Fortinet Certified Network Security Professional (FCNSP v4.2) - FCNSP FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

You are the administrator in charge of a FortiGate unit which acts as a VPN gateway. You have chosen to use Interface Mode when configuring the VPN tunnel and you want users from either side to be able to initiate new sessions. There is only 1 subnet at either end and the FortiGate unit already has a default route.
Which of the following configuration steps are required to achieve these objectives? (Select all that apply.)

A. Add a route for the remote subnet. B. Create one firewall policy. C. Create a phase 1 definition. D. Create two firewall policies. E. Add a route for incoming traffic. F. Create a phase 2 definition.

Discussion 0

Correct Answer: A,C,D,F Vote an answer

Question 2

SSL Proxy is used to decrypt the SSL-encrypted traffic. After decryption, where is the traffic buffered in preparation for content inspection?

A. The file is buffered by the application proxy. B. The file is buffered by the SSL proxy. C. No file buffering is needed since a stream-based scanning approach is used for SSL content inspection. D. In the upload direction, the file is buffered by the SSL proxy. In the download direction, the file is buffered by the application proxy.

Discussion 0

Correct Answer: A Vote an answer

Question 3

Which of the following statements is correct about how the FortiGate unit verifies username and password during user authentication?

A. The FortiGate unit will only attempt to authenticate against Active Directory if Fortinet Server Authentication Extensions are installed and configured. B. An administrator can define a local account for which the password must be verified by querying a remote server. C. If a remote server is included in a user group, it will be checked before local accounts. D. If authentication fails with a local password, the FortiGate unit will query the authentication server if the local user is configured with both a local password and an authentication server.

Discussion 0

Correct Answer: B Vote an answer

Question 4

The following diagnostic output is displayed in the CLI:
diag firewall auth list
policy iD. 9, srC. 192.168.3.168, action: accept, timeout: 13427
user: forticlient_chk_only, group:
flag (80020): auth timeout_ext, flag2 (40): exact group iD. 0, av group: 0
----- 1 listed, 0 filtered -----
Based on this output, which of the following statements is correct?

A. Firewall policy 9 has endpoint compliance enabled but not firewall authentication. B. The client check that is part of an SSL VPN connection attempt failed. C. An auth-keepalive value has been enabled. D. This user has been associated with a guest profile as evidenced by the group id of 0.

Discussion 0

Correct Answer: A Vote an answer

Question 5

Which of the following report templates must be used when scheduling report generation?

A. Output Template B. Chart Template C. Layout Template D. Data Filter Template

Discussion 0

Correct Answer: C Vote an answer

Question 6

Which of the following items are considered to be advantages of using the application control features on the FortiGate unit?
Application control allows an administor to:

A. enable AV scanning per application rather than per policy. B. check which applications are installed on workstations attempting to access the network. C. customize application types in a similar way to adding custom IPS signatures. D. set a unique session-ttl for select applications.

Discussion 0

Correct Answer: D Vote an answer

Question 7

Identify the correct properties of a partial mesh VPN deployment:

A. VPN tunnels are not configured between every single location. B. There are no hub locations in a partial mesh. C. VPN tunnels interconnect between every single location. D. Some locations are reached via a hub location.

Discussion 0

Correct Answer: A,D Vote an answer

Question 8

Review the CLI configuration below for an IPS sensor and identify the correct statements regarding this configuration from the choices below. (Select all that apply.)
config ips sensor edit "LINUX_SERVER" set comment '' set replacemsg-group '' set log enable config entries edit 1 set action default set application all set location server set log enable set log-packet enable set os Linux set protocol all set quarantine none set severity all set status default next end next
end

A. The sensor will reset all connections that match these signatures. B. The sensor will log all server attacks for all operating systems. C. The sensor will match all traffic from the address object 'LINUX_SERVER'. D. The sensor will include a PCAP file with a trace of the matching packets in the log message of any matched signature. E. The sensor only filters which IPS signatures to apply to the selected firewall policy.

Discussion 0

Correct Answer: D,E Vote an answer

Question 9

Which of the following statements correctly describes the deepscan option for HTTPS?

A. Enabling deepscan will perform further checks on the server certificate. B. When deepscan is disabled, only the web server certificate is inspected; no decryption of content occurs. C. With deepscan enabled, archived files will be decompressed before scanning for a more comprehensive file inspection. D. Deepscan is only applicable to mail protocols, where all IP addresses in the header are checked.

Discussion 0

Correct Answer: B Vote an answer

Question 10

What are the requirements for a cluster to maintain TCP connections after device or link failover? (Select all that apply.)

A. Only applies to UDP and ICMP connections. B. Connections must not be handled by a proxy. C. Enable session pick-up. D. Only applies to connections handled by a proxy.

Discussion 0

Correct Answer: B,C Vote an answer