[Jun-2024] C-HRHFC-2311 Dumps are Available for Instant Access from Real4Prep [Q31-Q52]

NR. 31 Which statement about video filtering on FortiGate is true?

Full SSL Inspection is not required.

It is available only on a proxy-based firewall policy.

It inspects video files hosted on file sharing services.

Video filtering FortiGuard categories are based on web filter FortiGuard categories.

NR. 32 Refer to the exhibit.

Examine the intrusion prevention system (IPS) diagnostic command.
Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?

The IPS engine was inspecting high volume of traffic.

The IPS engine was unable to prevent an intrusion attack .

The IPS engine was blocking all traffic.

The IPS engine will continue to run in a normal state.

NR. 33 Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

The collector agent uses a Windows API to query DCs for user logins.

NetAPI polling can increase bandwidth usage in large networks.

The collector agent must search security event logs.

The NetSession Enum function is used to track user logouts.

NR. 34 Which two statements describe how the RPF check is used? (Choose two.)

The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks.

The RPF check is run on the first sent and reply packet of any new session.

The RPF check is run on the first sent packet of any new session.

The RPF check is run on the first reply packet of any new session.

NR. 35 Refer to the exhibit.

Based on the raw log, which two statements are correct? (Choose two.)

Traffic is blocked because Action is set to DENY in the firewall policy.

Traffic belongs to the root VDOM.

This is a security log.

Log severity is set to error on FortiGate.

NO.36 Which three statements are true regarding session-based authentication? (Choose three.)

HTTP sessions are treated as a single user.

IP sessions from the same source IP address are treated as a single user.

It can differentiate among multiple clients behind the same source IP address.

It requires more resources.

It is not recommended if multiple users are behind the source NAT

NO.37 How can you disable RPF checking?

Disable strict-src-check under system settings.

Disable src-check on the interface level settings

Unset fail-alert-interfaces on the interface level settings.

Disable fail-detect on the interface level settings.

NO.38 Which three authentication timeout types are availability for selection on FortiGate? (Choose three.)

hard-timeout

auth-on-demand

soft-timeout

new-session

Idle-timeout

NO.39 Refer to the exhibits.
Exhibit A shows a topology for a FortiGate HA cluster that performs proxy-based inspection on traffic. Exhibit B shows the HA configuration and the partial output of the get system ha status command.

Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose two.)

For non-load balanced connections, packets forwarded by the cluster to the server contain the virtual MAC address of port2 as source.

The traffic sourced from the client and destined to the server is sent to FGT-1.

The cluster can load balance ICMP connections to the secondary.

For load balanced connections, the primary encapsulates TCP SYN packets before forwarding them to the secondary.

NO.40 Which statement correctly describes the use of reliable logging on FortiGate?

Reliable logging is enabled by default in all configuration scenarios.

Reliable logging is required to encrypt the transmission of logs.

Reliable logging can be configured only using the CLI.

Reliable logging prevents the loss of logs when the local disk is full.

NO.41 How does FortiGate act when using SSL VPN in web mode?

FortiGate acts as an FDS server.

FortiGate acts as an HTTP reverse proxy.

FortiGate acts as DNS server.

FortiGate acts as router.

NO.42 An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check?

The strict RPF check is run on the first sent and reply packet of any new session.

Strict RPF checks the best route back to the source using the incoming interface.

Strict RPF checks only for the existence of at least one active route back to the source using the incoming interface.

Strict RPF allows packets back to sources with all active routes.

NO.43 An administrator has configured outgoing Interface any in a firewall policy. Which statement is true about the policy list view?

Policy lookup will be disabled.

By Sequence view will be disabled.

Search option will be disabled

Interface Pair view will be disabled.

NO.44 What are two scanning techniques supported by FortiGate? (Choose two.)

Machine learning scan

Antivirus scan

Ransomware scan

Trojan scan

NO.45 Refer to the exhibit.

The global settings on a FortiGate device must be changed to align with company security policies. What does the Administrator account need to access the FortiGate global settings?

Change password

Enable restrict access to trusted hosts

Change Administrator profile

Enable two-factor authentication

NO.46 Refer to the exhibit.

The exhibit shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

The sensor will allow attackers matching the Microsoft Windows.iSCSI.Target.DoS signature.

The sensor will block all attacks aimed at Windows servers.

The sensor will reset all connections that match these signatures.

The sensor will gather a packet log for all matched traffic.

NO.47 What is a reason for triggering IPS fail open?

The IPS socket buffer is full and the IPS engine cannot process additional packets.

The IPS engine cannot decode a packet.

The IPS engine is upgraded.

The administrator enabled NTurbo acceleration.

NO.48 Refer to the exhibit.

Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

Traffic between port2 and port2-vlan1 is allowed by default.

port1-vlan10 and port2-vlan10 are part of the same broadcast domain.

port1 is a native VLAN.

port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

NO.49 Which two statements are correct about SLA targets? (Choose two.)

You can configure only two SLA targets per one Performance SLA.

SLA targets are optional.

SLA targets are required for SD-WAN rules with a Best Quality strategy.

SLA targets are used only when referenced by an SD-WAN rule.

NO.50 Refer to the exhibit.
The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile.
An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.

What are two solutions for satisfying the requirement? (Choose two.)

Configure a separate firewall policy with action Deny and an FQDN address object for *.download.com as destination address.

Configure a web override rating for download.com and select Malicious Websites as the subcategory.

Set the Freeware and Software Downloads category Action to Warning.

Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.

FortiGate Security 7.2 Study Guide (p.268-269): “If you want to make an exception, for example, rather than unblock access to a potentially unwanted category, change the website to an allowed category. You can also do the reverse. You can block a website that belongs to an allowed category.” “Static URL filtering is another web filter feature. Configured URLs in the URL filter are checked against the visited websites. If a match is found, the configured action is taken. URL filtering has the same patterns as static domain filtering: simple, regular expressions, and wildcard.” B) Configure a web override rating for download.com and select Malicious Websites as the subcategory.
This is true because a web override rating is a feature that allows the administrator to change the FortiGuard category of a specific website or domain, and apply a different action to it based on the web filter profile. By configuring a web override rating for download.com and selecting Malicious Websites as the subcategory, the administrator can block access to download.com, which belongs to the Freeware and Software Downloads category by default, without affecting other websites in the same category. The Malicious Websites category has the action Block in the web filter profile shown in the exhibit.
D) Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.
This is true because a static URL filter entry is a feature that allows the administrator to define custom rules for filtering specific URLs or domains, and apply an action to them based on the web filter profile. By configuring a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively, the administrator can block access to download.com and any subdomains or paths under it, without affecting other websites in the Freeware and Software Downloads category. The static URL filter entries have higher priority than the FortiGuard category based filter entries in the web filter profile.

NO.51 An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.
Which DPD mode on FortiGate will meet the above requirement?

Disabled

On Demand

Enabled

On Idle

NO.52 What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

It limits the scanning of application traffic to the DNS protocol only.

It limits the scanning of application traffic to use parent signatures only.

It limits the scanning of application traffic to the browser-based technology category only.

It limits the scanning of application traffic to the application category only.