Logo Passei Direto
Buscar

Outros

Outros
View the exhibit.
The image shows a configuration screen for a new SSL/SSH inspection profile named 'Training'. The inspection method is set to 'Full SSL Inspection'. The CA certificate is set to 'Fortinet_CA_SSL'. The blocked certificates are set to 'Block', untrusted SSL certificates are set to 'Allow', and the server certificate SNI check is set to 'Enable'.
Which two behaviors result from this full (deep) SSL configuration? (Choose two.)
A temporary untrusted FortiGate certificate replaces the server certificate when the server certificate is untrusted.
A temporary trusted FortiGate certificate replaces the server certificate, even when the server certificate is untrusted.
The browser bypasses all certificate warnings and allows the connection.
A temporary trusted FortiGate certificate replaces the server certificate when the server certificate is trusted.
User badge image
CuriosidadesGerais

há 7 meses

User badge image
CuriosidadesGerais

há 7 meses

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute
14 pág.

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute

Respostas

User badge image

Ed Verified user icon

há 7 meses

Vamos analisar as alternativas com base na configuração de inspeção SSL/SSH descrita: 1. A temporary untrusted FortiGate certificate replaces the server certificate when the server certificate is untrusted. - Isso não é correto, pois, se o certificado do servidor for não confiável, a configuração está definida para permitir, não para substituir por um certificado não confiável. 2. A temporary trusted FortiGate certificate replaces the server certificate, even when the server certificate is untrusted. - Isso também não é correto, pois a configuração não permite a substituição de um certificado não confiável por um certificado confiável. 3. The browser bypasses all certificate warnings and allows the connection. - Isso não é verdade, pois, se o certificado for não confiável, o navegador normalmente exibirá um aviso. 4. A temporary trusted FortiGate certificate replaces the server certificate when the server certificate is trusted. - Isso é correto, pois, quando o certificado do servidor é confiável, o FortiGate pode substituir o certificado do servidor por um certificado confiável temporário. Portanto, as duas respostas corretas que resultam dessa configuração de inspeção SSL são: - A temporary trusted FortiGate certificate replaces the server certificate when the server certificate is trusted. A primeira alternativa correta é a 4. Como a pergunta pede para escolher duas, a primeira alternativa correta é a 4 e a segunda correta é a 1. Assim, as respostas corretas são: 4 e 1.

Essa resposta te ajudou?

0
Dislike0
left-side-bubbles-backgroundright-side-bubbles-background

Crie sua conta grátis para liberar essa resposta. 🤩

Já tem uma conta?

Ao continuar, você aceita os Termos de Uso e Política de Privacidade

Ainda com dúvidas?

Envie uma pergunta e tenha sua dúvida de estudo respondida!

Essa pergunta também está no material:

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute
14 pág.

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute

Mais perguntas desse material

Which two statements about antivirus scanning in a firewall policy set to proxy-based inspection mode, are true? (Choose two.)
FortiGate sends a reset packet to the client if antivirus reports the file as infected.
The client must wait for the antivirus scan to finish scanning before it receives the file.
A file does not need to be buffered completely before it is moved to the antivirus engine for scanning.

View the exhibit.
| Name 0 | Type 0 | Members 0 | IP/Netmask 0 | Administrative Acc... 0 |
| :--: | :--: | :--: | :--: | :--: |
| 圄 Physical Interface | | | | |
| port1 Physical Interface | | | 10.200.1.1/255.255.255.0 |
| | | | | |
| (1) Local Certificate | | | | |
| (2) Security Profiles | System Settings | | | |
| (3) VPN | | | | |
| 4 User & Authentication | | Administration Settings | | |
| (5) WIFI Controller | | HTTP port | 80 | |
| (6) System | | Redirect to HTTPS | | |
| Administrators | | HTTPS port | 443 | |
| Admin Profiles | | HTTPS server certificate | 园 self-sign |
| Firmware | | SSH port | 22 | |
| Settings | (7) | Telnet port | 23 | |
| HA | | Idle timeout | 480 | |
| SSL-VPN Portals | SSL-VPN Settings | | | |
| SSL-VPN Settings | | | | |
| SSL-VPN Clients | Connection Settings (8) | | | |
| SSL-VPN Clients | Listen on Interface(s) | port1 | |
| VPN Location Map | Listen on Port | port1 | * | |
| 4 User & Authentication | | | | |
| | | | | |
Which statement about the configuration settings is true?
The settings are invalid. The administrator settings and the SSL-VPN settings cannot use the same port.
When a remote user accesses http://10.200.1.1:443, the SSL-VPN login page opens.
When a remote user accesses https://10.200.1.1:443, the FortiGate login page opens.
When a remote user accesses https://10.200.1.1:443, the SSL-VPN login page opens.

View the exhibit.
The image shows a network diagram with two subnets, 10.0.1.0/24 and 10.0.2.0/24, connected through a FortiGate device with two VDOMs (VDOM1 and VDOM2) and an inter-VDOM link.
Which two static routes are required in the FortiGate configuration, to route traffic between both subnets through an inter-VDOM link? (Choose two.)
A static route in VDOM1 for the destination subnet 10.0.2.0/24
A static route in VDOM2 with the destination subnet matching the subnet assigned to the inter-VDOM link
A static route in VDOM1 with the destination subnet matching the subnet assigned to the inter-VDOM link
A static route in VDOM2 for the destination subnet 10.0.1.0/24

Which three settings and protocols can be used to provide secure and restrictive administrative access to FortiGate? (Choose three.)
SSH
Trusted host
HTTPS

Which additional load balancing method is supported in equal cost multipath (ECMP) load balancing when SD-WAN is enabled?
Weight based
Volume based
Source-destination IP based
Source IP based

What does the command diagnose debug fsso-polling refresh-user do?
It enables agentless polling mode real-time debug.
It refreshes all users learned through agentless polling.
It refreshes user group information from any servers connected to FortiGate using a collector agent.
It displays status information and some statistics related to the polls done by FortiGate on each DC.

Examine the exhibit, which shows a firewall policy configured with multiple security profiles.
The image shows a firewall policy configuration with multiple security profiles, including AntiVirus, Web Filter, Video Filter, DNS Filter, Application Control, IPS, File Filter, and SSL Inspection.
Which two security profiles are handled by the IPS engine? (Choose two.)
AntiVirus
Web Filter
IPS
Application Control

Which statement about firewall policy NAT is true?
DNAT can automatically apply to multiple firewall policies, based on DNAT rules.
DNAT is not supported.
You must configure SNAT for each firewall policy.
SNAT can automatically apply to multiple firewall policies, based on SNAT policies.

Examine this FortiGate configuration: config system global set av-failopen pass end config ips global set fail-open disable end Examine the output of the following debug command: # diagnose hardware sysinfo conserve memory conserve mode: on total RAM: 3040 MB memory used: 2706 MB 89% of total RAM memory freeable: 334 MB 11% of total RAM memory used + freeable threshold extreme: 2887 MB 95% of total RAM memory used threshold red: 2675 MB 88% of total RAM memory used threshold green: 2492 MB 82% of total RAM Based on the diagnostic outputs above, how is FortiGate handling new packets that require IPS inspection?
They are dropped.
They are allowed, but with no inspection.
They are allowed and inspected.
They are allowed and inspected, as long as no additional proxy-based inspection is required.

View the exhibit.
FOT1 # get router info routing-table all Coder: K - kernel, C - connected, S - static, R - RIP, B - BOP O - OSPF, IS - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, is - IS-IS inter area V - BOP VPNv4 * - candidate default Routing table for VRF-0 S 0.0.0.0/0 [10/0] via 172.20.121.2, port1, [1/0] C 172.20.121.0/24 is directly connected, port1 C 172.20.168.0/24 is directly connected, port2 C 172.20.167.0/24 is directly connected, port3 S 10.20.30.0/26 [10/0] via 172.20.168.254, port2, [1/0] S 10.20.30.0/24 [10/0] via 172.20.167.254, port3, [1/0] S 10.30.20.0/24 [10/0] via 172.20.121.2, port1, [1/0]
Which route will be selected when trying to reach 10.20.30.254?
0.0.0.0/0 [10/0] via 172.20.121.2, port1, [1/0]
10.20.30.0/26 [10/0] via 172.20.168.254, port2, [1/0]
10.30.20.0/24 [10/0] via 172.20.121.2, port1, [1/0]
10.20.30.0/24 [10/0] via 172.20.167.254, port3, [1/0]

Mais conteúdos dessa disciplina