EMEA-Advanced-Support Sample Questions Answers

In a FortiGate HA cluster (active-active or active-passive), if the primary unit fails, a secondary unit automatically takes over as the primary, ensuring continuity of traffic with minimal disruption. Option A is incorrect as traffic continues, C is incorrect as the mode doesn’t change post-failure, and D is unrelated. Exact extract: "In a FortiGate HA cluster, if the primary unit fails, a secondary unit is elected as the new primary, taking over all roles to maintain traffic flow and session continuity."

Policy Routes in FortiGate allow routing decisions based on criteria like source, destination, or service, overriding the default routing table. SD-WAN Rules (A) are for WAN optimization, Static Routes (C) are fixed, and Dynamic Routes (D) are protocol-based, not policy-based. Exact extract: "Policy Routes allow FortiGate to make routing decisions based on user-defined criteria, such as source/destination IPs or services, overriding standard routing."

VMotion in VMware vSphere enables live migration of running virtual machines from one physical server to another with zero downtime, ensuring continuous operation. Fortinet’s FortiGate-VM supports such environments. Options A, C, and D are incorrect as they do not describe VMotion; C refers to a different migration scenario, and D is unrelated to virtualization. Exact extract: "VMotion allows the live migration of a running virtual machine from one physical server to another with no downtime... This ensures workloads continue running during server maintenance or load balancing."

In Active FTP, the client sends the PORT command to the server, specifying an ephemeral port for the server to initiate the data connection back to the client. This distinguishes Active FTP from Passive FTP, where the server provides the port. The server does not send PORT, and the command is a key part of Active FTP. Exact extract: "In Active FTP, the client sends a PORT command to the server, specifying the IP address and port number for the data connection... The server then initiates the data connection to the client’s specified port."

IPsec operates at Layer 4 (Transport Layer) in the OSI model, providing secure communication via protocols like ESP and AH, which work with TCP or UDP. BGP and OSPF are Layer 3 (Network Layer) routing protocols, and ARP operates at Layer 2 (Data Link Layer). Fortinet’s FortiGate uses IPsec for VPNs at Layer 4. Exact extract: "IPsec operates at the Transport Layer (Layer 4) to secure communications, encapsulating TCP or UDP packets... BGP and OSPF function at the Network Layer, while ARP resolves IP to MAC addresses at the Data Link Layer."

Auto Discovery VPN (ADVPN) in FortiGate enables dynamic routing protocols (e.g., OSPF, BGP) to propagate updates through IPsec VPN tunnels by automatically creating shortcut paths between spokes. This simplifies configuration and enhances scalability in hub-and-spoke topologies. Route-based VPN (D) supports routing but not dynamic discovery, VRF (C) is for segmentation, and Dynamic Routing Gateway (B) is not a standard Fortinet feature. Exact extract: "ADVPN allows dynamic routing protocols to be used over IPsec VPN tunnels, enabling spokes to discover and communicate directly via shortcuts, improving efficiency in hub-and-spoke setups."

The Fortinet Security Fabric provides a centralized management platform for multiple Fortinet devices (e.g., FortiGate, FortiSwitch, FortiAP), enabling coordinated security policies, telemetry sharing, and simplified administration. It does not directly speed up VPNs (B), reduce firewall policies (C), or auto-configure VLANs (D). Exact extract: "The Fortinet Security Fabric enables centralized management and visibility across Fortinet devices, allowing coordinated security policies and telemetry sharing for enhanced protection."

FortiGate operates on a default-deny principle; if a packet does not match any firewall policy, it is dropped to ensure security. No forwarding (A), IPS processing (C), or automatic allowing (D) occurs without a matching policy. Exact extract: "FortiGate uses a default-deny approach; packets that do not match any configured firewall policy are dropped to prevent unauthorized traffic."

IPS efficiency is improved by: A) Compiling signatures into a decision tree to reduce comparison overhead; B) Using IPS sensors/filters to selectively apply signatures to relevant traffic, reducing unnecessary processing; D) Using a regular database instead of an extended one to lower memory usage. Option C’s “Turbo” and round-robin load balancing is not a standard Fortinet IPS feature. Option E is incorrect as C is not valid. Exact extract: "IPS efficiency is improved by compiling signatures into decision trees to minimize CPU usage... IPS sensors and filters allow selective signature application to reduce processing... Using the regular signature database instead of extended reduces memory footprint."

In OSPF, the Area Border Router (ABR) generates Type-4 Summary LSAs to advertise the location of an Autonomous System Boundary Router (ASBR) to other areas. This LSA informs routers in different areas how to reach the ASBR for external routes. ASBR generates Type-5 LSAs for external routes, but ABR summarizes them with Type-4. Not all routers or stub routers do this. Exact extract: This article describes the basic steps to configure FortiGates in an OSPF scenario where the FortiGates will be ABR and ASBR OSPF routers across 3 areas. Router3 is the Autonomous System Border Router (ASBR). It routes all traffic to the ISP BGP router for internet access. It redistributes routes from BGP and ... Type 4 LSAs exist to let the area know the router-id of the ASBR, so the routers can look at the type 5 route, find advertising-router, and map ... An ASBR summary LSA is generated by an ABR and describes the location of an ASBR (Autonomous System Boundary Router) that connects to an external network. The FortiGate in the middle shall be a ABR between the two areas. But I don't want R2 in area 0.0.0.0 to have every /32 route for every VPN client. So I tried ...

FortiGate uses SSH (Secure Shell) by default for secure management access, providing encrypted command-line access. Telnet (A) and HTTP (C) are insecure, and SNMP (D) is for monitoring, not management. Exact extract: "FortiGate enables SSH by default for secure management access, providing encrypted CLI access to administrators."

BGP path selection follows a specific order of attributes to determine the best path. The process prefers the path with the highest local preference first, as it is one of the earliest steps in the decision process. Local preference is used within an AS to influence outbound traffic. Only if local preferences are equal does it move to the next criteria, such as shortest AS path. The AS path length is considered after local preference, MED after that, and eBGP over iBGP even later. Therefore, among the options, the highest local preference (D) is the most preferred criterion. The original document's answer B is incorrect based on standard BGP selection rules implemented in Fortinet. Exact extract: This article describes the BGP route selection process. Scope FortiGate. Solution Consider only routes with no AS loops and a valid next hop. BGP makes routing decisions based on path, network policies and rulesets ... select the route with the lowest router ID as the best path. Network. Type. To achieve this, multiple route selection techniques can be used. Some are protocol-agnostic (for example, weight) and others are protocol-specific (for example ...).