NSE5 Exam - Fortinet Network Security Expert 5 Written Exam (500)

certleader.com

Q1. - (Topic 2) 

Which of the following statements are correct about the HA diag command diagnose sys ha reset-uptime? (Select all that apply.) 

A. The device this command is executed on is likely to switch from master to slave status if master override is disabled. 

B. The device this command is executed on is likely to switch from master to slave status if master override is enabled. 

C. This command has no impact on the HA algorithm. 

D. This command resets the uptime variable used in the HA algorithm so it may cause a new master to become elected. 

Answer: A,D 

Q2. - (Topic 1) 

The default administrator profile that is assigned to the default "admin" user on a FortGate device is:____________________. 

A. trusted-admin 

B. super_admin 

C. super_user 

D. admin 

E. fortinet-root 

Answer:

Q3. - (Topic 3) 

An administrator is examining the attack logs and notices the following entry: 

device_id=FG100A3907508962 log_id=18432 subtype=anomaly type=ips timestamp=1270017358 pri=alert itime=1270017893 severity=critical src=192.168.1.52 dst=64.64.64.64 src_int=internal serial=0 status=clear_session proto=6 service=http vd=root count=1 src_port=35094 dst_port=80 attack_id=100663402 sensor=protect-servers ref=http://www.fortinet.com/ids/VID100663402 msg="anomaly: tcp_src_session, 2 > threshold 1" policyid=0 carrier_ep=N/A profile=N/A dst_int=N/A user=N/A group=N/A 

Based solely upon this log message, which of the following statements is correct? 

A. This attack was blocked by the HTTP protocol decoder. 

B. This attack was caught by the DoS sensor "protect-servers". 

C. This attack was launched against the FortiGate unit itself rather than a host behind the FortiGate unit. 

D. The number of concurrent connections to destination IP address 64.64.64.64 has exceeded the configured threshold. 

Answer:

Q4. - (Topic 3) 

When configuring a server load balanced virtual IP, which of the following is the best distribution algorithm to be used in applications where the same physical destination server must be maintained between sessions? 

A. Static 

B. Round robin 

C. Weighted round robin 

D. Least connected 

Answer:

Q5. - (Topic 3) 

Which of the following statements best decribes the proxy behavior on a FortiGate unit during an FTP client upload when FTP splice is disabled? 

A. The proxy buffers the entire file from the client, only sending the file to the server if the file is clean. One possible consequence of buffering is that the server could time out. 

B. The proxy sends the file to the server while simultaneously buffering it. 

C. The proxy removes the infected file from the server by sending a delete command on behalf of the client. 

D. If the file being scanned is determined to be clean, the proxy terminates the connection and leaves the file on the server. 

Answer:

Q6. - (Topic 1) 

Which Fortinet products & features could be considered part of a comprehensive solution to monitor and prevent the leakage of senstive data? (Select all that apply.) 

A. Archive non-compliant outgoing e-mails using FortiMail. 

B. Restrict unofficial methods of transferring files such as P2P using Application Control lists on a FortiGate. 

C. Monitor database activity using FortiAnalyzer. 

D. Apply a DLP sensor to a firewall policy. 

E. Configure FortiClient to prevent files flagged as sensitive from being copied to a USB disk. 

Answer: A,B,D 

Q7. - (Topic 2) 

Which of the following statements are correct regarding Application Control? 

A. Application Control is based on the IPS engine. 

B. Application Control is based on the AV engine. 

C. Application Control can be applied to SSL encrypted traffic. 

D. Application Control cannot be applied to SSL encrypted traffic. 

Answer: A,C 

Q8. - (Topic 1) 

Each UTM feature has configurable UTM objects such as sensors, profiles or lists that define how the feature will function. How are UTM features applied to traffic? 

A. One or more UTM features are enabled in a firewall policy. 

B. In the system configuration for that UTM feature, you can identify the policies to which the feature is to be applied. 

C. Enable the appropriate UTM objects and identify one of them as the default. 

D. For each UTM object, identify which policy will use it. 

Answer:

Q9. - (Topic 1) 

The ordering of firewall policies is very important. Policies can be re-ordered within the FortiGate unit’s GUI and also using the CLI. The command used in the CLI to perform this function is ______ . 

A. set order 

B. edit policy 

C. reorder 

D. move 

Answer:

Q10. - (Topic 3) 

The Host Check feature can be enabled on the FortiGate unit for SSL VPN connections. 

When this feature is enabled, the FortiGate unit probes the remote host computer to verify that it is "safe" before access is granted. 

Which of the following items is NOT an option as part of the Host Check feature? 

A. FortiClient Antivirus software 

B. Microsoft Windows Firewall software 

C. FortiClient Firewall software 

D. Third-party Antivirus software 

Answer: