FCSS_EFW_AD-7.4 試験問題を無料オンラインアクセス

A company's guest internet policy, operating in proxy mode, blocks access to Artificial Intelligence Technology sites using FortiGuard. However, a guest user accessed a page in this category using port 8443.
Which configuration changes are required for FortiGate to analyze HTTPS traffic on nonstandard ports like 8443 when full SSL inspection is active in the guest policy?

• A.In the Protocol Port Mapping section of the SSL/SSH Inspection Profile, enter 443, 8443 to analyze both standard (443) and non-standard (8443) HTTPS ports.
• B.Administrators can block traffic on nonstandard ports by enabling the SNI check in the SSL/SSH Inspection Profile.
• C.To analyze nonstandard ports in web filter profiles, use TLSv1.3 in the SSL/SSH Inspection Profile.
• D.Add a URL wildcard domain to the website CA certificate and use it in the SSL/SSH Inspection Profile.

An administrator needs to install an IPS profile without triggering false positives that can impact applications and cause problems with the user's normal traffic flow. Which action can the administrator take to prevent false positives on IPS analysis?

• A.Use an IPS profile with action monitor, however, the administrator must be aware that this can compromise network integrity.
• B.Use the IPS profile extension to select an operating system, protocol, and application for all the network internal services and users to prevent false positives.
• C.Install missing or expired SSUTLS certificates on the client PC to prevent expected false positives.
• D.Enable Scan Outgoing Connections to avoid clicking suspicious links or attachments that can deliver botnet malware and create false positives.

Which statement about network processor (NP) offloading is true?

• A.You can disable the NP for each firewall policy using the command np-acceleration set to loose.
• B.The FortiGate CPU offloads all firewall sessions that require FortiOS session helper to the network processing unit (NPU).
• C.When NP acceleration is enabled, firewall sessions may not offload if proxy-based security profiles are included in the firewall policy.
• D.For UDP traffic, the FortiGate CPU offloads the first packet to identify it as fast-path traffic.

An administrator is extensively using VXLAN on FortiGate. Which specialized acceleration hardware does FortiGate need to improve its performance?

• A.9
• B.SP5
• C.NP7
• D.NTurbo

How would fec-ingress and fec-sgress IPsec configuration affect an IPsec tunnel?

• A.If fragmentation occurs, FortiGate will allow the packets at the IKE layer.
• B.When an FGSP member in FortiGate fails, FortiGate flushes the corresponding tunnels and sends out dead peer detection probes to find unavailable remote peers.
• C.FortiGate will consider all IKEV2 packets as fragmentable.
• D.FortiGate will add additional redundant information to reconstruct any lost or erratically received packets.