Question 1

TCP protocol can be used for data delivery via multicast

Accepted Answer

B

Explanation: The Transmission Control Protocol (TCP) is fundamentally a connection-oriented, point-to-point protocol. It is designed to provide reliable, ordered, and error-checked delivery of data between a single sender and a single receiver. This reliability is achieved through mechanisms like the three-way handshake, sequence numbers, and acknowledgments (ACKs) which establish and maintain a unicast session state. Multicast is a one-to-many or many-to-many communication model. A sender transmits a single packet to a multicast group address, and the network delivers copies to all subscribed receivers. TCP's stateful, one-to-one acknowledgment mechanism is incompatible with this model, as a single sender would be overwhelmed by ACKs from potentially thousands of receivers (a problem known as "ACK implosion"). Therefore, the standard TCP protocol cannot be used for multicast data delivery.

Question 2

In Active FTP who sends the PORT command?

Accepted Answer

A

Explanation: In an Active FTP session, the client establishes the control connection to the server's port 21. For any subsequent data transfer (like a file listing or download), the client must inform the server how to connect back to it. The client achieves this by opening a high-numbered port locally and sending the PORT command over the control channel. This command contains the IP address and the specific port number the client is listening on, instructing the server to initiate the data connection from its port 20 to that client-specified endpoint.

Question 3

Link aggregation allows network devices to________

Accepted Answer

B

Explanation: Link aggregation, as defined by the IEEE 802.3ad standard, is a method of combining or "binding" multiple physical network links into a single logical channel. This technique serves two primary purposes: increasing the total available bandwidth beyond the capacity of any single link and providing link redundancy. By bundling physical interfaces, network devices can treat them as a single, higher-capacity link, effectively distributing traffic across the member interfaces to achieve greater throughput and resilience against individual link failures.

Question 4

Which of the following is a network monitoring protocol?

Accepted Answer

C

Explanation: Simple Network Management Protocol (SNMP) is an application-layer protocol specifically designed for managing and monitoring network devices. It is a core component of network management systems. SNMP operates using a manager-agent architecture, where an SNMP manager (a centralized system) queries SNMP agents running on network devices like FortiGate firewalls, routers, and switches. The agents provide access to a wide range of performance metrics, configuration data, and status information stored in a Management Information Base (MIB), enabling administrators to monitor network health and performance.

Question 5

Which of the following are classful addresses? (Select all that apply below)

Accepted Answer

A, C

Explanation: Classful addressing is an IP addressing architecture that divides the address space into five classes (A, B, C, D, E), where the class is determined by the first octet. Each class has a predefined, default subnet mask. Class A: First octet 1-126, default mask /8. Class B: First octet 128-191, default mask /16. Class C: First octet 192-223, default mask /24. Option A (10.225.30.0/8) is a Class A address with its correct default /8 mask. Option C (172.16.0.0/16) is a Class B address with its correct default /16 mask. Therefore, both are classful addresses.

Question 6

Which command would you use to verify the status of an IPsec VPN tunnel on a FortiGate?

Accepted Answer

A

Explanation: The diagnose vpn tunnel list command is the primary and most direct FortiOS CLI command used to verify the operational status of all configured IPsec VPN tunnels. It provides a concise summary that includes the tunnel name, its current state (up or down), and basic traffic counters for incoming and outgoing data. This command is essential for initial troubleshooting and status verification of IPsec VPN connections on a FortiGate device.

Question 7

What happens when a FortiGate’s CPU enters conserve mode?

Accepted Answer

B

Explanation: FortiGate enters conserve mode when system memory usage crosses the red (mem-low) threshold. To reduce further RAM consumption, FortiOS immediately turns off all proxy-based UTM engines and automatically reverts security profiles to flow-based inspection. Existing sessions continue and normal forwarding/routing functions remain; only features that rely on proxy workers are suspended. Traffic therefore still passes, but without proxy-based scanning.

Question 8

Which of the following Authentication protocols uses clear text?

Accepted Answer

B

Explanation: The Password Authentication Protocol (PAP) is a basic authentication method used by Point-to-Point Protocol (PPP) to validate users. Its primary characteristic is its simplicity, which unfortunately comes at the cost of security. PAP transmits the username and password across the network in clear, unencrypted text. This lack of encryption makes any network segment where PAP is used vulnerable to eavesdropping attacks, as an attacker with access to the traffic can easily capture the credentials. For this reason, PAP is considered obsolete and insecure for most modern applications.

Question 9

Which of these BGP paths will be the preferred one ?

Accepted Answer

D

Explanation: The BGP best path selection algorithm is a deterministic, step-by-step process. The Local Preference attribute is evaluated very early in this sequence, specifically after the non-standard Weight attribute. A path with a higher Local Preference value is always preferred over a path with a lower value, regardless of other attributes like AS Path length, MED, or whether the path was learned via eBGP or iBGP. Because Local Preference is checked before the other attributes listed in the options, it is the most influential and will be the deciding factor among the choices provided.

Question 10

What are the advantages of using a hub-and-spoke IPSec VPN configuration instead of a fully-meshed set of IPSec tunnels? (Select all that apply below)

Accepted Answer

B, D

Explanation: A hub-and-spoke IPsec VPN topology offers significant advantages in scalability and manageability over a fully-meshed design. The primary benefit is the reduction in the number of required tunnels. In a network with 'n' sites, a hub-and-spoke model requires only n-1 tunnels, whereas a full mesh requires n(n-1)/2 tunnels. This drastic reduction simplifies both the initial setup and ongoing maintenance. Consequently, routing management is also simplified. Each spoke device typically only needs a summary or default route pointing to the central hub for all inter-site traffic, while the hub centralizes the more complex routing logic. This contrasts with a full mesh, where every site needs specific routes to every other site.

Free Fortinet EMEA-Advanced-Support Actual Exam Questions