What Printable NSE5 exam Is?

Q1. - (Topic 1) 

If a FortiGate unit has a dmz interface IP address of 210.192.168.2 with a subnet mask of 255.255.255.0, what is a valid dmz DHCP addressing range? 

A. 172.168.0.1 - 172.168.0.10 

B. 210.192.168.3 - 210.192.168.10 

C. 210.192.168.1 - 210.192.168.4 

D. All of the above. 

View Answer

Q2. - (Topic 1) 

Which of the following statements are correct regarding logging to memory on a FortiGate unit? (Select all that apply.) 

A. When the system has reached its capacity for log messages, the FortiGate unit will stop logging to memory. 

B. When the system has reached its capacity for log messages, the FortiGate unit overwrites the oldest messages. 

C. If the FortiGate unit is reset or loses power, log entries captured to memory will be lost. 

D. None of the above. 

View Answer

Q3. - (Topic 2) 

In HA, the option Reserve Management Port for Cluster Member is selected as shown in the Exhibit below. 

Which of the following statements are correct regarding this setting? (Select all that apply.) 

A. Interface settings on port7 will not be synchronized with other cluster members. 

B. The IP address assigned to this interface must not overlap with the IP address subnet assigned to another interface. 

C. Port7 appears in the routing table. 

D. A gateway address may be configured for port7. 

E. When connecting to port7 you always connect to the master device. 

View Answer

Q4. - (Topic 1) 

Users may require access to a web site that is blocked by a policy. Administrators can give users the ability to override the block. Which of the following statements regarding overrides are correct? (Select all that apply.) 

A. A protection profile may have only one user group defined as an override group. 

B. A firewall user group can be used to provide override privileges for FortiGuard Web Filtering. 

C. Authentication to allow the override is based on a user's membership in a user group. 

D. Overrides can be allowed by the administrator for a specific period of time. 

View Answer

Q5. - (Topic 3) 

Which of the following Session TTL values will take precedence? 

A. Session TTL specified at the system level for that port number 

B. Session TTL specified in the matching firewall policy 

C. Session TTL dictated by the application control list associated with the matching firewall policy 

D. The default session TTL specified at the system level 

View Answer

Q6. - (Topic 3) 

An administrator configures a VPN and selects the Enable IPSec Interface Mode option in the phase 1 settings. 

Which of the following statements are correct regarding the IPSec VPN configuration? 

A. To complete the VPN configuration, the administrator must manually create a virtual IPSec interface in Web Config under System > Network. 

B. The virtual IPSec interface is automatically created after the phase1 configuration. 

C. The IPSec policies must be placed at the top of the list. 

D. This VPN cannot be used as part of a hub and spoke topology. 

E. Routes were automatically created based on the address objects in the firewall policies. 

View Answer

Q7. - (Topic 1) 

Because changing the operational mode to Transparent resets device (or vdom) to all defaults, which precautions should an Administrator take prior to performing this? (Select all that apply.) 

A. Backup the configuration. 

B. Disconnect redundant cables to ensure the topology will not contain layer 2 loops. 

C. Set the unit to factory defaults. 

D. Update IPS and AV files. 

View Answer

Q8. - (Topic 3) 

Which of the following represents the method used on a FortiGate unit running FortiOS version 4.2 to apply traffic shaping to P2P traffic, such as BitTorrent? 

A. Apply a Traffic Shaper to a BitTorrent entry in an Application Control List. 

B. Enable the Shape option in a Firewall policy with a Service set to BitTorrent. 

C. Define a DLP Rule to match against BitTorrent traffic and include the rule in a DLP Sensor with Traffic Shaping enabled. 

D. Specify the amount of Rate Limiting to be applied to BitTorrent traffic through the P2P settings of the Firewall Policy Protocol Options. 

View Answer

Q9. - (Topic 2) 

What are the requirements for a cluster to maintain TCP connections after device or link failover? (Select all that apply.) 

A. Enable session pick-up. 

B. Only applies to connections handled by a proxy. 

C. Only applies to UDP and ICMP connections. 

D. Connections must not be handled by a proxy. 

View Answer

Q10. - (Topic 1) 

An issue could potentially occur when clicking Connect to start tunnel mode SSL VPN. The tunnel will start up for a few seconds, then shut down. 

Which of the following statements best describes how to resolve this issue? 

A. This user does not have permission to enable tunnel mode. Make sure that the tunnel mode widget has been added to that user's web portal. 

B. This FortiGate unit may have multiple Internet connections. To avoid this problem, use the appropriate CLI command to bind the SSL VPN connection to the original incoming interface. 

C. Check the SSL adaptor on the host machine. If necessary, uninstall and reinstall the adaptor from the tunnel mode portal. 

D. Make sure that only Internet Explorer is used. All other browsers are unsupported. 

View Answer