Which two statements are true about the RPF check? (Choose two.)

1. A. The RPF check is run on the first sent packet of any new session.
2. B. The RPF check is run on the first reply packet of any new session.
3. C. The RPF check is run on the first sent and reply packet of any new session.
4. D. RPF is a mechanism that protects FortiGate and your network from IP spoofing attacks.

Correct Answer: AD

Which three CLI commands can you use to troubleshoot Layer 3 issues if the issue is in neither the physical layer nor the link layer? (Choose three.)

1. A. diagnose sys top
2. B. execute ping
3. C. execute traceroute
4. D. diagnose sniffer packet any
5. E. get system arp

Correct Answer: BCD

Which two types of traffic are managed only by the management VDOM? (Choose two.)

1. A. FortiGuard web filter queries
2. B. PKI
3. C. Traffic shaping
4. D. DNS

Correct Answer: AD
FortiGate Infrastructure 7.2 Study Guide (p.73): "What about traffic originating from FortiGate? Some system daemons, such as NTP and FortiGuard updates, generate traffic coming from FortiGate. Traffic coming from FortiGate to those global services originates from the management VDOM. One, and only one, of the VDOMs on a FortiGate device is assigned the role of the management VDOM. It is important to note that the management VDOM designation is solely for traffic originated by FortiGate, such as FortiGuard updates, and has no effect on traffic passing through FortiGate."

Which three statements explain a flow-based antivirus profile? (Choose three.)

1. A. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
2. B. If a virus is detected, the last packet is delivered to the client.
3. C. The IPS engine handles the process as a standalone.
4. D. FortiGate buffers the whole file but transmits to the client at the same time.
5. E. Flow-based inspection optimizes performance compared to proxy-based inspection.

Correct Answer: ADE

Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

1. A. To detect intermediary NAT devices in the tunnel path.
2. B. To dynamically change phase 1 negotiation mode aggressive mode.
3. C. To encapsulation ESP packets in UDP packets using port 4500.
4. D. To force a new DH exchange with each phase 2 rekey.

Correct Answer: AC