FCSS_EFW_AD-7.6 practice questions 31–40

1. Question 31 · 66 in bank

   To secure your enterprise network traffic, which step does FortiGate perform first, when handling the first packets of a session?

   • ADecryption
   • BInstallation of the session key in the network processor (NP)
   • CA reverse path forwarding (RPF) check
   • DIP integrity header checking

   Show answer

   Answer: D

   Next question

2. Question 32 · 66 in bank

   You must update a firewall policy to block multiple websites within the subnet 172.165.58.0/24. What must you do to block these addresses efficiently?

   • ACreate an application sensor and apply the application control profile to the firewall policy.
   • BCreate a URL niter and apply the web filter profile to the firewall policy.
   • CCreate an IP address external connector and apply it to the destination field of the firewall policy.
   • DCreate an Internet Service Database (ISDB) group and apply it to the destination field of the firewall policy.

   Show answer

   Answer: C

   Next question

3. Question 33 · 66 in bank

   You need to install a new intrusion prevention system (IPS) profile without triggering false positives that can impact applications and disrupt normal traffic flow. How can you prevent false positives on IPS analysis?

   • AUse an IPS profile with action default and analyze the applications.
   • BUse the IPS profile extension to select an OS, protocol, and application for all the network internal services and users to prevent false positives.
   • CUse an IPS profile with Scan Outgoing Connections to block botnets, which can create false positives.
   • DUse an IPS profile with action monitor; however, you must be aware that this can compromise network integrity.

   Show answer

   Answer: D

   Next question

4. Question 34 · 66 in bank

   Select 2

   If you implement IKEv2 in a VPN topology, which two statements are true? (Choose two.)

   • AUnlike IKEv1, it supports mode config.
   • BIt includes stronger Diffie-Hellman (DH) groups, such as Elliptic Curve (ECP) groups.
   • CIt supports the extensible authentication protocol (EAP).
   • DIt exchanges a minimum of two messages to establish a secure tunnel.

   Show answer

   Answer: BC

   Next question

5. Question 35 · 66 in bank

   During the maintenance window, you must sniff all the traffic going through a specific firewall policy, which is handled by NP6 interfaces. The output of the sniffer trace provides just a few packets. Why is the output of the sniffer trace limited?

   • Aauto-asic-offload is set to enable in the firewall policy.
   • BThe option npudbg is not added in the diagnose sniff packet command.
   • CThis is an ultralow latency interface.
   • Dinspection-mode is set to proxy in the firewall policy.

   Show answer

   Answer: A

   Next question

6. Question 36 · 66 in bank

   You must use FortiManager to standardize the deployment of same model FortiGate devices across branches with consistent interface roles and policy packages. In this scenario, what is the recommended best practice for interface assignment?

   • ACreate normalized interface types per-platform, to automatically recognize device layer interfaces based on the FortiGate model and interface name.
   • BCreate interfaces using CLI scripts and use those interfaces in FortiGate policy packages.
   • CEnable metadata variables to use dynamic configurations on the standard interfaces of FortiManager.
   • DUse the install on feature in the policy package to automatically assign the interfaces across branches.

   Show answer

   Answer: A

   Next question

7. Question 37 · 66 in bank

   Refer to the exhibit.

   

   The FortiGuard security services on a FortiGate device is shown. You need to find the web filter database signature on FortiGate to resolve issues with websites not being filtered correctly in a flow-mode web filter profile. Why is the web filter database version not visible on the GUI, like it is with the intrusion prevention system (IPS) definitions?

   • AThe web filter database is stored locally, but you must use the CLI command diagnose autoupdate versions to see the web filter database version.
   • BThe web filter database is accessible only after you add a web filter security profile in a firewall policy
   • CThe web filter database is stored locally on FortiGate, but you must enable Web Fitter in the Feature Visibility section to see the web filter database version.
   • DThe web filter database is not hosted on FortiGate; FortiGate queries FortiGuard or FortManager for web filter ratings on demand.

   Show answer

   Answer: D

   Next question

8. Question 38 · 66 in bank

   You configured the FortiGate devices in an enterprise network to join the Fortinet Security Fabric. You have a list of IP addresses that must be blocked by the data center firewall. The list is updated daily. How can you automate updates to the firewall policy to add the IP addresses from the daily updated list?

   • AWith an external connector from External Feeds
   • BWith metadata variables in FortiManager
   • CWith a CLI script in FortiManager
   • DWith a Security Fabric automation

   Show answer

   Answer: A

   Next question

9. Question 39 · 66 in bank

   Select 2

   You must segment an enterprise network. Which two features could you use? (Choose two.)

   • AVLAN
   • BZero Trust Network Access (ZTNA)
   • CIPsec
   • DVDOM

   Show answer

   Answer: AD

   Next question

10. Question 40 · 66 in bank

    Refer to the exhibit.

    

    The partial output of a troubleshooting command is shown. You are using IPsec on FortiGate extensively. Many tunnels are showing information that is similar to the output shown in the exhibit. Which statement about your IPsec use is correct?

    • AOnly the outbound IPsec SA is copied to the NPU.
    • BIPsec SAs cannot be offloaded.
    • CThe two IPsec security associations (SA), inbound and outbound, are copied to the network processing unit (NPU).
    • DOnly the inbound IPsec SA is copied to the NPU.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_EFW_AD-7.6 practice, question 31. 66 questions available.