Get 2024 Free SAP C-HRHFC-2311 Exam Practice Materials Collection
Get Latest and 100% Accurate C-HRHFC-2311 Exam Questions
SAP C-HRHFC-2311 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
NEW QUESTION # 102
Which of the following are valid actions for FortiGuard category based filter in a web filter profile ui proxy-based inspection mode? (Choose two.)
- A. Warning
- B. Exempt
- C. Allow
- D. Learn
Answer: A,C
NEW QUESTION # 103
Which statement about the policy ID number of a firewall policy is true?
- A. It changes when firewall policies are reordered.
- B. It is required to modify a firewall policy using the CLI.
- C. It represents the number of objects used in the firewall policy.
- D. It defines the order in which rules are processed.
Answer: B
NEW QUESTION # 104
Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?
- A. To generate logs
- B. To allow for out-of-order packets that could arrive after the FIN/ACK packets
- C. To remove the NAT operation
- D. To finish any inspection operations
Answer: B
Explanation:
TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.
NEW QUESTION # 105
Which of the following are purposes of NAT traversal in IPsec? (Choose two.)
- A. To dynamically change phase 1 negotiation mode aggressive mode.
- B. To force a new DH exchange with each phase 2 rekey.
- C. To encapsulation ESP packets in UDP packets using port 4500.
- D. To detect intermediary NAT devices in the tunnel path.
Answer: C,D
NEW QUESTION # 106
Refer to the exhibit.
Based on the raw log, which two statements are correct? (Choose two.)
- A. Traffic is blocked because Action is set to DENY in the firewall policy.
- B. Log severity is set to error on FortiGate.
- C. This is a security log.
- D. Traffic belongs to the root VDOM.
Answer: C,D
NEW QUESTION # 107
An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken. Each site has a FortiGate VPN gateway. What must an administrator do to achieve this objective?
- A. The administrator must use the user self-registration server.
- B. The administrator can use a third-party radius OTP server.
- C. The administrator can register the same FortiToken on more than one FortiGate.
- D. The administrator must use a FortiAuthenticator device
Answer: D
Explanation:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-FortiToken-for-multiple-units/ta-p/194435
NEW QUESTION # 108
Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?
- A. diagnose wad session list | grep hook=pre&&hook=out
- B. diagnose wad session list | grep hook-pre&&hook-out
- C. diagnose wad session list
- D. diagnose wad session list | grep "hook=pre"&"hook=out"
Answer: C
NEW QUESTION # 109
Which scanning technique on FortiGate can be enabled only on the CLI?
- A. Antivirus scan
- B. Heuristics scan
- C. Trojan scan
- D. Ransomware scan
Answer: B
NEW QUESTION # 110
What is a reason for triggering IPS fail open?
- A. The IPS engine is upgraded.
- B. The administrator enabled NTurbo acceleration.
- C. The IPS engine cannot decode a packet.
- D. The IPS socket buffer is full and the IPS engine cannot process additional packets.
Answer: D
NEW QUESTION # 111
A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.
What is the reason for the certificate warning errors?
- A. The matching firewall policy is set to proxy inspection mode.
- B. The browser does not trust the certificate used by FortiGate for SSL inspection.
- C. The full SSL inspection feature does not have a valid license.
- D. The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.
Answer: B
Explanation:
FortiGate Security 7.2 Study Guide (p.235): "If FortiGate receives a trusted SSL certificate, then it generates a temporary certificate signed by the built-in Fortinet_CA_SSL certificate and sends it to the browser. If the browser trusts the Fortinet_CA_SSL certificate, the browser completes the SSL handshake. Otherwise, the browser also presents a warning message informing the user that the site is untrusted. In other words, for this function to work as intended, you must import the Fortinet_CA_SSL certificate into the trusted root CA certificate store of your browser."
NEW QUESTION # 112
Which feature in the Security Fabric takes one or more actions based on event triggers?
- A. Security Rating
- B. Automation Stitches
- C. Fabric Connectors
- D. Logical Topology
Answer: B
NEW QUESTION # 113
Refer to the exhibit, which contains a session diagnostic output.
Which statement is true about the session diagnostic output?
- A. The session is in TCP ESTABLISHED state.
- B. The session is a UDP unidirectional state.
- C. The session is a bidirectional TCP connection.
- D. The session is a bidirectional UDP connection.
Answer: D
Explanation:
https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042
NEW QUESTION # 114
Refer to the exhibit.
The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device.
Which two actions does FortiGate take on internet traffic sourced from the subscribers? (Choose two.)
- A. FortiGate allocates port blocks per user, based on the configured range of internal IP addresses.
- B. FortiGate allocates port blocks on a first-come, first-served basis.
- C. FortiGate allocates 128 port blocks per user.
- D. FortiGate generates a system event log for every port block allocation made per user.
Answer: B,D
Explanation:
FortiGate Security 7.2 Study Guide (p.109): "FortiGate allocates port blocks on a first-come, first-served basis." "For logging purposes, when FortiGate allocates a port block to a host, it generates a system event log to inform the administrator."
NEW QUESTION # 115
On FortiGate, which type of logs record information about traffic directly to and from the FortiGate management IP addresses?
- A. Local traffic logs
- B. System event logs
- C. Forward traffic logs
- D. Security logs
Answer: A
Explanation:
Reference:
Traffic logs record the traffic flowing through your FortiGate unit. Since traffic needs firewall policies to properly flow through FortiGate, this type of logging is also called firewall policy logging. Firewall policies control all traffic attempting to pass through the FortiGate unit, between FortiGate interfaces, zones, and VLAN sub-interfaces.
FortiGate Security 7.2 Study Guide (p.176): "Local traffic logs contain information about traffic directly to and from the FortiGate management IP addresses. They also include connections to the GUI and FortiGuard queries."
NEW QUESTION # 116
Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)
- A. Proxy-based inspection
- B. Flow-based inspection
- C. Certificate inspection
- D. Full Content inspection
Answer: A,B
NEW QUESTION # 117
Which two statements are true when FortiGate is in transparent mode? (Choose two.)
- A. By default, all interfaces are part of the same broadcast domain.
- B. FortiGate forwards frames without changing the MAC address.
- C. The existing network IP schema must be changed when installing a transparent mode.
- D. Static routes are required to allow traffic to the next hop.
Answer: A,B
Explanation:
Reference:
attachID=Fortigate_Transparent_Mode_Technical_Guide_FortiOS_4_0_version1.2.pdf&documentID=FD33113
NEW QUESTION # 118
What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?
- A. FortiGate automatically negotiates different encryption and authentication algorithms with the remote peer.
- B. FortiGate automatically negotiates a new security association after the existing security association expires.
- C. FortiGate automatically negotiates different local and remote addresses with the remote peer.
- D. FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.
Answer: D
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=12069
FortiGate Infrastructure 7.2 Study Guide (p.264): "...then FortiGate might drop interesting traffic because of the absence of active SAs. To prevent this, you can enable Auto-negotiate. When you do this, FortiGate not only negotiates new SAs before the current SAs expire, but it also starts using the new SAs right away." "Another benefit of enabling Auto-negotiate is that the tunnel comes up and stays up automatically, even when there is no interesting traffic. When you enable Autokey Keep Alive and keep Auto-negotiate disabled, the tunnel does not come up automatically unless there is interesting traffic. However, after the tunnel is up, it stays that way because FortiGate periodically sends keep alive packets over the tunnel. Note that when you enable Auto-negotiate, Autokey Keep Alive is implicitly enabled."
NEW QUESTION # 119
Which statement regarding the firewall policy authentication timeout is true?
- A. It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address after this timer has expired.
- B. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source MAC.
- C. It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after this timer has expired.
- D. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source IP.
Answer: D
NEW QUESTION # 120
Refer to the exhibit.
An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic.
Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers? (Choose two.)
- A. The Enable probe packets setting is not enabled.
- B. The configured participants are not SD-WAN members.
- C. Administrator didn't configure a gateway for the SD-WAN members, or configured gateway is not valid.
- D. The Detection Mode setting is not set to Passive.
Answer: A,C
NEW QUESTION # 121
......
Maximum Grades By Making ready With C-HRHFC-2311 Dumps: https://www.exam-killer.com/C-HRHFC-2311-valid-questions.html
Prepare C-HRHFC-2311 Exam Questions Recently Updated Questions: https://drive.google.com/open?id=1cvU5KBRUEO7DQNtJugGuBUdFNus73ANv
