Fortinet Certified Network Security Professional (FCNSP v4.2) Sample Questions:

1. An administrator sets up a new FTP server on TCP port 2121. A FortiGate unit is located between the FTP clients and the server. The administrator has created a policy for TCP port 2121.
Users have been complaining that when downloading data they receive a 200 Port command successful message followed by a 425 Cannot build data connection message.
Which of the following statements represents the best solution to this problem?

A) Place the client and server interface in the same zone and enable intra-zone traffic.
B) Create a new session helper for the FTP service monitoring port 2121.
C) Enable the ANY service in the firewall policies for both incoming and outgoing traffic.
D) Disable any protection profiles being applied to FTP traffic.

2. Examine the Exhibit shown below; then answer the question following it.

In this scenario, the Fortigate unit in Ottawa has the following routing table: S* 0.0.0.0/0 [10/0] via 172.20.170.254, port2 C 172.20.167.0/24 is directly connected, port1 C 172.20.170.0/24 is directly connected, port2
Sniffer tests show that packets sent from the Source IP address 172.20.168.2 to the Destination IP address 172.20.169.2 are being dropped by the FortiGate unit located in Ottawa. Which of the following correctly describes the cause for the dropped packets?

A) The reverse path forwarding check.
B) The subnet 172.20.169.0/24 is NOT in the Ottawa FortiGate unit's routing table.
C) The forward policy check.
D) The destination workstation 172.20.169.2 does NOT have the subnet 172.20.168.0/24 in its routing table.

3. Which of the following statements is correct regarding the FortiGuard Services Web Filtering Override configuration as illustrated in the exhibit?

A) A client with an IP address of 10.10.10.12 is allowed access to any URL under the www.yahoo.com web site, including any subdirectory URLs, until August 7, 2009.
B) Any client on the same subnet as the authenticated user is allowed to access www.yahoo.com/images/.
C) A client with an IP of address 10.10.10.12 is allowed access to any subdirectory that is part of the www.yahoo.com web site.
D) Any client on the same subnet as the authenticated user is allowed to access www.yahoo.com/images/ until August 7, 2009.
E) A client with an IP address of 10.10.10.12 is allowed access to the www.yahoo.com/images/ web site and any of its offsite URLs.

4. What are the requirements for a cluster to maintain TCP connections after device or link failover? (Select all that apply.)

A) Only applies to connections handled by a proxy.
B) Enable session pick-up.
C) Only applies to UDP and ICMP connections.
D) Connections must not be handled by a proxy.

5. The following diagnostic output is displayed in the CLI:
diag firewall auth list
policy iD. 9, srC. 192.168.3.168, action: accept, timeout: 13427
user: forticlient_chk_only, group:
flag (80020): auth timeout_ext, flag2 (40): exact group iD. 0, av group: 0
----- 1 listed, 0 filtered -----
Based on this output, which of the following statements is correct?

A) An auth-keepalive value has been enabled.
B) This user has been associated with a guest profile as evidenced by the group id of 0.
C) Firewall policy 9 has endpoint compliance enabled but not firewall authentication.
D) The client check that is part of an SSL VPN connection attempt failed.

Solutions: