Logo Passei Direto
Buscar

Pedagogia

Outros
Refer to the exhibit, which shows the output of a diagnose command. diagnose sys session list expectation session info: proto=6 proto_state=00 duration=3 expire=26 timeout=3600 flags=000000000 sockflag=00000000 sockport=0 av_idx=0 use=3 origin=shaper= reply=shaper= per_ip_shaper= ba_id=0 policy_dir=1 tunnel=/ state=new complex statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2 orgin->sink: org_pre->post, reply_pre->post dev=2->4/4->2 gwy=10.0.1.10/10.200.1.254 book=pre dir=org act=dnat 10.171.121.38:0->10.200.1.1:60426(10.0.1.10:50365) book=pre dir=org act=noop 0.0.0.0:0->0.0.0.0:0(0.0.0.0:0) pss/(before,after) 0/(0,0), 0/(0,0) msc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=0 app_list=0 app=0 dd_type=0 dd_mode=0 What can you conclude from the output shown in the exhibit? (Choose two.)
A. This is a pinhole session created to allow traffic for a protocol that requires additional sessions to operate through FortiGate.
B. This is an expected session created by the IPS engine.
C. Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next-hop IP address 10.200.1.1.
D. Traffic in the original direction (coming from the IP address 10.171.121.38) will be routed to the next-hop IP address 10.0.1.10.
User badge image
Pedagogiando

há 6 meses

User badge image
Pedagogiando

há 6 meses

Fortinet FCSS_EFW_AD-7 4 Questions and Answers 2025
10 pág.

Fortinet FCSS_EFW_AD-7 4 Questions and Answers 2025

Respostas

User badge image

Ed Verified user icon

há 6 meses

Vamos analisar as alternativas com base nas informações fornecidas no comando de diagnóstico. A. Esta é uma sessão de pinhole criada para permitir tráfego para um protocolo que requer sessões adicionais para operar através do FortiGate. - Não há informações suficientes no output que confirmem que se trata de uma sessão de pinhole, então essa opção não parece correta. B. Esta é uma sessão esperada criada pelo mecanismo IPS. - O output não menciona que a sessão foi criada pelo IPS, então essa opção também não parece correta. C. O tráfego na direção original (vindo do endereço IP 10.171.121.38) será roteado para o próximo IP 10.200.1.1. - O output mostra que a ação de DNAT (Destination Network Address Translation) está redirecionando o tráfego para 10.200.1.1, então essa afirmação é verdadeira. D. O tráfego na direção original (vindo do endereço IP 10.171.121.38) será roteado para o próximo IP 10.0.1.10. - O output indica que o tráfego está sendo redirecionado para 10.200.1.1, não para 10.0.1.10, então essa opção é falsa. Portanto, a conclusão correta é que a opção C é verdadeira. Como a pergunta pede para escolher duas, e não há outra opção correta, parece que a questão pode estar mal formulada ou incompleta. A única opção correta que podemos afirmar com certeza é a C.

Essa resposta te ajudou?

0
Dislike0

Ainda com dúvidas?

Envie uma pergunta e tenha sua dúvida de estudo respondida!

Essa pergunta também está no material:

Fortinet FCSS_EFW_AD-7 4 Questions and Answers 2025
10 pág.

Fortinet FCSS_EFW_AD-7 4 Questions and Answers 2025

Mais perguntas desse material

An administrator must ensure that users cannot access sites containing malware and spyware, while also protecting them from phishing attempts. What is the most resource-efficient method to block access to these sites?
A. Enable antivirus profiles to scan all web traffic and block downloads from these malicious sites.
B. Configure FortiGuard Web Filtering and block the categories malware, spyware, and phishing to prevent access to such sites.
C. Create a custom IPS policy to monitor and block all outbound traffic related to malware, spyware, and phishing sites.
D. Set up a DNS filter and block domains related to these categories to stop users from reaching malicious content.

Refer to the exhibit, which shows partial outputs from two routing debug commands. FortiGate # get router info routing-table database Routing table for VRF=0 S 0.0.0.0/0 [20/0] via 100.64.2.254, port2, [10/0] S *> 0.0.0.0/0 [10/0] via 100.64.1.254, port1 FortiGate # get router info routing-table all Routing table for VRF=0 S* 0.0.0.0/0 [10/0] via 100.64.1.254, port1 Why is the port2 default route not in the second command output?
A. The port2 interface is disabled in the FortiGate configuration.
B. The port1 default route has a lower distance than the default route using port2.
C. The port1 default route has a higher priority value than the default route using port2.
D. The port1 default route has a lower priority value than the default route using port2.

An administrator has configured a dial-up IPsec VPN with one phase 2, extended authentication (XAuth) and IKE mode configuration. The administrator has also enabled the IKE real time debug: diagnose debug application ike-1 diagnose debug enable In which order is each step and phase displayed in the debug output each time a new dial-up user is connecting to the VPN?
A. Phase1; IKE mode configuration; XAuth; phase 2.
B. Phase1; XAuth; IKE mode configuration; phase2.
C. Phase1; XAuth; phase 2; IKE mode configuration.
D. Phase1; IKE mode configuration; phase 2; XAuth.

View the exhibit, which contains the partial output of a diagnose command, and then answer the question below.
The image shows the partial output of a diagnose command, including details about the VPN tunnel, IPsec tunnel, and various parameters.
Based on the output, which of the following statements is correct?
A. Anti-replay is enabled.
B. DPD is disabled.
C. Quick mode selectors are disabled.
D. Remote gateway IP is 10.200.5.1.

Refer to the exhibit, which contains the partial output of an IKE real-time debug.
The image shows the partial output of an IKE real-time debug, including details about the incoming proposal, protocol ID, encryption algorithms, and negotiation failure.
Why did the tunnel not come up?
A. The pre-shared keys do not match.
B. The remote gateway phase 1 configuration does not match the local gateway phase 1 configuration.
C. The remote gateway phase 2 configuration does not match the local gateway phase 2 configuration.
D. The remote gateway is using aggressive mode and the local gateway is configured to use main mode.

Refer to the exhibits.
The image shows a network diagram with FortiGate A (primary) and FortiGate B (secondary), a client, a switch, and a web server. It also includes the output from the command config system ha and a firewall policy.
The exhibits show a network diagram, the output from the command config system ha, and a firewall policy. What source MAC address does the web server detect when a user accesses it?
A. The virtual MAC address of FortiGate B.
B. The physical MAC address of FortiGate B.
C. The virtual MAC address of FortiGate A.
D. The physical MAC address of FortiGate A.

Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below. # diagnose debug authd fsso list--FSSO logons-IP: 192.168.3.1 User: STUDENT Groups:TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB. What should the administrator check?
A. The IP address recorded in the logon event for the user STUDENT.
B. The DNS name resolution for the workstation name INTERNAL2. TRAINING. LAB.
C. The source IP address of the traffic arriving to the FortiGate from the workstation INTERNAL2. TRAINING. LAB.
D. The reserve DNS lookup for the IP address 192.168.3.1.

Four FortiGate devices configured for OSPF connected to the same broadcast domain. The first unit is elected as the designated router. The second unit is elected as the backup designated router. Under normal operation, how many OSPF full adjacencies are formed to each of the other two units?
A. 1
B. 2
C. 3
D. 4

Mais conteúdos dessa disciplina