FCSS_EFW_AD-7.4試験無料問題集（78題）「Fortinet FCSS - Enterprise Firewall 7.4 Administrator 認定」

出題：1

A company's users on an IPsec VPN between FortiGate A and B have experienced intermittent issues since implementing VXLAN. The administrator suspects that packets exceeding the 1500- byte default MTU are causing the problems.
In which situation would adjusting the interface's maximum MTU value help resolve issues caused by protocols that add extra headers to IP packets?

A. Adjust the MTU on interfaces only if FortiGate has the FortiGuard enterprise bundle, which allows MTU modification.

B. Adjust the MTU on interfaces only in wired connections like PPPoE, optic fiber, and ethernet cable.

C. Adjust the MTU on interfaces in all FortiGate devices that support the latest family of Fortinet SPUs: NP7, CP9 and SP5.

D. Adjust the MTU on interfaces in controlled environments where all devices along the path allow MTU interface changes.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

While configuring the BGP protocol, an administrator applies the set network-import-check disable command under config network.
What will FortiGate do as a result of this command?

A. FortiGate will not advertise any imported routes received from one BGP neighbor to another.

B. FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table.

C. FortiGate will not advertise the prefixes, if it is not in the routing table.

D. FortiGate will advertise only the corresponding prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

Refer to the exhibit, which shows the ADVPN network topology and partial BGP configuration.

Which two parameters must an administrator configure in the config neighbor range for spokes shown in the exhibit? (Choose two.)

A. set max-neighbor-num 2

B. set neighbor-group advpn

C. set prefix 172.16.1.0 255.255.255.0

D. set route-reflector-client enable

正解：B,C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

Refer to the exhibits. The exhibits show a network topology, a firewall policy, and an SSL/SSH inspection profile configuration.

Why is FortiGate unable to detect HTTPS attacks on firewall policy ID 3 targeting the Linux server?

A. The administrator must enable HTTPS in the protocol port mapping of the deep- inspection SSL/SSH inspection profile.

B. The administrator must enable cipher suites in the SSL/SSH inspection profile to decrypt the message.

C. The administrator must set the policy to inspection mode to analyze the HTTPS packets as expected.

D. The administrator must enable SSL inspection of the SSL server and upload the certificate of the Linux server website to the SSL/SSH inspection profile.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

Which two configurations are mandatory for an auto-discovery VPN (ADVPN) implementation on a hub? (Choose two.)

A. set net-device must be disabled to avoid dynamic interface creation.

B. set add-route must be enabled to add routes.

C. An overlay IP address with a mask of /32 must be assigned to the IPsec virtual interface.

D. The remote-ip must be on a different IP address from the overlay subnet.

正解：A,C 解答を投票する

出題：6

Refer to the exhibit, which shows an ADVPN network.

An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2.
What must the administrator configure in the phase 1 VPN IPSEC configuration of the Hub2Hub tunnels?

A. set auto-discovery-forwarder enable

B. set auto-discovery-sender enable

C. set auto-discovery-receiver enable

D. set add-route enable

正解：A 解答を投票する

出題：7

An administrator is extensively using VXLAN on FortiGate. Which specialized acceleration hardware does FortiGate need to improve its performance?

A. NP7

B. 9

C. NTurbo

D. SP5

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：8

Refer to the exhibits.

The configuration of a user's Windows PC, which has a default MTU of 1500 bytes, along with FortiGate interfaces set to an MTU of 1000 bytes, and the results of PC1 pinging server
172.16.0.254 are shown.
Why is the user in Windows PC1 unable to ping server 172.16.0.254 and is seeing the message:
Packet needs to be fragmented but DF set?

A. Fragmented packets must be encrypted. To connect any application successfully, the user must install the Fortinet_CA certificate in the Microsoft Management Console.

B. Option ip.flags.mf must be set to enable on FortiGate. The user has to adjust the ping MTU to
1000 to succeed.

C. FortiGate honors the do not fragment bit and the packets are dropped. The user has to adjust the ping MTU to 972 to succeed.

D. The user must trigger different traffic because path MTU discovery techniques do not recognize ICMP payloads.

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

FCSS_EFW_AD-7.4試験無料問題集「Fortinet FCSS - Enterprise Firewall 7.4 Administrator 認定」