FortiGuard Outbreak Protection Service (VOS)? (Choose two.)

• A.The FortiGuard VOS can be used only with proxy-base policy inspections.
• B.If third-party AV database returns a match the scanned file is deemed to be malicious.
• C.The antivirus database queries FortiGuard with the hash of a scanned file
• D.The AV engine scan must be enabled to use the FortiGuard VOS feature
• E.The hash signatures are obtained from the FortiGuard Global Threat Intelligence database

Comment: *

Name: *

Email: *

Verification: *

A FortiGate with the default configuration shown below is deployed between two IP telephones.
FortiGate receives the INVITE request shown in the exhibit from Phone A (internal) to Phone B (external).
NVITE sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 10.31.101.20:5060
From: PhoneA <sip:[email protected]>
To: PhoneB <sip:[email protected]>
Call-ID: [email protected]
CSeq: 1 INVITE
Contact: sip:[email protected]
v=0
o=PhoneA 5462346 332134 IN IP4 10.31.101.20
c=IN IP4 10.31.101.20
m=audio 49170 RTP 0 3
Which two statements are correct after the FortiGate receives the packet? (Choose two.)

• A.A pinhole will be opened to accept traffic sent to the FortiGate WAN IP address.
• B.NAT takes place at both the network and SIP application layers.
• C.NAT takes place only in the SIP application layer.
• D.A pinhole is not required to accept traffic sent to the FortiGate WAN IP address.

Comment: *

Name: *

Email: *

Verification: *

A company wants to protect against Denial of Service attacks and has launched a new project.
They want to block the attacks that go above a certain threshold and for some others they are just trying to get a baseline of activity for those types of attacks so they are letting the traffic pass through without action.
Given the following:
- The interface to the Internet is on WAN1.
- There is no requirement to specify which addresses are being
protected or protected from.
- The protection is to extend to all services.
- The tcp_syn_flood attacks are to be recorded and blocked.
- The udp_flood attacks are to be recorded but not blocked.
- The tcp_syn_flood attack's threshold is to be changed from the
default to 1000.
The exhibit shows the current DoS-policy.
Which policy will implement the project requirements?

• A.
• B.
• C.
• D.

Comment: *

Name: *

Email: *

Verification: *