[2024年07月28日] 完全版最新の問題集でPDFで最新C-HRHFC-2311試験問題と解答
無料で使えるC-HRHFC-2311試験問題集で100%合格できる試験簡単に合格させるJPNTest
質問 # 15
Which three methods are used by the collector agent for AD polling? (Choose three.)
- A. WMI
- B. Novell API
- C. WinSecLog
- D. FortiGate polling
- E. NetAPI
正解：A、C、E
解説：
FortiGate Infrastructure 7.2 Study Guide (p.127-128): "As previously stated, collector agent-based polling mode has three methods (or options) for collecting login information. The order on the slide from left to right shows most recommend to least recommended: (WMI, WinSecLog, and NetAPI)"
質問 # 16
Which statement regarding the firewall policy authentication timeout is true?
- A. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source MAC.
- B. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source IP.
- C. It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address after this timer has expired.
- D. It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after this timer has expired.
正解：B
質問 # 17
Refer to the exhibit.
Examine the intrusion prevention system (IPS) diagnostic command.
Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?
- A. The IPS engine will continue to run in a normal state.
- B. The IPS engine was blocking all traffic.
- C. The IPS engine was unable to prevent an intrusion attack .
- D. The IPS engine was inspecting high volume of traffic.
正解：D
解説：
fortinet-fortigate-security-study-guide-for-fortios-72 page 417 If there are high-CPU use problems caused by the IPS, you can use the diagnose test application ipsmonitor command with option 5 to isolate where the problem might be. Option 5 enables IPS bypass mode. In this mode, the IPS engine is still running, but it is not inspecting traffic. If the CPU use decreases after that, it usually indicates that the volume of traffic being inspected is too high for that FortiGate model.
Reference:
https://docs.fortinet.com/document/fortigate/6.2.3/cookbook/232929/troubleshooting-high-cpu-usage
質問 # 18
What are two features of collector agent advanced mode? (Choose two.)
- A. Advanced mode uses the Windows convention-NetBios: Domain\Username.
- B. Advanced mode supports nested or inherited groups.
- C. In advanced mode, security profiles can be applied only to user groups, not individual users.
- D. In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.
正解：B、D
解説：
A) In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.
This is true because advanced mode allows FortiGate to query the LDAP server directly for user information and group membership, without relying on the collector agent. This enables FortiGate to apply security policies based on LDAP group filters, which can be configured on FortiGate1 D) Advanced mode supports nested or inherited groups.
This is true because advanced mode can handle complex group structures, such as nested groups or inherited groups, where a user belongs to a group that is a member of another group. This allows FortiGate to apply security policies based on the effective group membership of a user, not just the direct group membership1 FortiGate Infrastructure 7.2 Study Guide (p.146): "Also, advanced mode supports nested or inherited groups; that is, users can be members of subgroups that belong to monitored parent groups." "In advanced mode, you can configure FortiGate as an LDAP client and configure the group filters on FortiGate. You can also configure group filters on the collector agent."
質問 # 19
Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)
- A. The firmware image must be manually uploaded to each FortiGate.
- B. Only secondary FortiGate devices are rebooted.
- C. Traffic load balancing is temporally disabled while upgrading the firmware.
- D. Uninterruptable upgrade is enabled by default.
正解：C、D
質問 # 20
FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy. Which two other security profiles can you apply to the security policy? (Choose two.)
- A. DNS filter
- B. Antivirus scanning
- C. File filter
- D. Intrusion prevention
正解：B、D
質問 # 21
Refer to the exhibit.
Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?
- A. Traffic matching the signature will be allowed and logged.
- B. The signature setting includes a group of other signatures.
- C. The signature setting uses a custom rating threshold.
- D. Traffic matching the signature will be silently dropped and logged.
正解：D
解説：
Select Block to silently drop traffic matching any of the signatures included in the entry. So, while the default action would be 'Pass' for this signature the administrator is specifically overriding that to set the Block action. To use the default action the setting would have to be 'Default'.
FortiGate Security 7.2 Study Guide (p.394): "Select Allow to allow traffic to continue to its destination. Select Monitor to allow traffic to continue to its destination and log the activity. Select Block to silently drop traffic matching any of the signatures included in the entry. Select Reset to generate a TCP RST packet whenever the signature is triggered. Select Default to use the default action of the signatures." "If you enable Packet logging, FortiGate saves a copy of the packet that matches the signature." Action is drop, signature default action is listed only in the signature, it would only match if action was set to default.
質問 # 22
Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?
- A. To allow for out-of-order packets that could arrive after the FIN/ACK packets
- B. To finish any inspection operations
- C. To generate logs
- D. To remove the NAT operation
正解：A
解説：
TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.
質問 # 23
An administrator has configured the following settings:
What are the two results of this configuration? (Choose two.)
- A. Denied users are blocked for 30 minutes.
- B. A session for denied traffic is created.
- C. Device detection on all interfaces is enforced for 30 minutes.
- D. The number of logs generated by denied traffic is reduced.
正解：B、D
解説：
ses-denied-traffic
Enable/disable including denied session in the session table.
https://docs.fortinet.com/document/fortigate/7.0.6/cli-reference/20620/config-system-settings block-session-timer Duration in seconds for blocked sessions .
integer
Minimum value: 1 Maximum value: 300
30
https://docs.fortinet.com/document/fortigate/7.0.6/cli-reference/1620/config-system-global
質問 # 24
An administrator is running the following sniffer command:
Which three pieces of Information will be Included in me sniffer output? {Choose three.)
- A. Packet payload
- B. IP header
- C. Application header
- D. Interface name
- E. Ethernet header
正解：A、B、D
質問 # 25
What inspection mode does FortiGate use if it is configured as a policy-based next-generation firewall (NGFW)?
- A. Proxy-based inspection
- B. Full Content inspection
- C. Flow-based inspection
- D. Certificate inspection
正解：C
解説：
FortiGate Infrastructure 7.2 Study Guide (p.90): "However, if NGFW mode is Policy-based, then the inspection mode for all policies in that VDOM is always flow and there is no option available in the policy to change it."
質問 # 26
Refer to the exhibit.
Which contains a session list output. Based on the information shown in the exhibit, which statement is true?
- A. One-to-one NAT IP pool is used in the firewall policy.
- B. Destination NAT is disabled in the firewall policy.
- C. Overload NAT IP pool is used in the firewall policy.
- D. Port block allocation IP pool is used in the firewall policy.
正解：A
解説：
FortiGate_Security_6.4 page 155 . In one-to-one, PAT is not required.
質問 # 27
What are two functions of ZTNA? (Choose two.)
- A. ZTNA provides a security posture check.
- B. ZTNA provides role-based access.
- C. ZTNA manages access for remote users only.
- D. ZTNA manages access through the client only.
正解：A、B
解説：
Reference:
ZTNA (Zero Trust Network Access) is a security architecture that is designed to provide secure access to network resources for users, devices, and applications. It is based on the principle of "never trust, always verify," which means that all access to network resources is subject to strict verification and authentication.
Two functions of ZTNA are:
ZTNA provides a security posture check: ZTNA checks the security posture of devices and users that are attempting to access network resources. This can include checks on the device's software and hardware configurations, security settings, and the presence of malware.
ZTNA provides role-based access: ZTNA controls access to network resources based on the role of the user or device. Users and devices are granted access to only those resources that are necessary for their role, and all other access is denied. This helps to prevent unauthorized access and minimize the risk of data breaches.
質問 # 28
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)
- A. On Remote-FortiGate, set port2 as Interface.
- B. On HQ-FortiGate, set IKE mode to Main (ID protection).
- C. On both FortiGate devices, set Dead Peer Detection to On Demand.
- D. On HQ-FortiGate, disable Diffie-Helman group 2.
正解：A、B
解説：
"In IKEv1, there are two possible modes in which the IKE SA negotiation can take place: main, and aggressive mode. Settings on both ends must agree; otherwise, phase 1 negotiation fails and both IPsec peers are not able to establish a secure channel."
質問 # 29
Refer to the exhibits.
The exhibits show a network diagram and firewall configurations.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2. Remote-User1 must be able to access the Webserver. Remote-User2 must not be able to access the Webserver.
In this scenario, which two changes can the administrator make to deny Webserver access for Remote-User2? (Choose two.)
- A. Disable match-vip in the Deny policy.
- B. Set the Destination address as Web_server in the Deny policy.
- C. Enable match vip in the Deny policy.
- D. Set the Destination address as Deny_IP in the Allow-access policy.
正解：C、D
解説：
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Firewall-does-not-block-incoming-WAN-to-LAN/ta-p/189641 The exhibits show a network diagram and firewall configurations for a FortiGate unit that has two policies: Allow_access and Deny. The Allow_access policy allows traffic from the WAN (port1) interface to the LAN (port3) interface with the destination address of VIP and the service of HTTPS. The VIP object maps the external IP address 10.200.1.10 and port 10443 to the internal IP address 10.0.1.10 and port 443 of the Webserver. The Deny policy denies traffic from the WAN (port1) interface to the LAN (port3) interface with the source address of Deny_IP and the destination address of All.
In this scenario, the administrator wants to deny Webserver access for Remote-User2, who has the IP address 10.200.3.2, which is included in the Deny_IP address object. Remote-User1, who has the IP address 10.200.3.1, must be able to access the Webserver.
To achieve this goal, the administrator can make two changes to deny Webserver access for Remote-User2:
Set the Destination address as Webserver in the Deny policy. This will make the Deny policy more specific and match only the traffic that is destined for the Webserver's internal IP address, instead of any destination address.
Enable match-vip in the Deny policy. This will make the Deny policy apply to traffic that matches a VIP object, instead of ignoring it1. This way, the Deny policy will block Remote-User2's traffic that uses the VIP object's external IP address and port.
質問 # 30
What is the primary FortiGate election process when the HA override setting is disabled?
- A. Connected monitored ports > Priority > HA uptime > FortiGate serial number
- B. Connected monitored ports > Priority > System uptime > FortiGate serial number
- C. Connected monitored ports > HA uptime > Priority > FortiGate serial number
- D. Connected monitored ports > System uptime > Priority > FortiGate serial number
正解：C
質問 # 31
By default, FortiGate is configured to use HTTPS when performing live web filtering with FortiGuard servers.
Which CLI command will cause FortiGate to use an unreliable protocol to communicate with FortiGuard servers for live web filtering?
- A. set webfilter-cache disable
- B. set fortiguard-anycast disable
- C. set protocol tcp
- D. set webfilter-force-off disable
正解：B
解説：
y default, "fortiguard-anycast" is enabled, and this setting only works with "set protocol https". To use udp (ie. "set protocol udp"), "fortiguard-anycast" must be disabled.
Reference:
"By default, FortiGate is configured to enforce the use of HTTPS port 443 to perform live filtering with FortiGuard or FortiManager. Other ports and protocols are available by disabling the FortiGuard anycast setting on the CLI."
質問 # 32
Which statement about video filtering on FortiGate is true?
- A. Full SSL Inspection is not required.
- B. It inspects video files hosted on file sharing services.
- C. It is available only on a proxy-based firewall policy.
- D. Video filtering FortiGuard categories are based on web filter FortiGuard categories.
正解：C
質問 # 33
If Internet Service is already selected as Source in a firewall policy, which other configuration objects can be added to the Source filed of a firewall policy?
- A. FQDN address
- B. User or User Group
- C. Once Internet Service is selected, no other object can be added
- D. IP address
正解：C
解説：
Reference:
https://docs.fortinet.com/document/fortigate/6.2.5/cookbook/179236/using-internet-service-in-policy
質問 # 34
Which statement is correct regarding the use of application control for inspecting web applications?
- A. Application control does not require SSL inspection to identity web applications.
- B. Application control does not display a replacement message for a blocked web application.
- C. Application control can identity child and parent applications, and perform different actions on them.
- D. Application control signatures are organized in a nonhierarchical structure.
正解：C
解説：
Application control is a feature that allows FortiGate to inspect and control the use of specific web applications on the network. When application control is enabled, FortiGate can identify child and parent applications, and can perform different actions on them based on the configuration.
質問 # 35
Which two statements ate true about the Security Fabric rating? (Choose two.)
- A. The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.
- B. Many of the security issues can be fixed immediately by clicking Apply where available.
- C. The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.
- D. It provides executive summaries of the four largest areas of security focus.
正解：B、C
質問 # 36
Refer to the exhibit.
The exhibit shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)
- A. The sensor will block all attacks aimed at Windows servers.
- B. The sensor will gather a packet log for all matched traffic.
- C. The sensor will allow attackers matching the Microsoft Windows.iSCSI.Target.DoS signature.
- D. The sensor will reset all connections that match these signatures.
正解：A、C
質問 # 37
If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?
- A. A root CA
- B. A CRL
- C. A subordinate CA
- D. A person
正解：A
質問 # 38
An administrator configures outgoing interface any in a firewall policy.
What is the result of the policy list view?
- A. Search option is disabled.
- B. Interface Pair view is disabled.
- C. By Sequence view is disabled.
- D. Policy lookup is disabled.
正解：B
解説：
"If you use multiple source or destination interfaces, or the any interface in a firewall policy, you cannot separate policies into sections by interface pairs-some would be triplets or more. So instead, policies are then always displayed in a single list (By Sequence)."
質問 # 39
Refer to the exhibit.
The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.
The WAN (port1) interface has the IP address 10.200. 1. 1/24.
The LAN (port3) interface has the IP address 10 .0.1.254. /24.
The first firewall policy has NAT enabled using IP Pool.
The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0. 1. 10?
- A. 10.200. 1. 10
- B. 10.200.3. 1
- C. 10.200. 1. 1
- D. 10.200. 1. 100
正解：D
解説：
Policy 1 is applied on outbound (LAN-WAN) and policy 2 is applied on inbound (WAN-LAN). question is asking SNAT for outbound traffic so policy 1 will take place and NAT overload is in effect.
質問 # 40
......
無料で試せるC-HRHFC-2311試験問題C-HRHFC-2311実際の無料試験問題：https://www.jpntest.com/shiken/C-HRHFC-2311-mondaishu
検証済みのC-HRHFC-2311問題集と184格別な問題：https://drive.google.com/open?id=1IaTHyMft0shhBH6yQ4BlZi7jkSJ8LRoc