Fortinet FCNSP.v5 Actual Tests : Fortinet Certified Network Security Professional (FCNSP.v5)

Which of the following statements is correct about how the FortiGate unit verifies username and password during user authentication?

• A. If authentication fails with a local password, the FortiGate unit will query the authentication server if the local user is configured with both a local password and an authentication server.
• B. If a remote server is included in a user group, it will be checked before local accounts.
• C. The FortiGate unit will only attempt to authenticate against Active Directory if Fortinet Server Authentication Extensions are installed and configured.
• D. An administrator can define a local account for which the password must be verified by querying a remote server.

A FortiClient fails to establish a VPN tunnel with a FortiGate unit.
The following information is displayed in the FortiGate unit logs:
msg="Initiator: sent 192.168.11.101 main mode message #1 (OK)"
msg="Initiator: sent 192.168.11.101 main mode message #2 (OK)"
msg="Initiator: sent 192.168.11.101 main mode message #3 (OK)"
msg="Initiator: parsed 192.168.11.101 main mode message #3 (DONE)"
msg="Initiator: sent 192.168.11.101 quick mode message #1 (OK)"
msg="Initiator: tunnel 192.168.1.1/192.168.11.101 install ipsec sa"
msg="Initiator: sent 192.168.11.101 quick mode message #2 (DONE)"
msg="Initiator: tunnel 192.168.11.101, transform=ESP_3DES, HMAC_MD5" msg="Failed to acquire an IP address
Which of the following statements is a possible cause for the failure to establish the VPN tunnel?

• A. An IPSec DHCP server is not enabled on the external interface of the FortiGate unit.
• B. The phase 1 configuration on the FortiGate unit uses Aggressive mode while FortiClient uses Main mode.
• C. There is no IPSec firewall policy configured for the policy-based VPN.
• D. There is a mismatch between the FortiGate unit and the FortiClient IP addresses in the phase 2 settings.

What advantages are there in using a fully Meshed IPSec VPN configuration instead of a hub and spoke set of IPSec tunnels?

• A. Using a full mesh topology provides stronger encryption.
• B. Full mesh topology is the most fault-tolerant configuration.
• C. Using a hub and spoke topology is required to achieve full redundancy.
• D. Using a full mesh topology simplifies configuration.

A DLP rule with an action of Exempt has been matched against traffic passing through the FortiGate unit. Which of the following statements is correct regarding how this transaction will be handled by the FortiGate unit?

• A. Future files whose characteristics match this file will bypass DLP scanning.
• B. Any other matched DLP rules will be ignored with the exception of Archiving.
• C. The traffic matching the DLP rule will bypass antivirus scanning.
• D. The client IP address will be added to a white list.

A firewall policy has been configured for the internal email server to receive email from external parties through SMTP. Exhibits A and B show the AntiVirus and Email Filter profiles applied to this policy.

What is the correct behavior when the email attachment is detected as a virus by the FortiGate AntiVirus engine?

• A. The FortiGate unit will remove the infected file and deliver the email with a replacement message to alert the recipient that the original attachment was infected.
• B. The FortiGate unit will remove the infected file and add a replacement message. Both sender and recipient are notified that the infected file has been removed.
• C. The FortiGate unit will reject the infected email and notify both the sender and recipient.
• D. The FortiGate unit will reject the infected email and notify the sender.