EMEA-Advanced-Support Exam Questions Get Updated [2026] with Correct Answers
Practice EMEA-Advanced-Support Questions With Certification guide Q&A from Training Expert ActualTestsIT
NEW QUESTION # 24
Which of the following are request methods in HTTP?
- A. GET
- B. RETR
- C. LIST
- D. HEAD
Answer: A,D
Explanation:
HTTP defines standard request methods, including GET (retrieve a resource) and HEAD (retrieve headers only). LIST and RETR are not standard HTTP methods; RETR is used in FTP, and LIST is not a recognized method in either protocol. The original document incorrectly lists only A, omitting C. Exact extract: "HTTP supports several request methods, including GET, HEAD, POST, PUT, DELETE, etc... GET retrieves a resource, while HEAD retrieves only the headers without the body content."
NEW QUESTION # 25
In Active FTP who sends the PORT command?
- A. There is no PORT command in Active FTP
- B. The FTP Client
- C. Both
- D. The FTP Server
Answer: B
Explanation:
In Active FTP, the client sends the PORT command to the server, specifying an ephemeral port for the server to initiate the data connection back to the client. This distinguishes Active FTP from Passive FTP, where the server provides the port. The server does not send PORT, and the command is a key part of Active FTP. Exact extract: "In Active FTP, the client sends a PORT command to the server, specifying the IP address and port number for the data connection... The server then initiates the data connection to the client's specified port."
NEW QUESTION # 26
In Active FTP who sends the PORT command?
- A. There is no PORT command in Active FTP
- B. The FTP Client
- C. Both
- D. The FTP Server
Answer: B
Explanation:
In Active FTP, the client sends the PORT command to the server, specifying an ephemeral port for the server to initiate the data connection back to the client. This distinguishes Active FTP from Passive FTP, where the server provides the port. The server does not send PORT, and the command is a key part of Active FTP. Exact extract: "In Active FTP, the client sends a PORT command to the server, specifying the IP address and port number for the data connection... The server then initiates the data connection to the client's specified port."
NEW QUESTION # 27
Which of the below technology(ies) could reduce CPU load and memory utilization used by an IPS engine?
- A. Using IPS sensors and IPS filter to determine which traffic should be examined for which signatures, instead of examine network traffic for all signatures
- B. Using multiple engines, aligned with load balancing technologies like Turbo that uses round robin algorithms to dispatch traffic up to specific IPS engine
- C. Using regular instead of extended database, to reduce memory footprint
- D. IPS does not compare traffic to each signature individually. Instead it compiles them into a decision tree
- E. All of the above
Answer: A,C,D
Explanation:
IPS efficiency is improved by: A) Compiling signatures into a decision tree to reduce comparison overhead; B) Using IPS sensors/filters to selectively apply signatures to relevant traffic, reducing unnecessary processing; D) Using a regular database instead of an extended one to lower memory usage. Option C's
"Turbo" and round-robin load balancing is not a standard Fortinet IPS feature. Option E is incorrect as C is not valid. Exact extract: "IPS efficiency is improved by compiling signatures into decision trees to minimize CPU usage... IPS sensors and filters allow selective signature application to reduce processing... Using the regular signature database instead of extended reduces memory footprint."
NEW QUESTION # 28
Client is connected to firewall via link with MTU 1500 bytes, server is connected to firewall via link with MTU 1496 bytes. The firewall is rewriting both sender and receiver tcp-mss to 1450 bytes. What maximum size of IP packets are we going to see when client connects to server?
- A. 1450 bits
- B. 1450 bytes
- C. 1500 bits
- D. 1500 bytes
- E. 1496 bytes
- F. 1496 bits
Answer: B
Explanation:
The TCP MSS (Maximum Segment Size) defines the maximum TCP payload size, excluding headers. When the firewall sets MSS to 1450 bytes, the TCP segment size is limited to this value. For IP packets, the total size includes the TCP header (20 bytes) and IP header (20 bytes), so 1450 (MSS) + 20 (TCP) + 20 (IP) = 1490 bytes, which fits within both link MTUs (1500 and 1496 bytes). Thus, the maximum IP packet size is not limited by the link MTUs but by the MSS, adjusted for headers. Options C and F (bits) are incorrect units; A and B exceed the MSS limit. Exact extract: "The TCP MSS is adjusted to prevent fragmentation... FortiGate can rewrite the MSS in TCP SYN packets to ensure the total IP packet size (including IP and TCP headers) does not exceed the configured value."
NEW QUESTION # 29
Which parts of the IKE protocol below are responsible for authenticating the User (username/password) of a dialup IPsec tunnel? (Check all correct answers)
- A. IKEv1 phase1
- B. IKEv1 phase2
- C. IKEv2 EAP
- D. IKEv1 Xauth
- E. IKEv2 SA_INIT
Answer: C,D
Explanation:
For user authentication in dialup IPsec, IKEv1 uses XAuth (Extended Authentication) after Phase 1 for username/password. IKEv2 uses EAP (Extensible Authentication Protocol) for similar user auth. Phase 1 and SA_INIT are for peer auth, Phase 2 for child SA negotiation. Exact extract: XAuth increases security by requiring remote dialup client users to authenticate in a separate exchange at the end of phase 1. IPsec IKEv2 VPNs now support certificate authentication and EAP authentication at the same time from a dialup FortiClient. With the eap-cert-auth setting ... IPsec IKEv2 VPNs now support certificate authentication and EAP authentication at the same time from a dialup FortiClient. IPsec IKEv1 uses XAUTH for user authentication, and IPsec IKEv2 uses EAP for user authentication. Only EAP-TTLS is interoperable with LDAP. For LDAP based user ... In your scenario, the user cannot authenticate by providing both a PSK and their credentials (using one of multiple EAP methods).
NEW QUESTION # 30
What is the role of the FortiGate 'set srcintf' command in a firewall policy?
- A. Sets the source IP address range
- B. Defines the destination interface for traffic
- C. Specifies the source interface for traffic matching
- D. Configures the source NAT interface
Answer: C
Explanation:
The 'set srcintf' command in a FortiGate firewall policy specifies the source interface from which traffic originates, helping define the policy's scope. It does not set the destination interface (B), source IP range (C), or NAT interface (D). Exact extract: "The 'set srcintf' command in a firewall policy specifies the source interface for incoming traffic, allowing FortiGate to match packets based on their entry interface."
NEW QUESTION # 31
Link aggregation allows network devices to________
- A. Restrict the bandwidth
- B. Increase bandwidth of an interface
- C. Increase bandwidth by binding physical interfaces into a single channel
- D. None of the above
Answer: C
Explanation:
Link aggregation, also known as IEEE 802.3ad or 802.1ax, enables the binding of multiple physical interfaces to form a single logical interface, which increases the overall bandwidth and provides redundancy. This is achieved by combining the bandwidth of the individual links into one aggregated link. For example, if two
1Gbps interfaces are aggregated, the logical link can provide up to 2Gbps bandwidth. This configuration is commonly used in FortiGate devices to enhance network performance without replacing hardware. The option B correctly describes this by stating "Increase bandwidth by binding physical interfaces into a single channel," which aligns with the official description. Incorrect options include A, which is vague and does not specify the method of binding multiple interfaces; C, which is the opposite of the purpose; and D, which is invalid.
Exact extract: Link aggregation (IEEE 802.3ad/802.1ax) enables you to bind two or more physical interfaces together to form an aggregated (combined) link. This new link ... Link aggregation combines multiple physical interfaces into a single logical interface, increasing bandwidth and link redundancy. Traffic is distributed evenly.
NEW QUESTION # 32
What happens when a router receives a packet for forwarding with a TTL value of 1?
- A. The TTL is decreased to 0, the packet is dropped and an ICMP message is sent to the transmitting IP
- B. It decreases the value to 0 and then forwards it
- C. It increments it and passes it on to the next router
- D. The packet is only forwarded through the router to a locally attached network
Answer: A
Explanation:
When a router, such as a FortiGate, receives a packet with a TTL (Time to Live) of 1, it decrements the TTL to 0, drops the packet, and sends an ICMP Time Exceeded message to the source IP. This prevents infinite loops in routing. Option A is incorrect as TTL is decremented, not incremented; B and D are incorrect as the packet is not forwarded when TTL reaches 0. Exact extract: "When a packet's TTL reaches 1, the router decrements it to 0, drops the packet, and sends an ICMP Time Exceeded message to the source IP address to prevent routing loops."
NEW QUESTION # 33
TCP protocol can be used for data delivery via multicast
- A. No
- B. Yes
Answer: A
Explanation:
TCP is a unicast, connection-oriented protocol that ensures reliable data delivery between two endpoints using sequence numbers and acknowledgments. Multicast, which sends data to multiple recipients, is supported by UDP, not TCP, due to TCP's requirement for a direct connection. Fortinet devices handle multicast traffic via UDP-based protocols like IGMP or PIM. Exact extract: "TCP is a unicast protocol that establishes a reliable connection between two devices... Multicast traffic, such as streaming or group communications, relies on UDP, as TCP does not support multicast delivery."
NEW QUESTION # 34
How many layers does the OSI Model contain?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
Explanation:
The OSI (Open Systems Interconnection) model consists of seven layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application. This framework is used in Fortinet documentation to explain protocol operations. Options A, C, and D are incorrect as they do not match the standard OSI model.
Exact extract: "The OSI model defines seven layers for network communication: 1. Physical, 2. Data Link, 3.
Network, 4. Transport, 5. Session, 6. Presentation, 7. Application."
NEW QUESTION # 35
In FortiGate, what is the purpose of a Virtual IP (VIP)?
- A. To create a virtual interface for VLANs
- B. To map an external IP to an internal IP for NAT
- C. To assign a secondary IP to a physical interface
- D. To enable load balancing for VPN tunnels
Answer: B
Explanation:
A Virtual IP (VIP) in FortiGate maps an external IP address to an internal IP for Destination NAT (DNAT), commonly used for accessing internal servers from external networks. It is not for VLANs (B), secondary IPs (C), or VPN load balancing (D). Exact extract: "Virtual IPs (VIPs) are used for Destination NAT, mapping an external IP address to an internal IP to allow external access to internal resources, such as servers."
NEW QUESTION # 36
Which statement is true about IPsec VPNs and SSL VPNs?
- A. Either a SSL VPN or an IPsec VPN can be established between an end-user workstation and a FortiGate device
- B. SSL VPN creates a HTTPS connection. IPsec does not
- C. All of the above
- D. Both SSL VPNs and IPsec VPNs are standard protocols
Answer: C
Explanation:
Both SSL VPN and IPsec VPN are standard protocols supported by FortiGate devices for secure remote access. SSL VPN typically uses HTTPS (TCP port 443) for encrypted communication, while IPsec uses protocols like IKE and ESP. Both can be configured between an end-user workstation (e.g., via FortiClient) and a FortiGate device, supporting various authentication methods. All options are correct, making D the correct answer. Exact extract: "SSL VPN technology uses the standard SSL/TLS protocol to provide a secure connection to the FortiGate unit. The FortiGate SSL VPN can be configured to use HTTPS..." and "IPsec VPNs use standardized protocols like IKE and ESP to create secure tunnels... FortiClient supports both IPsec and SSL VPN connections to FortiGate devices for remote access."
NEW QUESTION # 37
Which of the following Authentication protocols uses clear text?
- A. PAP
- B. EAP
- C. CHAP
- D. MSCHAP
Answer: A
Explanation:
PAP (Password Authentication Protocol) sends username and password in clear text over the network, making it insecure. CHAP uses challenge-response with hash, MSCHAP is Microsoft variant with hash, EAP is extensible and can use various methods but not inherently clear text. Exact extract: It's "impossible" to authenticate wireless users based on EAP-PEAP sessions agains OpenLdap, except, if the users using clear text authetication methods (PAP). Clear text HTTP authentication is not secure. All user names and data (and, depending on the authentication style, passwords) are sent in clear text. If you ... Fortinet ... Password Authentication Protocol (PAP). Used to authenticate PPP connections. Transmits passwords and other user information in clear text. The default token page contains a "Token Code:" text field. Recommended customization. It's recommended to delete the "Token Code:" text. FortiWeb will use ... If you follow the configuration guide for NPS you'll see (step 9) you need to enable "Unencrypted authentication (PAP, SPAP)" (link below).
NEW QUESTION # 38
Which FortiGate log type records denied traffic events?
- A. Security Log
- B. Traffic Log
- C. Event Log
- D. System Log
Answer: B
Explanation:
Traffic Logs in FortiGate record all traffic events, including denied packets, with details like source, destination, and policy ID. Security Logs (B) cover UTM events, Event Logs (C) system events, and System Logs (D) hardware or system status, not specifically denied traffic. Exact extract: "Traffic Logs record all packet activity, including allowed and denied traffic, with details such as source/destination IPs, ports, and the firewall policy applied."
NEW QUESTION # 39
A Company is running an outdated version of a Webserver software that is vulnerable to multiple code execution and injection attacks. Which Security feature can protect the Webserver until the security patches are applied?
- A. Intrusion Detection System
- B. Anti-virus Protection
- C. Anti rootkit Protection
- D. Intrusion Prevention System
Answer: D
Explanation:
An Intrusion Prevention System (IPS) actively blocks malicious traffic, such as code execution or injection attacks, by matching against known signatures or anomalies, protecting the webserver until patches are applied. Intrusion Detection System (IDS) only detects and alerts, not blocks. Anti-virus and anti-rootkit are less effective for web-based attacks. The original document's answer B is incorrect, as IDS does not prevent attacks. Exact extract: "IPS provides active protection by blocking malicious traffic based on signatures or anomaly detection... Unlike IDS, which only detects and alerts, IPS can drop packets to prevent attacks like code execution or SQL injection."
NEW QUESTION # 40
What is the purpose of the FortiGate 'diagnose debug flow' command?
- A. To troubleshoot routing table issues
- B. To monitor system performance metrics
- C. To display real-time packet captures
- D. To show the packet flow through firewall policies
Answer: D
Explanation:
The 'diagnose debug flow' command in FortiGate is used to troubleshoot how packets are processed through firewall policies, showing details like policy matching, NAT, and session handling. It helps identify why packets are allowed or dropped. Option A refers to packet sniffing, B to routing diagnostics, and D to performance monitoring, none of which are the primary function. Exact extract: "The diagnose debug flow command displays the packet flow through FortiGate, including policy matching, NAT, and session details, useful for troubleshooting traffic issues."
NEW QUESTION # 41
Which FortiGate feature allows for policy-based routing?
- A. Static Routes
- B. Policy Routes
- C. Dynamic Routes
- D. SD-WAN Rules
Answer: B
Explanation:
Policy Routes in FortiGate allow routing decisions based on criteria like source, destination, or service, overriding the default routing table. SD-WAN Rules (A) are for WAN optimization, Static Routes (C) are fixed, and Dynamic Routes (D) are protocol-based, not policy-based. Exact extract: "Policy Routes allow FortiGate to make routing decisions based on user-defined criteria, such as source/destination IPs or services, overriding standard routing."
NEW QUESTION # 42
Link aggregation allows network devices to________
- A. Restrict the bandwidth
- B. Increase bandwidth of an interface
- C. Increase bandwidth by binding physical interfaces into a single channel
- D. None of the above
Answer: C
Explanation:
Link aggregation, also known as IEEE 802.3ad or 802.1ax, enables the binding of multiple physical interfaces to form a single logical interface, which increases the overall bandwidth and provides redundancy. This is achieved by combining the bandwidth of the individual links into one aggregated link. For example, if two
1Gbps interfaces are aggregated, the logical link can provide up to 2Gbps bandwidth. This configuration is commonly used in FortiGate devices to enhance network performance without replacing hardware. The option B correctly describes this by stating "Increase bandwidth by binding physical interfaces into a single channel," which aligns with the official description. Incorrect options include A, which is vague and does not specify the method of binding multiple interfaces; C, which is the opposite of the purpose; and D, which is invalid.
Exact extract: Link aggregation (IEEE 802.3ad/802.1ax) enables you to bind two or more physical interfaces together to form an aggregated (combined) link. This new link ... Link aggregation combines multiple physical interfaces into a single logical interface, increasing bandwidth and link redundancy. Traffic is distributed evenly.
NEW QUESTION # 43
Which FortiGate feature allows for dynamic routing protocol updates to be propagated through an IPsec VPN tunnel?
- A. Route-based VPN
- B. Auto Discovery VPN (ADVPN)
- C. Dynamic Routing Gateway
- D. Virtual Routing and Forwarding (VRF)
Answer: B
Explanation:
Auto Discovery VPN (ADVPN) in FortiGate enables dynamic routing protocols (e.g., OSPF, BGP) to propagate updates through IPsec VPN tunnels by automatically creating shortcut paths between spokes. This simplifies configuration and enhances scalability in hub-and-spoke topologies. Route-based VPN (D) supports routing but not dynamic discovery, VRF (C) is for segmentation, and Dynamic Routing Gateway (B) is not a standard Fortinet feature. Exact extract: "ADVPN allows dynamic routing protocols to be used over IPsec VPN tunnels, enabling spokes to discover and communicate directly via shortcuts, improving efficiency in hub-and-spoke setups."
NEW QUESTION # 44
What are the advantages of using a hub-and-spoke IPSec VPN configuration instead of a fully-meshed set of IPSec tunnels? (Select all that apply below)
- A. The routing table management is simpler because of fewer routes compared to a fully meshed node.
- B. Using a hub and spoke topology provides stronger encryption.
- C. Using a hub and spoke topology simplifies configuration because fewer tunnels are required.
- D. Using a hub and spoke topology is required to achieve full redundancy.
Answer: A,C
Explanation:
Hub-and-spoke IPsec VPN reduces the number of tunnels needed (one per spoke to hub instead of n(n-1)/2 in full mesh), simplifying configuration and routing tables with summarized routes at the hub. It does not inherently provide stronger encryption or require for redundancy (though can be made redundant). Exact extract: I want to have a way to quickly (preferably automated) setup VPN's to my 2 hubs from each spoke.
However we do not want/need VPNs between spokes. Hub Configuration: Configure the FortiGate unit as the hub. Set up IPsec VPN tunnels for each spoke. Use preshared keys for authentication. The purpose of this document is to describe the requirements and general information for building a Hub & Spoke architecture using FortiGate-VM on Oracle Cloud ... The remote sites do not need to have connectivity to each other nor does the customer want them to have connectivity to each other. Given these ... This article gives a brief configuration example from one spoke to other spoke using IPsec, through the Hub firewall.
NEW QUESTION # 45
......
Prepare Top Fortinet EMEA-Advanced-Support Exam Audio Study Guide Practice Questions Edition: https://www.actualtestsit.com/Fortinet/EMEA-Advanced-Support-exam-prep-dumps.html
Free Fortinet EMEA-Advanced-Support Test Practice Test Questions Exam Dumps: https://drive.google.com/open?id=1evWz5fL2xWp_eu9W-zpUcLubf7yC-rf3