Get Special Discount Offer of FCSS_EFW_AD-7.4 Certification Exam Sample Questions and Answers [Q26-Q43]

5/5 - (1 vote)

Get Special Discount Offer of FCSS_EFW_AD-7.4 Certification Exam Sample Questions and Answers

New FCSS_EFW_AD-7.4 Dumps For Preparing Fortinet Certified Solution Specialist Certified Fortinet Exam Well

NO.26 View the exhibit, which contains a session entry, and then answer the question below.

Which statement is correct regarding this session?

This traffic is using the VIP and central NAT tables.

This session was successfully authenticated.

Further packets for this session will be blocked.

This session is offloaded to the NPU.

NO.27 Which two conditions would prevent a static route from being added to the routing table? (Choose two.)

There is another other route to the same destination, with a lower distance.

The route has a lower priority value than another route to the same destination.

The next-hop IP address is unreachable.

The interface specified in the route configuration is down

NO.28 An administrator applied a block-all IPS profile for client and server targets to secure the server, but the database team reported the application stopped working immediately after. How can an administrator apply IPS in a way that ensures it does not disrupt existing applications in the network?

Use an IPS profile with all signatures in monitor mode and verify patterns before blocking.

Limit the IPS profile to server targets only to avoid blocking connections from the server to clients.

Select flow mode in the IPS profile to accurately analyze application patterns.

Set the IPS profile signature action to default to discard all possible false positives.

NO.29 View the partial crashlog output, and then answer the question below.
# diagnose debug crashlog read
2017-04-20 16:23:10 <00114> IPS enter fail open mode: engines=21 socketsize=123425682
2017-04-20 16:23:10 sessionact=pass
2017-04-20 16:24:09 <00114> IPS exit fail open mode
Which of the following statements are true regarding this FortiGate’s fail-open configuration? (Choose two.)

FortiGate was dropping traffic while fail-open mode was active.

Fail-open is enabled in FortiGate’s global IPS configuration.

Fail-open is disabled in FortiGate’s global IPS configuration.

FortiGate was passing traffic while fail-open mode was active.

NO.30 Which statement about IKE and IKE NAT-T is true?

IKE is used to encapsulate ESP traffic in some situations, and IKE NAT-T is used only when the local FortiGate is using NAT on the IPsec interface.

IKE is the standard implementation for IKEv1 and IKE NAT-T is an extension added in IKEv2.

They both use UDP as their transport protocol and the port number is configurable.

They each use their own IP protocol number.

NO.31 The IT department discovered during the last network migration that all zero phase selectors in phase 2 IPsec configurations impacted network operations.
What are two valid approaches to prevent this during future migrations? (Choose two.)

Use routing protocols to specify allowed subnets over the tunnel.

Configure an IPsec-aggregate to create redundancy between each firewall peer.

Clearly indicate to the VPN which segments will be encrypted in the phase two selectors.

Configure an IP address on the IPsec interface of each firewall to establish unique peer connections and avoid impacting network operations.

NO.32 Refer to the exhibit, which shows the output of a web filtering diagnose command.

Which configuration change would result in non-zero results in the cache statistics section?

set server-type rating under config system central-management

set webfilter-cache enable under config system fortiguard

set webfilter-force-off disable under config system fortiguard

set ngfw-mode policy-based under config system settings

NO.33 Refer to the exhibit, which contains a partial VPN configuration.

What can you conclude from this VPN IPsec phase 1 configuration?

This configuration is the best for networks with regular traffic intervals, providing a balance between connectivity assurance and resource utilization.

Peer IDs are unencrypted and exposed, creating a security risk.

FortiGate will not add a route to its routing or forwarding information base when the dynamic tunnel is negotiated.

A separate interface is created for each dial-up tunnel, which can be slower and more resource intensive, especially in large networks.

NO.34 Examine the output from the ‘diagnose vpn tunnel list’ command shown in the exhibit; then answer the question below.

Which command can be used to sniffer the ESP traffic for the VPN DialUP_0?

diagnose sniffer packet any ‘port 500’

diagnose sniffer packet any ‘esp’

diagnose sniffer packet any ‘host 10.0.10.10’

diagnose sniffer packet any ‘port 4500’

NO.35 Which layer of the FortiOS architecture does an application process or daemon run on?

User space

Configuration layer

Kernel

Hardware

NO.36 An administrator applied a block-all IPS profile for client and server targets to secure the server, but the database team reported the application stopped working immediately after.
How can an administrator apply IPS in a way that ensures it does not disrupt existing applications in the network?

Use an IPS profile with all signatures in monitor mode and verify patterns before blocking.

Limit the IPS profile to server targets only to avoid blocking connections from the server to clients.

Select flow mode in the IPS profile to accurately analyze application patterns.

Set the IPS profile signature action to default to discard all possible false positives.

NO.37 Which two configuration settings change the behavior for content-inspected traffic while FortiGate is in conserve mode? (Choose two.)

IPS failopen

mem failopen

AV failopen

UTM failopen

NO.38 A user reports that their computer was infected with malware after accessing a secured HTTPS website.
However, when the administrator checks the FortiGate logs, they do not see that the website was detected as insecure despite having an SSL certificate and correct profiles applied on the policy.
How can an administrator ensure that FortiGate can analyze encrypted HTTPS traffic on a website?

The administrator must enable reputable websites to allow only SSL/TLS websites rated by FortiGuard web filter.

The administrator must enable URL extraction from SNI on the SSL certificate inspection to ensure the TLS three-way handshake is correctly analyzed by FortiGate.

The administrator must enable DNS over TLS to protect against fake Server Name Indication (SNI) that cannot be analyzed in common DNS requests on HTTPS websites.

The administrator must enable full SSL inspection in the SSL/SSH Inspection Profile to decrypt packets and ensure they are analyzed as expected.

NO.39 Refer to the exhibit, which shows an ADVPN network.

An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.
What must the administrator configure in the phase 1 VPN IPSEC configuration of the Hub2Hub tunnels?

set auto-discovery-sender enable

set auto-discovery-forwarder enable

set add-route enable

set auto-discovery-receiver enable

NO.40 Refer to the exhibit, which shows theADVPNIPsec interface representing the VPN IPsec phase 1 from Hub A to Spoke 1 and Spoke 2, and from Hub # to Spoke 3 and Spoke 4.

An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.
What must the administrator configure in the phase 1 VPN IPsec configuration of theADVPNtunnels?

set auto-discovery-sender enable and set network-id x

set auto-discovery-forwarder enable and set remote-as x

set auto-discovery-crossover enable and set enforce-multihop enable

set auto-discovery-receiver enable and set npu-offload enable

NO.41 An administrator is extensively using VXLAN on FortiGate. Which specialized acceleration hardware does FortiGate need to improve its performance?

NP7

SP5

NTurbo

NO.42 An administrator wants to scale the IBGP sessions and optimize the routing table in an IBGP network.
Which parameter should the administrator configure?

network-import-check

ibgp-enforce-multihop

neighbor-group

route-reflector-client

NO.43 An administrator is setting up an ADVPN configuration and wants to ensure that peer IDs are not exposed during VPN establishment.
Which protocol can the administrator use to enhance security?

Use IKEv2, which encrypts peer IDs and prevents exposure.

Opt for SSL VPN web mode because it does not use peer IDs at all.

Choose IKEv1 aggressive mode because it simplifies peer identification.

Stick with IKEv1 main mode because it offers better performance.

Updated FCSS_EFW_AD-7.4 Dumps Questions Are Available For Passing Fortinet Exam: https://www.actualcollection.com/FCSS_EFW_AD-7.4-exam-questions.html

Leave a comment Cancel reply