View all questions & answers for the NSE 4 - FortiOS 7.6 Administrator Exam Materials exam

NSE 4 - FortiOS 7.6 Administrator Exam Materials - Question #31 Discussion

Comment Image Comment Image Comment Image
Question Diagram

Refer to the exhibit. A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up. Based on the phase 2 configuration shown in the exhibit, which two configuration changes will bring phase 2 up? (Choose two answers)

  • A. On BR1-FGT, set Seconds to 43200.
  • B. On HQ-NGFW, enable Diffie-Hellman Group 2.
  • C. On BR1-FGT, set Remote Address to 10.0.11.0/255.255.255.0.
  • D. On HQ-NGFW, set Encryption to AES256.
Correct Answer: C,D

Brave-Dump Community Votes

Answer: C, D (6 votes) 75%
Answer: C (1 vote) 12.5%
Answer: A, D (1 vote) 12.5%

Community Explanations & Comments (8)

Alex 1 year ago
Selected: C
This requires two answers rather than one. C & D
Brave-Dumps.com Admin 1 year ago
Thanks Alex, Done.
Anonymous User 9 months ago
Selected: C, D
Look closely at the IP address
abdulrahman 7 months ago
Selected: C, D
although the correct answer is C and D. these option are not enough to make the phase up. because the DH groups must match on both ends.
Genco 4 months ago
They don't have to be identical but at least they should have one DH group match and in this case DH 5 groups match.
Genco 4 months ago
They don't have to be identical but at least they should have one DH group match and in this case DH 5 groups match.
Anonymous User 7 months ago
Selected: C, D
C D
Julio Ricardo Inostroza Rivas 3 months ago
Selected: A, D
the correct is A y D
the A) because the keepalive of IPsec SA must be the same value for both peer
the D) because for IPSec SA (Phase 2) the encryptation and authentication must be the same value too for both peers.
Ahmed El Hasseen El Tom El Shaikh Berair 3 months ago
Selected: C, D
31
[email protected] 2 weeks ago
Selected: C, D
BR1-FGT has incorrect remote subnet configured.
HQ-NGFW has encryption AES 128 whereas BR1-FGT has encryption AES 512.

Diffie Hellman Group 5 is matching on both sides
Lifetime is mismatch. As IKE phase 1 is up & in phase 2, it check authentication and encryption.
BASEL ALNAJJAR 1 week ago
Selected: C, D
cd