Marcos Avila
Quiz by , created more than 1 year ago

NSE4 6.0 NSE4 6.0 Quiz on FSSO II, created by Marcos Avila on 25/07/2018.

411
1
0
Marcos Avila
Created by Marcos Avila over 6 years ago
Close

FSSO II

FSSO II

Question 1 of 23

1

TCP ports 139 its optional, only TCP port 445 must be opened between collector agents or FortiGate and all hosts.

Select one of the following:

  • True
  • False

Explanation

Question 2 of 23

1

Which is the recommended mode for FSSO deployments?

Select one of the following:

  • a. DC agent mode

  • b. Polling mode: Agentless

Explanation

Question 3 of 23

1

Which FSSO mode requires more FortiGate system resources (CPU and RAM)?

Select one of the following:

  • a. Polling mode: Collector agent-based

  • b. Polling mode: Agentless

Explanation

Question 4 of 23

1

Is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users.

Select one of the following:

  • NTLM

  • WinSecLog

  • NetAPI

  • WMI

Explanation

Question 5 of 23

1

NTLM

Select one of the following:

  • NT LAN Manager

  • Network LAN Microsoft

Explanation

Question 6 of 23

1

Simple domain configurations for NTLM authentication

Select one of the following:

  • a. do not require a DC agent

  • b. require only one global collector agent

Explanation

Question 7 of 23

1

When performing NTLM authentication, what information does the web browser supply to FortiGate?

Select one of the following:

  • a. The user's credentials (username and password)

  • b. The user’s user ID, IP address, and group membership

Explanation

Question 8 of 23

1

Which of the following may cause an NTLM authentication to occur?

Select one of the following:

  • a. Traffic coming from an IP on the F850 user list

  • b. Traffic coming from an IP not on the FSSO user list

Explanation

Question 9 of 23

1

The FSSO collector agent can access Windows AD in one of two modes:

Select one of the following:

  • Standard
    Advanced

  • Agent mode
    Polling mode

Explanation

Question 10 of 23

1

Notice that you do not need to match the F880 version with your exact FortiGate firmware version. When installing FSSO, grab the latest collector agent for your major release. You do however, need to match the dcagent version to the collector agent version.

Select one of the following:

  • True
  • False

Explanation

Question 11 of 23

1

The maximum number of Windows AD user groups allowed on a FortiGate depends on the model.

Select one of the following:

  • Low-end FortiGate models support 256 Windows AD user groups. Mid-range and high-end models can support more groups. This is per VDOM, if VDOMs are enabled on FortiGate.

  • Low-end FortiGate models support 526 Windows AD user groups. Mid-range and high-end models can support more groups. This is per VDOM, if VDOMs are enabled on FortiGate.

Explanation

Question 12 of 23

1

This setting controls when the collector agent connects to individual workstations on port 139 (or port 445), and uses the remote registry service to verify if a user is still logged on to the same station. It changes the status of the user under Show logon User, to not verified when it cannot connect to the workstation. If it does connect, it verifies the user and the status remains OK. To facilitate this verification process, the remote registry service should be set to auto start on all domain member PCs.

Select one of the following:

  • Workstation verify Interval.

  • Dead entry timeout Interval.

  • IP address change verify Interval.

  • Cache user group lookup result.

Explanation

Question 13 of 23

1

This setting applies only to entries with an unverified status. When an entry is not verified, the collector starts this timer. It‘s used to age out the entry. When the timer expires, the logon is removed from the collector. From FortiGate’s perspective, there is no difference between entries that are OK and entries that are not verified. Both are considered valid.

Select one of the following:

  • Dead entry timeout Interval.

  • Workstation verify Interval.

  • IP address change verify Interval.

  • Cache user group lookup result.

Explanation

Question 14 of 23

1

This setting checks the IP addresses of logged in users and updates the FortiGate when a user‘s IP addresses change. This timer is especially important in DHCP or dynamic environments to prevent users from being locked out if they change lP addresses. The domain's DNS server should be accurate; if the DNS server does not update the affected records promptly, the collector agent's lP information will be inaccurate.

Select one of the following:

  • IP address change verify Interval.

  • Workstation verify Interval.

  • Dead entry timeout Interval.

  • Cache user group lookup result.

Explanation

Question 15 of 23

1

This setting caches the user group membership for a defined period of time. It is not updated, even if the user changes group membership in AD.

Select one of the following:

  • Cache user group lookup result.

  • IP address change verify Interval.

  • Dead entry timeout Interval.

  • Workstation verify Interval.

Explanation

Question 16 of 23

1

Uses the Windows convention NetBios: Domain\Username.

Select one of the following:

  • Standard mode

  • Advanced mode

Explanation

Question 17 of 23

1

Uses the LDAP convention: CN=User, OU=Name, DC=Domain.

Select one of the following:

  • Standard mode

  • Advanced mode

Explanation

Question 18 of 23

1

AD Group support (Select 4)

Select one or more of the following:

  • Security groups

  • Universal groups

  • Groups inside OUs

  • Local or universal groups that contain universal groups from child domains (only with Global Catalog)

  • Global Catalog

  • Local groups

Explanation

Question 19 of 23

1

If you have collector agents, either using the DC agent mode or the collector agent-based polling mode, what 880 setting should you select on FortiGate?

Select one of the following:

  • a. Poll Active Directory Server

  • b. Fortinet Single—Sign-On Agent

Explanation

Question 20 of 23

1

Filtering from FortiGate can only be done if the collector agent is in which AD access mode?

Select one of the following:

  • a. Standard

  • b. Advanced

Explanation

Question 21 of 23

1

Which of the following naming conventions does the F880 collector agent use to access the Windows AD in Standard access mode?

Select one of the following:

  • a. Windows convention — NetBios: Domain\Username

  • b. LDAP convention: CN=User, OU=Name, DC=Domain

Explanation

Question 22 of 23

1

Which logging level shows the logon events on the collector agent?

Select one of the following:

  • a. Information

  • b. Warning

Explanation

Question 23 of 23

1

The command diagnose debug fsso-polling detail displays information for which mode of FSSO?

Select one of the following:

  • a. Agentless polling mode

  • b. Collector agent based polling mode

Explanation

Previous
Check answer
Next