[2026] Fortinet Certified Network Security Professional (FCNSP v4.2)

문제1

Review the CLI configuration below for an IPS sensor and identify the correct statements regarding this configuration from the choices below. (Select all that apply.)
config ips sensor edit "LINUX_SERVER" set comment '' set replacemsg-group '' set log enable config entries edit 1 set action default set application all set location server set log enable set log-packet enable set os Linux set protocol all set quarantine none set severity all set status default next end next
end

A. The sensor will reset all connections that match these signatures.

B. The sensor will match all traffic from the address object 'LINUX_SERVER'.

C. The sensor will include a PCAP file with a trace of the matching packets in the log message of any matched signature.

D. The sensor will log all server attacks for all operating systems.

E. The sensor only filters which IPS signatures to apply to the selected firewall policy.

정답: C,E

문제2

Which of the following statements are correct regarding Application Control?

A. Application Control is based on the AV engine.

B. Application Control is based on the IPS engine.

C. Application Control cannot be applied to SSL encrypted traffic.

D. Application Control can be applied to SSL encrypted traffic.

정답: B,D

문제3

An administrator configures a VPN and selects the Enable IPSec Interface Mode option in the phase 1 settings.
Which of the following statements are correct regarding the IPSec VPN configuration?

A. The IPSec policies must be placed at the top of the list.

B. The virtual IPSec interface is automatically created after the phase1 configuration.

C. Routes were automatically created based on the address objects in the firewall policies.

D. To complete the VPN configuration, the administrator must manually create a virtual IPSec interface in Web Config under System > Network.

E. This VPN cannot be used as part of a hub and spoke topology.

정답: B

문제4

Identify the statement which correctly describes the output of the following command:
diagnose ips anomaly list

A. Lists the errors captured when compiling the DoS policy.

B. List the real-time counters for the configured DoS policy.

C. Lists the configured DoS policy.

정답: B

문제5

FSSO provides a single sign on solution to authenticate users transparently to a FortiGate unit using credentials stored in Windows Active Directory.
Which of the following statements are correct regarding FSSO in a Windows domain environment when NTLM and Polling Mode are not used? (Select all that apply.)

A. The FSSO Collector Agent will retrieve user information from the Domain Controller Agent and will send the user logon information to the FortiGate unit.

B. The FSSO Domain Controller Agent will regularly update user logon information on the FortiGate unit.

C. For non-domain computers, the only way to allow FSSO authentication is to install an FSSO client.

D. An FSSO Domain Controller Agent must be installed on every domain controller.

E. An FSSO Collector Agent must be installed on every domain controller.

정답: A,D

문제6

Two devices are in an HA cluster, the device hostnames are STUDENT and REMOTE. Exhibit A shows the command output of 'diag sys session stat' for the STUDENT device. Exhibit B shows
the command output of 'diag sys session stat' for the REMOTE device. Exhibit A:

Exhibit B:

Given the information provided in the exhibits, which of the following statements are correct? (Select all that apply.)

A. Session-pickup is likely to be enabled.

B. The cluster mode is definitely Active-Passive.

C. There is not enough information to determine the cluster mode.

D. STUDENT is likely to be the master device.

정답: C,D

문제7

Shown below is a section of output from the debug command diag ip arp list.
index=2 ifname=port1 172.20.187.150 00:09:0f:69:03:7e state=00000004 use=4589 confirm=4589 update=2422 ref=1
In the output provided, which of the following best describes the IP address 172.20.187.150?

A. It is one of the secondary IP addresses of the port1 interface.

B. It is the primary IP address of the port1 interface.

C. It is the IP address of another network device located in the same LAN segment as the FortiGate unit's port1 interface.

정답: C

문제8

An organization wishes to protect its SIP Server from call flooding attacks. Which of the following configuration changes can be performed on the FortiGate unit to fulfill this requirement?

A. Enable Traffic Shaping for the appropriate SIP firewall policy.

B. Apply an application control list which contains a rule for SIP and has the "Limit INVITE Request" option configured.

C. Reduce the session time-to-live value for the SIP protocol by running the configure system session-ttl CLI command.

D. Run the set udp-idle-timer CLI command and set a lower time value.

정답: B

문제9

Which of the following Session TTL values will take precedence?

A. The default session TTL specified at the system level

B. Session TTL specified in the matching firewall policy

C. Session TTL dictated by the application control list associated with the matching firewall policy

D. Session TTL specified at the system level for that port number

정답: C

Fortinet Certified Network Security Professional (FCNSP v4.2) - FCNSP무료 덤프문제 풀어보기

우리와 연락하기

유용한 링크

최신 업데이트