Fortinet Certified Network Security Professional (FCNSP v4.2) Sample Questions:

1. Data Leak Prevention archiving gives the ability to store files and message data onto a FortiAnalyzer unit for which of the following types of network traffic? (Select all that apply.)

A) SNMP
B) SMTP
C) HTTP
D) IPSec
E) POP3

2. Which of the following is an advantage of using SNMP v3 instead of SNMP v1/v2 when querying the FortiGate unit?

A) Running SNMP service on a non-standard port is possible
B) SNMP access limits through access lists
C) MIB-based report uploads
D) Packet encryption

3. Examine the Exhibit shown below; then answer the question following it.

In this scenario, the Fortigate unit in Ottawa has the following routing table: S* 0.0.0.0/0 [10/0] via 172.20.170.254, port2 C 172.20.167.0/24 is directly connected, port1 C 172.20.170.0/24 is directly connected, port2
Sniffer tests show that packets sent from the Source IP address 172.20.168.2 to the Destination IP address 172.20.169.2 are being dropped by the FortiGate unit located in Ottawa. Which of the following correctly describes the cause for the dropped packets?

A) The subnet 172.20.169.0/24 is NOT in the Ottawa FortiGate unit's routing table.
B) The destination workstation 172.20.169.2 does NOT have the subnet 172.20.168.0/24 in its routing table.
C) The forward policy check.
D) The reverse path forwarding check.

4. An administrator configures a VPN and selects the Enable IPSec Interface Mode option in the phase 1 settings.
Which of the following statements are correct regarding the IPSec VPN configuration?

A) To complete the VPN configuration, the administrator must manually create a virtual IPSec interface in Web Config under System > Network.
B) The IPSec policies must be placed at the top of the list.
C) This VPN cannot be used as part of a hub and spoke topology.
D) Routes were automatically created based on the address objects in the firewall policies.
E) The virtual IPSec interface is automatically created after the phase1 configuration.

5. An administrator has formed a High Availability cluster involving two FortiGate 310B units.
[Multiple upstream Layer 2 switches] -- [ FortiGate HA Cluster ] -- [ Multiple downstream Layer 2 switches ]
The administrator wishes to ensure that a single link failure will have minimal impact upon the overall throughput of traffic through this cluster.
Which of the following options describes the best step the administrator can take?
The administrator should...

A) increase the number of FortiGate units in the cluster and configure HA in Active-Active mode.
B) enable monitoring of all active interfaces.
C) set up a full-mesh design which uses redundant interfaces.
D) configure the HA ping server feature to allow for HA failover in the event that a path is disrupted.

Solutions: