サンプル問題 1： A company that acquired multiple branches across different countries needs to install new FortiGate devices on each of those branches. However, the IT staff lacks sufficient knowledge to implement the initial configuration on the FortiGate devices. Which three approaches can the company take to successfully deploy advanced initial configurations on remote branches? (Choose three.)
A: Use metadata variables to dynamically assign values according to each FortiGate device.
B: Use provisioning templates and install configuration settings at the device layer.
C: Use the Global ADOM to deploy global object configurations to each FortiGate device.
D: Apply Jinja in the FortiManager scripts for large-scale and advanced deployments.
E: Add FortiGate devices on FortiManager as model devices, and use ZTP or LTP to connect to FortiGate devices.
正解：A, B, E
Explanation: Use metadata variables to dynamically assign values according to each FortiGate device: Metadata variables in FortiManager allow device-specific configurations to be dynamically assigned without manually configuring each FortiGate. This is especially useful when deploying multiple devices with similar base configurations. Use provisioning templates and install configuration settings at the device layer: Provisioning templates in FortiManager provide a structured way to configure FortiGate devices. These templates can define interfaces, policies, and settings, ensuring that each device is correctly configured upon deployment. Add FortiGate devices on FortiManager as model devices, and use ZTP or LTP to connect to FortiGate devices: Zero-Touch Provisioning (ZTP) and Local Touch Provisioning (LTP) help automate the deployment of FortiGate devices. By adding devices as model devices in FortiManager, configurations can be pushed automatically when devices connect for the first time, reducing manual effort
サンプル問題 2： An administrator is checking an enterprise network and sees a suspicious packet with the MAC address e0:23:ff:fc:00:86. What two conclusions can the administrator draw? (Choose two.)
A: The suspicious packet is related to a cluster that has VDOMs enabled.
B: The network includes FortiGate devices configured with the FGSP protocol.
C: The suspicious packet is related to a cluster with a group-id value lower than 255.
D: The suspicious packet corresponds to port 7 on a FortiGate device.
正解：A, C
Explanation: The MAC address e0:23:ff:fc:00:86 follows the format used in FortiGate High Availability (HA) clusters. When FortiGate devices are in an HA configuration, they use virtual MAC addresses for failover and redundancy purposes. The suspicious packet is related to a cluster that has VDOMs enabled: FortiGate devices with Virtual Domains (VDOMs) enabled use specific MAC address ranges to differentiate HA-related traffic. This MAC address is likely part of that mechanism. The suspicious packet is related to a cluster with a group-id value lower than 255: FortiGate HA clusters assign virtual MAC addresses based on the group ID. The last octet (00:86) corresponds to a group ID that is below 255, confirming this option.
サンプル問題 3： A company's guest internet policy, operating in proxy mode, blocks access to Artificial Intelligence Technology sites using FortiGuard. However, a guest user accessed a page in this category using port 8443. Which configuration changes are required for FortiGate to analyze HTTPS traffic on nonstandard ports like 8443 when full SSL inspection is active in the guest policy?
A: Add a URL wildcard domain to the website CA certificate and use it in the SSL/SSH Inspection Profile.
B: In the Protocol Port Mapping section of the SSL/SSH Inspection Profile, enter 443, 8443 to analyze both standard (443) and non-standard (8443) HTTPS ports.
C: To analyze nonstandard ports in web filter profiles, use TLSv1.3 in the SSL/SSH Inspection Profile.
D: Administrators can block traffic on nonstandard ports by enabling the SNI check in the SSL/SSH Inspection Profile.
正解：B
Explanation: When FortiGate is operating in proxy mode with full SSL inspection enabled, it inspects encrypted HTTPS traffic by default on port 443. However, some websites may use non-standard HTTPS ports (such as 8443), which FortiGate does not inspect unless explicitly configured. To ensure that FortiGate inspects HTTPS traffic on port 8443, administrators must manually add port 8443 in the Protocol Port Mapping section of the SSL/SSH Inspection Profile. This allows FortiGate to treat HTTPS traffic on port 8443 the same as traffic on port 443, enabling proper inspection and enforcement of FortiGuard category-based web filtering.
