The eicar test virus is put into a zip archive, which is given the password of “Fortinet” in
order to open the archive. Review the configuration in the exhibits shown below; then
answer the question that follows. Exhibit A – Antivirus Profile: Exhibit B – Non-default UTM
Proxy Options Profile: Exhibit C – DLP Profile: Which of one the following profiles could be

enabled in order to prevent the file from passing through the FortiGate device over HTTP on
the standard port for that protocol?

With FSSO, a domain user could authenticate either against the domain controller running
the Collector Agent and Domain Controller Agent, or a domain controller running only the
Domain Controller Agent. If you attempt to authenticate with the Secondary Domain
Controller running only the Domain Controller Agent, which of the following statements are
correct? (Select all that apply.)

Select the answer that describes what the CLI command diag debug authd fsso list is used
for.

What are the requirements for a cluster to maintain TCP connections after device or link
failover? (Select all that apply.)

Two devices are in an HA cluster, the device hostnames are STUDENT and REMOTE.
Exhibit A shows the command output of ‘diag sys session stat’ for the STUDENT device.
Exhibit B shows the command output of ‘diag sys session stat’ for the REMOTE device.
Exhibit A: Exhibit B: Given the information provided in the exhibits, which of the following
statements are correct? (Select all that apply.)

Which of the following statements are correct about the HA diag command diagnose sys ha
resetuptime? (Select all that apply.)

In HA, the option Reserve Management Port for Cluster Member is selected as shown in the
Exhibit below. Which of the following statements are correct regarding this setting? (Select
all that apply.)

In HA, what is the effect of the Disconnect Cluster Member command as given in the
Exhibit?

Two FortiGate devices fail to form an HA cluster, the device hostnames are STUDENT and
REMOTE. Exhibit A shows the command output of ‘show system ha’ for the STUDENT
device. Exhibit B shows the command output of ‘show system ha’ for the REMOTE device.
Exhibit A: Exhibit B Which one of the following is the most likely reason that the cluster fails
to form?

Examine the following log message for IPS and identify the valid responses below. (Select
all that apply.) 2012-07-01 09:54:28 oid=2 log_id=18433 type=ips subtype=anomaly
pri=alert vd=root severity=”critical” src=”192.168.3.168″ dst=”192.168.3.170″ src_int=”port2″
serial=0 status=”detected” proto=1 service=”icmp” count=1 attack_name=”icmp_flood”
icmp_id=”0xa8a4″ icmp_type=”0x08″ icmp_code=”0x00″ attack_id=16777316 sensor=”1″
ref=”http://www.fortinet.com/ids/VID16777316″ msg=”anomaly: icmp_flood, 51 > threshold
50″