[2026] Fortinet Network Security Expert 5 Written Exam (500)

문제1

Which ports are commonly used by FortiManager? (Choose two.)

A. TCP 5199 HA heartbeat or synchronization (FortiManager HA cluster).

B. TCP 541 for remote management of a FortiGate unit.

C. TCP 703 HA heartbeat or synchronization (FortiManager HA cluster).

D. TCP 514 for remote management of a FortiGate unit.

정답: A,B

문제2

You wish to create a firewall policy that applies only to traffic intended for your web server.
The server has an IP address of 192.168.2.2 and belongs to a class C subnet.
When defining the firewall address for use in this policy, which one of the following addressing formats is correct?

A. 192.168.2.0 / 255.255.255.0

B. 192.168.2.2 / 255.255.255.0

C. 192.168.2.2 / 255.255.255.255

D. 192.168.2.0 / 255.255.255.255

정답: C

문제3

How does the Log View page display logs when ADOMs are enabled?

A. The Log View page cannot display logs in real-time when ADOMs are enabled.

B. The Log View page cannot display raw logs when ADOMs are enabled.

C. The Log View page displays logs per ADOM.

D. The Log View page displays logs in ADOMs together so they appear as a single device.

정답: C

문제4

WAN optimization is configured in Active/Passive mode. When will the remote peer accept an attempt to initiate a tunnel?

A. The attempt will be accepted when a user on the remote peer accepts the connection request.

B. The attempt will be accepted when the request comes from a known peer.

C. The attempt will be accepted when there is a matching WAN optimization passive rule.

D. The attempt will be accepted when the request comes from a known peer and there is a matching WAN optimization passive rule.

정답: D

문제5

By default the Intrusion Protection System (IPS) on a FortiGate unit is set to perform which action?

A. Block all network attacks.

B. Block the most common network attacks.

C. Allow all traffic.

D. Allow and log all traffic.

정답: C

문제6

What are the requirements for a cluster to maintain TCP connections after device or link failover? (Select all that apply.)

A. Connections must not be handled by a proxy.

B. Enable session pick-up.

C. Only applies to UDP and ICMP connections.

D. Only applies to connections handled by a proxy.

정답: A,B

문제7

For Data Leak Prevention, which of the following describes the difference between the block and quarantine actions?

A. A block action prevents the transaction. A quarantine action archives the data.

B. A block action is used for known users. A quarantine action is used for unknown users.

C. A block action has a finite duration. A quarantine action must be removed by an administrator.

D. A block action prevents the transaction. A quarantine action blocks all future transactions, regardless of the protocol.

정답: D

문제8

Examine the following log message for IPS and identify the valid responses below. (Select all that apply.)
2012-07-01 09:54:28 oid=2 log_id=18433 type=ips subtype=anomaly pri=alert vd=root severity="critical" src="192.168.3.168" dst="192.168.3.170" src_int="port2" serial=0 status="detected" proto=1 service="icmp" count=1 attack_name="icmp_flood" icmp_id="0xa8a4" icmp_type="0x08" icmp_code="0x00" attack_id=16777316 sensor="1" ref="http://www.fortinet.com/ids/VID16777316" msg="anomaly: icmp_flood, 51 > threshold
50"

A. The attack was detected and blocked.

B. The target is 192.168.3.170.

C. The attack was TCP based.

D. The attack was detected only.

E. The target is 192.168.3.168.

정답: B,D

문제9

Which of the following is an advantage of using SNMP v3 instead of SNMP v1/v2 when querying the FortiGate unit?

A. Running SNMP service on a non-standard port is possible

B. Packet encryption

C. SNMP access limits through access lists

D. MIB-based report uploads

정답: B

문제10

A FortiGate unit is configured with three Virtual Domains (VDOMs) as illustrated in the exhibit.

Which of the following statements are correct regarding these VDOMs? (Select all that apply.)

A. All VDOMs must operate in the same mode.

B. The FortiGate unit must be a model 1000 or above to support multiple VDOMs.

C. A license had to be purchased and applied to the FortiGate unit before VDOM mode could be enabled.

D. The FortiGate unit supports any combination of these VDOMs in NAT/Route and Transparent modes.

E. Changing a VDOM operational mode requires a reboot of the FortiGate unit.

F. An admin account can be assigned to one VDOM or it can have access to all three VDOMs.

정답: D,F

문제11

When a FortiManager HA primary device fails, which two statements are correct for promoting a secondary device to the primary role? (Choose two.)

A. Reboot is required when promoting from secondary to primary.

B. Must manually reconfigure one of the secondary devices to become the master device.

C. The FortiManager HA supports IP takeover where an HA state transition does not require manual intervention.

D. All other secondary devices must be reconfigured to point to new primary device.

정답: B,D

문제12

What is the FortiGate unit password recovery process?

A. Interupt boot sequence, modify the boot registry and reboot. After changing the password, reset the boot registry.

B. Hold CTRL + break during reboot and reset the admin password.

C. The only way to regain access is to interrupt boot sequence and restore a configuration file for which the password has been modified.

D. Log in through the console port using the maintainer account within several minutes of a reboot.

정답: D

문제13

Which two statements are correct regarding the "Import all Objects" setting in the import policy wizard? (Choose two.)

A. FortiManager allows only policy dependent objects to be imported into an ADOM object database.

B. Any unused object on the FortiGate device will be deleted with the first policy install from FortiManager.

C. Only used objects will be imported into the ADOM object database.

D. All used and unused objects will be imported into the ADOM object database.

정답: B,D

Fortinet Network Security Expert 5 Written Exam (500) - NSE5무료 덤프문제 풀어보기

우리와 연락하기

유용한 링크

최신 업데이트