Best Way To Study For SAP C_HRHFC_2311 Exam Brilliant C_HRHFC_2311 Exam Questions PDF
Updated Verified Pass C_HRHFC_2311 Exam - Real Questions and Answers
SAP C_HRHFC_2311 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
NEW QUESTION # 101
Refer to the exhibit showing a debug flow output.
Which two statements about the debug flow output are correct? (Choose two.)
- A. The debug flow is of ICMP traffic.
- B. A new traffic session is created.
- C. The default route is required to receive a reply.
- D. A firewall policy allowed the connection.
Answer: A,B
NEW QUESTION # 102
To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?
- A. Downstream FortiGate
- B. FortiAnalyzer
- C. Root FortiGate
- D. FortiManager
Answer: C
NEW QUESTION # 103
What are two functions of ZTNA? (Choose two.)
- A. ZTNA manages access through the client only.
- B. ZTNA provides role-based access.
- C. ZTNA provides a security posture check.
- D. ZTNA manages access for remote users only.
Answer: B,C
Explanation:
Reference:
ZTNA (Zero Trust Network Access) is a security architecture that is designed to provide secure access to network resources for users, devices, and applications. It is based on the principle of "never trust, always verify," which means that all access to network resources is subject to strict verification and authentication.
Two functions of ZTNA are:
ZTNA provides a security posture check: ZTNA checks the security posture of devices and users that are attempting to access network resources. This can include checks on the device's software and hardware configurations, security settings, and the presence of malware.
ZTNA provides role-based access: ZTNA controls access to network resources based on the role of the user or device. Users and devices are granted access to only those resources that are necessary for their role, and all other access is denied. This helps to prevent unauthorized access and minimize the risk of data breaches.
NEW QUESTION # 104
Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)
- A. The client FortiGate requires a manually added route to remote subnets.
- B. The client FortiGate uses the SSL VPN tunnel interface type to connect SSL VPN.
- C. The server FortiGate requires a CA certificate to verify the client FortiGate certificate.
- D. The client FortiGate requires a client certificate signed by the CA on the server FortiGate.
Answer: B,C
Explanation:
https://docs.fortinet.com/document/fortigate/7.0.9/administration-guide/508779/fortigate-as-ssl-vpn-client To establish an SSL VPN connection between two FortiGate devices, the following two settings are required:
The server FortiGate requires a CA certificate to verify the client FortiGate certificate: The server FortiGate will use a CA (Certificate Authority) certificate to verify the client FortiGate certificate, ensuring that the client device is trusted and allowed to establish an SSL VPN connection.
The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN: The client FortiGate must have an SSL VPN tunnel interface type configured in order to establish an SSL VPN connection. This interface type will be used to connect to the server FortiGate over the SSL VPN.
NEW QUESTION # 105
An administrator has configured outgoing Interface any in a firewall policy. Which statement is true about the policy list view?
- A. Search option will be disabled
- B. By Sequence view will be disabled.
- C. Interface Pair view will be disabled.
- D. Policy lookup will be disabled.
Answer: C
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD47821
NEW QUESTION # 106
An administrator has configured the following settings:
What are the two results of this configuration? (Choose two.)
- A. The number of logs generated by denied traffic is reduced.
- B. Denied users are blocked for 30 minutes.
- C. A session for denied traffic is created.
- D. Device detection on all interfaces is enforced for 30 minutes.
Answer: A,C
Explanation:
ses-denied-traffic
Enable/disable including denied session in the session table.
https://docs.fortinet.com/document/fortigate/7.0.6/cli-reference/20620/config-system-settings block-session-timer Duration in seconds for blocked sessions .
integer
Minimum value: 1 Maximum value: 300
30
https://docs.fortinet.com/document/fortigate/7.0.6/cli-reference/1620/config-system-global
NEW QUESTION # 107
Which statements best describe auto discovery VPN (ADVPN). (Choose two.)
- A. ADVPN is only supported with IKEv2.
- B. Tunnels are negotiated dynamically between spokes.
- C. Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.
- D. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
Answer: B,D
NEW QUESTION # 108
Which two types of traffic are managed only by the management VDOM? (Choose two.)
- A. DNS
- B. Traffic shaping
- C. FortiGuard web filter queries
- D. PKI
Answer: A,C
Explanation:
FortiGate Infrastructure 7.2 Study Guide (p.73): "What about traffic originating from FortiGate? Some system daemons, such as NTP and FortiGuard updates, generate traffic coming from FortiGate. Traffic coming from FortiGate to those global services originates from the management VDOM. One, and only one, of the VDOMs on a FortiGate device is assigned the role of the management VDOM. It is important to note that the management VDOM designation is solely for traffic originated by FortiGate, such as FortiGuard updates, and has no effect on traffic passing through FortiGate."
NEW QUESTION # 109
A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.
What is the reason for the certificate warning errors?
- A. The full SSL inspection feature does not have a valid license.
- B. The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.
- C. The browser does not trust the certificate used by FortiGate for SSL inspection.
- D. The matching firewall policy is set to proxy inspection mode.
Answer: C
Explanation:
FortiGate Security 7.2 Study Guide (p.235): "If FortiGate receives a trusted SSL certificate, then it generates a temporary certificate signed by the built-in Fortinet_CA_SSL certificate and sends it to the browser. If the browser trusts the Fortinet_CA_SSL certificate, the browser completes the SSL handshake. Otherwise, the browser also presents a warning message informing the user that the site is untrusted. In other words, for this function to work as intended, you must import the Fortinet_CA_SSL certificate into the trusted root CA certificate store of your browser."
NEW QUESTION # 110
Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)
- A. Web filter in flow-based inspection
- B. Antivirus in flow-based inspection
- C. DNS filter
- D. Application control
- E. Web application firewall
Answer: A,B,D
Explanation:
https://docs.fortinet.com/document/fortigate/7.0.0/new-features/739623/dns-filter-handled-by-ips-engine-in-flow-mode
NEW QUESTION # 111
Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?
- A. By default, FortiGate uses WINS servers to resolve names.
- B. By default, the SSL VPN portal requires the installation of a client's certificate.
- C. By default, split tunneling is enabled.
- D. By default, the admin GUI and SSL VPN portal use the same HTTPS port.
Answer: D
NEW QUESTION # 112
Refer to the exhibit.
Based on the raw log, which two statements are correct? (Choose two.)
- A. Traffic is blocked because Action is set to DENY in the firewall policy.
- B. Traffic belongs to the root VDOM.
- C. Log severity is set to error on FortiGate.
- D. This is a security log.
Answer: B,D
NEW QUESTION # 113
Refer to the exhibit.
In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.
What should the administrator do next to troubleshoot the problem?
- A. Execute a debug flow.
- B. Run a sniffer on the web server.
- C. Execute another sniffer in the FortiGate, this time with the filter host 10.0.1.10€
- D. Capture the traffic using an external sniffer connected to port1.
Answer: A
Explanation:
This solution will help the administrator troubleshoot the problem by tracing the packet flow through the FortiGate device and displaying the details of each step. A debug flow can show the source and destination interfaces, the firewall policy, the routing table, the NAT translation, the security profiles, and the session information of the packet1. A debug flow can also show any errors or anomalies that occur during the packet processing. To execute a debug flow, the administrator can use the diagnose debug flow command in the CLI
NEW QUESTION # 114
Refer to the exhibit.
The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.
Which two statements are true? (Choose two.)
- A. FortiGate SN FGVM010000064692 has the higher HA priority.
- B. FortiGate SN FGVM010000065036 HA uptime has been reset.
- C. FortiGate devices are not in sync because one device is down.
- D. FortiGate SN FGVM010000064692 is the primary because of higher HA uptime.
Answer: A,B
Explanation:
1. Override is disable by default - OK
2. "If the HA uptime of a device is AT LEAST FIVE MINUTES (300 seconds) MORE than the HA Uptime of the other FortiGate devices, it becomes the primary" The question here is : HA Uptime of FGVM01000006492 > 5 minutes? NO - 198 seconds < 300 seconds (5 minutes) Page 314 Infra Study Guide. https://docs.fortinet.com/document/fortigate/6.0.0/handbook/666653/primary-unit-selection-with-override-disab
NEW QUESTION # 115
Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)
- A. Full Content inspection
- B. Proxy-based inspection
- C. Certificate inspection
- D. Flow-based inspection
Answer: B,D
NEW QUESTION # 116
Refer to the exhibits.
The exhibits show a network diagram and firewall configurations.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2. Remote-User1 must be able to access the Webserver. Remote-User2 must not be able to access the Webserver.
In this scenario, which two changes can the administrator make to deny Webserver access for Remote-User2? (Choose two.)
- A. Set the Destination address as Deny_IP in the Allow-access policy.
- B. Set the Destination address as Web_server in the Deny policy.
- C. Disable match-vip in the Deny policy.
- D. Enable match vip in the Deny policy.
Answer: A,D
Explanation:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Firewall-does-not-block-incoming-WAN-to-LAN/ta-p/189641 The exhibits show a network diagram and firewall configurations for a FortiGate unit that has two policies: Allow_access and Deny. The Allow_access policy allows traffic from the WAN (port1) interface to the LAN (port3) interface with the destination address of VIP and the service of HTTPS. The VIP object maps the external IP address 10.200.1.10 and port 10443 to the internal IP address 10.0.1.10 and port 443 of the Webserver. The Deny policy denies traffic from the WAN (port1) interface to the LAN (port3) interface with the source address of Deny_IP and the destination address of All.
In this scenario, the administrator wants to deny Webserver access for Remote-User2, who has the IP address 10.200.3.2, which is included in the Deny_IP address object. Remote-User1, who has the IP address 10.200.3.1, must be able to access the Webserver.
To achieve this goal, the administrator can make two changes to deny Webserver access for Remote-User2:
Set the Destination address as Webserver in the Deny policy. This will make the Deny policy more specific and match only the traffic that is destined for the Webserver's internal IP address, instead of any destination address.
Enable match-vip in the Deny policy. This will make the Deny policy apply to traffic that matches a VIP object, instead of ignoring it1. This way, the Deny policy will block Remote-User2's traffic that uses the VIP object's external IP address and port.
NEW QUESTION # 117
In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three.)
- A. The IP version of the sources and destinations in a policy must match.
- B. The Incoming Interface. Outgoing Interface. Schedule, and Service fields can be shared with both IPv4 and IPv6.
- C. The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations.
- D. The policy table in the GUI can be filtered to display policies with IPv4, IPv6 or IPv4 and IPv6 sources and destinations.
- E. The IP version of the sources and destinations in a firewall policy must be different.
Answer: A,B,C
NEW QUESTION # 118
An administrator needs to increase network bandwidth and provide redundancy.
What interface type must the administrator select to bind multiple FortiGate interfaces?
- A. Aggregate interface
- B. VLAN interface
- C. Redundant interface
- D. Software Switch interface
Answer: A
Explanation:
An aggregate interface is a logical interface that combines two or more physical interfaces into one virtual interface1. An aggregate interface can increase network bandwidth and provide redundancy by distributing traffic across multiple physical interfaces using a load balancing algorithm1. An aggregate interface can also support link aggregation control protocol (LACP) to negotiate the link aggregation settings with the connected device1.
Reference:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/567758/aggregation-and-redundancy
NEW QUESTION # 119
FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy. Which two other security profiles can you apply to the security policy? (Choose two.)
- A. Intrusion prevention
- B. DNS filter
- C. Antivirus scanning
- D. File filter
Answer: A,C
NEW QUESTION # 120
If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?
- A. A CRL
- B. A root CA
- C. A subordinate CA
- D. A person
Answer: B
NEW QUESTION # 121
What are two features of the NGFW policy-based mode? (Choose two.)
- A. NGFW policy-based mode does not require the use of central source NAT policy.
- B. NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy
- C. NGFW policy-based mode can only be applied globally and not on individual VDOMs_
- D. NGFW policy-based mode policies support only flow inspection.
Answer: B,D
Explanation:
C) NGFW policy-based mode policies support only flow inspection. This is correct. This is a feature of the NGFW policy-based mode, according to the Fortinet documentation "Profile-based NGFW vs policy-based NGFW"1. The documentation states that "In policy-based NGFW mode, you can only select flow inspection. Proxy inspection is not supported." D) NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy. This is correct. This is a feature of the NGFW policy-based mode, according to the Fortinet documentation "Profile-based NGFW vs policy-based NGFW"1. The documentation states that "In policy-based NGFW mode, you allow applications and URL categories to be used directly in security policies, without requiring web filter or application control profiles."
NEW QUESTION # 122
Refer to the exhibit.
The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check . Which interface will be selected as an outgoing interface?
- A. port2
- B. port1
- C. port4
- D. port3
Answer: B
Explanation:
Port 1 shows the lowest latency.
NEW QUESTION # 123
An administrator has a requirement to keep an application session from timing out on port 80. What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)
- A. Set the session TTL on the HTTP policy to maximum
- B. Create a new service object for HTTP service and set the session TTL to never
- C. Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy.
- D. Set the TTL value to never under config system-ttl
Answer: B,D
NEW QUESTION # 124
What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?
- A. It limits the scope of application control to scan application traffic using parent signatures only
- B. It limits the scope of application control to the browser-based technology category only.
- C. It limits the scope of application control to scan application traffic based on application category only.
- D. It limits the scope of application control to scan application traffic on DNS protocol only.
Answer: C
NEW QUESTION # 125
......
Updated PDF (New 2024) Actual SAP C_HRHFC_2311 Exam Questions: https://www.exam-killer.com/C_HRHFC_2311-valid-questions.html
Dumps Moneyack Guarantee - C_HRHFC_2311 Dumps Approved Dumps: https://drive.google.com/open?id=1ZGhNCU-rX0Syv9EDVB_UHLwKfh79EKFG
