最新的Fortinet Certification認證 FCNSP考試題庫

問題1

Examine the two static routes to the same destination subnet 172.20.168.0/24 as shown below; then answer the question following it.
config router static edit 1 set dst 172.20.168.0 255.255.255.0 set distance 20 set priority 10 set device port1 next edit 2 set dst 172.20.168.0 255.255.255.0 set distance 20 set priority 20 set device port2 next end
Which of the following statements correctly describes the static routing configuration provided above?

A. Only the route that is using port1 will show up in the routing table.

B. The FortiGate unit will evenly share the traffic to 172.20.168.0/24 through both routes.

C. The FortiGate unit will share the traffic to 172.20.168.0/24 through both routes, but the port2 route will carry approximately twice as much of the traffic.

D. The FortiGate unit will send all the traffic to 172.20.168.0/24 through port1.

正確答案: D

問題2

The transfer of encrypted files or the use of encrypted protocols between users and servers on the internet can frustrate the efforts of administrators attempting to monitor traffic passing through the FortiGate unit and ensuring user compliance to corporate rules.
Which of the following items will allow the administrator to control the transfer of encrypted data through the FortiGate unit? (Select all that apply.)

A. Firewall authentication can be enabled in the firewall policy, preventing the use of encrypted communications channels.

B. DLP rules can be used to block the transmission of encrypted files.

C. Application control can be used to monitor the use of encrypted protocols; alerts can be sent to the administrator through email when the use of encrypted protocols is attempted.

D. Encrypted protocols can be scanned through the use of the SSL proxy.

正確答案: B,C,D

問題3

Which of the following items is NOT a packet characteristic matched by a firewall service object?

A. TCP/UDP source and destination ports

B. IP protocol number

C. TCP sequence number

D. ICMP type and code

正確答案: C

問題4

In a High Availability cluster operating in Active-Active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a subordinate unit?

A. Request: Internal Host; Master FortiGate; Slave FortiGate; Internet; Web Server

B. Request: Internal Host; Slave FortiGate; Master FortiGate; Internet; Web Server

C. Request: Internal Host; Slave FortiGate; Internet; Web Server

D. Request: Internal Host; Master FortiGate; Slave FortiGate; Master FortiGate; Internet; Web Server

正確答案: A

問題5

Which of the following is an advantage of using SNMP v3 instead of SNMP v1/v2 when querying the FortiGate unit?

A. MIB-based report uploads

B. Running SNMP service on a non-standard port is possible

C. Packet encryption

D. SNMP access limits through access lists

正確答案: C

問題6

Which of the following statements is correct based on the firewall configuration illustrated in the exhibit?

A. A user can access the Internet using only the protocols that are supported by user
authentication.

B. A user must authenticate using the HTTP, HTTPS, SSH, FTP, or Telnet protocol before they can access any services.

C. A user can access the Internet using any protocol except HTTP, HTTPS, Telnet, and FTP. These require authentication before the user will be allowed access.

D. A user cannot access the Internet using any protocols unless the user has passed firewall authentication.

正確答案: D

問題7

If Routing Information Protocol (RIP) version 1 or version 2 has already been configured on a FortiGate unit, which of the following statements is correct if the routes learned through RIP need to be advertised into Open Shortest Path First (OSPF)?

A. At a minimum, the network administrator needs to enable Redistribute Default in the OSPF Advanced Options.

B. At a minimum, the network administrator needs to enable Redistribute RIP in the OSPF Advanced Options.

C. The network administrator needs to configure a RIP to OSPF announce policy as part of the RIP settings.

D. The FortiGate unit will automatically announce all routes learned through RIP v1 or v2 to its OSPF neighbors.

E. The FortiGate unit will automatically announce all routes learned only through RIP v2 to its OSPF neighbors.

正確答案: B

問題8

An administrator wishes to generate a report showing Top Traffic by service type, but wants to exclude SMTP traffic from the report.
Which of the following statements best describes how to do this?

A. Add the following entry to the Generic Field section of the Data Filter: service="!smtp".

B. When editing the chart, uncheck mlog to indicate that Mail Filtering data is being excluded when generating the chart.

C. When editing the chart, enter 'dns' in the Exclude Service field.

D. In the Service field of the Data Filter, type 25/smtp and select the NOT checkbox.

正確答案: D

問題9

A network administrator connects his PC to the INTERNAL interface on a FortiGate unit. The administrator attempts to make an HTTPS connection to the FortiGate unit on the VLAN1 interface at the IP address of 10.0.1.1, but gets no connectivity.
The following troubleshooting commands are executed from the CLI:
user1 # get system interface == [ internal ] namE. internal modE. static ip: 10.0.1.254 255.255.255.128 status: up netbios-forwarD. disable typE. physical mtu-overridE. disable == [ vlan1 ] namE. vlan1 modE. static ip: 10.0.1.1 255.255.255.128 status: up netb ios-forwarD. disable typE. vlan mtu-overridE. disable
user1 # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default
S 10.0.0.0/8 [10/0] is a summary, Null C 10.0.1.0/25 is directly connected, vlan1 C 10.0.1.128/25 is directly connected, internal
user1 # diagnose debug flow trace start 100
user1 # diagnose debug ena
user1 # diagnose debug flow filter daddr 10.0.1.1 10.0.1.1
id=20085 trace_id=277 msg="vd-root received a packet(proto=6, 10.0.1.130
:47922->10.0.1.1:443) from internal."
id=20085 trace_id=277 msg="allocate a new session-00000b21"
id=20085 trace_id=277 msg="iprope_in_check() check failed, drop"
Based on the output from these commands, which of the following is a possible cause of the problem?

A. The PC is using an incorrect default gateway IP address.

B. The PC has an IP address in the wrong subnet.

C. The FortiGate unit has no route back to the PC.

D. There is no firewall policy allowing traffic from INTERNAL -> VLAN1.

正確答案: D

問題10

A FortiGate unit is configured with multiple VDOMs. An administrative account on the device has been assigned a Scope value of VDOM:root.
Which of the following items would an administrator logging in using this account NOT be able to configure?

A. FortiGuard Distribution Network configuration

B. Firewall addresses

C. PPTP VPN configuration

D. DHCP servers

正確答案: A

最新的Fortinet Certified Network Security Professional (FCNSP v4.2) - FCNSP免費考試真題

最新更新

站內鏈接

聯系我們