Question 76
Why must you use aggressive mode when a local FortiGate IPsec gateway hosts multiple dialup tunnels?
- The FortiGate is able to handle NATed connections only with aggressive mode.
- FortiClient supports aggressive mode.
- The remote peers are able to provide their peer IDs in the first message with aggressive mode.
- Main mode does not support XAuth for user authentication.
Question 77
An administrator has configured the following settings: What does the configuration do? (Choose two.)
- Reduces the amount of logs generated by denied traffic.
- Enforces device detection on all interfaces for 30 minutes.
- Blocks denied users for 30 minutes.
- Creates a session for traffic being denied.
Question 78
Which statements about FortiGate inspection modes are true? (Choose two.)
- The default inspection mode is proxy based.
- Switching from proxy-based mode to flow-based, then back to proxy-based mode, will not result in the original configuration.
- Proxy-based inspection is not available in VDOMs operating in transparent mode.
- Flow-based profiles must be manually converted to proxy-based profiles before changing the inspection mode from flow based to proxy based.
Question 79
Examine the following interface configuration on a FortiGate in transparent mode: Which statement about this configuration is correct?
- The FortiGate generates spanning tree BPDU frames.
- The FortiGate device forwards received spanning tree BPDU frames.
- The FortiGate can block an interface if a layer-2 loop is detected.
- Ethernet layer-2 loops are likely to occur.
Question 80
Examine this PAC file configuration. Which of the following statements are true? (Choose two.)
- Browsers can be configured to retrieve this PAC file from the FortiGate.
- Any web request to the 172.25.120.0/24 subnet is allowed to bypass the proxy.
- All requests not made to Fortinet.com or the 172.25.120.0/24 subnet, have to go through altproxy.corp.com: 8060.
- Any web request fortinet.com is allowed to bypass the proxy.