NS4

Pregunta 1 de 50

1

Which configuration objects can be selected for the Source field of a firewall policy? (Choose
two.)

Selecciona una o más de las siguientes respuestas posibles:

Firewall service
User or user group
IP Pool
FQDN address

Explicación

Pregunta 2 de 50

1

If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT
is used?

Selecciona una o más de las siguientes respuestas posibles:

The Services field prevents SNAT and DNAT from being combined in the same policy.
The Services field is used when you need to bundle several VIPs into VIP groups.
The Services field removes the requirement to create multiple VIPs for different services.
The Services field prevents multiple sources of traffic from using multiple services to connect to a
single computer.

Explicación

Pregunta 3 de 50

1

Which of the following statements about central NAT are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

IP tool references must be removed from existing firewall policies before enabling central NAT.
Central NAT can be enabled or disabled from the CLI only.
Source NAT, using central NAT, requires at least one central SNAT policy.
Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.

Explicación

Pregunta 4 de 50

1

Examine the exhibit, which shows the partial output of an IKE real-time debug.

Which of the following statement about the output is true?

Selecciona una o más de las siguientes respuestas posibles:

The VPN is configured to use pre-shared key authentication.
Extended authentication (XAuth) was successful.
Remote is the host name of the remote IPsec peer.
Phase 1 went down.

Explicación

Pregunta 5 de 50

1

An administrator is configuring an antivirus profiles on FortiGate and notices that Proxy
Options is not listed under Security Profiles on the GUI. What can cause this issue?

Selecciona una o más de las siguientes respuestas posibles:

FortiGate needs to be switched to NGFW mode.
Proxy options section is hidden by default and needs to be enabled from the Feature Visibility
menu.
Proxy options are no longer available starting in FortiOS 5.6.
FortiGate is in flow-based inspection mode.

Explicación

Pregunta 6 de 50

1

Which of the following services can be inspected by the DLP profile? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

NFS
FTP
IMAP
CIFS
HTTP-POST

Explicación

Pregunta 7 de 50

1

Examine the following web filtering log. Which statement about the log message is true?

Selecciona una o más de las siguientes respuestas posibles:

The action for the category Games is set to block.
The usage quota for the IP address 10.0.1.10 has expired
The name of the applied web filter profile is default.
The web site miniclip.com matches a static URL filter whose action is set to Warning.

Explicación

Pregunta 8 de 50

1

Which of the following static routes are not maintained in the routing table?

Selecciona una o más de las siguientes respuestas posibles:

Named Address routes
Dynamic routes
ISDB routes
Policy routes

Explicación

Pregunta 9 de 50

1

An administrator is attempting to allow access to https://fortinet.com through a firewall policy
that is configured with a web filter and an SSL inspection profile configured for deep inspection.
Which of the following are possible actions to eliminate the certificate error generated by deep
inspection? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Implement firewall authentication for all users that need access to fortinet.com.
Manually install the FortiGate deep inspection certificate as a trusted CA.
Configure fortinet.com access to bypass the IPS engine.
Configure an SSL-inspection exemption for fortinet.com.

Explicación

Pregunta 10 de 50

1

If traffic matches a DLP filter with the action set to Quarantine IP Address, what action does
FortiGate take?

Selecciona una o más de las siguientes respuestas posibles:

It notifies the administrator by sending an email.
It provides a DLP block replacement page with a link to download the file.
It blocks all future traffic for that IP address for a configured interval.
It archives the data for that IP address.

Explicación

Pregunta 11 de 50

1

An administration wants to throttle the total volume of SMTP sessions to their email server.
Which of the following DoS sensors can be used to achieve this?

Selecciona una o más de las siguientes respuestas posibles:

tcp_port_scan
ip_dst_session
udp_flood
ip_src_session

Explicación

Pregunta 12 de 50

1

View the certificate shown to the exhibit, and then answer the following question:

The CA issued this certificate to which entity?

Selecciona una o más de las siguientes respuestas posibles:

A root CA
A person
A bridge CA
A subordinate CA

Explicación

Pregunta 13 de 50

1

What information is flushed when the chunk-size value is changed in the config dlp settings?

Selecciona una o más de las siguientes respuestas posibles:

The database for DLP document fingerprinting
The supported file types in the DLP filters
The archived files and messages
The file name patterns in the DLP filters

Explicación

Pregunta 14 de 50

1

View the exhibit.

VDOM1 is operating in transparent mode VDOM2 is operating in NAT Route mode. There is an
inteface VDOM link between both VDOMs. A client workstation with the IP address 10.0.1.10/24 is
connected to port2. A web server with the IP address 10.200.1.2/24 is connected to port1.
What is required in the FortiGate configuration to route and allow connections from the client
workstation to the web server? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

A static or dynamic route in VDOM2 with the subnet 10.0.1.0/24 as the destination.
A static or dynamic route in VDOM1 with the subnet 10.200.1.0/24 as the destination.
One firewall policy in VDOM1 with port2 as the source interface and InterVDOM0 as the
destination interface.
One firewall policy in VDOM2 with InterVDOM1 as the source interface and port1 as the
destination interface.

Explicación

Pregunta 15 de 50

1

Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Log downloads from the GUI are limited to the current filter view
Log backups from the CLI cannot be restored to another FortiGate.
Log backups from the CLI can be configured to upload to FTP as a scheduled time
Log downloads from the GUI are stored as LZ4 compressed files.

Explicación

Pregunta 16 de 50

1

Examine the routing database shown in the exhibit, and then answer the following question:

Which of the following statements are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The port3 default route has the highest distance.
The port3 default route has the lowest metric.
There will be eight routes active in the routing table.
The port1 and port2 default routes are active in the routing table.

Explicación

Pregunta 17 de 50

1

Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM
is enabled on all FortiGate devices?

Selecciona una o más de las siguientes respuestas posibles:

FG-traffic VDOM
Root VDOM
Customer VDOM
Global VDOM

Explicación

Pregunta 18 de 50

1

Examine the exhibit, which contains a session diagnostic output.

Which of the following statements about the session diagnostic output is true?

Selecciona una o más de las siguientes respuestas posibles:

The session is in ESTABLISHED state.
The session is in LISTEN state.
The session is in TIME_WAIT state.
The session is in CLOSE_WAIT state.

Explicación

Pregunta 19 de 50

1

Examine the network diagram shown in the exhibit, and then answer the following question:
A firewall administrator must configure equal cost multipath (ECMP) routing on FGT1 to ensure both
port1 and port3 links are used at the same time for all traffic destined for 172.20.2.0/24. Which of
the following static routes will satisfy this requirement on FGT1? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

172.20.2.0/24 (1/0) via 10.10.1.2, port1 [0/0]
172.20.2.0/24 (25/0) via 10.10.3.2, port3 [5/0]
172.20.2.0/24 (1/150) via 10.10.1.2, port3 [10/0]
172.20.2.0/24 (1/150) via 10.30.3.2, port3 [10/0]

Explicación

Pregunta 20 de 50

1

Examine this FortiGate configuration:

config system global
ser av-failopen pass
end

Examine the output of the following debug command:

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that
require inspection?

Selecciona una o más de las siguientes respuestas posibles:

It is allowed, but with no inspection
It is allowed and inspected as long as the inspection is flow based
It is dropped.
It is allowed and inspected, as long as the only inspection required is antivirus.

Explicación

Pregunta 21 de 50

1

HTTP Public Key Pinning (HPKP) can be an obstacle to implementing full SSL inspection. What
solutions could resolve this problem? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Enable Allow Invalid SSL Certificates for the relevant security profile.
Change web browsers to one that does not support HPKP.
Exempt those web sites that use HPKP from full SSL inspection.
Install the CA certificate (that is required to verify the web server certificate) stores of users' computers.

Explicación

Pregunta 22 de 50

1

Examine the exhibit, which shows the output of a web filtering real time debug.

Why is the site www.bing.com being blocked?

Selecciona una o más de las siguientes respuestas posibles:

The web site www.bing.com is categorized by FortiGuard as Malicious Websites.
The user has not authenticated with the FortiGate yet.
The web server IP address 204.79.197.200 is categorized by FortiGuard as Malicious Websites.
The rating for the web site www.bing.com has been locally overridden to a category that is being
blocked.

Explicación

Pregunta 23 de 50

1

A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub
interfaces added to the physical interface.
Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP
addresses in different subnets.

Selecciona una o más de las siguientes respuestas posibles:

The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in
different subnets.
The two VLAN sub interfaces must have different VLAN IDs.
The two VLAN sub interfaces can have the same VLAN ID, only if they belong to different VDOMs.
The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in the
same subnet.

Explicación

Pregunta 24 de 50

1

Examine the network diagram and the existing FGTI routing table shown in the exhibit, and
then answer the following question:

An administrator has added the following static route on FGTI.
DESTINATION: 172.20.1.0/244
GATEWAY: 172.11.12.1
INTERFACE: port1
ADMINISTARTIVE DISTANCE: 10

Since the change, the new static route is not showing up in the routing table. Given the information
provided, which of the following describes the cause of this problem?

Selecciona una o más de las siguientes respuestas posibles:

The new route's destination subnet overlaps an existing route.
The new route's Distance value should be higher than 10.
The Gateway IP address is not in the same subnet as port1.
The Priority is 0, which means that this route will remain inactive.

Explicación

Pregunta 25 de 50

1

Which of the following statements about NTLM authentication are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

It is useful when users log in to DCs that are not monitored by a collector agent.
It takes over as the primary authentication method when configured alongside FSSO.
Multi-domain environments require DC agents on every domain controller.
NTLM-enabled web browsers are required.

Explicación

Pregunta 26 de 50

1

Examine the exhibit, which contains a virtual IP and firewall policy configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP
address

The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy
is configured with a VIP as the destination address.
Which IP address will be used to source NAT the Internet traffic coming from a workstation with the
IP address 10.0.1.10/24?

Selecciona una o más de las siguientes respuestas posibles:

10.200.1.10
Any available IP address in the WAN (port1) subnet 10.200.1.0/24
10.200.1.1
10.0.1.254

Explicación

Pregunta 27 de 50

1

Which statements about antivirus scanning mode are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

In proxy-based inspection mode antivirus buffers the whole file for scarring before sending it to
the client.
In flow-based inspection mode, you can use the CLI to configure antivirus profiles to use protocol
option profiles.
In proxy-based inspection mode, if a virus is detected, a replacement message may not be
displayed immediately.
In quick scan mode, you can configure antivirus profiles to use any of the available signature data
bases.

Explicación

Pregunta 28 de 50

1

Which of the following statements are true when using WPAD with the DHCP discovery
method? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

If the DHCP method fails, browsers will try the DNS method.
The browser needs to be preconfigured with the DHCP server's IP address.
The browser sends a DHCPONFORM request to the DHCP server.
The DHCP server provides the PAC file for download.

Explicación

Pregunta 29 de 50

1

Which statements correctly describe transparent mode operation? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

All interfaces of the transparent mode FortiGate device must be on different IP subnets.
Ethernet packets are forwarded based on destination MAC addresses, not IP addresses.
The transparent FortiGate is visible to network hosts in an IP traceroute.
It permits inline traffic inspection and firewalling without changing the IP scheme of the network.
FortiGate acts as transparent bridge and forwards traffic at Layer 2.

Explicación

Pregunta 30 de 50

1

A team manager has decided that while some members of the team need access to particular
website, the majority of the team does not. Which configuration option is the most effective option
to support this request?

Selecciona una o más de las siguientes respuestas posibles:

Implement a web filter category override for the specified website.
Implement web filter authentication for the specified website
Implement web filter quotas for the specified website.
Implement DNS filter for the specified website.

Explicación

Pregunta 31 de 50

1

Examine the IPS sensor configuration shown in the exhibit, and then answer the question
below.

An administrator has configured the WINDOWS_SERVERS IPS sensor in an attempt to determine
whether the influx of HTTPS traffic is an attack attempt or not. After applying the IPS sensor,
FortiGate is still not generating any IPS logs for the HTTPS traffic.
What is a possible reason for this?

Selecciona una o más de las siguientes respuestas posibles:

The IPS filter is missing the Protocol: HTTPS option.
The HTTPS signatures have not been added to the sensor.
A DoS policy should be used, instead of an IPS sensor.
A DoS policy used, instead of an IPS sensor.
The firewall policy is not using a full SSL inspection profile.

Explicación

Pregunta 32 de 50

1

View the exhibit.

Why is the administrator getting the error shown in the exhibit?

Selecciona una o más de las siguientes respuestas posibles:

The administrator must first enter the command edit global.
The administrator admin does not have the privileges required to configure global settings.
The global settings cannot be configured from the root VDOM context.
The command config system global does not exist in FortiGate.

Explicación

Pregunta 33 de 50

1

View the exhibit.

Based on this output, which statements are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The all VDOM is not synchronized between the primary and secondary FortiGate devices.
The root VDOM is not synchronized between the primary and secondary FortiGate devices.
The global configuration is synchronized between the primary and secondary FortiGate devices.
The FortiGate devices have three VDOMs.

Explicación

Pregunta 34 de 50

1

A company needs to provide SSL VPN access to two user groups. The company also needs to
display different welcome messages on the SSL VPN login screen for both user groups.
What is required in the SSL VPN configuration to meet these requirements?

Selecciona una o más de las siguientes respuestas posibles:

Different SSL VPN realms for each group.
Two separate SSL VPNs in different interfaces mapping the same ssl.root.
Two firewall policies with different captive portals.
Different virtual SSL VPN IP addresses for each group.

Explicación

Pregunta 35 de 50

1

View the exhibit.

Which of the following statements are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

This setup requires at least two firewall policies with the action set to IPsec.
Dead peer detection must be disabled to support this type of IPsec setup.
The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
This is a redundant IPsec setup.

Explicación

Pregunta 36 de 50

1

What types of traffic and attacks can be blocked by a web application firewall (WAF) profile?
(Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Traffic to botnetservers
Traffic to inappropriate web sites
Server information disclosure attacks
Credit card data leaks
SQL injection attacks

Explicación

Pregunta 37 de 50

1

An administrator has configured central DNAT and virtual IPs. Which of the following can be
selected in the firewall policy Destination field?

Selecciona una o más de las siguientes respuestas posibles:

A VIP group
The mapped IP address object of the VIP object
A VIP object
An IP pool

Explicación

Pregunta 38 de 50

1

Examine this output from a debug flow:

Why did the FortiGate drop the packet?

Selecciona una o más de las siguientes respuestas posibles:

The next-hop IP address is unreachable.
It failed the RPF check.
It matched an explicitly configured firewall policy with the action DENY.
It matched the default implicit firewall policy.

Explicación

Pregunta 39 de 50

1

View the exhibit.

What does this raw log indicate? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

FortiGate blocked the traffic.
type indicates that a security event was recorded.
10.0.1.20 is the IP address for lavito.tk.
policyid indicates that traffic went through the IPS firewall policy.

Explicación

Pregunta 40 de 50

1

View the exhibit. Which of the following statements is true regarding the configuration
settings?

Selecciona una o más de las siguientes respuestas posibles:

When a remote user accesses https://11.200.1.1:443, the FortiGate login page appears.
When a remote user accesses https://10.200.1.1:443, the FortiGate login page appears.
When a remote user accesses http: //10.200.1.1 :443, the FortiGate login page appears.
When a remote user accesses http: /110.200.1.1:443, the SSL VPN login page appears.
The settings are invalid. The administrator settings and the SSL VPN settings cannot use the same port.

Explicación

Pregunta 41 de 50

1

Which certificate value can FortiGate use to determine the relationship between the issuer
and the certificate?

Selecciona una o más de las siguientes respuestas posibles:

Subject Key Identifier value
SMMIE Capabilities value
Subject value
Subject Alternative Name value

Explicación

Pregunta 42 de 50

1

To complete the final step of a Security Fabric configuration, an administrator must authorize
all the devices on which device?

Selecciona una o más de las siguientes respuestas posibles:

FortiManager
Root FortiGate
FortiAnalyzer
Downstream FortiGate

Explicación

Pregunta 43 de 50

1

Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
ADVPN is only supported with IKEv2.
Tunnels are negotiated dynamically between spokes.
Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Explicación

Pregunta 44 de 50

1

Which of the following conditions must be met in order for a web browser to trust a web
server certificate signed by a third-party CA?

Selecciona una o más de las siguientes respuestas posibles:

The public key of the web server certificate must be installed on the browser.
The web-server certificate must be installed on the browser.
The CA certificate that signed the web-server certificate must be installed on the browser.
The private key of the CA certificate that signed the browser certificate must be installed on the browser.

Explicación

Pregunta 45 de 50

1

View the exhibit.

Based on the configuration shown in the exhibit, what statements about application control behavior
are true?

Selecciona una o más de las siguientes respuestas posibles:

Access to all unknown applications will be allowed.
Access to browser-based Social.Media applications will be blocked.
Access to mobile social media applications will be blocked.
Access to all applications in Social.Media category will be blocked.

Explicación

Pregunta 46 de 50

1

An administrator needs to create an SSL-VPN connection for accessing an internal server
using the bookmark Port Forward. What step is required for this configuration?

Selecciona una o más de las siguientes respuestas posibles:

Configure an SSL VPN realm for clients to use the port forward bookmark.
Configure the client application to forward IP traffic through FortiClient.
Configure the virtual IP address to be assigned t the SSL VPN users.
Configure the client application to forward IP traffic to a Java applet proxy.

Explicación

Pregunta 47 de 50

1

A FortiGate device has multiple VDOMs. Which statement about an administrator account
configured with the default prof_admin profile is true?

Selecciona una o más de las siguientes respuestas posibles:

It can create administrator accounts with access to the same VDOM.
It cannot have access to more than one VDOM.
It can reset the password for the admin account.
It can upgrade the firmware on the FortiGate device.

Explicación

Pregunta 48 de 50

1

When override is enabled, which of the following shows the process and selection criteria
that are used to elect the primary FortiGate in an HA cluster?

Selecciona una o más de las siguientes respuestas posibles:

Connected monitored ports > HA uptime > priority > serial number
Priority > Connected monitored ports > HA uptime > serial number
Connected monitored ports > priority > HA uptime > serial number
HA uptime > priority > Connected monitored ports > serial number

Explicación

Pregunta 49 de 50

1

Which Statements about virtual domains (VDOMs) arc true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Transparent mode and NAT/Route mode VDOMs cannot be combined on the same FortiGate.
Each VDOM can be configured with different system hostnames.
Different VLAN sub-interface of the same physical interface can be assigned to different VDOMs.
Each VDOM has its own routing table.

Explicación

Pregunta 50 de 50

1

Which of the following conditions are required for establishing an IPSec VPN between two
FortiGate devices?
(Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

If XAuth is enabled as a server in one peer, it must be enabled as a client in the other peer.
If the VPN is configured as route-based, there must be at least one firewall policy with the action set to IPSec.
If the VPN is configured as DialUp User in one peer, it must be configured as either Static IP Address or Dynamic DNS in the other peer.
If the VPN is configured as a policy-based in one peer, it must also be configured as policy-based in the other peer.

	Creado por Carlos Garcia hace más de 3 años

Test sobre NS4, creado por Carlos Garcia el 27/04/2021.

Pregunta 1 de 50

Which configuration objects can be selected for the Source field of a firewall policy? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 2 de 50

If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT is used?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 3 de 50

Which of the following statements about central NAT are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 4 de 50

Examine the exhibit, which shows the partial output of an IKE real-time debug. Which of the following statement about the output is true?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 5 de 50

An administrator is configuring an antivirus profiles on FortiGate and notices that Proxy Options is not listed under Security Profiles on the GUI. What can cause this issue?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 6 de 50

Which of the following services can be inspected by the DLP profile? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 7 de 50

Examine the following web filtering log. Which statement about the log message is true?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 8 de 50

Which of the following static routes are not maintained in the routing table?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 9 de 50

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 10 de 50

If traffic matches a DLP filter with the action set to Quarantine IP Address, what action does FortiGate take?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 11 de 50

An administration wants to throttle the total volume of SMTP sessions to their email server. Which of the following DoS sensors can be used to achieve this?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 12 de 50

View the certificate shown to the exhibit, and then answer the following question: The CA issued this certificate to which entity?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 13 de 50

What information is flushed when the chunk-size value is changed in the config dlp settings?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 14 de 50

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 15 de 50

Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 16 de 50

Examine the routing database shown in the exhibit, and then answer the following question: Which of the following statements are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 17 de 50

Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 18 de 50

Examine the exhibit, which contains a session diagnostic output. Which of the following statements about the session diagnostic output is true?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 19 de 50

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 20 de 50

Examine this FortiGate configuration: config system global ser av-failopen pass end Examine the output of the following debug command: Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 21 de 50

Which configuration objects can be selected for the Source field of a firewall policy? (Choose
two.)

If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT
is used?

Examine the exhibit, which shows the partial output of an IKE real-time debug.

Which of the following statement about the output is true?

An administrator is configuring an antivirus profiles on FortiGate and notices that Proxy
Options is not listed under Security Profiles on the GUI. What can cause this issue?

If traffic matches a DLP filter with the action set to Quarantine IP Address, what action does
FortiGate take?

An administration wants to throttle the total volume of SMTP sessions to their email server.
Which of the following DoS sensors can be used to achieve this?

View the certificate shown to the exhibit, and then answer the following question:

The CA issued this certificate to which entity?

Examine the routing database shown in the exhibit, and then answer the following question:

Which of the following statements are correct? (Choose two.)

Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM
is enabled on all FortiGate devices?

Examine the exhibit, which contains a session diagnostic output.

Which of the following statements about the session diagnostic output is true?

Examine this FortiGate configuration:

config system global
ser av-failopen pass
end

Examine the output of the following debug command:

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that
require inspection?

HTTP Public Key Pinning (HPKP) can be an obstacle to implementing full SSL inspection. What
solutions could resolve this problem? (Choose two.)

Examine the exhibit, which shows the output of a web filtering real time debug.

Why is the site www.bing.com being blocked?

A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub
interfaces added to the physical interface.
Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP
addresses in different subnets.

Which of the following statements are true when using WPAD with the DHCP discovery
method? (Choose two.)

A team manager has decided that while some members of the team need access to particular
website, the majority of the team does not. Which configuration option is the most effective option
to support this request?

View the exhibit.

Why is the administrator getting the error shown in the exhibit?

View the exhibit.

Based on this output, which statements are correct? (Choose two.)

A company needs to provide SSL VPN access to two user groups. The company also needs to
display different welcome messages on the SSL VPN login screen for both user groups.
What is required in the SSL VPN configuration to meet these requirements?

View the exhibit.

Which of the following statements are correct? (Choose two.)

What types of traffic and attacks can be blocked by a web application firewall (WAF) profile?
(Choose three.)

An administrator has configured central DNAT and virtual IPs. Which of the following can be
selected in the firewall policy Destination field?