FCSS_EFW_AD-7.4 試験問題を無料オンラインアクセス

An administrator needs to install an IPS profile without triggering false positives that can impact applications and cause problems with the user's normal traffic flow. Which action can the administrator take to prevent false positives on IPS analysis?

• A.Use the IPS profile extension to select an operating system, protocol, and application for all the network internal services and users to prevent false positives.
• B.Enable Scan Outgoing Connections to avoid clicking suspicious links or attachments that can deliver botnet malware and create false positives.
• C.Install missing or expired SSUTLS certificates on the client PC to prevent expected false positives.
• D.Use an IPS profile with action monitor, however, the administrator must be aware that this can compromise network integrity.

Why does the ISDB block layers 3 and 4 of the OSI model when applying content filtering?
(Choose two.)

• A.The ISDB works in proxy mode, allowing the analysis of packets in layers 3 and 4 of the OSI model.
• B.The ISDB blocks the IP addresses and ports of an application predefined by FortiGuard.
• C.FortiGate has a predefined list of all IPs and ports for specific applications downloaded from FortiGuard.
• D.The ISDB limits access by URL and domain.

While configuring the BGP protocol, an administrator applies the set network-import-check disable command under config network.
What will FortiGate do as a result of this command?

• A.FortiGate will not advertise any imported routes received from one BGP neighbor to another.
• B.FortiGate will advertise only the corresponding prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table.
• C.FortiGate will advertise all the prefixes in the BGP network table to its BGP neighbor, even if it is not in the routing table.
• D.FortiGate will not advertise the prefixes, if it is not in the routing table.

An administrator must standardize the deployment of FortiGate devices across branches with consistent interface roles and policy packages using FortiManager. What is the recommended best practice for interface assignment in this scenario?

• A.Use the Install On feature in the policy package to automatically assign different interfaces based on the branch.
• B.Enable metadata variables to use dynamic configurations in the standard interfaces of FortiManager.
• C.Create normalized interface types per-platform to automatically recognize device layer interfaces based on the FortiGate model and interface name.
• D.Create interfaces using device database scripts to use them on the same policy package of FortiGate devices.

Refer to the exhibit, which shows a network diagram showing the addition of site 2 with an overlapping network segment to the existing VPN IPsec connection between the hub and site 1.

Which IPsec phase 2 configuration must an administrator make on the FortiGate hub to enable equal-cost multi-path (ECMP) routing when multiple remote sites connect with overlapping subnets?

• A.Set route-overlap to either use-new or use-old
• B.Set single-source to enable
• C.Set net-device to ecmp
• D.Set route-overlap to allow