Quiz
FSSO II
Questions in this quiz (23)
1TCP ports 139 its optional, only TCP port 445 must be opened between collector agents or FortiGate and all hosts.
- ATrue
- BFalse
2Which is the recommended mode for FSSO deployments?
- Aa. DC agent mode
- Bb. Polling mode: Agentless
3Which FSSO mode requires more FortiGate system resources (CPU and RAM)?
- Aa. Polling mode: Collector agent-based
- Bb. Polling mode: Agentless
4Is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users.
- ANTLM
- BWinSecLog
- CNetAPI
- DWMI
5NTLM
- ANT LAN Manager
- BNetwork LAN Microsoft
6Simple domain configurations for NTLM authentication
- Aa. do not require a DC agent
- Bb. require only one global collector agent
7When performing NTLM authentication, what information does the web browser supply to FortiGate?
- Aa. The user's credentials (username and password)
- Bb. The user’s user ID, IP address, and group membership
8Which of the following may cause an NTLM authentication to occur?
- Aa. Traffic coming from an IP on the F850 user list
- Bb. Traffic coming from an IP not on the FSSO user list
9The FSSO collector agent can access Windows AD in one of two modes:
- AStandard
Advanced - BAgent mode
Polling mode
- AStandard
10Notice that you do not need to match the F880 version with your exact FortiGate firmware version. When installing FSSO, grab the latest collector agent for your major release. You do however, need to match the dcagent version to the collector agent version.
- ATrue
- BFalse
11The maximum number of Windows AD user groups allowed on a FortiGate depends on the model.
- ALow-end FortiGate models support 256 Windows AD user groups. Mid-range and high-end models can support more groups. This is per VDOM, if VDOMs are enabled on FortiGate.
- BLow-end FortiGate models support 526 Windows AD user groups. Mid-range and high-end models can support more groups. This is per VDOM, if VDOMs are enabled on FortiGate.
12This setting controls when the collector agent connects to individual workstations on port 139 (or port 445), and uses the remote registry service to verify if a user is still logged on to the same station. It changes the status of the user under Show logon User, to not verified when it cannot connect to the workstation. If it does connect, it verifies the user and the status remains OK. To facilitate this verification process, the remote registry service should be set to auto start on all domain member PCs.
- AWorkstation verify Interval.
- BDead entry timeout Interval.
- CIP address change verify Interval.
- DCache user group lookup result.
13This setting applies only to entries with an unverified status. When an entry is not verified, the collector starts this timer. It‘s used to age out the entry. When the timer expires, the logon is removed from the collector. From FortiGate’s perspective, there is no difference between entries that are OK and entries that are not verified. Both are considered valid.
- ADead entry timeout Interval.
- BWorkstation verify Interval.
- CIP address change verify Interval.
- DCache user group lookup result.
14This setting checks the IP addresses of logged in users and updates the FortiGate when a user‘s IP addresses change. This timer is especially important in DHCP or dynamic environments to prevent users from being locked out if they change lP addresses. The domain's DNS server should be accurate; if the DNS server does not update the affected records promptly, the collector agent's lP information will be inaccurate.
- AIP address change verify Interval.
- BWorkstation verify Interval.
- CDead entry timeout Interval.
- DCache user group lookup result.
15This setting caches the user group membership for a defined period of time. It is not updated, even if the user changes group membership in AD.
- ACache user group lookup result.
- BIP address change verify Interval.
- CDead entry timeout Interval.
- DWorkstation verify Interval.
16Uses the Windows convention NetBios: Domain\Username.
- AStandard mode
- BAdvanced mode
17Uses the LDAP convention: CN=User, OU=Name, DC=Domain.
- AStandard mode
- BAdvanced mode
18AD Group support (Select 4)
- ASecurity groups
- BUniversal groups
- CGroups inside OUs
- DLocal or universal groups that contain universal groups from child domains (only with Global Catalog)
- EGlobal Catalog
- FLocal groups
19If you have collector agents, either using the DC agent mode or the collector agent-based polling mode, what 880 setting should you select on FortiGate?
- Aa. Poll Active Directory Server
- Bb. Fortinet Single—Sign-On Agent
20Filtering from FortiGate can only be done if the collector agent is in which AD access mode?
- Aa. Standard
- Bb. Advanced
21Which of the following naming conventions does the F880 collector agent use to access the Windows AD in Standard access mode?
- Aa. Windows convention — NetBios: Domain\Username
- Bb. LDAP convention: CN=User, OU=Name, DC=Domain
22Which logging level shows the logon events on the collector agent?
- Aa. Information
- Bb. Warning
23The command diagnose debug fsso-polling detail displays information for which mode of FSSO?
- Aa. Agentless polling mode
- Bb. Collector agent based polling mode
Information
- Description
- User has deleted their subject information Quiz on FSSO II, created by Deleted user on 11/04/2019.
- Author
- Deleted user
- Language
- English
- Views
- 25
- History
- Created on 11 Apr 2019 · updated on 11 Apr 2019
- Tags