Logo Passei Direto
Buscar

Outros

Outros
An administrator needs to create a tunnel mode SSL-VPN to access an internal web server from the internet. The web server is connected to port1. The internet is connected to port2. Both interfaces belong to the VDOM named Corporation. What interface must the administrator use as the source for the firewall policy that will allow this traffic?
ssl. Corporation
port2
ssl.root
port1
User badge image
CuriosidadesGerais

há 7 meses

User badge image
CuriosidadesGerais

há 7 meses

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute
14 pág.

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute

Respostas

User badge image

Ed Verified user icon

há 7 meses

Para resolver essa questão, precisamos entender como funciona a configuração de uma VPN SSL em um ambiente de firewall, especialmente em relação às interfaces e políticas de firewall. 1. Contexto: O administrador está criando uma VPN SSL em modo túnel para acessar um servidor web interno. O servidor está conectado à interface `port1`, e a internet está conectada à interface `port2`. 2. Objetivo: Precisamos determinar qual interface deve ser usada como fonte para a política de firewall que permitirá o tráfego da VPN SSL para o servidor web. 3. Análise das opções: - ssl.Corporation: Esta interface é geralmente usada para gerenciar conexões SSL-VPN, mas não é a interface de origem do tráfego. - port2: Esta é a interface conectada à internet. O tráfego da VPN SSL virá da internet, então essa interface pode ser considerada. - ssl.root: Esta interface é a interface padrão para a VDOM raiz e não é relevante para a configuração da VDOM "Corporation". - port1: Esta é a interface onde o servidor web está conectado. O tráfego da VPN SSL deve ser direcionado para essa interface. 4. Conclusão: Para permitir que o tráfego da VPN SSL acesse o servidor web, a política de firewall deve ser configurada para permitir o tráfego que vem da interface conectada à internet (`port2`) e que se destina ao servidor na interface `port1`. Portanto, a interface que o administrador deve usar como fonte para a política de firewall é: port2.

Essa resposta te ajudou?

0
Dislike0
left-side-bubbles-backgroundright-side-bubbles-background

Crie sua conta grátis para liberar essa resposta. 🤩

Já tem uma conta?

Ao continuar, você aceita os Termos de Uso e Política de Privacidade

Ainda com dúvidas?

Envie uma pergunta e tenha sua dúvida de estudo respondida!

Essa pergunta também está no material:

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute
14 pág.

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute

Mais perguntas desse material

Which two statements about antivirus scanning in a firewall policy set to proxy-based inspection mode, are true? (Choose two.)
FortiGate sends a reset packet to the client if antivirus reports the file as infected.
The client must wait for the antivirus scan to finish scanning before it receives the file.
A file does not need to be buffered completely before it is moved to the antivirus engine for scanning.

View the exhibit.
| Name 0 | Type 0 | Members 0 | IP/Netmask 0 | Administrative Acc... 0 |
| :--: | :--: | :--: | :--: | :--: |
| 圄 Physical Interface | | | | |
| port1 Physical Interface | | | 10.200.1.1/255.255.255.0 |
| | | | | |
| (1) Local Certificate | | | | |
| (2) Security Profiles | System Settings | | | |
| (3) VPN | | | | |
| 4 User & Authentication | | Administration Settings | | |
| (5) WIFI Controller | | HTTP port | 80 | |
| (6) System | | Redirect to HTTPS | | |
| Administrators | | HTTPS port | 443 | |
| Admin Profiles | | HTTPS server certificate | 园 self-sign |
| Firmware | | SSH port | 22 | |
| Settings | (7) | Telnet port | 23 | |
| HA | | Idle timeout | 480 | |
| SSL-VPN Portals | SSL-VPN Settings | | | |
| SSL-VPN Settings | | | | |
| SSL-VPN Clients | Connection Settings (8) | | | |
| SSL-VPN Clients | Listen on Interface(s) | port1 | |
| VPN Location Map | Listen on Port | port1 | * | |
| 4 User & Authentication | | | | |
| | | | | |
Which statement about the configuration settings is true?
The settings are invalid. The administrator settings and the SSL-VPN settings cannot use the same port.
When a remote user accesses http://10.200.1.1:443, the SSL-VPN login page opens.
When a remote user accesses https://10.200.1.1:443, the FortiGate login page opens.
When a remote user accesses https://10.200.1.1:443, the SSL-VPN login page opens.

View the exhibit.
The image shows a network diagram with two subnets, 10.0.1.0/24 and 10.0.2.0/24, connected through a FortiGate device with two VDOMs (VDOM1 and VDOM2) and an inter-VDOM link.
Which two static routes are required in the FortiGate configuration, to route traffic between both subnets through an inter-VDOM link? (Choose two.)
A static route in VDOM1 for the destination subnet 10.0.2.0/24
A static route in VDOM2 with the destination subnet matching the subnet assigned to the inter-VDOM link
A static route in VDOM1 with the destination subnet matching the subnet assigned to the inter-VDOM link
A static route in VDOM2 for the destination subnet 10.0.1.0/24

Which three settings and protocols can be used to provide secure and restrictive administrative access to FortiGate? (Choose three.)
SSH
Trusted host
HTTPS

Which additional load balancing method is supported in equal cost multipath (ECMP) load balancing when SD-WAN is enabled?
Weight based
Volume based
Source-destination IP based
Source IP based

What does the command diagnose debug fsso-polling refresh-user do?
It enables agentless polling mode real-time debug.
It refreshes all users learned through agentless polling.
It refreshes user group information from any servers connected to FortiGate using a collector agent.
It displays status information and some statistics related to the polls done by FortiGate on each DC.

Examine the exhibit, which shows a firewall policy configured with multiple security profiles.
The image shows a firewall policy configuration with multiple security profiles, including AntiVirus, Web Filter, Video Filter, DNS Filter, Application Control, IPS, File Filter, and SSL Inspection.
Which two security profiles are handled by the IPS engine? (Choose two.)
AntiVirus
Web Filter
IPS
Application Control

Which statement about firewall policy NAT is true?
DNAT can automatically apply to multiple firewall policies, based on DNAT rules.
DNAT is not supported.
You must configure SNAT for each firewall policy.
SNAT can automatically apply to multiple firewall policies, based on SNAT policies.

Examine this FortiGate configuration: config system global set av-failopen pass end config ips global set fail-open disable end Examine the output of the following debug command: # diagnose hardware sysinfo conserve memory conserve mode: on total RAM: 3040 MB memory used: 2706 MB 89% of total RAM memory freeable: 334 MB 11% of total RAM memory used + freeable threshold extreme: 2887 MB 95% of total RAM memory used threshold red: 2675 MB 88% of total RAM memory used threshold green: 2492 MB 82% of total RAM Based on the diagnostic outputs above, how is FortiGate handling new packets that require IPS inspection?
They are dropped.
They are allowed, but with no inspection.
They are allowed and inspected.
They are allowed and inspected, as long as no additional proxy-based inspection is required.

View the exhibit.
FOT1 # get router info routing-table all Coder: K - kernel, C - connected, S - static, R - RIP, B - BOP O - OSPF, IS - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, is - IS-IS inter area V - BOP VPNv4 * - candidate default Routing table for VRF-0 S 0.0.0.0/0 [10/0] via 172.20.121.2, port1, [1/0] C 172.20.121.0/24 is directly connected, port1 C 172.20.168.0/24 is directly connected, port2 C 172.20.167.0/24 is directly connected, port3 S 10.20.30.0/26 [10/0] via 172.20.168.254, port2, [1/0] S 10.20.30.0/24 [10/0] via 172.20.167.254, port3, [1/0] S 10.30.20.0/24 [10/0] via 172.20.121.2, port1, [1/0]
Which route will be selected when trying to reach 10.20.30.254?
0.0.0.0/0 [10/0] via 172.20.121.2, port1, [1/0]
10.20.30.0/26 [10/0] via 172.20.168.254, port2, [1/0]
10.30.20.0/24 [10/0] via 172.20.121.2, port1, [1/0]
10.20.30.0/24 [10/0] via 172.20.167.254, port3, [1/0]

Mais conteúdos dessa disciplina