[2024年08月]更新のC-HRHFC-2311試験問題集、無料サンプル365日更新
まもなく無料セール終了！リアルC-HRHFC-2311のPDF解答使おう
SAP C-HRHFC-2311 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 65
If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT is used?
- A. The Services field prevents SNAT and DNAT from being combined in the same policy.
- B. The Services field prevents multiple sources of traffic from using multiple services to connect to a single computer.
- C. The Services field removes the requirement to create multiple VIPs for different services.
- D. The Services field is used when you need to bundle several VIPs into VIP groups.
正解：C
質問 # 66
Which scanning technique on FortiGate can be enabled only on the CLI?
- A. Heuristics scan
- B. Ransomware scan
- C. Trojan scan
- D. Antivirus scan
正解：A
質問 # 67
Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?
- A. The CA certificate that signed the web-server certificate must be installed on the browser.
- B. The public key of the web server certificate must be installed on the browser.
- C. The private key of the CA certificate that signed the browser certificate must be installed on the browser.
- D. The web-server certificate must be installed on the browser.
正解：A
質問 # 68
Which two statements are true when FortiGate is in transparent mode? (Choose two.)
- A. Static routes are required to allow traffic to the next hop.
- B. FortiGate forwards frames without changing the MAC address.
- C. By default, all interfaces are part of the same broadcast domain.
- D. The existing network IP schema must be changed when installing a transparent mode.
正解：B、C
解説：
Reference:
attachID=Fortigate_Transparent_Mode_Technical_Guide_FortiOS_4_0_version1.2.pdf&documentID=FD33113
質問 # 69
If Internet Service is already selected as Source in a firewall policy, which other configuration objects can be added to the Source filed of a firewall policy?
- A. User or User Group
- B. FQDN address
- C. Once Internet Service is selected, no other object can be added
- D. IP address
正解：C
解説：
Reference:
https://docs.fortinet.com/document/fortigate/6.2.5/cookbook/179236/using-internet-service-in-policy
質問 # 70
Which of the following statements about central NAT are true? (Choose two.)
- A. Central NAT can be enabled or disabled from the CLI only.
- B. IP tool references must be removed from existing firewall policies before enabling central NAT .
- C. Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.
- D. Source NAT, using central NAT, requires at least one central SNAT policy.
正解：A、B
質問 # 71
What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?
- A. It limits the scope of application control to scan application traffic based on application category only.
- B. It limits the scope of application control to scan application traffic on DNS protocol only.
- C. It limits the scope of application control to the browser-based technology category only.
- D. It limits the scope of application control to scan application traffic using parent signatures only
正解：A
質問 # 72
Refer to the exhibit showing a debug flow output.
What two conclusions can you make from the debug flow output? (Choose two.)
- A. The debug flow is for ICMP traffic.
- B. A firewall policy allowed the connection.
- C. The default route is required to receive a reply.
- D. Anew traffic session was created.
正解：A、D
解説：
The debug flow output shows the result of a diagnose command that captures the traffic flow between the source and destination IP addresses1. The debug flow output reveals the following information about the traffic flow1:
The protocol is 1, which means that the traffic uses ICMP protocol2. ICMP is a protocol that is used to send error messages and test connectivity between devices2.
The session state is 0, which means that a new traffic session was created3. A session is a data structure that stores information about a connection between two devices3.
The policy ID is 1, which means that the traffic matched the firewall policy with ID 14. A firewall policy is a rule that defines how FortiGate processes traffic based on the source, destination, service, and action parameters4.
The action is 0, which means that the traffic was allowed by the firewall policy. An action is a parameter that specifies what FortiGate does with the traffic that matches a firewall policy.
Therefore, two conclusions that can be made from the debug flow output are:
The debug flow is for ICMP traffic.
A new traffic session was created.
質問 # 73
Refer to the exhibit.
The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device.
Which two actions does FortiGate take on internet traffic sourced from the subscribers? (Choose two.)
- A. FortiGate allocates port blocks on a first-come, first-served basis.
- B. FortiGate allocates 128 port blocks per user.
- C. FortiGate allocates port blocks per user, based on the configured range of internal IP addresses.
- D. FortiGate generates a system event log for every port block allocation made per user.
正解：A、D
解説：
FortiGate Security 7.2 Study Guide (p.109): "FortiGate allocates port blocks on a first-come, first-served basis." "For logging purposes, when FortiGate allocates a port block to a host, it generates a system event log to inform the administrator."
質問 # 74
Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?
- A. To allow for out-of-order packets that could arrive after the FIN/ACK packets
- B. To finish any inspection operations
- C. To generate logs
- D. To remove the NAT operation
正解：A
解説：
TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.
質問 # 75
Which three statements explain a flow-based antivirus profile? (Choose three.)
- A. Flow-based inspection optimizes performance compared to proxy-based inspection.
- B. The IPS engine handles the process as a standalone.
- C. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
- D. If a virus is detected, the last packet is delivered to the client.
- E. FortiGate buffers the whole file but transmits to the client at the same time.
正解：A、C、E
質問 # 76
Which statement about the IP authentication header (AH) used by IPsec is true?
- A. AH does not provide any data integrity or encryption.
- B. AH provides data integrity bur no encryption.
- C. AH provides strong data integrity but weak encryption.
- D. AH does not support perfect forward secrecy.
正解：B
質問 # 77
Which statement about the deployment of the Security Fabric in a multi-VDOM environment is true?
- A. VDOMs without ports with connected devices are not displayed in the topology.
- B. Each VDOM in the environment can be part of a different Security Fabric.
- C. Security rating reports can be run individually for each configured VDOM.
- D. Downstream devices can connect to the upstream device from any of their VDOMs.
正解：A
解説：
FortiGate Security 7.2 Study Guide (p.436): "When you configure FortiGate devices in multi-vdom mode and add them to the Security Fabric, each VDOM with its assigned ports is displayed when one or more devices are detected. Only the ports with discovered and connected devices appear in the Security Fabric view and, because of this, you must enable Device Detection on ports you want to have displayed in the Security Fabric. VDOMs without ports with connected devices are not displayed. All VDOMs configured must be part of a single Security Fabric."
質問 # 78
When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?
- A. Policy ID
- B. Log ID
- C. Universally Unique Identifier
- D. Sequence ID
正解：C
解説：
FortiGate Security 7.2 Study Guide (p.67): "When creating firewall objects or policies, a universally unique identifier (UUID) attribute is added so that logs can record these UUIDs and improve functionality when integrating with FortiManager or FortiAnalyzer."
質問 # 79
Refer to the exhibits.
The exhibits show the firewall policies and the objects used in the firewall policies.
The administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit.
Which policy will be highlighted, based on the input criteria?
- A. Policies with ID 2 and 3.
- B. Policy with ID 4.
- C. Policy with ID 5.
- D. Policy with ID 4.
正解：C
解説：
Reference:
We are looking for a policy that will allow or deny traffic from the source interface Port3 and source IP address 10.1.1.10 (LOCAL_CLIENT) to facebook.com TCP port 443 (HTTPS). There are only two policies that will match this traffic, policy ID 2 and 5. In FortiGate, firewall policies are evaluated from top to bottom. This means that the first policy that matches the traffic is applied, and subsequent policies are not evaluated. Based on the Policy Lookup criteria, Policy ID 5 will be highlighted
質問 # 80
Refer to the exhibits.
Exhibit A shows a topology for a FortiGate HA cluster that performs proxy-based inspection on traffic. Exhibit B shows the HA configuration and the partial output of the get system ha status command.
Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose two.)
- A. For load balanced connections, the primary encapsulates TCP SYN packets before forwarding them to the secondary.
- B. The traffic sourced from the client and destined to the server is sent to FGT-1.
- C. The cluster can load balance ICMP connections to the secondary.
- D. For non-load balanced connections, packets forwarded by the cluster to the server contain the virtual MAC address of port2 as source.
正解：A、D
解説：
FortiGate Infrastructure 7.2 Study Guide (p.317 & p.320): "To forward traffic correctly, a FortiGate HA solution uses virtual MAC addresses." "The primary forwards the SYN packet to the selected secondary. (...) This is also known as MAC address rewrite. In addition, the primary encapsulates the packet in an Ethernet frame type 0x8891. The encapsulation is done only for the first packet of a load balanced session. The encapsulated packet includes the original packet plus session information that the secondary requires to process the traffic."
質問 # 81
Refer to the exhibits.
The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) for Facebook .
Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.
Which part of the policy configuration must you change to resolve the issue?
- A. Force access to Facebook using the HTTP service.
- B. Add Facebook in the URL category in the security policy.
- C. Make SSL inspection needs to be a deep content inspection.
- D. Get the additional application signatures are required to add to the security policy.
正解：C
解説：
They can play video (tick) content hosted on Facebook, but they are unable to leave reactions on videos or other types of posts. This indicate that the rule are partially working as they can watch video but cant react, i.e. liking the content. So must be an issue with the SSL inspection rather then adding an app rule.
質問 # 82
Which statement regarding the firewall policy authentication timeout is true?
- A. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source MAC.
- B. It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address after this timer has expired.
- C. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source IP.
- D. It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after this timer has expired.
正解：C
質問 # 83
Which two statements about FortiGate FSSO agentless polling mode are true? (Choose two.)
- A. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
- B. FortiGate directs the collector agent to use a remote LDAP server.
- C. FortiGate does not support workstation check .
- D. FortiGate uses the AD server as the collector agent.
正解：A、C
解説：
You can deploy FSSO w/o installing an agent. FG polls the DCs directly, instead of receiving logon info indirectly from a collector agent.
Because FG collects all of the data itself, agentless polling mode requires greater system resources, and it doesn't scale as easily.
Agentless polling mode operates in a similar way to WinSecLog, but with only two event IDs: 4768 and 4769. Because there's no collector agent, FG uses the SMB protocol to read the event viewer logs from the DCs.
FG acts as a collector. It 's responsible for polling on top of its normal FSSO tasks but does not have all the extra features, such as workstation checks, that are available with the external collector agent.
Reference:
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-troubleshoot-FSSO-agentless-polling/ta-p/214349
質問 # 84
Refer to the exhibit.
The global settings on a FortiGate device must be changed to align with company security policies. What does the Administrator account need to access the FortiGate global settings?
- A. Change Administrator profile
- B. Enable two-factor authentication
- C. Enable restrict access to trusted hosts
- D. Change password
正解：A
質問 # 85
An administrator has configured outgoing Interface any in a firewall policy. Which statement is true about the policy list view?
- A. By Sequence view will be disabled.
- B. Policy lookup will be disabled.
- C. Search option will be disabled
- D. Interface Pair view will be disabled.
正解：D
解説：
https://kb.fortinet.com/kb/documentLink.do?externalID=FD47821
質問 # 86
Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)
- A. FortiAnalyzer
- B. FortiCache
- C. FortiSandbox
- D. FortiSIEM
- E. FortiCloud
正解：A、D、E
解説：
Reference:
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/265052/logging-and-reporting-overview
質問 # 87
Refer to the exhibits.
Exhibit A shows a network diagram. Exhibit B shows the firewall policy configuration and a VIP object configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
The administrator disabled the WebServer firewall policy.
Which IP address will be used to source NAT the traffic, if a user with address 10.0.1.10 connects over SSH to the host with address 10.200.3.1?
- A. 10.200.1.10
- B. 10.0.1.254
- C. 10.200.3.1
- D. 10.200.1.1
正解：D
解説：
Traffic is coming from LAN to WAN, matches policy Full_Access which has NAT enable, so traffic uses source IP address of outgoing interface. Simple SNAT.
質問 # 88
......
C-HRHFC-2311問題集あなたを合格させる認証試験：https://www.jpntest.com/shiken/C-HRHFC-2311-mondaishu
最新でリアルなSAP C-HRHFC-2311試験問題集解答：https://drive.google.com/open?id=1wSIYybOzo1V5ZR7ry61aA4pCzRT7vwL0