Latest Fortinet EMEA-Advanced-Support PDF and Dumps (2026) Free Exam Questions Answers
Pass Your Fortinet NSE EMEA-Advanced-Support Exam on Mar 07, 2026 with 52 Questions
NEW QUESTION # 26
Which Router in an OSPF Domain sends a Type-4 Summary LSA
- A. Stub Routers only
- B. ABR
- C. ASBR
- D. All OSPF Routers
Answer: B
Explanation:
In OSPF, the Area Border Router (ABR) generates Type-4 Summary LSAs to advertise the location of an Autonomous System Boundary Router (ASBR) to other areas. This LSA informs routers in different areas how to reach the ASBR for external routes. ASBR generates Type-5 LSAs for external routes, but ABR summarizes them with Type-4. Not all routers or stub routers do this. Exact extract: This article describes the basic steps to configure FortiGates in an OSPF scenario where the FortiGates will be ABR and ASBR OSPF routers across 3 areas. Router3 is the Autonomous System Border Router (ASBR). It routes all traffic to the ISP BGP router for internet access. It redistributes routes from BGP and ... Type 4 LSAs exist to let the area know the router-id of the ASBR, so the routers can look at the type 5 route, find advertising-router, and map
... An ASBR summary LSA is generated by an ABR and describes the location of an ASBR (Autonomous System Boundary Router) that connects to an external network. The FortiGate in the middle shall be a ABR between the two areas. But I don't want R2 in area 0.0.0.0 to have every /32 route for every VPN client. So I tried ...
NEW QUESTION # 27
In FortiGate, what is the purpose of a Virtual IP (VIP)?
- A. To assign a secondary IP to a physical interface
- B. To map an external IP to an internal IP for NAT
- C. To create a virtual interface for VLANs
- D. To enable load balancing for VPN tunnels
Answer: B
Explanation:
A Virtual IP (VIP) in FortiGate maps an external IP address to an internal IP for Destination NAT (DNAT), commonly used for accessing internal servers from external networks. It is not for VLANs (B), secondary IPs (C), or VPN load balancing (D). Exact extract: "Virtual IPs (VIPs) are used for Destination NAT, mapping an external IP address to an internal IP to allow external access to internal resources, such as servers."
NEW QUESTION # 28
Link aggregation allows network devices to________
- A. None of the above
- B. Increase bandwidth by binding physical interfaces into a single channel
- C. Increase bandwidth of an interface
- D. Restrict the bandwidth
Answer: B
Explanation:
Link aggregation, also known as IEEE 802.3ad or 802.1ax, enables the binding of multiple physical interfaces to form a single logical interface, which increases the overall bandwidth and provides redundancy. This is achieved by combining the bandwidth of the individual links into one aggregated link. For example, if two
1Gbps interfaces are aggregated, the logical link can provide up to 2Gbps bandwidth. This configuration is commonly used in FortiGate devices to enhance network performance without replacing hardware. The option B correctly describes this by stating "Increase bandwidth by binding physical interfaces into a single channel," which aligns with the official description. Incorrect options include A, which is vague and does not specify the method of binding multiple interfaces; C, which is the opposite of the purpose; and D, which is invalid.
Exact extract: Link aggregation (IEEE 802.3ad/802.1ax) enables you to bind two or more physical interfaces together to form an aggregated (combined) link. This new link ... Link aggregation combines multiple physical interfaces into a single logical interface, increasing bandwidth and link redundancy. Traffic is distributed evenly.
NEW QUESTION # 29
What is the role of the FortiGate 'set srcintf' command in a firewall policy?
- A. Specifies the source interface for traffic matching
- B. Sets the source IP address range
- C. Configures the source NAT interface
- D. Defines the destination interface for traffic
Answer: A
Explanation:
The 'set srcintf' command in a FortiGate firewall policy specifies the source interface from which traffic originates, helping define the policy's scope. It does not set the destination interface (B), source IP range (C), or NAT interface (D). Exact extract: "The 'set srcintf' command in a firewall policy specifies the source interface for incoming traffic, allowing FortiGate to match packets based on their entry interface."
NEW QUESTION # 30
Which FortiGate feature mitigates DDoS attacks by limiting the rate of incoming connections?
- A. Application Control
- B. IPS Signature
- C. DoS Policy
- D. Web Filtering
Answer: C
Explanation:
FortiGate's DoS (Denial of Service) Policy limits the rate of incoming connections or packets to mitigate DDoS attacks, such as SYN floods, by setting thresholds for specific traffic types. IPS Signatures (B) detect specific attack patterns, Application Control (C) manages app usage, and Web Filtering (D) blocks URLs, none of which focus on rate limiting. Exact extract: "DoS policies protect against DDoS attacks by limiting the rate of incoming connections or packets, such as SYN floods, based on configured thresholds."
NEW QUESTION # 31
What is the default FortiGate behavior when a packet matches no firewall policy?
- A. The packet is logged and allowed
- B. The packet is forwarded to the default gateway
- C. The packet is sent to the IPS engine
- D. The packet is dropped
Answer: D
Explanation:
FortiGate operates on a default-deny principle; if a packet does not match any firewall policy, it is dropped to ensure security. No forwarding (A), IPS processing (C), or automatic allowing (D) occurs without a matching policy. Exact extract: "FortiGate uses a default-deny approach; packets that do not match any configured firewall policy are dropped to prevent unauthorized traffic."
NEW QUESTION # 32
Client is connected to firewall via link with MTU 1500 bytes, server is connected to firewall via link with MTU 1496 bytes. The firewall is rewriting both sender and receiver tcp-mss to 1450 bytes. What maximum size of IP packets are we going to see when client connects to server?
- A. 1496 bytes
- B. 1450 bytes
- C. 1450 bits
- D. 1500 bits
- E. 1496 bits
- F. 1500 bytes
Answer: B
Explanation:
The TCP MSS (Maximum Segment Size) defines the maximum TCP payload size, excluding headers. When the firewall sets MSS to 1450 bytes, the TCP segment size is limited to this value. For IP packets, the total size includes the TCP header (20 bytes) and IP header (20 bytes), so 1450 (MSS) + 20 (TCP) + 20 (IP) = 1490 bytes, which fits within both link MTUs (1500 and 1496 bytes). Thus, the maximum IP packet size is not limited by the link MTUs but by the MSS, adjusted for headers. Options C and F (bits) are incorrect units; A and B exceed the MSS limit. Exact extract: "The TCP MSS is adjusted to prevent fragmentation... FortiGate can rewrite the MSS in TCP SYN packets to ensure the total IP packet size (including IP and TCP headers) does not exceed the configured value."
NEW QUESTION # 33
Which of the following protocols would you expect a typical switch to support?
- A. OSPF
- B. VLAN
- C. STP
- D. SIP
Answer: B,C
Explanation:
Typical Layer 2 switches support STP (Spanning Tree Protocol) to prevent loops in redundant networks and VLANs (Virtual Local Area Networks) to segment traffic logically. OSPF is a Layer 3 routing protocol typically on routers, and SIP is for VoIP session initiation, not core switch functions. FortiSwitch supports STP variants like MSTP and VLAN tagging. Exact extract: MSTP supports multiple spanning tree instances, where each instance carries traffic for one or more VLANs (the mapping of VLANs to instances is configurable). These protocols include the Spanning Tree Protocol (STP), Multiple Spanning Tree Protocol (MSTP), and Per-VLAN Rapid Spanning Tree Protocol ( ... FortiSwitch supports Spanning Tree Protocol (STP), Multiple Spanning Tree Protocol (MSTP), and Per-VLAN Rapid Spanning Tree Protocol (RSTP).
Spanning Tree Protocol (STP) is a link-management protocol to enable a layer 2 loop-free topology. STP enables a network to have redundant paths for fault ... Go to WiFi & Switch Controller > FortiSwitch Ports.
Click a port row. Click the Native VLAN column in one of the selected entries to change the native VLAN.
NEW QUESTION # 34
A firewall receives an out-of-order packet in a TCP session after the FIN/ACK and the packet is dropped as expected. What parameter can be changed to prevent such drops?
- A. TCP time-wait timer
- B. Enable TCP option
- C. TCP close-wait timer
- D. TCPMSS
Answer: A
Explanation:
Out-of-order packets after FIN/ACK indicate a packet arriving in the TIME_WAIT state, where the session is closing. The TCP time-wait timer controls how long the firewall keeps the session in the TIME_WAIT state to handle late packets. Increasing this timer allows the firewall to accept such packets instead of dropping them. Close-wait timer relates to a different state, TCPMSS affects packet size, and "Enable TCP option" is not a standard parameter. Exact extract: "The TCP time-wait timer determines how long a session remains in the TIME_WAIT state to handle out-of-order or retransmitted packets after FIN/ACK... Adjusting this timer can prevent drops of late-arriving packets."
NEW QUESTION # 35
What are the advantages of using a hub-and-spoke IPSec VPN configuration instead of a fully-meshed set of IPSec tunnels? (Select all that apply below)
- A. Using a hub and spoke topology provides stronger encryption.
- B. Using a hub and spoke topology is required to achieve full redundancy.
- C. The routing table management is simpler because of fewer routes compared to a fully meshed node.
- D. Using a hub and spoke topology simplifies configuration because fewer tunnels are required.
Answer: C,D
Explanation:
Hub-and-spoke IPsec VPN reduces the number of tunnels needed (one per spoke to hub instead of n(n-1)/2 in full mesh), simplifying configuration and routing tables with summarized routes at the hub. It does not inherently provide stronger encryption or require for redundancy (though can be made redundant). Exact extract: I want to have a way to quickly (preferably automated) setup VPN's to my 2 hubs from each spoke.
However we do not want/need VPNs between spokes. Hub Configuration: Configure the FortiGate unit as the hub. Set up IPsec VPN tunnels for each spoke. Use preshared keys for authentication. The purpose of this document is to describe the requirements and general information for building a Hub & Spoke architecture using FortiGate-VM on Oracle Cloud ... The remote sites do not need to have connectivity to each other nor does the customer want them to have connectivity to each other. Given these ... This article gives a brief configuration example from one spoke to other spoke using IPsec, through the Hub firewall.
NEW QUESTION # 36
Hybrid cloud means that
- A. Some of the customer's systems are virtualized in the public cloud and some are in the local datacenter
- B. One customer uses VMs with multiple different operating systems in the same cloud account
- C. The cloud provider uses AMD, Intel and possibly also other CPU vendors
- D. Cloud provider provides both 32-bit and 64-bit virtual machines
Answer: A
Explanation:
A hybrid cloud combines on-premises infrastructure (local datacenter) with public cloud resources, allowing workloads to operate across both environments for flexibility and scalability. Fortinet solutions like FortiGate- VM support hybrid cloud deployments. Option A refers to hardware diversity, C to OS variety, and D to architecture types, none of which define hybrid cloud. Exact extract: "Hybrid cloud is the combination of public cloud services with an on-premises private cloud or datacenter... This allows customers to run some systems in the public cloud and others in their local datacenter, managed seamlessly."
NEW QUESTION # 37
Which of the following are request methods in HTTP?
- A. LIST
- B. GET
- C. RETR
- D. HEAD
Answer: B,D
Explanation:
HTTP defines standard request methods, including GET (retrieve a resource) and HEAD (retrieve headers only). LIST and RETR are not standard HTTP methods; RETR is used in FTP, and LIST is not a recognized method in either protocol. The original document incorrectly lists only A, omitting C. Exact extract: "HTTP supports several request methods, including GET, HEAD, POST, PUT, DELETE, etc... GET retrieves a resource, while HEAD retrieves only the headers without the body content."
NEW QUESTION # 38
What happens when a FortiGate detects a SYN flood attack?
- A. It drops all incoming packets
- B. It applies rate limiting to SYN packets
- C. It redirects traffic to a backup gateway
- D. It enables proxy-based inspection
Answer: B
Explanation:
When FortiGate detects a SYN flood attack, it applies rate limiting to SYN packets via a DoS policy, dropping excessive packets to mitigate the attack. It does not drop all packets (A), enable proxy inspection (B), or redirect traffic (D). Exact extract: "FortiGate mitigates SYN flood attacks using DoS policies, which apply rate limiting to SYN packets to prevent overwhelming the system."
NEW QUESTION # 39
Which FortiGate log type records denied traffic events?
- A. Traffic Log
- B. Security Log
- C. Event Log
- D. System Log
Answer: A
Explanation:
Traffic Logs in FortiGate record all traffic events, including denied packets, with details like source, destination, and policy ID. Security Logs (B) cover UTM events, Event Logs (C) system events, and System Logs (D) hardware or system status, not specifically denied traffic. Exact extract: "Traffic Logs record all packet activity, including allowed and denied traffic, with details such as source/destination IPs, ports, and the firewall policy applied."
NEW QUESTION # 40
Which protocol is used by FortiGate to synchronize session tables in an HA cluster?
- A. FGCP
- B. VRRP
- C. OSPF
- D. BGP
Answer: A
Explanation:
The FortiGate Cluster Protocol (FGCP) is used to synchronize session tables, configuration, and state information between HA cluster members to ensure seamless failover. VRRP (B) is for router redundancy, OSPF (C) and BGP (D) are routing protocols, not used for HA synchronization. Exact extract: "FGCP synchronizes session tables, configurations, and state information between FortiGate HA cluster members to ensure continuity during failover."
NEW QUESTION # 41
What happens when a FortiGate's CPU enters conserve mode?
- A. All traffic is blocked
- B. New sessions are dropped
- C. Routing protocols are disabled
- D. Proxy-based inspection is disabled
Answer: D
Explanation:
When a FortiGate's CPU enters conserve mode due to high load, proxy-based inspection (e.g., web filtering, DLP) is disabled to reduce resource usage, while flow-based inspection continues. Traffic isn't fully blocked (A), new sessions may still be processed (C), and routing protocols (D) are unaffected. Exact extract: "In conserve mode, FortiGate disables proxy-based inspection to reduce CPU and memory load, switching to flow-based inspection to maintain performance."
NEW QUESTION # 42
......
EMEA-Advanced-Support Dumps for Fortinet NSE Certified Exam Questions and Answer: https://pass4sure.dumps4pdf.com/EMEA-Advanced-Support-valid-braindumps.html