EMEA-Advanced-Support Fortinet EMEA Advanced Support Exam Questions and Answers

FortiGate uses SSH (Secure Shell) by default for secure management access, providing encrypted command-line access. Telnet (A) and HTTP (C) are insecure, and SNMP (D) is for monitoring, not management. Exact extract: "FortiGate enables SSH by default for secure management access, providing encrypted CLI access to administrators."

Traffic Logs in FortiGate record all traffic events, including denied packets, with details like source, destination, and policy ID. Security Logs (B) cover UTM events, Event Logs (C) system events, and System Logs (D) hardware or system status, not specifically denied traffic. Exact extract: "Traffic Logs record all packet activity, including allowed and denied traffic, with details such as source/destination IPs, ports, and the firewall policy applied."

In a FortiGate HA cluster (active-active or active-passive), if the primary unit fails, a secondary unit automatically takes over as the primary, ensuring continuity of traffic with minimal disruption. Option A is incorrect as traffic continues, C is incorrect as the mode doesn’t change post-failure, and D is unrelated. Exact extract: "In a FortiGate HA cluster, if the primary unit fails, a secondary unit is elected as the new primary, taking over all roles to maintain traffic flow and session continuity."

FortiGate operates on a default-deny principle; if a packet does not match any firewall policy, it is dropped to ensure security. No forwarding (A), IPS processing (C), or automatic allowing (D) occurs without a matching policy. Exact extract: "FortiGate uses a default-deny approach; packets that do not match any configured firewall policy are dropped to prevent unauthorized traffic."

The Fortinet Security Fabric provides a centralized management platform for multiple Fortinet devices (e.g., FortiGate, FortiSwitch, FortiAP), enabling coordinated security policies, telemetry sharing, and simplified administration. It does not directly speed up VPNs (B), reduce firewall policies (C), or auto-configure VLANs (D). Exact extract: "The Fortinet Security Fabric enables centralized management and visibility across Fortinet devices, allowing coordinated security policies and telemetry sharing for enhanced protection."

In OSPF, the Area Border Router (ABR) generates Type-4 Summary LSAs to advertise the location of an Autonomous System Boundary Router (ASBR) to other areas. This LSA informs routers in different areas how to reach the ASBR for external routes. ASBR generates Type-5 LSAs for external routes, but ABR summarizes them with Type-4. Not all routers or stub routers do this. Exact extract: This article describes the basic steps to configure FortiGates in an OSPF scenario where the FortiGates will be ABR and ASBR OSPF routers across 3 areas. Router3 is the Autonomous System Border Router (ASBR). It routes all traffic to the ISP BGP router for internet access. It redistributes routes from BGP and ... Type 4 LSAs exist to let the area know the router-id of the ASBR, so the routers can look at the type 5 route, find advertising-router, and map ... An ASBR summary LSA is generated by an ABR and describes the location of an ASBR (Autonomous System Boundary Router) that connects to an external network. The FortiGate in the middle shall be a ABR between the two areas. But I don't want R2 in area 0.0.0.0 to have every /32 route for every VPN client. So I tried ...

Typical Layer 2 switches support STP (Spanning Tree Protocol) to prevent loops in redundant networks and VLANs (Virtual Local Area Networks) to segment traffic logically. OSPF is a Layer 3 routing protocol typically on routers, and SIP is for VoIP session initiation, not core switch functions. FortiSwitch supports STP variants like MSTP and VLAN tagging. Exact extract: MSTP supports multiple spanning tree instances, where each instance carries traffic for one or more VLANs (the mapping of VLANs to instances is configurable). These protocols include the Spanning Tree Protocol (STP), Multiple Spanning Tree Protocol (MSTP), and Per-VLAN Rapid Spanning Tree Protocol ( ... FortiSwitch supports Spanning Tree Protocol (STP), Multiple Spanning Tree Protocol (MSTP), and Per-VLAN Rapid Spanning Tree Protocol (RSTP). Spanning Tree Protocol (STP) is a link-management protocol to enable a layer 2 loop-free topology. STP enables a network to have redundant paths for fault ... Go to WiFi & Switch Controller > FortiSwitch Ports. Click a port row. Click the Native VLAN column in one of the selected entries to change the native VLAN.

The ‘set webfilter-profile’ command applies a web filtering profile to a firewall policy, enabling URL blocking or allowing based on categories or specific URLs. It does not enable DPI (B), configure proxies (C), or set authentication (D). Exact extract: "The ‘set webfilter-profile’ command applies a web filtering profile to a firewall policy, controlling access to websites based on URL categories or specific URLs."

A stateful firewall, like FortiGate, tracks TCP sessions by maintaining a state table that includes TCP sequence numbers and flags (e.g., SYN, ACK, FIN) to monitor the connection's lifecycle (establishment, data transfer, termination). This ensures proper session handling, detecting out-of-order packets or invalid states. Source and destination ports identify the session but don’t control its state, and ACK numbers alone are insufficient. Exact extract: "Stateful inspection tracks TCP sessions using sequence numbers and TCP flags (SYN, ACK, FIN, etc.) to ensure packets are valid and part of an established session... FortiGate maintains a state table to monitor the TCP connection states."

When a FortiGate’s CPU enters conserve mode due to high load, proxy-based inspection (e.g., web filtering, DLP) is disabled to reduce resource usage, while flow-based inspection continues. Traffic isn’t fully blocked (A), new sessions may still be processed (C), and routing protocols (D) are unaffected. Exact extract: "In conserve mode, FortiGate disables proxy-based inspection to reduce CPU and memory load, switching to flow-based inspection to maintain performance."

The ‘diagnose debug flow’ command in FortiGate is used to troubleshoot how packets are processed through firewall policies, showing details like policy matching, NAT, and session handling. It helps identify why packets are allowed or dropped. Option A refers to packet sniffing, B to routing diagnostics, and D to performance monitoring, none of which are the primary function. Exact extract: "The diagnose debug flow command displays the packet flow through FortiGate, including policy matching, NAT, and session details, useful for troubleshooting traffic issues."

The TCP MSS (Maximum Segment Size) defines the maximum TCP payload size, excluding headers. When the firewall sets MSS to 1450 bytes, the TCP segment size is limited to this value. For IP packets, the total size includes the TCP header (20 bytes) and IP header (20 bytes), so 1450 (MSS) + 20 (TCP) + 20 (IP) = 1490 bytes, which fits within both link MTUs (1500 and 1496 bytes). Thus, the maximum IP packet size is not limited by the link MTUs but by the MSS, adjusted for headers. Options C and F (bits) are incorrect units; A and B exceed the MSS limit. Exact extract: "The TCP MSS is adjusted to prevent fragmentation... FortiGate can rewrite the MSS in TCP SYN packets to ensure the total IP packet size (including IP and TCP headers) does not exceed the configured value."