C-HRHFC-2311問題集、SAP実際の試験問題

質問 1

An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings.
What is true about the DNS connection to a FortiGuard server?

A. It uses DNS overTLS.

B. It uses UDP 53.

C. It uses UDP 8888.

D. It uses DNS over HTTPS.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 2

A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
* All traffic must be routed through the primary tunnel when both tunnels are up
* The secondary tunnel must be used only if the primary tunnel goes down
* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

A. Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.

B. Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.

C. Enable Dead Peer Detection.

D. Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.

正解: A,C

解説: (PassTest メンバーにのみ表示されます)

質問 3

Refer to the exhibits.
Exhibit A shows a network diagram. Exhibit B shows the firewall policy configuration and a VIP object configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.

If the host 10.200.3.1 sends a TCP SYN packet on port 10443 to 10.200.1.10, what will the source address, destination address, and destination port of the packet be, after FortiGate forwards the packet to the destination?

A. 10.0.1.254, 10.200.1.10, and 443, respectively

B. 10.0.1.254, 10.0.1.10, and 443, respectively

C. 10.0.1.254, 10.0.1.10, and 10443, respectively

D. 10.200.3.1, 10.0.1.10, and 443, respectively

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 4

Refer to the exhibit.

The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check . Which interface will be selected as an outgoing interface?

A. port1

B. port3

C. port2

D. port4

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 5

Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)

A. Lowest to highest policy ID number.

B. Highest to lowest priority defined in the firewall policy.

C. Services defined in the firewall policy.

D. Source defined as Internet Services in the firewall policy.

E. Destination defined as Internet Services in the firewall policy.

正解: C,D,E

解説: (PassTest メンバーにのみ表示されます)

質問 6

How does FortiGate act when using SSL VPN in web mode?

A. FortiGate acts as an HTTP reverse proxy.

B. FortiGate acts as DNS server.

C. FortiGate acts as router.

D. FortiGate acts as an FDS server.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 7

Which statement correctly describes the use of reliable logging on FortiGate?

A. Reliable logging is required to encrypt the transmission of logs.

B. Reliable logging prevents the loss of logs when the local disk is full.

C. Reliable logging is enabled by default in all configuration scenarios.

D. Reliable logging can be configured only using the CLI.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 8

An administrator is configuring an Ipsec between site A and siteB. The Remotes Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192. 16. 1.0/24 and the remote quick mode selector is 192. 16.2.0/24. How must the administrator configure the local quick mode selector for site B?

A. 192. 168.3.0/24

B. 192. 168.2.0/24

C. 192. 168.0.0/8

D. 192. 168. 1.0/24

正解: B

質問 9

Refer to the exhibit.

Which contains a network diagram and routing table output.
The Student is unable to access Webserver.
What is the cause of the problem and what is the solution for the problem?

A. The first reply packet for Student failed the RPF check .
This issue can be resolved by adding a static route to 203.0. 114.24/32 through port3.

B. The first packet sent from Student failed the RPF check.
This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

C. The first packet sent from Student failed the RPF check.
This issue can be resolved by adding a static route to 203.0. 114.24/32 through port3.

D. The first reply packet for Student failed the RPF check.
This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

正解: C

質問 10

Refer to exhibit.
An administrator configured the web filtering profile shown in the exhibit to block access to all social networking sites except Twitter. However, when users try to access twitter.com, they are redirected to a FortiGuard web filtering block page.

Based on the exhibit, which configuration change can the administrator make to allow Twitter while blocking all other social networking sites?

A. On the Static URL Filter configuration, set Action to Monitor.

B. On the FortiGuard Category Based Filter configuration, set Action to Warning for Social Networking

C. On the Static URL Filter configuration, set Type to Simple

D. On the Static URL Filter configuration, set Action to Exempt.

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 11

Which scanning technique on FortiGate can be enabled only on the CLI?

A. Heuristics scan

B. Antivirus scan

C. Ransomware scan

D. Trojan scan

正解: A

質問 12

Refer to the exhibit showing a debug flow output.

Which two statements about the debug flow output are correct? (Choose two.)

A. A new traffic session is created.

B. The debug flow is of ICMP traffic.

C. The default route is required to receive a reply.

D. A firewall policy allowed the connection.

正解: A,B

SAP Fortinet NSE 4 - FortiOS 7.2 - C-HRHFC-2311 模擬練習