Free C-HRHFC-2311 Exam Files Downloaded Instantly 100% Dumps & Practice Exam
Free Exam Updates C-HRHFC-2311 dumps with test Engine Practice
NEW QUESTION # 41
Refer to the exhibits.
The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) for Facebook .
Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.
Which part of the policy configuration must you change to resolve the issue?
- A. Make SSL inspection needs to be a deep content inspection.
- B. Force access to Facebook using the HTTP service.
- C. Add Facebook in the URL category in the security policy.
- D. Get the additional application signatures are required to add to the security policy.
Answer: A
Explanation:
They can play video (tick) content hosted on Facebook, but they are unable to leave reactions on videos or other types of posts. This indicate that the rule are partially working as they can watch video but cant react, i.e. liking the content. So must be an issue with the SSL inspection rather then adding an app rule.
NEW QUESTION # 42
Refer to the exhibits.
The exhibits show the firewall policies and the objects used in the firewall policies.
The administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit.
Which policy will be highlighted, based on the input criteria?
- A. Policy with ID 5.
- B. Policy with ID 4.
- C. Policy with ID 4.
- D. Policies with ID 2 and 3.
Answer: A
Explanation:
Reference:
We are looking for a policy that will allow or deny traffic from the source interface Port3 and source IP address 10.1.1.10 (LOCAL_CLIENT) to facebook.com TCP port 443 (HTTPS). There are only two policies that will match this traffic, policy ID 2 and 5. In FortiGate, firewall policies are evaluated from top to bottom. This means that the first policy that matches the traffic is applied, and subsequent policies are not evaluated. Based on the Policy Lookup criteria, Policy ID 5 will be highlighted
NEW QUESTION # 43
View the exhibit.
Which of the following statements are correct? (Choose two.)
- A. This is a redundant IPsec setup.
- B. This setup requires at least two firewall policies with the action set to IPsec.
- C. The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
- D. Dead peer detection must be disabled to support this type of IPsec setup.
Answer: A,C
Explanation:
https://docs.fortinet.com/document/fortigate/6.2.4/cookbook/632796/ospf-with-ipsec-vpn-for-network-redundancy
NEW QUESTION # 44
If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?
- A. A root CA
- B. A CRL
- C. A person
- D. A subordinate CA
Answer: A
NEW QUESTION # 45
Refer to the exhibit to view the firewall policy
Why would the firewall policy not block a well-known virus, for
example eicar?
- A. The firewall policy does not apply deep content inspection.
- B. The firewall policy is not configured in proxy-based inspection mode.
- C. Web filter is not enabled on the firewall policy to complement the antivirus profile.
- D. The action on the firewall policy is not set to deny
Answer: A
NEW QUESTION # 46
Refer to the exhibit.
The exhibit shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)
- A. The sensor will gather a packet log for all matched traffic.
- B. The sensor will reset all connections that match these signatures.
- C. The sensor will allow attackers matching the Microsoft Windows.iSCSI.Target.DoS signature.
- D. The sensor will block all attacks aimed at Windows servers.
Answer: C,D
NEW QUESTION # 47
Refer to the exhibit, which contains a static route configuration.
An administrator created a static route for Amazon Web Services.
Which CLI command must the administrator use to view the route?
- A. get router info routing-table all
- B. get internet-service route list
- C. diagnose firewall proute list
- D. get router info routing-table database
Answer: C
Explanation:
ISDB static route will not create entry directly in routing-table. Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creating-a-static-route-for-Predefined-Internet/ta-p/198756 and here https://community.fortinet.com/t5/FortiGate/Technical-Tip-Verify-the-matching-policy-route/ta-p/190640 FortiGate Infrastructure 7.2 Study Guide (p.16 and p.59): "Even though they are configured as static routes, ISDB routes are actually policy routes and take precedence over any other routes in the routing table. As such, ISDB routes are added to the policy routing table." "FortiOS maintains a policy route table that you can view by running the diagnose firewall proute list command."
NEW QUESTION # 48
An administrator needs to increase network bandwidth and provide redundancy.
What interface type must the administrator select to bind multiple FortiGate interfaces?
- A. Software Switch interface
- B. VLAN interface
- C. Aggregate interface
- D. Redundant interface
Answer: C
Explanation:
An aggregate interface is a logical interface that combines two or more physical interfaces into one virtual interface1. An aggregate interface can increase network bandwidth and provide redundancy by distributing traffic across multiple physical interfaces using a load balancing algorithm1. An aggregate interface can also support link aggregation control protocol (LACP) to negotiate the link aggregation settings with the connected device1.
Reference:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/567758/aggregation-and-redundancy
NEW QUESTION # 49
Which two types of traffic are managed only by the management VDOM? (Choose two.)
- A. DNS
- B. FortiGuard web filter queries
- C. PKI
- D. Traffic shaping
Answer: A,B
NEW QUESTION # 50
Refer to the exhibits.
The SSL VPN connection fails when a user attempts to connect to it. What should the user do to successfully connect to SSL VPN?
- A. Change the SSL VPN port on the client.
- B. Change the Server IP address.
- C. Change the idle-timeout.
- D. Change the SSL VPN portal to the tunnel.
Answer: A
NEW QUESTION # 51
Refer to the exhibit.
Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)
- A. There will be eight routes active in the routing table.
- B. The port1 and port2 default routes are active in the routing table.
- C. The port3 default route has the lowest metric.
- D. The ports default route has the highest distance.
Answer: B,D
Explanation:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-identify-Inactive-Routes-in-the-Routing/ta-p/197595
NEW QUESTION # 52
Refer to the exhibits.
Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)
- A. Administrators cannot change the configuration.
- B. FortiGate will start sending all files to FortiSandbox for inspection.
- C. Administrators can access FortiGate only through the console port.
- D. FortiGate has entered conserve mode.
Answer: A,D
Explanation:
Reference:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Conserve-mode-changes/ta-p/198502 configurable thresholds Though it is recommended to keep the default memory threshold, a new CLI command has been added to allow administrators to adjust the thresholds.
Default values are :
- red : 88% of total memory is considered "used memory"
- extreme : 95% of total memory is considered "used memory"
- green : 82% of total memory is considered "used memory"
NEW QUESTION # 53
Refer to the exhibit.
An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic.
Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers? (Choose two.)
- A. The Enable probe packets setting is not enabled.
- B. Administrator didn't configure a gateway for the SD-WAN members, or configured gateway is not valid.
- C. The Detection Mode setting is not set to Passive.
- D. The configured participants are not SD-WAN members.
Answer: A,B
NEW QUESTION # 54
Examine the exhibit, which contains a virtual IP and firewall policy configuration.
The WAN (port1) interface has the IP address 10.200. 1. 1/24. The LAN (port2) interface has the IP address 10.0. 1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address. Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0. 1. 10/24?
- A. 10.200. 1. 1
- B. Any available IP address in the WAN (port1) subnet 10.200. 1.0/24
- C. 10.200. 1. 10
- D. 10.0. 1.254
Answer: C
Explanation:
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Firewall%20Objects/Virtual%20IPs.
NEW QUESTION # 55
What are two characteristics of FortiGate HA cluster virtual IP addresses? (Choose two.)
- A. The primary device in the cluster is always assigned IP address 169.254.0.1.
- B. Virtual IP addresses are used to distinguish between cluster members.
- C. A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.
- D. Heartbeat interfaces have virtual IP addresses that are manually assigned.
Answer: B,C
Explanation:
Fortigate Infrastructure 7.2 Study Guide page 301
FortiGate Infrastructure 7.2 Study Guide (p.301):
"FGCP automatically assigns the heartbeat IP addresses based on the serial number of each device. The IP address 169.254.0.1 is assigned to the device with the highest serial number."
"A change in the heartbeat IP addresses may happen when a FortiGate device joins or leaves the cluster."
"The HA cluster uses the heartbeat IP addresses to distinguish the cluster members and synchronize data."
https://networkinterview.com/fortigate-ha-high-availability/
NEW QUESTION # 56
Refer to the exhibits.
The exhibits show a network diagram and firewall configurations.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2. Remote-User1 must be able to access the Webserver. Remote-User2 must not be able to access the Webserver.
In this scenario, which two changes can the administrator make to deny Webserver access for Remote-User2? (Choose two.)
- A. Enable match vip in the Deny policy.
- B. Disable match-vip in the Deny policy.
- C. Set the Destination address as Web_server in the Deny policy.
- D. Set the Destination address as Deny_IP in the Allow-access policy.
Answer: A,D
Explanation:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Firewall-does-not-block-incoming-WAN-to-LAN/ta-p/189641 The exhibits show a network diagram and firewall configurations for a FortiGate unit that has two policies: Allow_access and Deny. The Allow_access policy allows traffic from the WAN (port1) interface to the LAN (port3) interface with the destination address of VIP and the service of HTTPS. The VIP object maps the external IP address 10.200.1.10 and port 10443 to the internal IP address 10.0.1.10 and port 443 of the Webserver. The Deny policy denies traffic from the WAN (port1) interface to the LAN (port3) interface with the source address of Deny_IP and the destination address of All.
In this scenario, the administrator wants to deny Webserver access for Remote-User2, who has the IP address 10.200.3.2, which is included in the Deny_IP address object. Remote-User1, who has the IP address 10.200.3.1, must be able to access the Webserver.
To achieve this goal, the administrator can make two changes to deny Webserver access for Remote-User2:
Set the Destination address as Webserver in the Deny policy. This will make the Deny policy more specific and match only the traffic that is destined for the Webserver's internal IP address, instead of any destination address.
Enable match-vip in the Deny policy. This will make the Deny policy apply to traffic that matches a VIP object, instead of ignoring it1. This way, the Deny policy will block Remote-User2's traffic that uses the VIP object's external IP address and port.
NEW QUESTION # 57
Which three methods are used by the collector agent for AD polling? (Choose three.)
- A. WMI
- B. Novell API
- C. FortiGate polling
- D. WinSecLog
- E. NetAPI
Answer: A,D,E
Explanation:
FortiGate Infrastructure 7.2 Study Guide (p.127-128): "As previously stated, collector agent-based polling mode has three methods (or options) for collecting login information. The order on the slide from left to right shows most recommend to least recommended: (WMI, WinSecLog, and NetAPI)"
NEW QUESTION # 58
Which three statements explain a flow-based antivirus profile? (Choose three.)
- A. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
- B. FortiGate buffers the whole file but transmits to the client at the same time.
- C. Flow-based inspection optimizes performance compared to proxy-based inspection.
- D. If a virus is detected, the last packet is delivered to the client.
- E. The IPS engine handles the process as a standalone.
Answer: A,B,C
NEW QUESTION # 59
Which two statements are correct about NGFW Policy-based mode? (Choose two.)
- A. NGFW policy-based mode policies support only flow inspection
- B. NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy
- C. NGFW policy-based mode can only be applied globally and not on individual VDOMs
- D. NGFW policy-based mode does not require the use of central source NAT policy
Answer: A,B
NEW QUESTION # 60
Which of the following are purposes of NAT traversal in IPsec? (Choose two.)
- A. To dynamically change phase 1 negotiation mode aggressive mode.
- B. To encapsulation ESP packets in UDP packets using port 4500.
- C. To detect intermediary NAT devices in the tunnel path.
- D. To force a new DH exchange with each phase 2 rekey.
Answer: B,C
NEW QUESTION # 61
Which two statements are correct about SLA targets? (Choose two.)
- A. SLA targets are required for SD-WAN rules with a Best Quality strategy.
- B. SLA targets are used only when referenced by an SD-WAN rule.
- C. SLA targets are optional.
- D. You can configure only two SLA targets per one Performance SLA.
Answer: B,C
NEW QUESTION # 62
Refer to the exhibits.
Exhibit A
Exhibit B
The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration.
How will FortiGate handle user authentication for traffic that arrives on the LAN interface?
- A. Authentication is enforced at a policy level; all users will be prompted for authentication.
- B. All users will be prompted for authentication, users from the HR group can authenticate successfully with the correct credentials.
- C. All users will be prompted for authentication, users from the Sales group can authenticate successfully with the correct credentials.
- D. If there is a fall-through policy in place, users will not be prompted for authentication.
Answer: B
NEW QUESTION # 63
What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?
- A. It limits the scanning of application traffic to use parent signatures only.
- B. It limits the scanning of application traffic to the application category only.
- C. It limits the scanning of application traffic to the browser-based technology category only.
- D. It limits the scanning of application traffic to the DNS protocol only.
Answer: C
Explanation:
FortiGate Security 7.2 Study Guide (p.317): "You can configure the URL Category within the same security policy; however, adding a URL filter causes application control to scan applications in only the browser-based technology category, for example, Facebook Messenger on the Facebook website."
NEW QUESTION # 64
Which two features of IPsec IKEv1 authentication are supported by FortiGate? (Choose two.)
- A. Pre-shared key and certificate signature as authentication methods
- B. No certificate is required on the remote peer when you set the certificate signature as the authentication method
- C. Extended authentication (XAuth) to request the remote peer to provide a username and password
- D. Extended authentication (XAuth) for faster authentication because fewer packets are exchanged
Answer: A,C
Explanation:
B) Extended authentication (XAuth) to request the remote peer to provide a username and password This is true because extended authentication (XAuth) is a feature that allows FortiGate to request the remote peer to provide a username and password during the IPsec IKEv1 authentication process. XAuth is an extension of the IKEv1 protocol that adds an additional authentication step after the main mode or aggressive mode exchange. XAuth can be used with either pre-shared key or certificate signature as the primary authentication method, and it can provide stronger security and granular access control for IPsec VPNs12 D) Pre-shared key and certificate signature as authentication methods This is true because pre-shared key and certificate signature are two authentication methods that are supported by FortiGate for IPsec IKEv1 VPNs. Pre-shared key is a method where both peers share a secret key that is used to authenticate each other during the IKEv1 exchange. Certificate signature is a method where both peers have digital certificates that are used to verify each other's identity and public key during the IKEv1 exchange. Both methods can be combined with XAuth for additional authentication
NEW QUESTION # 65
......
Provide Valid Dumps To Help You Prepare For Fortinet NSE 4 - FortiOS 7.2 Exam: https://www.practicedump.com/C-HRHFC-2311_actualtests.html
Updated Verified C-HRHFC-2311 dumps Q&As - 100% Pass Guaranteed: https://drive.google.com/open?id=1NIghR3uomlgEevHJsS8MD1A0GTkcSj7R