FCSS_EFW_AD-7.6 practice questions 61–66

1. Question 61 · 66 in bank

   Refer to the exhibit.

   

   You need to modify the MED value advertised from FortiGate_1 to a BGP neighbor in the autonomous system, AS 30. Which parameter must you configure on FortiGate_1 to implement this?

   • Adistribute-list-out
   • Broute-map-out
   • Cprefix-list-out
   • Droute-overlap

   Show answer

   Answer: B

   Next question

2. Question 62 · 66 in bank

   A user reports that their computer was infected with malware after accessing a secured HTTPS website. However, when you check the FortiGate logs, you see that FortiGate did not detect the website as insecure, despite having an SSL certificate and the correct profiles applied on the policy. How can you ensure that FortiGate can analyze encrypted HTTPS traffic on a website?

   • AEnable server certificate SNI check to protect against unsecured HTTPS websites.
   • BSet min-allowed-ssl-version to tls-1.2.
   • CEnable full SSL inspection in the SSL/SSH Inspection profile to decrypt packets.
   • DSet inspection-mode to proxy.

   Show answer

   Answer: C

   Next question

3. Question 63 · 66 in bank

   Refer to the exhibits.

   

   

   The firewall policy ID 1 of the DCFW policy package and the reinstall preview window for the DCFW policy package installation are shown. Why is FortiManager is installing set srcaddr “SSLVPN_TUNNEL_ADDR1” on firewall policy ID 1 when the policy package DCFW has the source address 10.0.5 on the firewall policy ID 1?

   • AFortiManager has assigned firewall HQ-DCFW a CLI template that can overwrite configurations at the policy layer.
   • BFortiManager is installing the global policy package, which has higher priority than the ADOM policy package.
   • CThe reinstall policy package ignores recent changes to the policy layer. The administrator must run the Install Wizard.
   • DThe firewall policy and reinstall preview use the same addresses, but they have different names because of per-device mapping.

   Show answer

   Answer: A

   Next question

4. Question 64 · 66 in bank

   You applied a block-all intrusion prevention system (IPS) profile for client and server targets to secure the server, but the database team reported that applications stopped working immediately after. How can you apply IPS in a way that ensures it does not disrupt existing applications in the network?

   • ASet the IPS profile signature action to default and verity patterns.
   • BUse an IPS profile with all signatures in monitor mode and verify patterns before blocking.
   • CLimit the IPS profile to server targets only and set the action to default.
   • DSelect flow mode in the IPS profile and monitor the application patterns.

   Show answer

   Answer: B

   Next question

5. Question 65 · 66 in bank

   An organization’s guest internet policy, operating in proxy mode, blocks access to artificial intelligence technology sites using FortiGuard. However, a guest user accessed a page in this category using port 8443. Which configuration change must you make for FortiGate to analyze HTTPS traffic on nonstandard ports like 6443, when full SSL inspection is active in the guest policy?

   • ABlock traffic on nonstandard ports by enabling server certificate SNI check in the SSLISSH inspection profile.
   • BEnter 443, 8443 to analyze both standard (443) and non-standard (8443) HTTPS ports in the protocol port mapping section of the SSL/SSH Inspection profile.
   • CEnable network protocol enforcement for port 8443 with the protocol HTTPS in FortiGuard application control.
   • DBlock untrusted SSL certificates in the SSL/SSH inspection profile.

   Show answer

   Answer: B

   Next question

6. Question 66 · 66 in bank

   Refer to the exhibits.

   

   The system administrator settings configured on a root FortiGate and the Security Fabric settings configured on a downstream FortiGate are shown. When prompted to sign in with Security Fabric to the downstream FortiGate, a user enters the single sign-on (SSO) provider credentials. What is the result?

   • AThe downstream FortiGate creates an SSO administrator account for AdminSSO with the super_admin profile.
   • BThe user accesses the downstream FortiGate with super_admin_readonly profile.
   • CThe user is prompted to create an administrator account for AdminSSO.
   • DThe downstream FortiGate relies on the root FortiGate and does not create an administrator account.

   Show answer

   Answer: B

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCSS_EFW_AD-7.6 practice, question 61. 66 questions available.