FCSS_NST_SE-7.6問題集、Fortinet実際の試験問題

質問 1

Consider the scenario where the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate. Which two actions will FortiGate take when using the default settings for SSL certificate inspection? (Choose two answers)

A. FortiGate uses the CN information from the Subject field in the server certificate.

B. FortiGate does not decrypt the traffic if the traffic is allowed by the web filter profile.

C. FortiGate does not decrypt the traffic if the traffic is blocked by the web filter profile.

D. FortiGate uses the SNI from the user ' s web browser.

正解: A,B

解説: (PassTest メンバーにのみ表示されます)

質問 2

Refer to the exhibit.

The partial output of diagnose sys session stat command is shown.
Which statement about the output shown in the exhibit is correct?

A. 113 sessions have been dropped because of memory page exhaustion.

B. 27 sessions have expired but are still in the session table in case any out-of-order packets arrive.

C. 562 TCP sessions have their proto_state set to 01 if there is no inspection.

D. There have been 131072 recorded ephemeral sessions but there are no current ones.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 3

A VPN tunnel is up. To monitor traffic flow, the administrator enters the following CLI commands on an SSH session on FortiGate:
# diagnose debug enable
# diagnose sniffer packet any ' udp and port 500 ' 4
However, the sniffer does not show any output. Assuming default configuration values, what are two possible reasons there is no output? (Choose two answers)

A. NAT Traversal is enabled.

B. The filter should be modified to also capture packets for TCP port 443 or UDP port 4500 .

C. The sniffer output will be ignored because running diagnose debug enable shows only application real- time debugs.

D. The sniffer must be restricted to the remote peer IP address.

正解: A,B

解説: (PassTest メンバーにのみ表示されます)

質問 4

Which of the following regarding protocol states is true? (Choose one answer)

A. proto_state=01 indicates an established TCP session.

B. proto_state=10 indicates an established TCP session.

C. proto_state=00 indicates that UDP traffic flows in both directions.

D. proto_state=01 indicates one-way ICMP traffic.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 5

Refer to the exhibit.

The sniffer log on two FortiGate devices are shown. Based on the information in the log, which two factors explain the output on FortiGate FGT-02? (Choose two answers)

A. The administrator configured the wrong remote peer IP address on FGT-01.

B. The administrator set the wrong sniffer filter on FGT-02.

C. The administrator has not yet configured the VPN tunnel on FGT-02.

D. A third-party device is blocking protocol 50.

正解: A,D

解説: (PassTest メンバーにのみ表示されます)

質問 6

Which statement about IKEv2 is true?

A. IKEv1 and IKEv2 share the concept of phase1 and phase2.

B. Both IKEv1 and IKEv2 share the feature of asymmetric authentication.

C. IKEv1 and IKEv2 use the same TCP port but run on different UDP ports.

D. IKEv1 and IKEv2 have enough of the header format in common that both versions can run over the same UDP port.

正解: D

解説: (PassTest メンバーにのみ表示されます)

Fortinet FCSS - Network Security 7.6 Support Engineer - FCSS_NST_SE-7.6 模擬練習