Logo Passei Direto
Buscar

Outros

Outros
Which statement about traffic flow in an active-active HA cluster is true?
The secondary device responds to the primary device with a SYN/ACK, and then the primary device forwards the SYN/ACK to the client.
The ACK from the client is received on the physical MAC address of the primary device.
All FortiGate devices are assigned the same virtual MAC addresses for the HA heartbeat interfaces to redistribute to the sessions.
The SYN packet from the client always arrives at the primary device first.
User badge image
CuriosidadesGerais

há 4 meses

User badge image
CuriosidadesGerais

há 4 meses

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute
14 pág.

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute

Respostas

User badge image

Ed Verified user icon

há 4 meses

Parece que sua pergunta está em inglês, mas vou responder em português, conforme solicitado. Analisando as alternativas sobre o fluxo de tráfego em um cluster HA (alta disponibilidade) ativo-ativo: 1. A primeira afirmação fala sobre o fluxo de resposta do dispositivo secundário para o primário e depois para o cliente. Isso pode ser verdade em alguns contextos, mas não é uma descrição típica do funcionamento de um cluster HA ativo-ativo. 2. A segunda afirmação menciona que o ACK do cliente é recebido no endereço MAC físico do dispositivo primário. Isso é verdade, pois o tráfego normalmente é direcionado ao dispositivo primário. 3. A terceira afirmação diz que todos os dispositivos FortiGate têm os mesmos endereços MAC virtuais para as interfaces de heartbeat HA. Isso é uma prática comum em configurações de HA, mas não é diretamente relevante para o fluxo de tráfego. 4. A quarta afirmação afirma que o pacote SYN do cliente sempre chega primeiro ao dispositivo primário. Isso é uma suposição que pode não ser verdadeira em todas as situações, especialmente em redes complexas. Dentre as opções analisadas, a que parece mais correta e relevante para o fluxo de tráfego em um cluster HA ativo-ativo é: "O ACK do cliente é recebido no endereço MAC físico do dispositivo primário." Portanto, a resposta correta é a segunda alternativa.

Essa resposta te ajudou?

0
Dislike0
left-side-bubbles-backgroundright-side-bubbles-background

Crie sua conta grátis para liberar essa resposta. 🤩

Já tem uma conta?

Ao continuar, você aceita os Termos de Uso e Política de Privacidade

Ainda com dúvidas?

Envie uma pergunta e tenha sua dúvida de estudo respondida!

Essa pergunta também está no material:

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute
14 pág.

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute

Mais perguntas desse material

Which two statements about antivirus scanning in a firewall policy set to proxy-based inspection mode, are true? (Choose two.)
FortiGate sends a reset packet to the client if antivirus reports the file as infected.
The client must wait for the antivirus scan to finish scanning before it receives the file.
A file does not need to be buffered completely before it is moved to the antivirus engine for scanning.

View the exhibit.
| Name 0 | Type 0 | Members 0 | IP/Netmask 0 | Administrative Acc... 0 |
| :--: | :--: | :--: | :--: | :--: |
| 圄 Physical Interface | | | | |
| port1 Physical Interface | | | 10.200.1.1/255.255.255.0 |
| | | | | |
| (1) Local Certificate | | | | |
| (2) Security Profiles | System Settings | | | |
| (3) VPN | | | | |
| 4 User & Authentication | | Administration Settings | | |
| (5) WIFI Controller | | HTTP port | 80 | |
| (6) System | | Redirect to HTTPS | | |
| Administrators | | HTTPS port | 443 | |
| Admin Profiles | | HTTPS server certificate | 园 self-sign |
| Firmware | | SSH port | 22 | |
| Settings | (7) | Telnet port | 23 | |
| HA | | Idle timeout | 480 | |
| SSL-VPN Portals | SSL-VPN Settings | | | |
| SSL-VPN Settings | | | | |
| SSL-VPN Clients | Connection Settings (8) | | | |
| SSL-VPN Clients | Listen on Interface(s) | port1 | |
| VPN Location Map | Listen on Port | port1 | * | |
| 4 User & Authentication | | | | |
| | | | | |
Which statement about the configuration settings is true?
The settings are invalid. The administrator settings and the SSL-VPN settings cannot use the same port.
When a remote user accesses http://10.200.1.1:443, the SSL-VPN login page opens.
When a remote user accesses https://10.200.1.1:443, the FortiGate login page opens.
When a remote user accesses https://10.200.1.1:443, the SSL-VPN login page opens.

View the exhibit.
The image shows a network diagram with two subnets, 10.0.1.0/24 and 10.0.2.0/24, connected through a FortiGate device with two VDOMs (VDOM1 and VDOM2) and an inter-VDOM link.
Which two static routes are required in the FortiGate configuration, to route traffic between both subnets through an inter-VDOM link? (Choose two.)
A static route in VDOM1 for the destination subnet 10.0.2.0/24
A static route in VDOM2 with the destination subnet matching the subnet assigned to the inter-VDOM link
A static route in VDOM1 with the destination subnet matching the subnet assigned to the inter-VDOM link
A static route in VDOM2 for the destination subnet 10.0.1.0/24

Which three settings and protocols can be used to provide secure and restrictive administrative access to FortiGate? (Choose three.)
SSH
Trusted host
HTTPS

Which additional load balancing method is supported in equal cost multipath (ECMP) load balancing when SD-WAN is enabled?
Weight based
Volume based
Source-destination IP based
Source IP based

What does the command diagnose debug fsso-polling refresh-user do?
It enables agentless polling mode real-time debug.
It refreshes all users learned through agentless polling.
It refreshes user group information from any servers connected to FortiGate using a collector agent.
It displays status information and some statistics related to the polls done by FortiGate on each DC.

Examine the exhibit, which shows a firewall policy configured with multiple security profiles.
The image shows a firewall policy configuration with multiple security profiles, including AntiVirus, Web Filter, Video Filter, DNS Filter, Application Control, IPS, File Filter, and SSL Inspection.
Which two security profiles are handled by the IPS engine? (Choose two.)
AntiVirus
Web Filter
IPS
Application Control

Which statement about firewall policy NAT is true?
DNAT can automatically apply to multiple firewall policies, based on DNAT rules.
DNAT is not supported.
You must configure SNAT for each firewall policy.
SNAT can automatically apply to multiple firewall policies, based on SNAT policies.

Examine this FortiGate configuration: config system global set av-failopen pass end config ips global set fail-open disable end Examine the output of the following debug command: # diagnose hardware sysinfo conserve memory conserve mode: on total RAM: 3040 MB memory used: 2706 MB 89% of total RAM memory freeable: 334 MB 11% of total RAM memory used + freeable threshold extreme: 2887 MB 95% of total RAM memory used threshold red: 2675 MB 88% of total RAM memory used threshold green: 2492 MB 82% of total RAM Based on the diagnostic outputs above, how is FortiGate handling new packets that require IPS inspection?
They are dropped.
They are allowed, but with no inspection.
They are allowed and inspected.
They are allowed and inspected, as long as no additional proxy-based inspection is required.

View the exhibit.
FOT1 # get router info routing-table all Coder: K - kernel, C - connected, S - static, R - RIP, B - BOP O - OSPF, IS - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, is - IS-IS inter area V - BOP VPNv4 * - candidate default Routing table for VRF-0 S 0.0.0.0/0 [10/0] via 172.20.121.2, port1, [1/0] C 172.20.121.0/24 is directly connected, port1 C 172.20.168.0/24 is directly connected, port2 C 172.20.167.0/24 is directly connected, port3 S 10.20.30.0/26 [10/0] via 172.20.168.254, port2, [1/0] S 10.20.30.0/24 [10/0] via 172.20.167.254, port3, [1/0] S 10.30.20.0/24 [10/0] via 172.20.121.2, port1, [1/0]
Which route will be selected when trying to reach 10.20.30.254?
0.0.0.0/0 [10/0] via 172.20.121.2, port1, [1/0]
10.20.30.0/26 [10/0] via 172.20.168.254, port2, [1/0]
10.30.20.0/24 [10/0] via 172.20.121.2, port1, [1/0]
10.20.30.0/24 [10/0] via 172.20.167.254, port3, [1/0]

Mais conteúdos dessa disciplina