FCSS_EFW_AD-7.6 practice questions 21–30

1. Question 21 · 66 in bank

   Select 2

   Refer to the exhibit.

   

   A physical topology along with a traffic log is shown. You are using FortiAnalyzer to monitor traffic from the device with IP address 10.0.2.51, which is located behind the FortiGate internal segmentation firewall (ISFW) device. Unified threat management (UTM) is not enabled in the firewall policy on the HQ-ISFW device, and you are surprised to see a log with the action Malware, as shown in the exhibit. What are two reasons why FortiAnalyzer would display this log? (Choose two.)

   • ASecurity rating is enabled in HQ-ISFW.
   • BUTM is enabled in the firewall policy in HQ-NGFW-1.
   • CHQ-ISFW is in a Security Fabric environment.
   • DHQ-ISFW is not connected to FortiAnalyzer and traffic must go through HQ-NGFW-1.

   Show answer

   Answer: BC

   Next question

2. Question 22 · 66 in bank

   Select 2

   Refer to the exhibit.

   

   A normalized interface LAN on FortiManager is shown. Which two statements about this interface configuration are correct? (Choose two.)

   • AThe normalized interface LAN will be mapped to the private interface for FortiGate-VM64 model devices.
   • BThe normalized interface LAN will be mapped to the wireless interface for FortiGate-81E model devices.
   • CThe normalized interface LAN will be mapped to the port2 interface for NGFW-1 [Core2].
   • DThe normalized interface LAN will be mapped to the Human Resources interface for any FortiGate-40F model devices.

   Show answer

   Answer: AC

   Next question

3. Question 23 · 66 in bank

   Refer to the exhibits.

   

   A policy package conflict status and information from the import device wizard in the Core1 VDOM are shown. When you import a policy package, the following message appears for the Web_restrictions web filter profile and the deep-inspection SSL-SSH profile: The following objects were found having conflicts. Please confirm your settings, then continue. The Web_restrictions and deep-inspection profiles are used by other FortiGate devices within FortiManager. Which step must you take to resolve the issue?

   • ACreate uniquely named objects on FortiGate and reimport them into the policy package.
   • BRetrieve the FortiGate configuration to automatically export correct objects and policies.
   • CUse non-default object values because FortiManager is unable to alter default values.
   • DSelect the FortiManager configuration that accepts changes on FortiManager and preserves existing configurations on FortiGate devices.

   Show answer

   Answer: A

   Next question

4. Question 24 · 66 in bank

   Select 2

   You are checking an enterprise network and see a suspicious packet with the MAC address 00:09:0f:09:18:81. Which two statements about the suspicious packet are correct? (Choose two.)

   • AThe suspicious packet is related to a cluster with a group-id value lower than 255.
   • BThe suspicious packet corresponds to a port with a physical index equal to 2.
   • CThe suspicious packet is related to a cluster that has VDOMs enabled
   • DThe suspicious packet is related to a cluster configured with the FortiGate Session Life Protocol (FGSP).

   Show answer

   Answer: AC

   Next question

5. Question 25 · 66 in bank

   In a transparent VDOM interface, what does the command set forward-domain <domain_ID> do?

   • AIt allows the interface to access the configured admin domain.
   • BIt restricts the interface to managing traffic from only the specified VLAN, effectively segregating network traffic.
   • CIt isolates traffic within a specific VLAN by assigning a broadcast domain to an interface based on the VLAN ID.
   • DIt assigns a unique domain ID to the interface, allowing it to operate across multiple VLANs within the same VDOM.

   Show answer

   Answer: C

   Next question

6. Question 26 · 66 in bank

   Which action can you take on FortiGate to block traffic using intrusion prevention system (IPS) protocol decoders, focusing on network transmission patterns and application signatures?

   • AEnable inspect all ports in flow mode
   • BUse application control to limit non-URL-based software handling.
   • CEnable application detection-based SD-WAN rules.
   • DUse the DNS filter to block application signatures and protocol decoders.

   Show answer

   Answer: B

   Next question

7. Question 27 · 66 in bank

   Select 2

   During the last network migration, the IT department discovered that all zero phase selectors in phase 2 IPsec configurations impact network operations. What are two valid recommendations to prevent potential invalid paths during future migrations? (Choose two.)

   • AConfigure an IP address on the IPsec interface of each firewall to establish unique peer connections and avoid impacting network operations.
   • BConfigure the VPN with the exact segments that will be encrypted in the phase two selectors.
   • CConfigure an IPsec aggregate to create redundancy between each firewall peer.
   • DConfigure routing protocols to specify allowed subnets over the tunnel.

   Show answer

   Answer: BD

   Next question

8. Question 28 · 66 in bank

   You need an internal segmentation firewall (ISFW) FortiGate for a campus with an ultralow latency interface. Which FortiGate should you select?

   • AFortiGate with ports X5 to X8.
   • BFortiGate with only one NP6.
   • CFortiGate with ports connected to a CP10.
   • DFortiGate with ports connected to a SP5.

   Show answer

   Answer: A

   Next question

9. Question 29 · 66 in bank

   A vulnerability scan report has revealed that a user has generated traffic to the website example.com using a weak SSUTLS version supported by the HTTPS web server. What can you do to block all outdated SSL/TLS versions on any HTTPS web server to prevent possible attacks on user traffic?

   • AEnable server certificate SNI check in the SSL/SSH inspection profile.
   • BEnable auto-detection of outdated SSL/TLS versions in the SSL/SSH inspection profile to block vulnerable websites.
   • CBlock invalid SSL certificates in the SSL/SSH inspection profile.
   • DConfigure the unsupported SSL version and set the minimum allowed SSL version in the HTTPS settings of the SSL/SSH inspection profile.

   Show answer

   Answer: D

   Next question

10. Question 30 · 66 in bank

    You are setting up an ADVPN configuration and want to ensure that peer IDs are not exposed during VPN establishment. Which protocol can the administrator use to enhance security?

    • AUse SSL VPN tunnel mode with certificates.
    • BUse IKEv2, which encrypts peer IDs and prevents exposure.
    • CUse IKEv1 aggressive mode with certificates.
    • DUse IKEv1 main mode with AES-GCM security proposal.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_EFW_AD-7.6 practice, question 21. 66 questions available.