EMEA-Advanced-Support Fortinet EMEA Advanced Support Exam Questions and Answers

TCP is a unicast, connection-oriented protocol that ensures reliable data delivery between two endpoints using sequence numbers and acknowledgments. Multicast, which sends data to multiple recipients, is supported by UDP, not TCP, due to TCP’s requirement for a direct connection. Fortinet devices handle multicast traffic via UDP-based protocols like IGMP or PIM. Exact extract: "TCP is a unicast protocol that establishes a reliable connection between two devices... Multicast traffic, such as streaming or group communications, relies on UDP, as TCP does not support multicast delivery."

PAP (Password Authentication Protocol) sends username and password in clear text over the network, making it insecure. CHAP uses challenge-response with hash, MSCHAP is Microsoft variant with hash, EAP is extensible and can use various methods but not inherently clear text. Exact extract: It's "impossible" to authenticate wireless users based on EAP-PEAP sessions agains OpenLdap, except, if the users using clear text authetication methods (PAP). Clear text HTTP authentication is not secure. All user names and data (and, depending on the authentication style, passwords) are sent in clear text. If you ... Fortinet ... Password Authentication Protocol (PAP). Used to authenticate PPP connections. Transmits passwords and other user information in clear text. The default token page contains a "Token Code:" text field. Recommended customization. It's recommended to delete the "Token Code:" text. FortiWeb will use ... If you follow the configuration guide for NPS you'll see (step 9) you need to enable "Unencrypted authentication (PAP, SPAP)" (link below).

FortiGate’s SSL Inspection feature decrypts and inspects SSL/TLS traffic to detect threats or enforce policies, using techniques like full SSL inspection or certificate inspection. Deep Packet Inspection (A) is a broader term, Application Control (C) identifies apps, and Web Filtering (D) blocks URLs, not specific to SSL. Exact extract: "SSL Inspection allows FortiGate to decrypt and inspect SSL/TLS traffic to detect hidden threats or enforce security policies, supporting full or certificate-based inspection."

The ‘get router info routing-table all’ command displays the FortiGate’s current routing table, including all active routes and their details. Options B, C, and D are not valid or specific for this purpose. Exact extract: "Use ‘get router info routing-table all’ to display the complete routing table, showing destination, gateway, interface, and metric for all routes."

The ‘diagnose vpn tunnel list’ command on FortiGate displays detailed status information about IPsec VPN tunnels, including phase 1 and phase 2 states, uptime, and traffic statistics. Options B, C, and D are not valid FortiGate commands for this purpose. Exact extract: "Use diagnose vpn tunnel list to view the status of IPsec VPN tunnels, including phase 1 and phase 2 details, such as SA status, uptime, and traffic counters."

VMotion in VMware vSphere enables live migration of running virtual machines from one physical server to another with zero downtime, ensuring continuous operation. Fortinet’s FortiGate-VM supports such environments. Options A, C, and D are incorrect as they do not describe VMotion; C refers to a different migration scenario, and D is unrelated to virtualization. Exact extract: "VMotion allows the live migration of a running virtual machine from one physical server to another with no downtime... This ensures workloads continue running during server maintenance or load balancing."

Link aggregation, also known as IEEE 802.3ad or 802.1ax, enables the binding of multiple physical interfaces to form a single logical interface, which increases the overall bandwidth and provides redundancy. This is achieved by combining the bandwidth of the individual links into one aggregated link. For example, if two 1Gbps interfaces are aggregated, the logical link can provide up to 2Gbps bandwidth. This configuration is commonly used in FortiGate devices to enhance network performance without replacing hardware. The option B correctly describes this by stating "Increase bandwidth by binding physical interfaces into a single channel," which aligns with the official description. Incorrect options include A, which is vague and does not specify the method of binding multiple interfaces; C, which is the opposite of the purpose; and D, which is invalid. Exact extract: Link aggregation (IEEE 802.3ad/802.1ax) enables you to bind two or more physical interfaces together to form an aggregated (combined) link. This new link ... Link aggregation combines multiple physical interfaces into a single logical interface, increasing bandwidth and link redundancy. Traffic is distributed evenly.

BGP path selection follows a specific order of attributes to determine the best path. The process prefers the path with the highest local preference first, as it is one of the earliest steps in the decision process. Local preference is used within an AS to influence outbound traffic. Only if local preferences are equal does it move to the next criteria, such as shortest AS path. The AS path length is considered after local preference, MED after that, and eBGP over iBGP even later. Therefore, among the options, the highest local preference (D) is the most preferred criterion. The original document's answer B is incorrect based on standard BGP selection rules implemented in Fortinet. Exact extract: This article describes the BGP route selection process. Scope FortiGate. Solution Consider only routes with no AS loops and a valid next hop. BGP makes routing decisions based on path, network policies and rulesets ... select the route with the lowest router ID as the best path. Network. Type. To achieve this, multiple route selection techniques can be used. Some are protocol-agnostic (for example, weight) and others are protocol-specific (for example ...).

Stateful inspection requires a complete TCP three-way handshake (SYN, SYN-ACK, ACK) to establish a session in the firewall’s state table. If the handshake is incomplete (e.g., missing ACK), the session is not established, and traffic is dropped. The question implies a stateful firewall scenario where traffic is blocked, likely due to an incomplete handshake. Asymmetric traffic (B) or incorrect ACK (A) are not indicated without further context, and C is incorrect if the handshake fails. Exact extract: "Stateful inspection ensures that a TCP three-way handshake is completed before allowing traffic... If the handshake is not completed, FortiGate drops the packets as invalid."

When a FortiGate’s CPU enters conserve mode due to high load, proxy-based inspection (e.g., web filtering, DLP) is disabled to reduce resource usage, while flow-based inspection continues. Traffic isn’t fully blocked (A), new sessions may still be processed (C), and routing protocols (D) are unaffected. Exact extract: "In conserve mode, FortiGate disables proxy-based inspection to reduce CPU and memory load, switching to flow-based inspection to maintain performance."

IPS efficiency is improved by: A) Compiling signatures into a decision tree to reduce comparison overhead; B) Using IPS sensors/filters to selectively apply signatures to relevant traffic, reducing unnecessary processing; D) Using a regular database instead of an extended one to lower memory usage. Option C’s “Turbo” and round-robin load balancing is not a standard Fortinet IPS feature. Option E is incorrect as C is not valid. Exact extract: "IPS efficiency is improved by compiling signatures into decision trees to minimize CPU usage... IPS sensors and filters allow selective signature application to reduce processing... Using the regular signature database instead of extended reduces memory footprint."

FortiGate’s SD-WAN feature enables load balancing and intelligent traffic steering across multiple WAN links based on criteria like bandwidth, latency, or application. Link Aggregation (B) bonds interfaces, Virtual Routing (C) is VRF, and Multi-Path Routing (D) is not a standard term. Exact extract: "SD-WAN enables load balancing and traffic steering across multiple WAN links, optimizing performance and reliability based on configured rules and metrics."