Exam FCP_FGT_AD-7.4 topic 1 question 88 discussion

Actual exam question from Fortinet's FCP_FGT_AD-7.4

Question #: 88
Topic #: 1

Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up.

Based on the phase 2 configuration shown in the exhibit, which two configuration changes will bring phase 2 up? (Choose two.)

A. On Remote-FortiGate, set Seconds to 43200.
B. On HQ-FortiGate, enable Diffie-Hellman Group 2.
C. On HQ-FortiGate, set Encryption to AES256.
D. On Remote-FortiGate, set Remote Address to 10.0.1.0/255.255.255.0.

Show Suggested Answer

Suggested Answer: CD 🗳️

by Chele16 at Jan. 24, 2025, 7:03 p.m.

Comments

Submit Cancel

Orbit

4 months ago

Selected Answer: CD

C and D is correct. C: Encryption needs to be the same and is conflicting on both devices. D: The local network for HQ-FortiGate is 10.0.1.0/24 which is configured incorrectly on the remote network of the Remote-FortiGate device. The reason it is not A is because key lifetime does not have to match to bring up phase 2. Of course best practice would be to have these match but it would not stop the tunnel coming up.

upvoted 2 times

...