FCSS_EFW_AD-7.6 practice questions 51–60

1. Question 51 · 66 in bank

   Refer to the exhibits.

   

   

   

   A network topology, firewall policy, and SSL/SSH inspection profile configuration are shown. What must you configure on firewall policy ID 2 to detect HTTPS attacks that target a Linux server hosting the website www.acmetest.com?

   • AEnable SSL inspection of the SSL server and upload the certificate of the Linux server website to the SSL/SSH inspection profile.
   • BEnable HTTPS in the protocol port mapping of the deep-inspection SSL/SSH inspection profile.
   • CSet ips-sensor to IPS_block in the firewall policy.
   • DSet inspection-mode to f1ow to analyze the HTTPS packets and make sure that they are as expected.

   Show answer

   Answer: A

   Next question

2. Question 52 · 66 in bank

   You want to scale the IBGP sessions and optimize the routing table in an IBGP network. Which parameter should you configure?

   • Aneighbor-group
   • Bneighbor-range
   • Crecursive-next-hop
   • Droute-reflector-client

   Show answer

   Answer: D

   Next question

3. Question 53 · 66 in bank

   If you configure set tcp-mss-sender and set tcp-mss-receiver in a firewall policy, how does it affect the size and handling of TCP packets in the network?

   • AThe maximum segment size permitted in the firewall policy determines whether TCP packets are allowed or denied.
   • BThe TCP packet modifies the packet size only if no fragmentation occurs.
   • CApplying commands in a firewall policy determines the largest payload a device can handle in a single TCP segment.
   • DThe commands affect the payload size of the packet and the size of the IP header for handling TCP packets.

   Show answer

   Answer: C

   Next question

4. Question 54 · 66 in bank

   You must enable direct communication between multiple spokes in a organization’s network. Each spoke has more than one internet connection. Each spoke must connect directly without passing through the hub and the links must automatically switch to the best available connection. How can you achieve automatic detection and optimal link utilization between spokes?

   • ASet up OSPF routing over dynamic VPN tunnels between spokes.
   • BUse ADVPN 2.0 to facilitate dynamic direct tunnels and automatic link optimization.
   • CImplement SD-WAN policies at the hub and the spokes.
   • DEstablish dynamic VPN tunnels between spokes with predefined backup routes.

   Show answer

   Answer: B

   Next question

5. Question 55 · 66 in bank

   Refer to the exhibit. A prerun CLI template that is used in zero-touch provisioning (ZTP) and low-touch provisioning (LTP) with FortiManager is shown.

   

   The template is not assigned even though the configuration is already installed on FortiGate. Which statement about this scenario is true?

   • AThe administrator must use postrun CLI templates that are designed for ZTP and LTP.
   • BPrerun CLI templates for ZTP and LTP must be unassigned manually after the first installation, to avoid conflicting error objects when importing a policy package.
   • CThe administrator did not assign the template correctly when they added the model device because prerun CLI templates remain permanently assigned to the firewall.
   • DPrerun CLI templates are automatically unassigned after the quick install process.

   Show answer

   Answer: D

   Next question

6. Question 56 · 66 in bank

   Select 3

   An organization acquired multiple branches across different countries and must install FortiGate devices at each branch. However, their IT staff lacks the knowledge required to implement the initial configuration on the FortiGate devices. Which three approaches can the organization take to successfully deploy advanced initial configurations on the FortiGate devices at their remote branches? (Choose three.)

   • AApply Jinja in the FortiManager scripts for large-scale and advanced deployments.
   • BUse provisioning templates and install configuration settings at the device layer.
   • COn FortiManager, add the FortiGate devices as model devices, and use zero-touch provisioning (ZTP) or low-touch provisioning (LTP) to connect to the FortiGate devices.
   • DUse the global ADOM to deploy global object configurations to each FortiGate device.
   • EUse metadata variables to dynamically assign values according to each FortiGate device.

   Show answer

   Answer: BCE

   Next question

7. Question 57 · 66 in bank

   You are using Virtual eXtensible LAN (VXLAN) extensively on FortiGate. Which specialized acceleration hardware must you use to improve FortiGate performance?

   • ACP10
   • BNTurbo
   • CCPU
   • DNP7

   Show answer

   Answer: D

   Next question

8. Question 58 · 66 in bank

   Select 2

   In which two ways does FortiGate utlize the Internet Service Database (ISDB) within firewall policies and SD-WAN rules? (Choose two.)

   • AThe ISDB works in proxy mode, allowing the analysis of packets in layers 3 and 4 of the OSI model.
   • BThe ISDB blocks the IP addresses and ports of an application predefined by FortiGuard.
   • CThe ISDB limits access by URL and domain.
   • DFortiGate has a predefined list of all IP addresses and ports for specific applications downloaded from FortiGuard.

   Show answer

   Answer: BD

   Next question

9. Question 59 · 66 in bank

   Refer to the exhibit.

   

   A FortiGate segmented into VDOMs is shown. You must ensure effective and accelerated internet access for all of the VDOMs in this enterprise network. How can you achieve this?

   • ACreate VLANs over network processing unit (NPU) vlinks.
   • BConnect a physical interface from each VDOM to the root VDOM.
   • CCreate VDOM links.
   • DConfigure network processing unit (NPU) vlinks.

   Show answer

   Answer: A

   Next question

10. Question 60 · 66 in bank

    Refer to the exhibit.

    

    The network diagram shows the addition of Site 2 with an overlapping network segment to the existing VPN IPsec connection between the hub and Site 1. Which IPsec phase 2 configuration must you make on the FortiGate hub to enable equal-cost multi-path (ECMP) routing when multiple remote sites connect with overlapping subnets?

    • ASet multipath to enable
    • BSet net-device to ecmp
    • CSet route-overlap to allow
    • DSet route-overlap to either use-new or use-old

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_EFW_AD-7.6 practice, question 51. 66 questions available.