How does configuring tcp-mss-sender and tcp-mss-receiver affect TCP packets?

• A. Allow
• B. Header
• C. Payload
• D. Fragment

You must update a firewall policy to block multiple websites within the subnet 172.165.58.0/24.
What must you do to block these addresses efficiently?

• A. Create an Internet Service Database (ISDB) group and apply it to the destination field of the firewall policy.
• B. Create an IP address external connector and apply it to the destination field of the firewall policy.
• C. Create a URL niter and apply the web filter profile to the firewall policy.
• D. Create an application sensor and apply the application control profile to the firewall policy.

Refer to the exhibits.

A policy package conflict status and information from the import device wizard in the Core1 VDOM are shown.
When you import a policy package, the following message appears for the Web_restrictions web filter profile and the deep-inspection SSL-SSH profile:
The following objects were found having conflicts. Please confirm your
settings, then continue.
The Web_restrictions and deep-inspection profiles are used by other FortiGate devices within FortiManager.
Which step must you take to resolve the issue?

• A. Retrieve the FortiGate configuration to automatically export correct objects and policies.
• B. Use non-default object values because FortiManager is unable to alter default values.
• C. Select the FortiManager configuration that accepts changes on FortiManager and preserves existing configurations on FortiGate devices.
• D. Create uniquely named objects on FortiGate and reimport them into the policy package.

Refer to the exhibits.


The Administrators section of a root FortiGate device and the Security Fabric Settings section of a downstream FortiGate device are shown.
When prompted to sign in with Security Fabric in the downstream FortiGate device, a user enters the AdminSSO credentials.
What is the next status for the user?

• A. The user receives an authentication failure message.
• B. The user accesses the downstream FortiGate with super_admin_readonly privileges.
• C. The user is prompted to create an SSO administrator account for AdminSSO.
• D. The user accesses the downstream FortiGate with super_admin privileges.

An administrator must improve the resiliency of a link by minimizing data loss within the enterprise network that has full path redundancy.
What should the administrator enable on the FortiGate devices that use BGP as dynamic routing protocol between two separate autonomous systems? (Choose two.)

• A. ibgp-multipath
• B. bfd
• C. route-reflector-client
• D. graceful-restart