Study with FCNSP.v5 Actual Test Questions

Review the CLI configuration below for an IPS sensor and identify the correct statements regarding this configuration from the choices below. (Select all that apply.)
config ips sensor edit "LINUX_SERVER" set comment '' set replacemsg-group '' set log enable config entries edit 1 set action default set application all set location server set log enable set log-packet enable set os Linux set protocol all set quarantine none set severity all set status default next end next
end

• A. The sensor will include a PCAP file with a trace of the matching packets in the log message of any matched signature.
• B. The sensor will log all server attacks for all operating systems.
• C. The sensor only filters which IPS signatures to apply to the selected firewall policy.
• D. The sensor will match all traffic from the address object 'LINUX_SERVER'.
• E. The sensor will reset all connections that match these signatures.

A network administrator connects his PC to the INTERNAL interface on a FortiGate unit. The administrator attempts to make an HTTPS connection to the FortiGate unit on the VLAN1 interface at the IP address of 10.0.1.1, but gets no connectivity.
The following troubleshooting commands are executed from the CLI:
user1 # get system interface == [ internal ] namE. internal modE. static ip: 10.0.1.254 255.255.255.128 status: up netbios-forwarD. disable typE. physical mtu-overridE. disable == [ vlan1 ] namE. vlan1 modE. static ip: 10.0.1.1 255.255.255.128 status: up netb ios-forwarD. disable typE. vlan mtu-overridE. disable
user1 # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default
S 10.0.0.0/8 [10/0] is a summary, Null C 10.0.1.0/25 is directly connected, vlan1 C 10.0.1.128/25 is directly connected, internal
user1 # diagnose debug flow trace start 100
user1 # diagnose debug ena
user1 # diagnose debug flow filter daddr 10.0.1.1 10.0.1.1
id=20085 trace_id=277 msg="vd-root received a packet(proto=6, 10.0.1.130
:47922->10.0.1.1:443) from internal."
id=20085 trace_id=277 msg="allocate a new session-00000b21"
id=20085 trace_id=277 msg="iprope_in_check() check failed, drop"
Based on the output from these commands, which of the following is a possible cause of the problem?

• A. The PC is using an incorrect default gateway IP address.
• B. The PC has an IP address in the wrong subnet.
• C. The FortiGate unit has no route back to the PC.
• D. There is no firewall policy allowing traffic from INTERNAL -> VLAN1.

Which of the following statements is correct based on the firewall configuration illustrated in the exhibit?

• A. A user can access the Internet using only the protocols that are supported by user
  authentication.
• B. A user must authenticate using the HTTP, HTTPS, SSH, FTP, or Telnet protocol before they can access any services.
• C. A user cannot access the Internet using any protocols unless the user has passed firewall authentication.
• D. A user can access the Internet using any protocol except HTTP, HTTPS, Telnet, and FTP. These require authentication before the user will be allowed access.

Which part of an email message exchange is NOT inspected by the POP3 and IMAP proxies?

• A. File attachments
• B. Message body
• C. TCP connection
• D. Message headers

The diag sys session list command is executed in the CLI. The output of this command is shown in the exhibit.

Based on the output from this command, which of the following statements is correct?

• A. This session matches a firewall policy with ID 5.
• B. This is a UDP session.
• C. Traffic shaping is being applied to this session.
• D. This traffic has been authenticated.
• E. This is an ICMP session.