Fortinet FCSS_EFW_AD-7.4 問題集

質問 1：
Refer to the exhibit, which shows an OSPF network.

Which types of link-state advertisements (LSA) will NGFW-1 send, if it is a backup designated router (BDR)?
A. NGFW-1 will send type 1 and type 3 LSAs.
B. NGFW-1 will send type 1 and type 5 LSAs.
C. NGFW-1 will send type 1 and type 4 LSAs.
D. NGFW-1 will send type 1 and type 2 LSAs.
正解：A

質問 2：
An administrator received a FortiAnalyzer alert that a 1 disk filled up in a day. Upon investigation, they found thousands of unusual DNS log requests, such as JHCMQK.website.com, with no answers. They later discovered that DNS exfiltration was occurring through both UDP and TLS. How can the administrator prevent this data theft technique?
A. Configure a File Filter profile to prevent DNS exfiltration.
B. Use an IPS profile and DNS exfiltration-related signatures.
C. Enable DNS Filter to protect against DNS exfiltration.
D. Create an inline-CASB to protect against DNS exfiltration.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 3：
What action can be taken on a FortiGate to block traffic using IPS protocol decoders, focusing on network transmission patterns and application signatures?
A. Use the DNS filter to block application signatures and protocol decoders.
B. Configure a web filter profile in flow mode.
C. Enable application detection-based SD-WAN rules.
D. Use application control to limit non-URL-based software handling.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 4：
How will configuring set tcp-mss-sender and set tcp-mss-receiver in a firewall policy affect the size and handling of TCP packets in the network?
A. The maximum segment size permitted in the firewall policy determines whether TCP packets are allowed or denied.
B. The TCP packet modifies the packet size only if the size of the packet is less than the one the administrator configured in the firewall policy.
C. Applying commands in a firewall policy determines the largest payload a device can handle in a single TCP segment.
D. The administrator must consider the payload size of the packet and the size of the IP header to configure a correct value in the firewall policy.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 5：
The IT department discovered during the last network migration that all zero phase selectors in phase 2 IPsec configurations impacted network operations. What are two valid approaches to prevent this during future migrations? (Choose two.)
A. Configure an IP address on the IPsec interface of each firewall to establish unique peer connections and avoid impacting network operations.
B. Configure an IPsec-aggregate to create redundancy between each firewall peer.
C. Use routing protocols to specify allowed subnets over the tunnel.
D. Clearly indicate to the VPN which segments will be encrypted in the phase two selectors.
正解：C,D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
An administrator must minimize CPU and RAM use on a FortiGate firewall while also enabling essential security features, such as web filtering and application control for HTTPS traffic. Which SSL inspection setting helps reduce system load while also enabling security features, such as web filtering and application control for encrypted HTTPS traffic?
A. Disable SSL inspection entirely to conserve resources.
B. Enable SSL certificate inspection mode to perform basic checks without decrypting traffic.
C. Use full SSL inspection to thoroughly inspect encrypted payloads.
D. Configure SSL inspection to handle HTTPS traffic efficiently.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 7：
Refer to the exhibit, which shows a LAN interface connected from FortiGate to two FortiSwitch devices.

What two conclusions can you draw from the corresponding LAN interface? (Choose two.)
A. FortiGate is using an SD-WAN-type interface to connect to a FortiSwitch device with MCLAG.
B. You must enable STP or RSTP on FortiGate and FortiSwitch to avoid layer 2 loopbacks.
C. The LAN interface must use a 802.3ad type interface.
D. This connection is using a FortiLInk to manage VLANs on FortiGate.
正解：C,D
解説: (Topexam メンバーにのみ表示されます)