Logo Passei Direto
Buscar

Outros

Outros
Examine this FortiGate configuration: config system global set av-failopen pass end config ips global set fail-open disable end Examine the output of the following debug command: # diagnose hardware sysinfo conserve memory conserve mode: on total RAM: 3040 MB memory used: 2706 MB 89% of total RAM memory freeable: 334 MB 11% of total RAM memory used + freeable threshold extreme: 2887 MB 95% of total RAM memory used threshold red: 2675 MB 88% of total RAM memory used threshold green: 2492 MB 82% of total RAM Based on the diagnostic outputs above, how is FortiGate handling new packets that require IPS inspection?
They are dropped.
They are allowed, but with no inspection.
They are allowed and inspected.
They are allowed and inspected, as long as no additional proxy-based inspection is required.
User badge image
CuriosidadesGerais

há 5 meses

User badge image
CuriosidadesGerais

há 5 meses

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute
14 pág.

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute

Respostas

User badge image

Ed Verified user icon

há 5 meses

Para analisar a configuração do FortiGate e o comando de diagnóstico fornecido, vamos considerar as informações apresentadas. 1. Configuração do FortiGate: - A configuração `set av-failopen pass` indica que, em caso de falha do sistema de antivírus, o tráfego deve ser permitido. - A configuração `set fail-open disable` para IPS significa que, em caso de falha do sistema de IPS, o tráfego não será permitido. 2. Saída do comando de diagnóstico: - O sistema está em modo de conservação de memória, com 89% da RAM total utilizada e apenas 11% livre. - Os limites de uso de memória indicam que o sistema está próximo de sua capacidade máxima. Dado que o IPS está configurado para não permitir tráfego em caso de falha (`set fail-open disable`), e considerando que o sistema está com alta utilização de memória, é razoável concluir que novos pacotes que requerem inspeção de IPS não podem ser processados adequadamente. Portanto, a resposta correta é: Eles são descartados.

Essa resposta te ajudou?

0
Dislike0

Ainda com dúvidas?

Envie uma pergunta e tenha sua dúvida de estudo respondida!

Essa pergunta também está no material:

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute
14 pág.

FortiGate Security and FortiGate Infrastructure 7.2 Sample Questions_ Revisão da tentativa _ Training Institute

Mais perguntas desse material

Which two statements about antivirus scanning in a firewall policy set to proxy-based inspection mode, are true? (Choose two.)
FortiGate sends a reset packet to the client if antivirus reports the file as infected.
The client must wait for the antivirus scan to finish scanning before it receives the file.
A file does not need to be buffered completely before it is moved to the antivirus engine for scanning.

View the exhibit.
| Name 0 | Type 0 | Members 0 | IP/Netmask 0 | Administrative Acc... 0 |
| :--: | :--: | :--: | :--: | :--: |
| 圄 Physical Interface | | | | |
| port1 Physical Interface | | | 10.200.1.1/255.255.255.0 |
| | | | | |
| (1) Local Certificate | | | | |
| (2) Security Profiles | System Settings | | | |
| (3) VPN | | | | |
| 4 User & Authentication | | Administration Settings | | |
| (5) WIFI Controller | | HTTP port | 80 | |
| (6) System | | Redirect to HTTPS | | |
| Administrators | | HTTPS port | 443 | |
| Admin Profiles | | HTTPS server certificate | 园 self-sign |
| Firmware | | SSH port | 22 | |
| Settings | (7) | Telnet port | 23 | |
| HA | | Idle timeout | 480 | |
| SSL-VPN Portals | SSL-VPN Settings | | | |
| SSL-VPN Settings | | | | |
| SSL-VPN Clients | Connection Settings (8) | | | |
| SSL-VPN Clients | Listen on Interface(s) | port1 | |
| VPN Location Map | Listen on Port | port1 | * | |
| 4 User & Authentication | | | | |
| | | | | |
Which statement about the configuration settings is true?
The settings are invalid. The administrator settings and the SSL-VPN settings cannot use the same port.
When a remote user accesses http://10.200.1.1:443, the SSL-VPN login page opens.
When a remote user accesses https://10.200.1.1:443, the FortiGate login page opens.
When a remote user accesses https://10.200.1.1:443, the SSL-VPN login page opens.

View the exhibit.
The image shows a network diagram with two subnets, 10.0.1.0/24 and 10.0.2.0/24, connected through a FortiGate device with two VDOMs (VDOM1 and VDOM2) and an inter-VDOM link.
Which two static routes are required in the FortiGate configuration, to route traffic between both subnets through an inter-VDOM link? (Choose two.)
A static route in VDOM1 for the destination subnet 10.0.2.0/24
A static route in VDOM2 with the destination subnet matching the subnet assigned to the inter-VDOM link
A static route in VDOM1 with the destination subnet matching the subnet assigned to the inter-VDOM link
A static route in VDOM2 for the destination subnet 10.0.1.0/24

Which three settings and protocols can be used to provide secure and restrictive administrative access to FortiGate? (Choose three.)
SSH
Trusted host
HTTPS

Which additional load balancing method is supported in equal cost multipath (ECMP) load balancing when SD-WAN is enabled?
Weight based
Volume based
Source-destination IP based
Source IP based

What does the command diagnose debug fsso-polling refresh-user do?
It enables agentless polling mode real-time debug.
It refreshes all users learned through agentless polling.
It refreshes user group information from any servers connected to FortiGate using a collector agent.
It displays status information and some statistics related to the polls done by FortiGate on each DC.

Examine the exhibit, which shows a firewall policy configured with multiple security profiles.
The image shows a firewall policy configuration with multiple security profiles, including AntiVirus, Web Filter, Video Filter, DNS Filter, Application Control, IPS, File Filter, and SSL Inspection.
Which two security profiles are handled by the IPS engine? (Choose two.)
AntiVirus
Web Filter
IPS
Application Control

Which statement about firewall policy NAT is true?
DNAT can automatically apply to multiple firewall policies, based on DNAT rules.
DNAT is not supported.
You must configure SNAT for each firewall policy.
SNAT can automatically apply to multiple firewall policies, based on SNAT policies.

View the exhibit.
FOT1 # get router info routing-table all Coder: K - kernel, C - connected, S - static, R - RIP, B - BOP O - OSPF, IS - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, is - IS-IS inter area V - BOP VPNv4 * - candidate default Routing table for VRF-0 S 0.0.0.0/0 [10/0] via 172.20.121.2, port1, [1/0] C 172.20.121.0/24 is directly connected, port1 C 172.20.168.0/24 is directly connected, port2 C 172.20.167.0/24 is directly connected, port3 S 10.20.30.0/26 [10/0] via 172.20.168.254, port2, [1/0] S 10.20.30.0/24 [10/0] via 172.20.167.254, port3, [1/0] S 10.30.20.0/24 [10/0] via 172.20.121.2, port1, [1/0]
Which route will be selected when trying to reach 10.20.30.254?
0.0.0.0/0 [10/0] via 172.20.121.2, port1, [1/0]
10.20.30.0/26 [10/0] via 172.20.168.254, port2, [1/0]
10.30.20.0/24 [10/0] via 172.20.121.2, port1, [1/0]
10.20.30.0/24 [10/0] via 172.20.167.254, port3, [1/0]

Mais conteúdos dessa disciplina