FCSS_EFW_AD-7.4無料問題集「Fortinet FCSS - Enterprise Firewall 7.4 Administrator」

質問 1

Examine the following partial outputs from two routing debug commands; then answer the question below.
# get router info kernel
tab=254 vf=0 scope=0type=1 proto=11 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.1.254 dev=2(port1) tab=254 vf=0 scope=0type=1 proto=11 prio=10 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.200.2.254 dev=3(port2) tab=254 vf=0 scope=253type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/.->10.0.1.0/24 pref=10.0.1.254 gwy=0.0.0.0 dev=4(port3)
# get router info routing-table all s*0.0.0.0/0 [10/0] via 10.200.1.254, portl [10/0] via 10.200.2.254, port2,
[10/0] dO.0.1.0/24 is directly connected, port3 dO.200.1.0/24 is directly connected, portl d0.200.2.0/24 is directly connected, port2 Which outbound interface or interfaces will be used by this FortiGate to route web traffic from internal users to the Internet?

（A）port!

（B）Both portl and port2.

（C）port3.

（D）port2.

正解：B 解答を投票する

質問 2

Refer to the exhibit, which contains the partial output of an IKE real-time debug.

The administrator does not have access to the remote gateway. Based on the debug output, which configuration change can the administrator make to the local gateway to resolve the phase 1 negotiation error?

（A）Change phase 1 encryption to 3DES and authentication to CBC.

（B）Change phase 1 encryption to 3DES and authentication to SHA256.

（C）Change phase 1 encryption to AES128 and authentication to SHA512.

（D）Change phase 1 encryption to AESCBC and authentication to SHA128.

正解：B 解答を投票する

質問 3

Which two configuration changes can be applied to optimize the memory usage on FortiGate?
(Choose two.)

（A）Increase the maximum file size for AV inspection.

（B）Reduce the FortiGuard cache TTL.

（C）Decrease the sessions TTL.

（D）Increase TCP session timers.

（E）Use flow-based inspection.

正解：B、C 解答を投票する

質問 4

Which two conditions would prevent a static route from being added to the routing table? (Choose two.)

（A）There is another other route to the same destination, with a lower distance.

（B）The route has a lower priority value than another route to the same destination.

（C）The next-hop IP address is unreachable.

（D）The interface specified in the route configuration is down

正解：A、D 解答を投票する

質問 5

Refer to the exhibit, which contains the partial output of a diagnose command.

Based on the output, which two statements are correct? (Choose two.)

（A）The remote gateway has quick mode selectors containing a destination subnet of 10.1.2.0/24.

（B）The remote gateway IP is 10.200.5.1.

（C）DPD is disabled.

（D）Anti-replay is enabled.

正解：A、D 解答を投票する

質問 6

Which statement is true regarding File description (FD) conserve mode?

（A）A FortiGate enters FD conserve mode when the amount of available description is less than 5%.

（B）FD conserve mode affects all daemons running on the device.

（C）IPS inspection is affected when FortiGate enters FD conserve mode.

（D）Restarting the WAD process is required to leave FD conserve mode.

正解：A 解答を投票する

質問 7

What is the diagnose test application ipsmenitor 5 command used for?

（A）To enable IPS bypass mode

（B）To restart all IPS engines and monitors

（C）To disable the IPS engine

（D）To provide information regarding IPS sessions

正解：A 解答を投票する

質問 8

Which of the following statements are true regarding the SIP session helper and the SIP application layer gateway (ALG)? (Choose three)

（A）SIP helper supports SIP over TCP and UDP; SIP ALG supports only SIP over UDP.

（B）SIP ALG supports SIP over IPv6; SIR helper does not.

（C）SIP ALG can create expected sessions for media traffic; SIP helper does not.

（D）SIP ALG supports SIP HA failover; SIR helper does not

（E）SIP session helper runs in the kernel; SIP ALG runs as a user space process.

正解：B、D、E 解答を投票する

質問 9

Refer to the exhibits, which contain the partial configurations of two VPNs on FortiGate.

An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovered that FortiGate is not matching the user-2 VPN for members of the Users-2 group.
Which two changes must the administrator make to fix the issue? (Choose two.)

（A）Enable XAuth on both VPNs.

（B）Change to aggressive mode on both VPNs.

（C）Set up specific peer IDs on both VPNs.

（D）Use different pre-shared keys on both VPNs.

正解：B、C 解答を投票する

質問 10

Which real time debug should an administrator enable to troubleshoot RADIUS authentication problems?

（A）Diagnose authd console -log enable.

（B）Diagnose debug application fnbamd -1.

（C）Diagnose radius console -log enable.

（D）Diagnose debug application radius -1.

正解：B 解答を投票する

質問 11

Which two statements about OCVPN are true? (Choose two.)

（A）OCVPN offers only Hub-Spoke VPNs.

（B）OCVPN supports static and dynamic IPs in WAN interface.

（C）Only root vdom supports OCVPN.

（D）FortiGate devices under different FortiCare accounts can be used to form OCVPN.

正解：B、C 解答を投票する

質問 12

View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

Which statements about this debug output are correct? (Choose two.)

（A）The remote gateway IP address is 10.0.0.1.

（B）The initiator has provided remote as its IPsec peer ID.

（C）The negotiation is using AES128 encryption with CBC hash.

（D）It shows a phase 1 negotiation.

正解：B、D 解答を投票する

質問 13

An administrator has decreased all the TCP session timers to optimize the FortiGate memory usage.
However, after the changes, one network application started to have problems.
During the troubleshooting, the administrator noticed that the FortiGate deletes the sessions after the clients send the SYN packets, and before the arrival of the SYN/ACKs.
When the SYN/ACK packets arrive to the FortiGate, the unit has already deleted the respective sessions.
Which TCP session timer must be increased to fix this problem?

（A）TCP half close.

（B）TCP session time to live.

（C）TCP half open.

（D）TCP time wait.

正解：C 解答を投票する

質問 14

Which two statements about bulk configuration changes using FortiManager CLI scripts are correct?
(Choose two.)

（A）When executed on the All FortiGate in ADOM, changes are automatically installed without creating a new revision history.

（B）When executed on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate

（C）When executed on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.

（D）When executed on the Policy Package, ADOM database, changes are applied directly to the managed FortiGate.

正解：B、C 解答を投票する

FCSS_EFW_AD-7.4 無料問題集「Fortinet FCSS - Enterprise Firewall 7.4 Administrator」

弊社を連絡する

関連リンク

トップ試験