EMEA-Advanced-Support Fortinet EMEA Advanced Support Exam Questions and Answers

IPS efficiency is improved by: A) Compiling signatures into a decision tree to reduce comparison overhead; B) Using IPS sensors/filters to selectively apply signatures to relevant traffic, reducing unnecessary processing; D) Using a regular database instead of an extended one to lower memory usage. Option C’s “Turbo” and round-robin load balancing is not a standard Fortinet IPS feature. Option E is incorrect as C is not valid. Exact extract: "IPS efficiency is improved by compiling signatures into decision trees to minimize CPU usage... IPS sensors and filters allow selective signature application to reduce processing... Using the regular signature database instead of extended reduces memory footprint."

The ‘get router info routing-table all’ command displays the FortiGate’s current routing table, including all active routes and their details. Options B, C, and D are not valid or specific for this purpose. Exact extract: "Use ‘get router info routing-table all’ to display the complete routing table, showing destination, gateway, interface, and metric for all routes."

In OSPF, the Area Border Router (ABR) generates Type-4 Summary LSAs to advertise the location of an Autonomous System Boundary Router (ASBR) to other areas. This LSA informs routers in different areas how to reach the ASBR for external routes. ASBR generates Type-5 LSAs for external routes, but ABR summarizes them with Type-4. Not all routers or stub routers do this. Exact extract: This article describes the basic steps to configure FortiGates in an OSPF scenario where the FortiGates will be ABR and ASBR OSPF routers across 3 areas. Router3 is the Autonomous System Border Router (ASBR). It routes all traffic to the ISP BGP router for internet access. It redistributes routes from BGP and ... Type 4 LSAs exist to let the area know the router-id of the ASBR, so the routers can look at the type 5 route, find advertising-router, and map ... An ASBR summary LSA is generated by an ABR and describes the location of an ASBR (Autonomous System Boundary Router) that connects to an external network. The FortiGate in the middle shall be a ABR between the two areas. But I don't want R2 in area 0.0.0.0 to have every /32 route for every VPN client. So I tried ...

The ‘set webfilter-profile’ command applies a web filtering profile to a firewall policy, enabling URL blocking or allowing based on categories or specific URLs. It does not enable DPI (B), configure proxies (C), or set authentication (D). Exact extract: "The ‘set webfilter-profile’ command applies a web filtering profile to a firewall policy, controlling access to websites based on URL categories or specific URLs."

When a FortiGate’s CPU enters conserve mode due to high load, proxy-based inspection (e.g., web filtering, DLP) is disabled to reduce resource usage, while flow-based inspection continues. Traffic isn’t fully blocked (A), new sessions may still be processed (C), and routing protocols (D) are unaffected. Exact extract: "In conserve mode, FortiGate disables proxy-based inspection to reduce CPU and memory load, switching to flow-based inspection to maintain performance."

FortiGuard services provide real-time threat intelligence updates to FortiGate for signatures, URL databases, and anti-malware, enhancing security profiles like IPS and web filtering. It does not handle log storage (B), VPN encryption (C), or HA synchronization (D). Exact extract: "FortiGuard services deliver real-time threat intelligence, updating FortiGate with the latest signatures, URL databases, and anti-malware definitions for security profiles."

The TCP MSS (Maximum Segment Size) defines the maximum TCP payload size, excluding headers. When the firewall sets MSS to 1450 bytes, the TCP segment size is limited to this value. For IP packets, the total size includes the TCP header (20 bytes) and IP header (20 bytes), so 1450 (MSS) + 20 (TCP) + 20 (IP) = 1490 bytes, which fits within both link MTUs (1500 and 1496 bytes). Thus, the maximum IP packet size is not limited by the link MTUs but by the MSS, adjusted for headers. Options C and F (bits) are incorrect units; A and B exceed the MSS limit. Exact extract: "The TCP MSS is adjusted to prevent fragmentation... FortiGate can rewrite the MSS in TCP SYN packets to ensure the total IP packet size (including IP and TCP headers) does not exceed the configured value."

The ‘set srcintf’ command in a FortiGate firewall policy specifies the source interface from which traffic originates, helping define the policy’s scope. It does not set the destination interface (B), source IP range (C), or NAT interface (D). Exact extract: "The ‘set srcintf’ command in a firewall policy specifies the source interface for incoming traffic, allowing FortiGate to match packets based on their entry interface."

Traffic Logs in FortiGate record all traffic events, including denied packets, with details like source, destination, and policy ID. Security Logs (B) cover UTM events, Event Logs (C) system events, and System Logs (D) hardware or system status, not specifically denied traffic. Exact extract: "Traffic Logs record all packet activity, including allowed and denied traffic, with details such as source/destination IPs, ports, and the firewall policy applied."

The ‘set nat enable’ command in a FortiGate firewall policy enables Source NAT (SNAT) for outgoing traffic, typically rewriting the source IP to the FortiGate’s interface IP or an IP pool. It does not disable NAT (B), force a specific pool (C), or limit to incoming traffic (D). Exact extract: "The ‘set nat enable’ command in a firewall policy enables Source NAT, rewriting the source IP address of outgoing traffic to the egress interface IP or a configured NAT pool."

Classful addressing follows the original IP address classes: Class A (/8), Class B (/16), and Class C (/24). Option A (10.225.30.0/8) is a Class A address, and C (172.16.0.0/16) is a Class B address. Option B (10.225.30.0/16) and D (172.16.0.0/24) use non-standard masks for their respective ranges, making them classless (CIDR). The original document incorrectly lists only A. Fortinet routing supports both classful and classless addressing. Exact extract: "Classful addressing uses fixed subnet masks: Class A (/8), Class B (/16), and Class C (/24)... Addresses like 10.0.0.0/8 and 172.16.0.0/16 are classful, while non-standard masks indicate classless addressing."

In a FortiGate HA cluster (active-active or active-passive), if the primary unit fails, a secondary unit automatically takes over as the primary, ensuring continuity of traffic with minimal disruption. Option A is incorrect as traffic continues, C is incorrect as the mode doesn’t change post-failure, and D is unrelated. Exact extract: "In a FortiGate HA cluster, if the primary unit fails, a secondary unit is elected as the new primary, taking over all roles to maintain traffic flow and session continuity."