無料Fortinet NSE7_ZTA-7.2試験問題と解答トレーニングを提供しています
トップクラスFortinet NSE7_ZTA-7.2オンライン問題集
質問 # 16
Which three statements are true about zero-trust telemetry compliance1? (Choose three.)
- A. FortiClient EMS sends the endpoint information received through FortiClient Telemetry to FortiOS
- B. FortiOS provides network access to the endpoint based on the zero-trust tagging rules
- C. ZTNA tags are configured in FortiClient,based on criteria such as certificates and the logged in domain
- D. FortiClient EMS creates dynamic policies using ZTNAtags
- E. FortiChent checks the endpoint using the ZTNAtags provided by FortiClient EMS
正解：B、D、E
解説：
In the context of zero-trust telemetry compliance, the three true statements are:
A: FortiClient EMS creates dynamic policies using ZTNA tags: FortiClient EMS utilizes ZTNA (Zero Trust Network Access) tags to create dynamic policies based on the telemetry it receives from endpoints.
B: FortiClient checks the endpoint using the ZTNA tags provided by FortiClient EMS: FortiClient on the endpoint uses the ZTNA tags from FortiClient EMS to determine compliance with the specified security policies.
D: FortiOS provides network access to the endpoint based on the zero-trust tagging rules: FortiOS, the operating system running on FortiGate devices, uses the zero-trust tagging rules to make decisions on network access for endpoints.
The other options are not accurate in this context:
C: ZTNA tags are configured in FortiClient, based on criteria such as certificates and the logged-in domain: ZTNA tags are typically configured and managed in FortiClient EMS, not directly in FortiClient.
E: FortiClient EMS sends the endpoint information received through FortiClient Telemetry to FortiOS: While FortiClient EMS does process telemetry data, the direct sending of endpoint information to FortiOS is not typically described in this manner.
References:
Zero Trust Telemetry in Fortinet Solutions.
FortiClient EMS and FortiOS Integration for ZTNA.
質問 # 17
An administrator has to configure LDAP authentication tor ZTNA HTTPS access proxy Which authentication scheme can the administrator apply1?
- A. Digest
- B. Form-based
- C. NTLM
- D. Basic
正解：B
解説：
LDAP (Lightweight Directory Access Protocol) authentication for ZTNA (Zero Trust Network Access) HTTPS access proxy is effectively implemented using a Form-based authentication scheme. This approach allows for a secure, interactive, and user-friendly means of capturing credentials. Form-based authentication presents a web form to the user, enabling them to enter their credentials (username and password), which are then processed for authentication against the LDAP directory. This method is widely used for web-based applications, making it a suitable choice for HTTPS access proxy setups in a ZTNA framework.References:FortiGate Security 7.2 Study Guide, LDAP Authentication configuration sections.
質問 # 18
With the increase in loT devices, which two challenges do enterprises face? (Choose two.)
- A. Achieving full network visibility
- B. Maintaining a high performance network
- C. Bandwidth consumption due to added overhead of loT
- D. Unpatched vulnerabilities in loT devices
正解：A、D
解説：
With the increase in IoT devices, enterprises face many challenges in securing and managing their network and data. Two of the most significant challenges are:
Unpatched vulnerabilities in IoT devices (Option C): IoT devices are often vulnerable to cyber attacks due to their increased exposure to the internet and their limited computing resources. Some of the security challenges in IoT include weak password protection, lack of regular patches and updates, insecure interfaces, insufficient data protection, and poor IoT device management12. Unpatched vulnerabilities in IoT devices can allow hackers to exploit them and compromise the network or data. For example, the Mirai malware infected IoT devices by using default credentials and created a massive botnet that launched DDoS attacks on internet services2.
Achieving full network visibility (Option D): IoT devices can generate a large amount of data that needs to be collected, processed, and analyzed. However, many enterprises lack the tools and capabilities to monitor and manage the IoT devices and data effectively. This can result in poor performance, inefficiency, and security risks. Achieving full network visibility means having a clear and comprehensive view of all the IoT devices, their status, their connectivity, their data flow, and their potential threats. This can help enterprises optimize their network performance, ensure data quality and integrity, and detect and prevent any anomalies or attacks3.
References := 1: Challenges in Internet of things (IoT) - GeeksforGeeks 2: Top IoT security issues and challenges (2022) - Thales 3: 7 challenges in IoT and how to overcome them - Hologram
質問 # 19
FortiNAC has alarm mappings configured for MDM compliance failure, and FortiClient EMS is added as a MDM connector When an endpoint is quarantined by FortiClient EMS, what action does FortiNAC perform?
- A. The host is marked at risk
- B. The host is disabled
- C. The host is isolated in the registration VLAN
- D. The host is forced to authenticate again
正解：C
解説：
In the scenario where FortiNAC has alarm mappings configured for MDM (Mobile Device Management) compliance failure and FortiClient EMS (Endpoint Management System) is integrated as an MDM connector, the typical response when an endpoint is quarantined by FortiClient EMS is to isolate the host in the registration VLAN. This action is consistent with FortiNAC's approach to network access control, focusing on ensuring network security and compliance. By moving the non-compliant or quarantined host to a registration VLAN, FortiNAC effectively segregates it from the rest of the network, mitigating potential risks while allowing for further investigation or remediation steps.References:FortiNAC documentation, MDM Compliance and Response Actions.
質問 # 20
Which three methods can you use to trigger layer 2 polling on FortiNAC? (Choose three)
- A. Scheduled tasks
- B. Manual polling
- C. Polling scripts
- D. Link traps
- E. Polling using API
正解：A、B、C
解説：
To trigger layer 2 polling on FortiNAC, the three methods are:
A: Polling scripts: These are scripts configured within FortiNAC to actively poll the network at layer 2 to gather information about connected devices.
C: Manual polling: This involves manually initiating a polling process from the FortiNAC interface to gather current network information.
D: Scheduled tasks: Polling can be scheduled as regular tasks within FortiNAC, allowing for automated, periodic collection of network data.
The other options are not standard methods for layer 2 polling in FortiNAC:
B: Link traps: These are more related to SNMP trap messages rather than layer 2 polling.
E: Polling using API: While APIs are used for various integrations, they are not typically used for initiating layer 2 polling in FortiNAC.
References:
FortiNAC Layer 2 Polling Documentation.
Configuring Polling Methods in FortiNAC.
質問 # 21
Which statement is true about disabled hosts on FortiNAC?
- A. They are placed in the authentication VLAN to reauthenticate
- B. They are marked as unregistered rogue devices
- C. They are placed in the dead end VLAN
- D. They are quarantined and placed in the remediation VLAN
正解：C
解説：
According to the FortiNAC documentation1, disabled hosts are placed in the dead end VLAN, which is a special VLAN that isolates them from the production network. This is done to prevent unauthorized or compromised hosts from accessing network resources or spreading malware. The dead end VLAN must be configured in the AP model or the SSID configuration, and the state must be enforced23. Disabled hosts can be enabled again by the administrator or by reauthenticating through the FortiNAC portal. References := 1:
Enable or disable hosts | FortiNAC 9.4.0 - Fortinet Documentation 2: Technical Tip: Disabled wireless hosts not isolated - FortiNAC 3: Technical Tip: Disabled wired hosts not isolated - FortiNAC
質問 # 22
Which three statements are true about a persistent agent? (Choose three.)
- A. Supports advanced custom scans and software inventory.
- B. Can be used for automatic registration and authentication
- C. Can apply supplicant configuration to a host
- D. Deployed by a login/logout script and is not installed on the endpoint
- E. Agent is downloaded and run from captive portal
正解：A、B、C
解説：
A persistent agent is an application that works on Windows, macOS, or Linux hosts to identify them to FortiNAC Manager and scan them for compliance with an endpoint compliance policy. A persistent agent can support advanced custom scans and software inventory, apply supplicant configuration to a host, and be used for automatic registration and authentication. References := Persistent Agent Persistent Agent on Windows Using the Persistent Agent
質問 # 23
Exhibit.
Which statement is true about the configuration shown in the exhibit?
- A. The domain that FortiClient is connecting to should match the domain to which the certificate is issued.
- B. default_ZTNARoot CA signs the FortiClient certificate for the SSL connectivity to FortiClient EMS
- C. The connection from FortiClient to FortiClient EMS uses TCP and TLS 1.2.
- D. It the FortiClient EMS server certificate is invalid, FortiClient connects silently.
正解：C
解説：
The exhibit shows the EMS Settings where various configurations related to network security are displayed.
Option C is correct because, in the settings, it is indicated that HTTPS port is used (which operates over TCP) and SSL certificates are involved in securing the connection, implying the use of TLS for encryption and secure communication between FortiClient and FortiClient EMS.
Option A is incorrect because the domain that FortiClient is connecting to does not have to match the domain to which the certificate is issued. The certificate is issued by the ZTNA CA, which is a separate entity from the domain. The certificate only contains the device ID, ZTNA tags, and other information that are used to identify and authenticate the device.
Option B is incorrect because if the FortiClient EMS server certificate is invalid, FortiClient does not connect silently. Instead, it performs the Invalid Certificate Action that is configured in the settings. The Invalid Certificate Action can be set to block, warn, or allow the connection.
Option D is incorrect because default_ZTNARoot CA does not sign the FortiClient certificate for the SSL connectivity to FortiClient EMS. The FortiClient certificate is signed by the ZTNA CA, which is a different certificate authority from default_ZTNARoot CA. default_ZTNARoot CA is the EMS CA Certificate that is used to verify the identity of the EMS server.
References :=
[1]: Technical Tip: ZTNA for Corporate hosts with SAML authentication and FortiAuthenticator as IDP
[2]: Zero Trust Network Access - Fortinet
質問 # 24
Which one of the supported communication methods does FortiNAC usefor initial device identification during discovery?
- A. SSH
- B. API
- C. LLDP
- D. SNMP
正解：D
解説：
FortiNAC uses a variety of methods to identify devices on the network, such as Vendor OUI, DHCP fingerprinting, and device profiling12. One of the supported communication methods that FortiNAC uses for initial device identification during discovery is SNMP (Simple Network Management Protocol)3. SNMP is a protocol that allows network devices to exchange information and monitor their status4. FortiNAC can use SNMP to read information from switches and routers, such as MAC addresses, IP addresses, VLANs, and port status3. SNMP can also be used to configure network devices and enforce policies4. References: 1:
Identification | FortiNAC 9.4.0 - Fortinet Documentation 2: Device profiling process | FortiNAC8.3.0 | Fortinet Document Library 3: Using FortiNAC to identify medical devices - James Pratt 4: How does FortiNAC identify a new device on the network?
質問 # 25
Exhibit.
Based on the ZTNA logs provided, which statement is true?
- A. An authentication scheme is configured
- B. The Remote_user ZTNA tag has matched the ZTNA rule
- C. The external IP for ZTNA server is 10 122 0 139.
- D. Traffic is allowed by firewall policy 1
正解：B
解説：
Based on the ZTNA logs provided, the true statement is:
A: The Remote_user ZTNA tag has matched the ZTNA rule: The log includes a user tag "ztna_user" and a policy name "External_Access_FAZ", which suggests that the ZTNA tag for "Remote_User" has successfully matched the ZTNA rule defined in the policy to allow access.
The other options are not supported by the information in the log:
B: An authentication scheme is configured: The log does not provide details about an authentication scheme.
C: The external IP for ZTNA server is 10.122.0.139: The log entry indicates "dstip=10.122.0.139" which suggests that this is the destination IP address for the traffic, not necessarily the external IP of the ZTNA server.
D: Traffic is allowed by firewall policy 1: The log entry "policyid=1" indicates that the traffic is matched to firewall policy ID 1, but it does not explicitly state that the traffic is allowed; although the term "action=accept" suggests that the action taken by the policy is to allow the traffic, the answer option D could be considered correct as well.
References:
Interpretation of FortiGate ZTNA Log Files.
Analyzing Traffic Logs for Zero Trust Network Access.
質問 # 26
Exhibit.
Which statement is true about the FortiAnalyzer playbook configuration shown in the exhibit?
- A. The playbook is run on a configured schedule
- B. The playbook is run when an incident is created that matches the filters.
- C. The playbook is run when an event is created that matches the filters
- D. The playbook is manually started by an administrator
正解：D
解説：
The FortiAnalyzer playbook configuration shown in the exhibit indicates that:
D: The playbook is manually started by an administrator: The "ON DEMAND" trigger in the playbook suggests that it is initiated manually, as opposed to being automated or scheduled. This typically means that an administrator decides when to run the playbook based on specific needs or incidents.
質問 # 27
Which two statements are true regarding certificate-based authentication for ZTNA deployment? (Choose two.)
- A. Certificate actions can be configured only on the FortiGate CLI
- B. The default action for empty certificates is block
- C. Client certificate configuration is a mandatory component for ZTNA
- D. FortiGate signs the client certificate submitted by FortiClient.
正解：B、C
解説：
Certificate-based authentication is a method of verifying the identity of a device or user by using a digital certificate issued by a trusted authority. For ZTNA deployment, certificate-based authentication is used to ensure that only authorized devices and users can access the protected applications or resources.
B: The default action for empty certificates is block. This is true because ZTNA requires both device and user verification before granting access. If a device does not have a valid certificate issued by the ZTNA CA, it will be blocked by the ZTNA gateway. This prevents unauthorized or compromised devices from accessing the network.
D: Client certificate configuration is a mandatory component for ZTNA. This is true because ZTNA relies on client certificates to identify and authenticate devices. Client certificates are generated by the ZTNA CA and contain the device ID, ZTNA tags, and other information. Client certificates are distributed to devices by the ZTNA management server (such as EMS) and are used to establish a secure connection with the ZTNA gateway.
A: FortiGate signs the client certificate submitted by FortiClient. This is false because FortiGate does not sign the client certificates. The client certificates are signed by the ZTNA CA, which is a separate entity from FortiGate. FortiGate only verifies the client certificates and performs certificate actions based on the ZTNA tags.
C: Certificate actions can be configured only on the FortiGate CLI. This is false because certificate actions can be configured on both the FortiGate GUI and CLI. Certificate actions are the actions that FortiGate takes based on the ZTNA tags in the client certificates. For example, FortiGate can allow, block, or redirect traffic based on the ZTNA tags.
References :=
1: Technical Tip: ZTNA for Corporate hosts with SAML authentication and FortiAuthenticator as IDP
2: Zero Trust Network Access - Fortinet
質問 # 28
Exhibit.
Which statement is true about the hr endpoint?
- A. The endpoint is unauthenticated
- B. The endpoint has been marked at risk
- C. The endpoint is a rogue device
- D. The endpoint is disabled
正解：B
解説：
Based on the exhibit showing the status of the hr endpoint, the true statement about this endpoint is:
D: The endpoint has been marked at risk: The "w" next to the host status for the 'hr' endpoint typically denotes a warning, indicating that the system has marked it as at risk due to some security policy violations or other concerns that need to be addressed.
The other options do not align with
the provided symbol "w" in the context of FortiNAC:
A: The endpoint is a rogue device: If the endpoint were rogue, we might expect a different symbol, often indicating a critical status or alarm.
B:The endpoint is disabled: A disabled status is typically indicated by a different icon or status indicator.
C: The endpoint is unauthenticated: An unauthenticated status would also be represented by a different symbol or status indication, not a "w".
質問 # 29
......
Fortinet NSE7_ZTA-7.2 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
最新（2024)Fortinet NSE7_ZTA-7.2試験問題集：https://www.passtest.jp/Fortinet/NSE7_ZTA-7.2-shiken.html
NSE7_ZTA-7.2練習問題集で検証済みのPassTest更新された32問題あります：https://drive.google.com/open?id=1Z0JgQ6dfUgOFqia21TsMxmX9zgnAr46Q