Quiz
6.2 V Emma
Erstelle ein kostenloses Konto, um dieses Quiz zu beenden
Speichere deinen Fortschritt und sieh dir dein Endergebnis an.
oder mit deiner E-Mail registrieren
Schon ein Konto? Anmelden
Fragen in diesem Quiz (45)
1What does the command diagnose debug fsso-polling refresh-user do?
- AIt refreshes all users learned through agentless polling.
- BIt refreshes user group information form any servers connected to the FortiGate using a collector agent.
- CIt enables agentless polling mode real-time debug.
- DIt displays status information and some statistics related with the polls done by FortiGate on each DC.
2How do you configure a FortiGate to do traffic shaping of P2P traffic, such as BitTorrent?
- AApply a traffic shaper to a BitTorrent entry in the SSL/SSH inspection profile.
- BApply a traffic shaper to a protocol options profile.
- CApply an application control profile allowing BitTorrent to a firewall policy and configure a traffic shaping policy.
- DEnable the shape option in a firewall policy with service set to BitTorrent.
3Which statement is correct based on this configuration.
- A00:0c:29:29:38:da is the virtual MAC address assigned to the secondary IP address (10.0.1.254) of the port1 interface.
- BThe IP address 10.0.1.254 is reserves for the device with the MAC address 00:0c:29:29:38:da.
- CThe MAC address 00:0c:29:29:38:da belongs to the port1 interface.
- DAccess to the network is blocked for the devices with the MAC address 00:0c:29:29:38:da and the IP address 10.0.1.254.
4What FortiGate feature can be used to allow IPv6 clients to connect to IPv4 servers?
- AIPv4-over-IPv6 IPsec
- BNAT66
- CNAT64
- DIPv6-over-IPv4 Ipsec
5View the exhibit. When Role is set to Undefined, which statement is true?
- AThe GUI provides all the configuration options available for the port 1 interface.
- BFirewall policies can be created from only the port1 interface to any interface.
- CYou cannot configure a static IP address for the port1 interface because it allows only DHCP addressing mode.
- DThe port 1 interface is reserved for management only.
6How do you configure inline SSL inspection on a firewall policy? (Choose two.)
- AEnable the SSL/SSH Inspection profile on the firewall policy.
- BEnable one or more flow-based security profiles on the firewall policy.
- CEnable one or more proxy-based security profiles on the firewall policy.
- DExecute the inline ssl inspection CLI command.
7View the exhibit. When a user attempts to connect to an HTTPS site, what is the expected result with this configuration?
- AThe user is required to authenticate before accessing sites with untrusted SSL certificates.
- BThe user is presented with certificate warnings when connecting to sites that have untrusted SSL certificates.
- CThe user is blocked from connecting to sites that have untrusted SSL certificates (no exception provided).
- DThe user is allowed access all sites with untrusted SSL certificates, without certificate warnings.
8Which file names will match the *.tiff file name pattern configured in a data leak prevention filter? (Choose two.)
- Agif.tiff
- Btiff.tiff
- Ctiff.jpeg
- Dtiff.png
9Which traffic inspection features can be executed by a security processor (SP)? (Choose three.)
- ASIP session helper
- BFlow-based web filtering
- CProxy-based antivirus
- DTCP SYN proxy
- EAttack signature matching
10An administrator is using the FortiGate built-in sniffer to capture HTTP traffic between a client and a server, however, the sniffer output shows only the packets related with TCP session setups and disconnections. Why?
- AThe administrator is running the sniffer on the internal interface only.
- BTCP traffic is being offloaded to an NP6.
- CThe FortiGate is doing content inspection.
- DThe filter used in the sniffer matches the traffic only in one direction.
11What are valid options for handling DNS requests sent directly to a FortiGates interface IP? (Choose three.)
- AIterative.
- BForward-only.
- CConditional-forward.
- DRecursive.
- ENon-recursive.
12What is FortiGate’s behavior when local disk logging is disabled?
- AOnly real-time logs appear on the FortiGate dashboard.
- BAlert emails are disabled.
- CNo logs are generated.
- DRemote logging is automatically enabled.
13An administrator has blocked Netflix login in a cloud access security inspection (CASI) profile. The administrator has also applied the CASI profile to a firewall policy.What else is required for the CASI profile to work properly?
- AYou must activate a FortiCloud account.
- BYou must apply an application control profile to the firewall policy.
- CYou must enable SSL inspection on the firewall policy.
- DYou must enable logging for security events on the firewall policy.
14What inspections are executed by the IPS engine? (Choose three.)
- AProxy-based antivirus
- BApplication control
- CProxy-based antispam
- DFlow-based web filtering
- EFlow-based data leak prevention
15An administrator needs to inspect all web traffic (including Internet web traffic) coming from users connecting to SSL VPN. How can this be achieved?
- ADisabling split tunneling
- BConfiguring web bookmarks
- CAssigning public IP addresses to SSL VPN clients
- DUsing web-only mode
16Which of the following statements about advanced AD access mode for FSSO collector agent are true? (Choose two.)
- AFortiGate can act as an LDAP client configure the group filters.
- BIt supports monitoring of nested groups.
- CIt uses the Windows convention for naming, that is, Domain\Username.
- DIt is only supported if DC agents are deployed.
17Which traffic sessions can be offloaded to a NP6 processor? (Choose two.)
- AIPv6
- BGRE
- CRIP
- DNAT64
18An administrator has enabled proxy-based antivirus scanning and configured the following settings:
Which statement about the above configuration is true?
- AFiles bigger than 10 MB are not scanned for viruses and will be blocked.
- BFortiGate scans the files in chunks of 10 MB.
- CFortiGate scans only the first 10 MB of any file.
- DFiles bigger than 10 MB are sent to the heuristics engine for scanning.
19How to configure Collector agent settings?
- AThe IP address change verify interval monitors the server IP address where the collector agent is installed, and updates the collector agent configuration if it changes.
- BThe dead entry timeout interval is used to age out entries with an unverified status.
- CThe user group cache expiry is used to age out the monitored groups.
- DThe workstation verify interval is used to periodically check if a workstation is still a domain member.
20An administrator needs to offload logging to FortiAnalyzer from a FortiGate with an internal hard drive. Which statements are true? (Choose two.)
- AFortiGate can encrypt communications using SSL encrypted OFTP traffic.
- BLog messages are transmitted as plain text in LZ4 compressed format (store-and-upload method).
- CFortiGate uses port 8080 for log transmission
- DLogs must be stored on FortiGate first, before transmitting to FortiAnalyzer
21Which component of FortiOS performs application control inspection?
- AKernel
- BIPS engine
- CAntivirus engine
- DApplication control engine
22An administrator has created a custom IPS signature. Where does the custom IPS signature have to be applied?
- AIn an application control profile.
- BIn a DoS policy.
- CIn an interface.
- DIn an IPS sensor
23How do you configure a FortiGate to do traffic shaping of P2P traffic, such as BitTorrent?
- AApply an application control profile allowing BitTorrent to a firewall policy and configure a traffic shaping policy.
- BEnable the shape option in a firewall policy with service set to BitTorrent.
- CApply a traffic shaper to a protocol options profile.
- DApply a traffic shaper to a BitTorrent entry in the SSL/SSH inspection profile.
24An administrator needs to be able to view logs for application usage on your network. What configurations are required to ensure that FortiGate generates logs for application usage activity? (Choose two.)
- AEnable an application control security profile on the firewall policy.
- BEnable logging on the firewall policy.
- CEnable a web filtering profile on the firewall policy.
- DCreate an application control policy.
25View the Exhibit.
The administrator needs to confirm that FortiGate 2 is properly routing that traffic to the 10.0.1.0/24 subnet. The administrator needs to confirm it by sending ICMP pings to FortiGate 2 from the CLI of FortiGate 1. What ping option needs to be enabled before running the ping?
- AExecute ping-options source port1.
- BExecute ping-options source 10.0.1.254
- CExecute ping-options source 10.200.1.2
- DExecute ping-options source 10.200.1.1
26Examine the exhibit.
A client workstation is connected to FortiGate port2. The FortiGate port1 is connected to an ISP router. Port2 and port3 are both configured as a software switch. What IP address must be configured in the workstation as the default gateway?
- AThe software switch interface´s IP address.
- BThe FortiGate´s management IP address.
- CThe port2´s IP address.
- DThe router´s IP address
27View the exhibit.
Based on this output, which statements are correct? (Choose two.)
- AFortiGate generated an event log for system conserve mode.
- BBy default, the FortiGate blocks new sessions.
- CFortiGate changed the global av-failopen settings to idledrop.
- DFortiGate has entered in to system conserve mode.
28Which statements about application control are true? (Choose two.)
- AIt can identify traffic from known applications, even when they are using non-standard TCP/UDP ports.
- BIt can inspect encrypted traffic.
- CEnabling application control profile in a security profile enables application control for all the traffic flowing through the FortiGate.
- DIt cannot take an action on unknown applications.
29What does the command diagnose debug fsso-polling refresh-user do?
- AIt displays status information and some statistics related with the polls done by FortiGate on each DC.
- BIt refreshes user group information form any servers connected to the FortiGate using a collector agent.
- CIt enables agentless polling mode real-time debug.
- DIt refreshes all users learned through agentless polling.
30View the exhibit.
What is the effect of the Disconnect Cluster Member operation as shown in the exhibit? (Choose two.)
- AThe system hostname is set to the FortiGate serial number.
- BThe HA mode changes to standalone.
- CThe firewall policies are deleted on the disconnected member.
- DThe port3 is configured with an IP address for management access.
31Under what circumstance would you enable LEARN as the Action on a firewall policy?
- AYou want FortiGate to automatically modify your firewall policies as it learns your networking behavior.
- BYou want FortiGate to monitor a specific security profile in a firewall policy, and provide recommendations for that profile.
- CYou want to capture data across all traffic and security vectors, and receive learning logs and a report with recommendations.
- DYou want FortiGate to compile security feature activity from various security-related logs, such as virus and attack logs.
32Which of the following settings and protocols can be used to provide secure and restrictive administrative access to FortiGate? (Choose three.)
- ASSH
- BTrusted host
- CFortiTelemetry
- DTrusted authentication
- EHTTPS
33Which statements about an IPv6-over-IPv4 IPsec configuration are correct? (Choose two.)
- AThe local gateway IP must an IPv4 address.
- BThe source quick mode selector must be an IPv4 address.
- CThe remote gateway IP must be an IPv6 address.
- DThe destination quick mode selector must be an IPv6 address.
34Which statement about this configuration is correct?
- AEthernet layer-2 loops are likely to occur.
- BThe FortiGate generates spanning tree BPDU frames.
- CThe FortiGate can block an interface if a layer-2 loop is detected.
- DThe FortiGate device forwards received spanning tree BPDU frames.
35Which of the following Fortinet hardware accelerators can be used to offload flow-based antivirus inspection? (Choose two.)
- ACP8
- BNP4
- CSP3
- DNP6
36What statement describes what DNS64 does?
- ATranslates the destination IPv6 address of the DNS traffic to an IPv4 address.
- BSynthesizes DNS AAAA records from A records.
- CConverts DNS A record lookups to AAAA record lookups.
- DTranslates the destination IPv4 address of the DNS traffic to an IPv6 address.
37Examine this output from the diagnose sys top command:
Which statements about the output are true? (Choose two)
- AAll the processes listed are in sleeping state
- Bsshd is the process consuming most CPU
- CThe sshd process is using 123 pages of memory
- Dsshd is the process consuming most memory
38View the exhibit.
This is a sniffer output of a telnet connection request from 172.20.120.186 to the port1 interface of FGT1. In this scenario. FGT1 has the following routing table. Assuming telnet service is enabled for port1, which of the following statements correctly describes why FGT1 is not responding?
- AFGT1’s port1 interface is administratively down.
- BThe connection is denied due to forward policy check.
- CThe connection is dropped due to reverse path forwarding check.
- DThe port1 cable is disconnected.
39Which statements about IP-based explicit proxy authentication are true? (Choose two.)
- AIP-based authentication consumes less FortiGates memory than session-based authentication.
- BIP-based authentication is best suited to authenticating users behind a NAT device.
- CSessions from the same source address are treated as a single user.
- DFortiGate remembers authenticated sessions using browser cookies.
40What capabilities can a FortiGate provide? (Choose three.)
- AMail relay.
- BEmail filtering.
- CVPN gateway.
- DMail server.
- EFirewall
41What methods can be used to deliver the token code to a user who is configured to use two-factor authentication? (Choose three.)
- AFortiToken
- BBrowser pop-up window
- CCode blocks
- DEmail
- ESMS phone message
42Which statements about antivirus scanning using flow-based full scan are true? (Choose two.)
- AIt does not support FortiSandbox inspection.
- BIt uses the compact antivirus database.
- CFortiGate can insert the block replacement page during the first connection attempt only if a virus is detected at the start of the TCP stream.
- DThe antivirus engine starts scanning a file after the last packet arrives.
43View the example routing table.
Which route will be selected when trying to reach 10.20.30.254?
- AThe traffic will be dropped because it cannot be routed.
- B10.20.30.0/24 [10/0] via 172.20.167.254, port3
- C0.0.0.0/0 [10/0] via 172.20.121.2, port1
- D10.20.30.0/26 [10/0] via 172.20.168.254, port2
44Which statements about FortiGate inspection modes are true? (Choose two.)
- AThe default inspection mode is proxy based.
- BSwitching from proxy-based mode to flow-based, then back to proxy-based mode, will not result in the original configuration.
- CFlow-based profiles must be manually converted to proxy-based profiles before
changing the inspection mode from flow based to proxy based. - DProxy-based inspection is not available in VDOMs operating in transparent mode.
45A FortiGate interface is configured with the following commands:
What statements about the configuration are correct? (Choose two.)
- AFortiGate can provide DNS settings to IPv6 clients.
- BIPv6 clients connected to port1 can use SLAAC to generate their IPv6 addresses.
- CFortiGate can send IPv6 router advertisements (RAs.)
- DFortiGate can provide IPv6 addresses to DHCPv6 client.
Informationen
- Beschreibung
- Quiz am 6.2 V Emma, erstellt von Ramiro Palmira am 15/12/2020.
- Autor
- Ramiro Palmira
- Sprache
- Español
- Aufrufe
- 0
- Schlagwörter
- Bewertung
- Noch keine Bewertungen Bewerte dieses Quiz