Fortinet Network Security Expert 5 Written Exam (500) (NSE5) Free Practice Test

Question 1

Which of the following statements correctly describe Transparent Mode operation? (Select all that apply.)

A. The FortiGate unit acts as transparent bridge and routes traffic using Layer-2 forwarding.

B. All interfaces must be on different IP subnets.

C. Permits inline traffic inspection and firewalling without changing the IP scheme of the network.

D. The device is transparent to network hosts.

E. Ethernet packets are forwarded based on destination MAC addresses NOT IPs.

Correct Answer: A,C,D,E

Question 2

If Open Shortest Path First (OSPF) has already been configured on a FortiGate unit, which of the following statements is correct if the routes learned through OSPF need to be announced by Border Gateway Protocol (BGP)?

A. The BGP local AS number must be the same as the OSPF area number of the routes learned that need to be redistributed into BGP.

B. The FortiGate unit will automatically announce all routes learned through OSPF to its BGP peers if the FortiGate unit is configured as an OSPF Area Border Router (ABR).

C. At a minimum, the network administrator needs to enable Redistribute OSPF in the BGP settings.

D. By design, BGP cannot redistribute routes learned through OSPF.

E. The FortiGate unit will automatically announce all routes learned through OSPF to its BGP peers if the FortiGate unit is configured as an OSPF Autonomous System Boundary Router (ASBR).

Correct Answer: C

Question 3

Examine the two static routes to the same destination subnet 172.20.168.0/24 as shown below; then answer the question following it.
config router static
edit 1
set dst 172.20.168.0 255.255.255.0
set distance 20
set priority 10
set device port1
next
edit 2
set dst 172.20.168.0 255.255.255.0
set distance 20
set priority 20
set device port2
next
end
Which of the following statements correctly describes the static routing configuration provided above?

A. The FortiGate unit will evenly share the traffic to 172.20.168.0/24 through both routes.

B. The FortiGate unit will send all the traffic to 172.20.168.0/24 through port1.

C. Only the route that is using port1 will show up in the routing table.

D. The FortiGate unit will share the traffic to 172.20.168.0/24 through both routes, but the port2 route will carry approximately twice as much of the traffic.

Correct Answer: B

Question 4

Which of the following is true regarding Switch Port Mode?

A. Provides separate routable interfaces for each internal port.

B. An administrator can select ports to be used as a switch.

C. Allows all internal ports to share the same subnet.

D. Configures ports to be part of the same broadcast domain.

Correct Answer: C

Question 5

In the case of TCP traffic, which of the following correctly describes the routing table lookups performed by a FortiGate unit when searching for a suitable gateway?

A. A look-up is done when the first packet coming from the client (SYN) arrives, and a second is performed when the first packet coming from the server (SYNC/ACK) arrives.

B. A look-up is done only when the first packet coming from the client (SYN) arrives.

C. A look-up is always done each time a packet arrives, from either the server or the client side.

D. A look-up is done only during the TCP 3-way handshake (SYNC, SYNC/ACK, ACK).

Correct Answer: A

Question 6

A client can establish a secure connection to a corporate network using SSL VPN in tunnel mode.
Which of the following statements are correct regarding the use of tunnel mode SSL VPN?
(Select all that apply.)

A. The source IP address used by the client for the tunnel mode SSL VPN is assigned by the FortiGate unit.

B. Split tunneling can be enabled when using tunnel mode SSL VPN.

C. Users attempting to create a tunnel mode SSL VPN connection must be authenticated by at least one SSL VPN policy.

D. Client software is required to be able to use a tunnel mode SSL VPN.

Correct Answer: A,B,C,D

Question 7

Refer to the exhibit. What does the clock icon denote beside the Bandwidth and Applications Report?

A. It is in the process of generating.

B. It is an imported report from either a different FortiAnalyzer device or a different (but supported) ADOM.

C. It is a scheduled report.

D. It is a custom report.

Correct Answer: C

Question 8

Examine the exhibit shown below then answer the question that follows it.

Within the UTM Proxy Options, the CA certificate Fortinet_CA_SSLProxy defines which of the following:

A. FortiGate unit's signing certificate used by the SSL proxy.

B. FortiGuard's encryption certificate used by the SSL proxy.

C. FortiGate unit's encryption certificate used by the SSL proxy.

D. FortiGuard's signing certificate used by the SSL proxy.

Correct Answer: C

Question 9

In an IPSec gateway-to-gateway configuration, two FortiGate units create a VPN tunnel between two separate private networks.
Which of the following configuration steps must be performed on both FortiGate units to support this configuration? (Select all that apply.)

A. Create firewall policies to control traffic between the IP source and destination address.

B. Configure the appropriate user groups on the FortiGate units to allow users access to the IPSec VPN connection.

C. Define the Phase 2 parameters that the FortiGate unit needs to create a VPN tunnel with the remote peer.

D. Set the operating mode of the FortiGate unit to IPSec VPN mode.

E. Define the Phase 1 parameters that the FortiGate unit needs to authenticate the remote peers.

Correct Answer: A,C,E

Question 10

Which of the following statements is correct regarding a FortiGate unit operating in NAT/Route mode?

A. The FortiGate unit must use public IP addresses on both the internal and external networks.

B. The FortiGate unit requires only a single IP address for receiving updates and configuring from a management computer.

C. The FortiGate unit commonly uses private IP addresses on the internal network but hides them using network address translation.

D. The FortiGate unit uses only DHCP-assigned IP addresses on the internal network.

Correct Answer: C

Question 11

Which part of an email message exchange is NOT inspected by the POP3 and IMAP proxies?

A. File attachments

B. Message headers

C. Message body

D. TCP connection

Correct Answer: D

Question 12

Review the CLI configuration below for an IPS sensor and identify the correct statements regarding this configuration from the choices below. (Select all that apply.) config ips sensor edit "LINUX_SERVER" set comment '' set replacemsg-group '' set log enable config entries edit 1 set action default set application all set location server
set log enable
set log-packet enable
set os Linux
set protocol all
set quarantine none
set severity all
set status default
next
end
next
end

A. The sensor only filters which IPS signatures to apply to the selected firewall policy.

B. The sensor will log all server attacks for all operating systems.

C. The sensor will reset all connections that match these signatures.

D. The sensor will match all traffic from the address object "LINUX_SERVER".

E. The sensor will include a PCAP file with a trace of the matching packets in the log message of any matched signature.

Correct Answer: A,E

Question 13

Which of the following statements are correct about the HA diag command diagnose sys ha reset-uptime? (Select all that apply.)

A. This command resets the uptime variable used in the HA algorithm so it may cause a new master to become elected.

B. This command has no impact on the HA algorithm.

C. The device this command is executed on is likely to switch from master to slave status if master override is enabled.

D. The device this command is executed on is likely to switch from master to slave status if master override is disabled.

Correct Answer: A,D

Question 14

A FortiGate unit is configured with three Virtual Domains (VDOMs) as illustrated in the exhibit.

Which of the following statements are true if the network administrator wants to route traffic between all the VDOMs? (Select all that apply.)

A. This configuration requires the use of an external router.

B. As each VDOM has an independent routing table, routing rules need to be set (for example, static routing, OSPF) in each VDOM to route traffic between VDOMs.

C. The administrator should configure inter-VDOM links to avoid using external interfaces and routers.

D. Inter-VDOM routing is automatically provided if all the subnets that need to be routed are locally attached.

E. As with all FortiGate unit interfaces, firewall policies must be in place for traffic to be allowed to pass through any interface, including inter-VDOM links. This provides the same level of security internally as externally.

Correct Answer: B,C,E

Welcome to TestSimulate

Fortinet Network Security Expert 5 Written Exam (500) (NSE5) Free Practice Test