Refer to the exhibit, which a network topology and a partial routing table.

FortiGate has already been configured with a firewall policy that allows all ICMP traffic to flow from port1 to port3.
Which changes must the administrator perform to ensure the server at 10.4.0.1/24 receives the echo reply from the laptop at 10.1.0.1/24?

1. A. Enable asymmetric routing under config system settings.
2. B. Change the configuration from strict RPF check mode to feasible RPF check mode.
3. C. A firewall policy that allows all ICMP traffic from port3 to port1.
4. D. Modify the default gateway on the laptop from 10.1.0.2 to 10.2.0.2.

Correct Answer: A

Exhibit.

Refer to the exhibit, which shows the output of get system ha status. NGFW-1 and NGFW-2 have been up for a week.
Which two statements about the output are true? (Choose two.)

1. A. If a configuration change is made to the primary FortiGate at this time, the secondary will initiate a synchronization reset.
2. B. If port 7 becomes disconnected on the secondary, both FortiGate devices will elect itself as primary.
3. C. If FGVM...649 is reboote
4. D. FGVM...650 will become the primary and retain that role, even after FGVM...649 rejoins the cluster.
5. E. If no action is taken, the primary FortiGate will leave the cluster because of the current sync status.

Correct Answer: BC

Refer to the exhibit.

An IPsec VPN tunnel is dropping, as shown by the debug output. Analyzing the debug output, what could be causing the tunnel to go down?

1. A. Phase 2 drops but Phase 1 is up.
2. B. Dead Peer Detection is not receiving its acknowledge packet.
3. C. The tunnel drops during rekey negotiation.
4. D. The tunnel drops after the timer expires.

Correct Answer: B

Refer to the exhibits.

An administrator is attempting to advertise the network configured on port3. However, FGT-A is not receiving the prefix.
Which two actions can the administrator take to fix this problem? (Choose two.)

1. A. Modify the prefix using the network command from 172.16.0.0/16 to 172.16.54.0/24.
2. B. Manually add the BGP route on FGT-A.
3. C. Restart BGP using a soft reset to force both peers to exchange their complete BGP routing tables.
4. D. Use the set network-import-check disable command.

Correct Answer: AD

Exhibit 1.

Exhibit 2.

Refer to the exhibits, which show the configuration on FortiGate and partial internet session information from a user on the internal network.
An administrator would like to lest session failover between the two service provider connections.
Which two changes must the administrator make to force this existing session to immediately start using the other interface? (Choose two.)

1. A. Change the priority of the port! static route to 11.
2. B. Change the priority of the port2 static route to 5.
3. C. Configure unset snat-route-change to return it to the default setting.
4. D. Configure set snat-route-change enable.

Correct Answer: AD