素晴らしいNetwork-Security-Essentials試験問題集試そうNetwork-Security-Essentials問題集PDF
Network-Security-Essentials問題集PDFでNetwork-Security-Essentialsリアル試験問題解答
質問 # 12
You lost access to a Firebox because no one knows the administrator passphrase. How can you regain access to the Firebox? (Select one.)
- A. Connect with a console cable to reset the passphrase
- B. Plug in a USB flash drive with the WatchGuard Password Reset utility loaded
- C. Reset the Firebox to its factory defaults
- D. Call WatchGuard Support for a passphrase reset
- E. Restore a backup image of the Firebox
正解：C
解説：
If the administrator passphrase is lost:
* Option A: Resetting the Firebox to factory defaults is the recommended solution to regain access, as it clears the current configurations, including the admin passphrase, allowing reconfiguration from scratch.
* Option B(USB reset utility) andOption E(console cable reset) are not standard options for passphrase recovery on Firebox.
* Option C(Calling WatchGuard Support) cannot directly reset the passphrase.
* Option D(Restoring a backup) requires access to the device with the current passphrase.
質問 # 13
You can run TCP Dump directly from the Firebox.
- A. True
- B. False
正解：B
解説：
You cannot runTCP Dumpdirectly from a Firebox device. While Firebox has various monitoring tools such as Traffic Monitor and Firebox System Manager, it does not natively support TCP Dump, which is a command-line tool primarily available on Linux-based systems. Instead, packet captures and traffic monitoring need to be handled through Firebox-specific tools or by exporting logs to external devices for further analysis.
質問 # 14
You configured your Firebox as a DHCP server and want to verify the status of the leased addresses. You found this information in Firebox System Manager > Status Report. What is true about DHCP leases in this deployment? (Select two.)
- A. The MAC address for the host using 10.0.1.2 is 00:50:56:9a:75
- B. The hostname Server1 is associated with the IP address 10.20.1.100
- C. DHCP leases for the 10.20.1.0/24 network are valid for 24 hours
- D. DHCP leases for the 10.0.1.0/24 network are valid for 8 hours
- E. 252 IP addresses are currently available in the address pool for the 10.0.1.0/24 network
正解：D、E
解説：
Analyzing the DHCP lease information from the provided image:
* Lease Duration for 10.0.1.0/24 Network:
* The lease for IP address 10.0.1.2 on interface eth1 starts at 2023/03/09 21:42:33 and ends at 2023
/03/10 05:42:33, showing a lease duration of 8 hours. Thus, DHCP leases for the 10.0.1.0/24 network are set to be valid for 8 hours.
* Available IP Addresses in 10.0.1.0/24 Pool:
* The summary indicates that 1 out of 253 IPs is leased for the 10.0.1.0/24 subnet, meaning 252 IPs remain available in the address pool.
These details confirm the correct answers:BandD.
Other options, such as MAC address and hostname associations, do not match the data provided in the image, making them incorrect choices. Let me know if you need further assistance analyzing DHCP configurations on Firebox devices.
質問 # 15
What steps must you take to send log messages from a Firebox to WatchGuard Cloud? (Select two.)
- A. Define an Authentication Key that all your Fireboxes use to communicate with WatchGuard Cloud
- B. Enable WatchGuard Cloud in the Firebox configuration
- C. Configure Dimension to synchronize log messages with WatchGuard Cloud
- D. Add the FQDN of your WatchGuard Cloud account as a Log Server on the Firebox
- E. Use the WatchGuard Cloud Add Device wizard to add the Firebox to WatchGuard Cloud
正解：B、E
解説：
* Enable WatchGuard Cloud in Firebox Configuration: To send log messages to WatchGuard Cloud, you need to activate WatchGuard Cloud integration within the Firebox's configuration settings. This action prepares the device to communicate with WatchGuard Cloud and transfer log data.
* Use the WatchGuard Cloud Add Device Wizard: The Add Device wizard in WatchGuard Cloud is used to register and connect the Firebox to WatchGuard Cloud. This wizard guides administrators through the setup and ensures that the device is correctly configured to send logs and other data to the cloud.
These steps are required to establish connectivity and ensure that log messages are sent to WatchGuard Cloud.
Other options, such as adding an FQDN or configuring Dimension synchronization, are not necessary for this task.
質問 # 16
Match each WatchGuard Subscription Service with its function.
正解：
解説：
Explanation:
Here is the correct match for each WatchGuard Subscription Service and its function:
* A cloud-based service that uses emulation analysis to identify characteristics and behavior of malware : APT Blocker
* Uses artificial intelligence scanning on files to detect malicious software : IntelligentAV
* Uses signature-based file scanning to detect malicious software through Firebox proxy policies : Gateway AntiVirus
* Uses signatures to provide real-time protection against known software vulnerabilities : Intrusion Prevention Service
* Uses signatures to monitor and control use of applications on your network : Application Control
* Controls access to websites based on content categories : WebBlocker APT Blockeris a cloud-based, advanced threat detection service that performs behavioral analysis in a sandbox environment to identify sophisticated malware.
It focuses on identifying advanced persistent threats (APT) by observing their behavior in a controlled setting.
IntelligentAVleverages artificial intelligence to perform deep scanning and analysis of files to detect malware using predictive modeling techniques. This provides proactive protection by identifying previously unknown threats.
Gateway AntiVirusrelies on a signature-based detection mechanism to identify malware in real-time. It is used within Firebox's proxy policies to scan file transfers, ensuring files containing known malware are blocked.
Intrusion Prevention Service (IPS)scans network traffic against a database of known vulnerabilities to detect and prevent exploitation attempts in real time. It protects against network-based attacks targeting known vulnerabilities.
Application Controlhelps in monitoring, managing, and enforcing the use of applications across the network using a signature-based approach. It provides visibility and control over applications to enhance productivity and security.
WebBlockeris a content filtering service that restricts access to websites based on their content categories. It helps enforce web usage policies and block access to inappropriate or harmful content.
質問 # 17
After you enable content inspection, your users see a certificate warning when they browse the Internet. What is one way to resolve this? (Select one.)
- A. Import a trusted web server certificate to the Firebox
- B. Configure the HTTPS proxy policy to allow inbound traffic from your CA
- C. Install the current Firebox Proxy Authority certificate on your user workstations
- D. Configure a WebBlocker exception for your certificate server
正解：C
解説：
When content inspection is enabled on a Firebox, it decrypts HTTPS traffic for inspection, which requires presenting its own certificate to the client devices. This often causes certificate warnings in web browsers because the certificate issued by the Firebox is not inherently trusted by the client browsers. To resolve this, you need to install the Firebox'sProxy Authority certificateon each user's workstation as a trusted certificate. This action will prevent browsers from displaying certificate warnings, as they will recognize the Firebox certificate as a trusted source for secure connections.
質問 # 18
In a Mobile VPN configuration, why would you choose default-route (full tunnel) VPN instead of split tunnel VPN? (Select one.)
- A. Default-route VPN is the only option you can use to apply security services to connections routed to your internal servers.
- B. Default-route VPN automatically allows dynamic NAT.
- C. Default-route VPN uses less processing power.
- D. Default-route VPN enables your Firebox to examine all remote user traffic.
- E. Default-route VPN uses less bandwidth.
正解：D
解説：
In a Mobile VPN setup, adefault-route (full tunnel)VPN routes all of a remote user's internet traffic through the VPN tunnel to the Firebox. This configuration allows the Firebox to inspect and apply security policies to all traffic, including traffic that is not destined for internal network resources. In contrast, asplit tunnel VPN would route only traffic meant for the internal network through the VPN, while internet-bound traffic would bypass the Firebox, potentially exposing it to threats and limiting the Firebox's ability to inspect all traffic.
質問 # 19
Which of these statements are true for this log message? (Select three.)
- A. Application Control detected the application as a virus
- B. The URL path matched the proxy content type restrictions
- C. The connection used an HTTP Proxy
- D. Gateway AntiVirus detected a virus
- E. The connection was denied
- F. The connection used an HTTP Packet Filter
正解：C、D、E
解説：
Analyzing a typical Firebox log message for a denied connection with an associated virus detection involves recognizing multiple elements:
* HTTP Proxy Detection (C): If the connection utilized an HTTP proxy, this is typically noted in the log. Firebox's HTTP proxy is often used to inspect and manage web traffic, including scanning for malicious content.
* Gateway AntiVirus Detection (D): This service scans HTTP traffic for malware and will generate log messages if it identifies a virus. When a virus is detected, the action taken is generally to block the connection.
* Connection Denial (E): When a threat is detected (e.g., a virus via Gateway AntiVirus), Firebox policies are configured to deny the connection to prevent potential infection or data breaches. This is logged as a denied connection.
Other options, such as Application Control detecting a virus or the use of an HTTP Packet Filter, are not relevant in this context based on the function of HTTP proxies and Gateway AntiVirus in Firebox logs.
質問 # 20
You enable a network device monitoring application on a server with IP address 10.0.1.22. After you run the application, it reports that it cannot ping the Firebox at 10.0.1.1, and you see this log message in Traffic Monitor. What is the most likely cause of this issue? (Select one.)
- A. The dynamic NAT statement is not configured correctly for the 10.0.1.0/24 subnet
- B. There is no route on the Firebox for the 10.0.1.0/24 subnet
- C. There is no policy that allows Ping traffic from the server to the Firebox alias
- D. The server IP address is on the Blocked Sites list
- E. The default Unhandled Internal Packet policy is at the top of the policy set
正解：C
解説：
The most likely reason for the network device monitoring application's failure to ping the Firebox is the absence of an explicit policy permitting Ping traffic from the server (IP 10.0.1.22) to the Firebox alias (10.0.1.1). By default, Firebox policies are configured to allow only traffic explicitly permitted by a policy.
Therefore, without a dedicated policy allowing ICMP (Ping) requests from this specific source to the Firebox, the device will drop the traffic, resulting in a connectivity failure for Ping.
This is a common scenario in Firebox configurations, where restrictive policy settings enhance network security by blocking all traffic types unless specifically allowed.
質問 # 21
Which of these options are private IPv4 address spaces described in RFC 1918 Address Allocation for Private Internets? (Select three.)
- A. 192.168.0.0/16
- B. 172.0.0.0/16
- C. 102.0.2.0/24
- D. 172.16.0.0/12
- E. 10.0.0.0/8
正解：A、D、E
解説：
RFC 1918 defines private IP address spaces that are not routable on the public internet and are reserved for internal network use:
* 10.0.0.0/8: Covers IP addresses from 10.0.0.0 to 10.255.255.255 and is often used in large private networks.
* 172.16.0.0/12: Covers addresses from 172.16.0.0 to 172.31.255.255 and is commonly used in medium- sized networks.
* 192.168.0.0/16: Covers addresses from 192.168.0.0 to 192.168.255.255 and is frequently used in small to medium networks, especially for home and office routers.
* Option C(102.0.2.0/24) andOption D(172.0.0.0/16) are not private address spaces according to RFC
1918.
質問 # 22
You can add your Firebox to WatchGuard Cloud but continue to manage it locally. When you do this, what additional features does WatchGuard Cloud provide for your locally-managed Firebox? (Select two.)
- A. Automatic Firebox firmware updates
- B. Ability to schedule Firebox firmware updates
- C. Live status and access to reports
- D. Unified event correlation and analysis
- E. Real-time network traffic data
正解：B、C
解説：
When adding a Firebox to WatchGuard Cloud while maintaining local management:
* Option B: WatchGuard Cloud allows the scheduling of Firebox firmware updates, which provides flexibility in managing update timing without disrupting operations.
* Option E: It provides live status updates and reporting access, giving insights into device health and performance metrics for informed management decisions.
* Option A(Automatic firmware updates) is typically managed manually in a locally managed configuration.
* Option C(Real-time network traffic data) andOption D(Unified event correlation andanalysis) are advanced features that require full cloud management rather than hybrid (local/cloud) setup.
質問 # 23
What does a Firebox configured with default firewall policies do with outbound traffic that does not have a configured route? (Select one.)
- A. Drops the traffic
- B. Denies the traffic
- C. Sends the traffic to the loopback interface
- D. Sends the traffic to the default gateway
正解：A
解説：
When a Firebox is configured with default firewall policies and encounters outbound traffic that lacks a specified route, the Firebox will drop this traffic. In firewall configurations, if there's no matching route or policy, the traffic typically gets discarded by default to prevent unintended data leakage or unauthorized connections. This behavior is standard for most firewall devices to ensure secure handling of unconfigured paths.
質問 # 24
Match the "network server to the protocol and port it uses."
正解：
解説：
Explanation:
DHCP (Dynamic Host Configuration Protocol):DHCP operates over UDP ports 67 and 68. Port 67 is used by the DHCP server to listen for client requests, and port 68 is used by the DHCP client. This allows devices to automatically receive IP addresses and other network configuration details on a network, essential for automating IP management. [Referenced from multiple sources on network fundamentals] SMTP (Simple Mail Transfer Protocol):SMTP uses TCP port 25 for sending emails from client to server or between mail servers. SMTP is integral for email transmission, allowing efficient communication across mail servers within and outside organizational networks. [Referenced in standard protocols documentation in network management guides] DNS (Domain Name System):DNS typically runs on UDP port 53 for standard queries, with TCP/53 used for zone transfers and other larger requests. DNS is critical for resolving human-readable domain names into IP addresses, which allows users to connect to websites using easily remembered names rather than numerical IP addresses. [Foundational knowledge as detailed in network security and management resources] HTTPS (Hypertext Transfer Protocol Secure):HTTPS, an encrypted version of HTTP,operates on TCP port 443. It provides secure communication over the internet by encrypting data between the client and server using SSL/TLS, protecting data integrity and privacy. [Security essentials for network communications as found in secure web traffic documentation] HTTP (Hypertext Transfer Protocol):HTTP operates on TCP port 80 and is used for unencrypted web traffic. HTTP is the foundation of data exchange on the World Wide Web, supporting basic client-server interactions for retrieving resources from the web. [Basic networking knowledge referenced across multiple network essentials texts]
質問 # 25
If policies are automatically ordered, which of these policies has the highest precedence? (Select one.)
- A. Outgoing policy - From: Any-Trusted, Any-Optional To: Any-External
- B. HTTPS policy - From: Any-Trusted, Any-Optional To: Any-External
- C. HTTPS policy - From: Trusted To: Any-External
- D. HTTPS policy - From: User1@Firebox-DB To: Any-External
正解：D
解説：
When policies are automatically ordered, policies with more specific user-based criteria have higher precedence over general policies. In this scenario, an HTTPS policy for a specific user (e.g.,User1@Firebox- DB) would take precedence over policies that apply to broader groups or networks, such asAny-Trustedor Any-Optional. This ordering ensures that individual user rules are evaluated first before generic policies, providing finer access control.
質問 # 26
In the network configuration shown in this image, which aliases include Eth2 as a member? (Select three.)
- A. Optional-1
- B. Any-External
- C. Any-Optional
- D. Any-Trusted
- E. Any
正解：A、C、E
解説：
In the network configuration image provided, the interfaceOptional-1is mapped toEth2. Here's how the aliases work:
* Optional-1: Directly includes Eth2 since it's configured as Optional-1 in the network configuration.
* Any-Optional: This alias includes all optional interfaces, which would cover Eth2 as it is associated with Optional-1.
* Any: The "Any" alias includes all interfaces on the Firebox, covering all Trusted, Optional, and External interfaces. Thus, Eth2 is part of this alias by default.
Aliases likeAny-TrustedandAny-Externalwould not include Eth2 since it is configured as an Optional interface, not Trusted or External.
質問 # 27
In Firebox System Manager, where can you perform each of these tasks?
正解：
解説：
Explanation:
Here are the correct answers based on the Firebox System Manager interface functions:
* See the routing table and interface statisticsanswer:Firebox System Manager - Status Report Explanation: The Status Report section in Firebox System Manager includes information on network routing and interface statistics, providing insights into network paths and interface performance.
* See a list of users connected to the Fireboxanswer:Firebox System Manager - Authentication List Explanation: The Authentication List displays all active user sessions connected to the Firebox, showing authenticated users and their session details.
* Learn the status of your IPS signature databaseanswer:Firebox System Manager - Subscription Services Explanation: Subscription Services in FSM gives information on the status of services like IPS, showing the update status and version of the signature database.
* Ping the source of a denied packetanswer:Firebox System Manager - Traffic Monitor Explanation: The Traffic Monitor tool allows administrators to track packet details and offers functionality to ping sources directly, aiding in network troubleshooting.
* Block all traffic for an IP addressanswer:Firebox System Manager - Blocked Sites List Explanation: The Blocked Sites List feature in FSM lets administrators add IP addresses to a blacklist, blocking all incoming and outgoing traffic for specified addresses.
These answers utilize standard Firebox management features for performing administrative and diagnostic tasks efficiently. Let me know if you need further assistance with Firebox System Manager capabilities.
質問 # 28
You added a route on the Firebox for the 10.0.20.0/24 network. The server has 10.0.2.1 configured as its default gateway. The clients have 10.0.10.1 configured as their default gateway. The client computers on the
10.0.10.0/24 network cannot route traffic to the server at 10.0.20.100. What could cause this problem? (Select one.)
- A. The server does not have a route for the 10.0.10.0/24 network
- B. The router at 10.0.2.254 does not have a route to reach the server
- C. The default gateway of the clients is misconfigured
- D. The default gateway of the server is misconfigured
- E. The router at 10.0.2.254 needs an IP address in the 10.0.10.0/24 network
正解：D
解説：
In this scenario:
* The Firebox has a route to the 10.0.20.0/24 network.
* The server has 10.0.2.1 as its default gateway.
* Clients on the 10.0.10.0/24 network use 10.0.10.1 as their default gateway.
The issue arises because the server is in the 10.0.20.0/24 network and should have a gateway that directs traffic through the appropriate path. However, since 10.0.2.1 is configured as the server's gateway, the server likely doesn't have a correct return path to the clients on 10.0.10.0/24. This misconfiguration prevents the server from properly routing responses back to clients.
* Option Cis correct because the misconfigured default gateway on the server disrupts the routing, preventing communication with clients.
* Option Ais incorrect because the router at 10.0.2.254 is used for routing but doesn't need additional configuration if the server's gateway is corrected.
* Option Bis incorrect because the clients have the correct gateway for reaching the Firebox.
* Option Dis irrelevant since adding an IP in 10.0.10.0/24 on the router won't resolve the routing issue.
* Option Eis incorrect because adding a route on the server wouldn't solve the default gateway misconfiguration.
質問 # 29
Match each type of NAT with the correct descriptor
正解：
解説：
Explanation:
Here are the correct answers for matching each NAT type with its descriptor:
* Changes incoming packets sent to a public IP address to different internal IP addresses based on the destination portanswer:Static NAT Explanation: Static NAT maps a public IP address to multiple internal IP addresses based on the port, allowing specific services or applications to be routed to various internal destinations.
* Allows a user on the trusted or optional network to connect to a public server that is on the same physical Firebox interface by its public IP address or domain nameanswer:NAT loopback Explanation: NAT loopback (or NAT reflection) allows internal users to access a public IP address or domain name that resolves to the same local network, making it appear as if they are connecting from outside the network.
* Conserves IP addresses and hides the internal topology of your networkanswer:Dynamic NAT Explanation: Dynamic NAT (or PAT - Port Address Translation) conserves public IP addresses by allowing multiple internal devices to share a single public IP address. This setup is commonly used for outbound internet connections from a private network.
* Changes all incoming and outgoing packets sent from one range of addresses to a different range of addressesanswer:1-to-1 NAT Explanation: 1-to-1 NAT maps each internal IP address to a unique public IP address, providing a one-to-one relationship. This type of NAT is often used for networks that require external access to specific internal resources.
質問 # 30
What is true about this log message? (Select three.)
- A. The traffic is allowed inbound through the Firebox
- B. The Application Control service has identified the traffic as Gmail
- C. The HTTPS proxy identified a TLS v1.3 connection to the inbox.google.com SNI domain
- D. The Gateway AntiVirus service denied the email traffic because it matches the 18.254 virus signature
- E. The traffic is allowed outbound through the Firebox
正解：B、C、E
解説：
Application Control Identifying Gmail Traffic: Application Control is capable of identifying and categorizing applications based on traffic patterns and signatures. In this case, it recognizes Gmail traffic, which is a typical function of Application Control for managing and monitoring web applications. This functionality allows administrators to monitor and control access to applications based on organizational policies.
HTTPS Proxy Identifies TLS v1.3 Connection: The HTTPS proxy in Firebox can inspect and manage encrypted traffic by recognizing details such as the Server Name Indication (SNI) field in TLS connections.
By identifying a TLS v1.3 connection to the inbox.google.com domain, the HTTPS proxy provides additional monitoring and control capabilities over encrypted connections.
Traffic Allowed Outbound Through the Firebox: Given that the log indicates outbound traffic, this confirms that the connection is permitted by the Firebox's policies for outbound traffic. Outbound traffic control is crucial for managing access to external resources and ensuring that only authorized traffic exits the network.
質問 # 31
A Firebox backup image includes certificates that were previously imported to the Firebox.
- A. False
- B. True
正解：B
解説：
A Firebox backup image indeed includes any certificates previously imported to the Firebox. This backup not only contains configurations and policies but also all associated certificates, ensuring that if a restoration is necessary, all security certificates will be restored alongside other settings. This feature is critical for maintaining the integrity and continuity of encrypted connections and secure communications across the Firebox environment.
質問 # 32
Which of these is a network IP address? (Select one.)
- A. 1G2 153 10 O 1
- B. 172 16 100 1/12
- C. 10 0.1 255 8
- D. 1Q2 158.10 0-24
- E. 10 10 10 255/24
正解：E
解説：
In this question, we need to identify the correctly formatted network IP address. IPv4 addresses are represented in a dotted decimal format, typically in the form of x.x.x.x/n, where x represents decimal values from 0 to 255, and /n is the CIDR notation indicating the subnet mask. Among the options:
* Option E (10 10 10 255/24)fits the IPv4 standard and CIDR notation.
* The other options contain invalid characters or formats (letters like "G" or "Q" or unusual symbols like
"O" or "-") and do not conform to IP addressing standards.
質問 # 33
When Mobile VPN is enabled, remote users receive the domain name and DNS servers from the Firebox Network Configuration by default.
- A. False
- B. True
正解：B
解説：
WhenMobile VPNis enabled on a Firebox, remote users receive network configuration settings, including domain nameandDNS server informationfrom the Firebox by default. This setupensures that remote users can resolve internal domain names and access network resources as though they were connected directly to the internal network. This functionality is essential for maintaining consistent user experience and connectivity while working remotely.
質問 # 34
You want to create a branch office VPN virtual interface between a remote Firebox and your headquarters Firebox so the remote Firebox can send log data to a server at headquarters. For the log data to be sent from the remote Firebox over the VPN successfully, what BOVPN virtual interface setting must you configure?
(Select one.)
- A. Virtual IP addresses
- B. Dead Peer Detection (DPD)
- C. IKEv2 in the Phase 1 settings
- D. Perfect Forward Secrecy (PFS)
- E. An IPSec certificate, instead of a Pre-shared key
正解：A
解説：
To enable the remote Firebox to send log data to a server at headquarters through a Branch Office VPN (BOVPN) virtual interface, you must configureVirtual IP addresses. Virtual IPs enable devices on either end of the VPN tunnel to communicate as if they are on the same network, facilitating routing of log data from the remote Firebox to the log server located at headquarters.
Other options likeIPSec certificatesandIKEv2are not specifically required for this configuration, though they can enhance security.Dead Peer Detection (DPD)andPerfect Forward Secrecy (PFS)are useful for maintaining VPN stability and security but are not directly necessary for enabling log transmission.
質問 # 35
If the Firebox does not have a feature key installed, which of these statements are true? (Select three.)
- A. You cannot save configuration changes to the Firebox
- B. You cannot run the Web Setup Wizard
- C. Only one user can connect to the Internet through the Firebox
- D. You cannot upgrade the Firebox
- E. You cannot configure subscription services
正解：A、D、E
解説：
Without a feature key:
* Option A: Upgrades are restricted, as the device relies on the feature key to validate software entitlement.
* Option B: Subscription services like antivirus, IPS, or web filtering cannot be configured without the feature key, which activates these services.
* Option D: Configuration changes cannot be permanently saved to the Firebox without the feature key, limiting the device's functionality.
* Option C(Web Setup Wizard) andOption E(one user internet access) do not depend on the feature key and are not restricted in this scenario.
質問 # 36
......
有効なNetwork-Security-Essentialsテスト解答とWatchGuard Network-Security-Essentials試験PDF：https://www.jpntest.com/shiken/Network-Security-Essentials-mondaishu
実際に出るNetwork-Security-Essentials試験問題集には正確で更新された問題：https://drive.google.com/open?id=1gRq8YSoxQPckOmYprs7knt6YYvo3nhNp