Question 1

Refer to the exhibit, which contains partial output from an IKE real-time debug.

Based on the debug output, which phase 1 setting is enabled in the configuration of this VPN?

Options :

A : auto-discovery-receiver

B : auto-discovery-forwarder

C : auto-discovery-shortcut

D : auto-discovery-sender

Answer: D

Question 2

Refer to the exhibit, which shows the output of a debug command.

What can be concluded from the debug command output?

Options :

A : The OSPF router with the ID 0.0.0.69 has its OSPF priority set to 0.

B : The local FortiGate has a different MTU value from the OSPF router with ID 0.0.0.2, based on the state information.

C : There are more than two OSPF routers on the wan2 network.

D : The interface ToRemote is a broadcast OSPF network.

Answer: C

Question 3

Refer to the exhibit, which shows the FortiGuard Distribution Network of a FortiGate device. FortiGuard Distribution Network on FortiGate

An administrator is trying to find the web filter database signature on FortiGate to resolve issues with websites not being filtered correctly in a flow-mode web filter profile. Why is the web filter database version not visible on the GUI, such as with IPS definitions?

Options :

A :

The web filter database is stored locally, but the administrator must run over CLI diagnose autoupdate versions.

B :

The web filter database is stored locally on FortiGate, but it is hidden behind the GUI. It requires enabling debug mode to make it visible.

C :

The web filter database is not hosted on FortiGate: FortiGate queries FortiGuard or FortiManager for web filter ratings on demand.

D :

The web filter database is only accessible after manual syncing with a valid FDS server using diagnose test update info.

Answer: C

Question 4

When using the SSL certificate inspection method to inspect HTTPS traffic, how does FortiGate filter web requests when the client browser does not provide the server name indication (SNI) extension?

Options :

A : FortiGate uses the CN information from the Subject field in the server certificate.

B : FortiGate switches to the full SSL inspection method to decrypt the data.

C : FortiGate uses the requested URL from the user-s web browser.

D : FortiGate blocks the request without any further inspection.

Answer: A

Question 5

A company's guest internet policy, operating in proxy mode, blocks access to Artificial Intelligence Technology sites using FortiGuard. However, a guest user accessed a page in this category using port 8443. Which configuration changes are required for FortiGate to analyze HTTPS traffic on nonstandard ports like 8443 when full SSL inspection is active in the guest policy?

Options :

A : Add a URL wildcard domain to the website CA certificate and use it in the SSL/SSH Inspection Profile.

B :

In the Protocol Port Mapping section of the SSL/SSH Inspection Profile, enter 443, 8443 to analyze both standard (443) and non-standard (8443) HTTPS ports.

C : To analyze nonstandard ports in web filter profiles, use TLSv1.3 in the SSL/SSH Inspection Profile.

D :

Administrators can block traffic on nonstandard ports by enabling the SNI check in the SSL/SSH Inspection Profile.

Answer: B

Higher Test Marks with Free Online FCSS_EFW_AD-7.4 Exam Practice

Buying Options: