En Es Ea 3

1. 1Which of the following represents the correct order of criteria used for the selection of a
   Master unit within a FortiGate High Availability (HA) cluster when master override is
   disabled?

   1. A1.port monitor, 2. unit priority, 3. up time, 4. serial number
   2. B1.port monitor, 2. up time, 3. unit priority, 4. serial number
   3. C1. unit priority, 2. up time, 3. port monitor, 4. serial number
   4. D1. up time, 2. unit priority, 3. port monitor, 4. serial number
2. 2Which of the following statements are correct regarding virtual domains (VDOMs)? (Select all that apply.)

   1. AVDOMs share firmware versions, as well as antivirus and IPS databases.
   2. BOnly administrative users with a ‘super_admin’ profile will be able to enter multiple
      VDOMs to make configuration changes.
   3. CA management VDOM handles SNMP, logging, alert email, and FDN-based updates.
   4. DVDOMs divide a single FortiGate unit into two or more virtual units that function as
      multiple, independent units.
3. 3Data Leak Prevention archiving gives the ability to store files and message data onto a
   FortiAnalyzer unit for which of the following types of network traffic? (Select all that apply.)

   1. AIPSec
   2. BSMTP
   3. CPOP3
   4. DHTTP
   5. ESNMP
4. 4Which of the following statements are correct regarding Application Control? (Select all that apply.)

   1. AApplication Control is based on the IPS engine.
   2. BApplication Control cannot be applied to SSL encrypted traffic.
   3. CApplication Control is based on the AV engine.
   4. DApplication Control can be applied to SSL encrypted traffic.
5. 5For Data Leak Prevention, which of the following describes the difference between the block and quarantine actions?

   1. AA block action has a finite duration. A quarantine action must be removed by an administrator.
   2. BA block action is used for known users. A quarantine action is used for unknown users.
   3. CA block action prevents the transaction. A quarantine action archives the data.
   4. DA block action prevents the transaction. A quarantine action blocks all future
      transactions, regardless of the protocol.
6. 6How can DLP file filters be configured to detect Office 2010 files? (Select all that apply.)

   1. AFile TypE. Archive(zip)
   2. BFile TypE. Unknown Filetype(unknown)
   3. CFile NamE. “*.ppt”, “*.doc”, “*.xls”
   4. DFile NamE. “*.pptx”, “*.docx”, “*.xlsx”
   5. EFile TypE. Microsoft Office(msoffice)
7. 7When using SD-WAN, how do you configure the next-hop gateway address for a member interface so that FortiGate can forward Internet traffic?

   1. AIt must be configured in a static route using the sdwan virtual interface.
   2. BIt must be provided in the SD-WAN member interface configuration.
   3. CIt must be configured in a policy-route using the sdwan virtual interface.
   4. DIt must be learned automatically through a dynamic routing protocol
8. 8Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?

   1. AThe public key of the web server certificate must be installed on the browser.
   2. BThe web-server certificate must be installed on the browser.
   3. CThe CA certificate that signed the web-server certificate must be installed on the browser.
   4. DThe private key of the CA certificate that signed the browser certificate must be installed on the browser.
9. 9Which statement is true regarding SSL VPN timers? (Choose two.)

   1. AAllow to mitigate DoS attacks from partial HTTP requests.
   2. BSSL VPN settings do not have customizable timers.
   3. CDisconnect idle SSL VPN users when a firewall policy authentication timeout occurs.
   4. DPrevent SSL VPN users from being logged out because of high network latency.
10. 10An administrator wants to block HTTP uploads. Examine the exhibit, which contains the proxy address created for that purpose.
    Where must the proxy address be used?

    

    1. AAs the source in a firewall policy.
    2. BAs the source in a proxy policy.
    3. CAs the destination in a firewall policy
    4. DAs the destination in a proxy policy.

11. 11Which statement is true regarding the policy ID number of a firewall policy?

    1. ADefines the order in which rules are processed.
    2. BRepresents the number of objects used in the firewall policy.
    3. CRequired to modify a firewall policy using the CLI.
    4. DChanges when firewall policies are reordered.
12. 12Which of the following route attributes must be equal for static routes to be eligible for equal cost multipath (ECMP) routing? (Choose two.)

    1. APriority
    2. BMetric
    3. CDistance
    4. DCost
13. 13Which statement about FortiGuard services for FortiGate is true?

    1. AThe web filtering database is downloaded locally on FortiGate.
    2. BAntivirus signatures are downloaded locally on FortiGate.
    3. CFortiGate downloads IPS updates using UDP port 53 or 8888
    4. DFortiAnalyzer can be configured as a local FDN to provide antivirus and IPS updates.
14. 14An administrator needs to strengthen the security for SSL VPN access. Which of the following statements are best practices to do so? (Choose three.)

    1. AConfigure split tunnelling for content inspection.
    2. BConfigure host restrictions by IP or MAC address.
    3. CConfigure two-factor authentication using security certificates.
    4. DConfigure SSL offloading to a content processor (FortiASIC).
    5. EConfigure a client integrity check (host-check).
15. 15An administrator has configured central DNAT and virtual IPs. Which of the following can be selected in the firewall policy Destination field?

    1. AA VIP group
    2. BThe mapped IP address object of the VIP object
    3. CA VIP object
    4. DAn IP pool
16. 16Examine the diagnostic output shown exhibit. Which of the following options is the most likely cause of this issue?

    

    1. ANAT port exhaustion
    2. BHigh CPU usage
    3. CHigh memory usage
    4. DHigh session timeout value
17. 17A company needs to provide SSL VPN access to two user groups. The company also needs to display different welcome messages on the SSL VPN login screen for both user groups.

    1. ADifferent SSL VPN realms for each group.
    2. BTwo separate SSL VPNs in different interfaces mapping the same ssl.root.
    3. CTwo firewall policies with different captive portals.
    4. DDifferent virtual SSL VPN IP addresses for each group.
18. 18Which of the following FortiGate configuration tasks will create a route in the policy route table? (Choose two.)

    1. AStatic route created with a Named Address object
    2. BStatic route created with an Internet Services object
    3. CSD-WAN route created for individual member interfaces
    4. DSD-WAN rule created to route traffic based on link latency
19. 19Which statements about a One-to-One IP pool are true? (Choose two.)

    1. AIt is used for destination NAT.
    2. BIt allows the fixed mapping of an internal address range to an external address range.
    3. CIt does not use port address translation.
    4. DIt allows the configuration of ARP replies.
20. 20What files are sent to FortiSandbox for inspection in flow-based inspection mode?

    1. AAll suspicious files that do not have their hash value in the FortiGuard antivirus signature database.
    2. BAll suspicious files that are above the defined oversize limit value in the protocol options.
    3. CAll suspicious files that match patterns defined in the antivirus profile.
    4. DAll suspicious files that are allowed to be submitted to FortiSandbox in the antivirus profile.
21. 21Which two statements about NTLM authentication are correct? (Choose two.)

    1. AIt requires DC agents on every domain controller when used in multidomain environments.
    2. BIt is useful when users log in to DCs that are not monitored by a collector agent.
    3. CIt requires NTLM-enabled web browsers.
    4. DIt takes over as the primary authentication method when configured alongside FSSO.
22. 22You are configuring the root FortiGate to implement the Security Fabric. You are configuring port10 to communicate with a downstream FortiGate. The exhibit shows the default Edit Interface.
    
    When configuring the root FortiGate to communicate with a downstream FortiGate, which two settings must you configure? (Choose two.)

    

    1. AEnable Device Detection
    2. BAdministrative Access: FortiTelemetry.
    3. CIP/Network Mask.
    4. DRole: Security Fabric.
23. 23What criteria does FortiGate use to look for a matching firewall policy to process traffic? (Choose two.)

    1. AServices defined in the firewall policy.
    2. BIncoming and outgoing interfaces
    3. CHighest to lowest priority defined in the firewall policy.
    4. DLowest to highest policy ID number.
24. 24Consider a new IPsec deployment with the following criteria:
    
     All satellite offices must connect to the two HQ sites.
     The satellite offices do not need to communicate directly with other satellite offices.
     Backup VPN is not required.
     The design should minimize the number of tunnels being configured.
    
    Which topology should you use to satisfy all of the requirements?

    1. APartial Mesh
    2. BRedundant
    3. CFull Mesh
    4. DHub and Spoke
25. 25When using WPAD DNS method, which FQDN format do browsers use to query the DNS server?

    1. Asrv_proxy./wpad.dat
    2. Bsrv_tcp.wpad.
    3. Cwpad.
    4. Dprodxy..wpad
26. 26Why is the site www.bing.com being blocked?

    

    1. AThe web site www.bing.com is categorized by FortiGuard as Malicious Websites.
    2. BThe user has not authenticated with the FortiGate yet.
    3. CThe web server IP address 204.79.197.200 is categorized by FortiGuard as Malicious Websites.
    4. DThe rating for the web site www.bing.com has been locally overridden to a category that is being blocked.
27. 27A team manager has decided that, while some members of the team need access to a particular website, the majority of the team does not.
    
    Which configuration option is the most effective way to support this request?

    1. AImplement web filter authentication for the specified website.
    2. BImplement a web filter category override for the specified website.
    3. CImplement DNS filter for the specified website
    4. DImplement web filter quotas for the specified website.
28. 28What three FortiGate components are tested during the hardware test? (Choose three.)

    1. ACPU
    2. BAdministrative access
    3. CHA heartbeat
    4. DHard disk
    5. ENetwork Interfaces
29. 29Which two statements about virtual domains (VDOMs) are true? (Choose two.)

    1. ATransparent mode and NAT mode VDOMs cannot be combined on the same FortiGate.
    2. BEach VDOM can be configured with different system hostnames.
    3. CDifferent VLAN subinterfaces of the same physical interface can be assigned to different VDOMs.
    4. DEach VDOM has its own routing table.
30. 30The FSSO collector agent set to advanced access mode for the Windows Active Directory uses which convention?

    1. ALDAP
    2. BWindows
    3. CRSSO
    4. DNTLM
31. 31Which two statements about antivirus scanning mode are true? (Choose two.)

    1. AIn proxy-based inspection mode, antivirus buffers the whole file for scanning, before sending it to the client.
    2. BIn full scan flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.
    3. CIn proxy-based inspection mode, files bigger than the buffer size are scanned.
    4. DIn quick scan mode, you can configure antivirus profiles to use any of the available antivirus signature databases.
32. 32In an HA cluster operating in active-active mode, which path is taken by the SYN packet of an HTTP session that is offloaded to a secondary FortiGate?

    1. AClient > secondary FortiGate > primary FortiGate > web server
    2. BClient > primary FortiGate > secondary FortiGate > primary FortiGate > web server
    3. CClient > primary FortiGate > secondary FortiGate > web server
    4. DClient > secondary FortiGate > web server
33. 33Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?

    1. AFG-traffic VDOM
    2. BRoot VDOM
    3. CCustomer VDOM
    4. DGlobal VDOM
34. 34What will happen to unauthenticated users when an active authentication policy is followed by a fall through policy without authentication?

    

    1. AThe user must log in again to authenticate.
    2. BThe user will be denied access to resources without authentication.
    3. CThe user will not be prompted for authentication.
    4. DUser authentication happens at an interface level

Description

Quiz on En Es Ea 3 , created by Guy F on 14/07/2021.

Author

Guy F

Language

English

Views

5

Tags

none

Rating

No ratings yet

Rate this quiz

Rate this quiz

More on Firewalls and Access Control Lists