考题篇(7.0) 05 ❀ FortiGate防火墙 ❀ Fortinet 网络安全专家 NSE 4

本文主要是介绍考题篇(7.0) 05 ❀ FortiGate防火墙 ❀ Fortinet 网络安全专家 NSE 4，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

Which statement about the policy ID number of a firewall policy is true? 〖关于防火墙策略的策略ID号，哪个描述是正确的?〗

　　A. It is required to modify a firewall policy using the CLI. 〖需要通过命令行修改防火墙策略。〗

　　B. It represents the number of objects used in the firewall policy. 〖它表示防火墙策略中使用的对象的数量。〗

　　C. It changes when firewall policies are reordered. 〖当防火墙策略重新排序时，它会发生变化。〗

　　D. It defines the order in which rules are processed. 〖它定义了处理规则的顺序。〗

　　【分析】教程篇(7.0) 03. FortiGate安全 & 防火墙策略 ❀ Fortinet 网络安全专家 NSE 4

　　当你在GUI上创建一个新的防火墙策略时，FortiGate会自动分配一个策略ID。策略ID永远不会改变，即使你将规则在序列中移动得更高或更低。

　　【答案】A

Refer to the exhibits. 〖参考提示〗

　　The SSL VPN connection fails when a user attempts to connect to it. What should the user do to successfully connect to SSL VPN? 〖现象描述SSL VPN连接失败。用户需要做什么才能成功连接SSL VPN?〗

　　A. Change the SSL VPN port on the client. 〖修改客户端SSL VPN端口〗

　　B. Change the Server IP address. 〖修改服务器IP地址〗

　　C. Change the idle-timeout. 〖修改空闲超时〗

　　D. Change the SSL VPN portal to the tunnel. 〖修改SSL VPN门户为隧道〗

　　【分析】教程篇(7.0) 12. FortiGate安全 & SSL安全隧道 ❀ Fortinet 网络安全专家 NSE 4

　　配置的端口号是10443，访问的时候输入的是1443。

　　【答案】A

An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check? 〖管理员在FortiGate上配置了严格的RPF检查。关于严格的RPF检查，哪个描述是正确的?〗

　　A. The strict RPF check is run on the first sent and reply packet of any new session. 〖严格的RPF检查将在任何新会话的第一个发送和回复数据包上运行。〗

　　B. Strict RPF checks the best route back to the source using the incoming interface. 〖严格RPF通过入接口检查回源的最佳路由。〗

　　C. Strict RPF checks only for the existence of at cast one active route back to the source using the incoming interface. 〖严格的RPF只检查是否存在at cast，使用入接口返回源的活动路由。〗

　　D. Strict RPF allows packets back to sources with all active routes. 〖严格RPF允许报文返回到所有激活路由的源。〗

　　【分析】教程篇(7.0) 01. FortiGate基础架构 & 路由 ❀ Fortinet 网络安全专家 NSE 4

　　【答案】Ｂ

Refer to the exhibits. 〖参考提示〗

　　The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) tor Facebook. 〖提示显示了SSL和身份验证策略(提示A)和Facebook的安全策略(提示)。〗

　　Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts. 〖用户可以访问Facebook的web应用程序。他们可以播放Facebook上的视频内容，但不能在视频或其他类型的帖子上留言。〗

　　Which part of the policy configuration must you change to resolve the issue? 〖要解决这个问题，必须更改策略配置的哪一部分?〗

　　A. The SSL inspection needs to be a deep content inspection. 〖SSL检查需要是深入的内容检查。〗

　　B. Force access to Facebook using the HTTP service. 〖使用HTTP服务强制访问Facebook。〗

　　C. Additional application signatures are required to add to the security policy. 〖附加的应用程序签名需要添加到安全策略中。〗

　　D. Add Facebook in the URL category in the security policy. 〖在安全策略的URL分类中添加Facebook。〗

　　【分析】

　　Facebook_like后面的锁logo。表示需要SSL深度检测。

　　【答案】A

Which two statements about FortiGate FSSO agentless polling mode are true? (Choose two.) 〖关于FortiGate FSSO无代理轮询模式的哪两个描述是正确的?(选择两个)〗

　　A. FortiGate uses the AD server as the collector agent. 〖FortiGate使用AD服务器作为采集器代理。〗

　　B. FortiGate uses the SMB protocol to read the event viewer logs from the DCs. 〖FortiGate使用SMB协议从数据中心读取事件查看器日志。〗

　　C. FortiGate does not support workstation check. 〖FortiGate不支持工作站检查。〗

　　D. FortiGate directs the collector agent to use a remote LDAP server. 〖FortiGate指示收集器代理使用远程LDAP服务器。〗

　　【分析】教程篇(7.0) 06. FortiGate基础架构 & 单点登录(FSSO) ❀ Fortinet 网络安全专家 NSE 4

　　【答案】ＢＣ

Refer to the exhibits. 〖参考提示〗

　　The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check. 〖提示包含SD-WAN性能SLA的配置，以及　diagnose sys virtual-wan-link health-check的输出。〗

　　Which interface will be selected as an outgoing interface? 〖哪个接口将被选为出接口?〗

　　A. port2

　　B. port4

　　C. port3

　　D. port1

　　【分析】教程篇(7.0) 02. FortiGate基础架构 & SD-WAN本地分汇 ❀ Fortinet 网络安全专家 NSE 4

　　将选择一条最佳宽带，而port1的延迟最低。

　　【答案】D

Refer to the exhibits. 〖参考提示〗

　　Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile? 〖检查入侵防御系统(IPS)配置文件签名配置。在IPS传感器配置文件中添加FTP.Login.Failed签名时，哪一种描述是正确的?〗

　　A. The signature setting uses a custom rating threshold. 〖签名设置使用自定义的评级阈值。〗

　　B. The signature setting includes a group of other signatures. 〖签名设置包括一组其他签名。〗

　　C. Traffic matching the signature will be allowed and logged. 〖命中该签名的流量将被允许并记录日志。〗

　　D. Traffic matching the signature will be silently dropped and logged. 〖匹配该签名的流量将被无声地删除并记录。〗

　　【分析】教程篇(7.0) 11. FortiGate安全 & 入侵防御和拒绝服务 ❀ Fortinet 网络安全专家 NSE 4

　　选择阻断以静默地删除匹配该表项中包含的任何签名的流量。

　　【答案】D

Refer to the exhibits. 〖参考提示〗

　　The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration. 〖提示包含网络图、虚拟IP、IP池和防火墙策略配置。〗

　　The WAN (port1) interface has the IP address 10.200.1.1/24. 〖WAN (port1)接口的IP地址为10.200.1.1/24。〗

　　The LAN (port3) interface has the IP address 10 .0.1.254/24. 〖LAN (port3)接口的IP地址为10.0.1.254/24。〗

　　The first firewall policy has NAT enabled using IP Pool. 〖第一条防火墙策略有启用NAT使用IP池。〗

　　The second firewall policy is configured with a VIP as the destination address. 〖第二条防火墙策略的目的地址为VIP。〗

　　Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0.1.10? 〖来自IP地址为10.0.1.10的工作站的internet流量将使用哪个IP地址来进行NAT源转换?〗

　　A. 10.200.1.1

　　B. 10.200.3.1

　　C. 10.200.1.100

　　D. 10.200.1.10

　　【分析】

　　【答案】A

Refer to the exhibits. 〖参考提示〗