Use SAP C_HRHFC_2311 Dumps To Succeed Instantly in C_HRHFC_2311 Exam
Ultimate Guide to C_HRHFC_2311 Dumps - Enhance Your Future Career Now
NEW QUESTION # 56
Refer to the exhibits.
The exhibits show the firewall policies and the objects used in the firewall policies.
The administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit.
Which policy will be highlighted, based on the input criteria?
- A. Policy with ID 5.
- B. Policy with ID 4.
- C. Policies with ID 2 and 3.
- D. Policy with ID 4.
Answer: A
Explanation:
Reference:
We are looking for a policy that will allow or deny traffic from the source interface Port3 and source IP address 10.1.1.10 (LOCAL_CLIENT) to facebook.com TCP port 443 (HTTPS). There are only two policies that will match this traffic, policy ID 2 and 5. In FortiGate, firewall policies are evaluated from top to bottom. This means that the first policy that matches the traffic is applied, and subsequent policies are not evaluated. Based on the Policy Lookup criteria, Policy ID 5 will be highlighted
NEW QUESTION # 57
A network administrator has enabled SSL certificate inspection and antivirus on FortiGate. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and the file can be downloaded.
What is the reason for the failed virus detection by FortiGate?
- A. The selected SSL inspection profile has certificate inspection enabled.
- B. The EICAR test file exceeds the protocol options oversize limit.
- C. The browser does not trust the FortiGate self-signed CA certificate.
- D. The website is exempted from SSL inspection.
Answer: A,D
Explanation:
SSL Inspection Profile, on the Inspection method there are 2 options to choose from, SSL Certificate Inspection or Full SSL Inspection. FG SEC 7.2 Studi Guide: Full SSL Inspection level is the only choice that allows antivirus to be effective.
NEW QUESTION # 58
An administrator has configured outgoing Interface any in a firewall policy. Which statement is true about the policy list view?
- A. Interface Pair view will be disabled.
- B. By Sequence view will be disabled.
- C. Search option will be disabled
- D. Policy lookup will be disabled.
Answer: A
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD47821
NEW QUESTION # 59
Which two features of IPsec IKEv1 authentication are supported by FortiGate? (Choose two.)
- A. No certificate is required on the remote peer when you set the certificate signature as the authentication method
- B. Extended authentication (XAuth) for faster authentication because fewer packets are exchanged
- C. Extended authentication (XAuth) to request the remote peer to provide a username and password
- D. Pre-shared key and certificate signature as authentication methods
Answer: C,D
Explanation:
B) Extended authentication (XAuth) to request the remote peer to provide a username and password This is true because extended authentication (XAuth) is a feature that allows FortiGate to request the remote peer to provide a username and password during the IPsec IKEv1 authentication process. XAuth is an extension of the IKEv1 protocol that adds an additional authentication step after the main mode or aggressive mode exchange. XAuth can be used with either pre-shared key or certificate signature as the primary authentication method, and it can provide stronger security and granular access control for IPsec VPNs12 D) Pre-shared key and certificate signature as authentication methods This is true because pre-shared key and certificate signature are two authentication methods that are supported by FortiGate for IPsec IKEv1 VPNs. Pre-shared key is a method where both peers share a secret key that is used to authenticate each other during the IKEv1 exchange. Certificate signature is a method where both peers have digital certificates that are used to verify each other's identity and public key during the IKEv1 exchange. Both methods can be combined with XAuth for additional authentication
NEW QUESTION # 60
An administrator has a requirement to keep an application session from timing out on port 80. What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)
- A. Set the TTL value to never under config system-ttl
- B. Create a new service object for HTTP service and set the session TTL to never
- C. Set the session TTL on the HTTP policy to maximum
- D. Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy.
Answer: A,B
NEW QUESTION # 61
An administrator has configured two-factor authentication to strengthen SSL VPN access. Which additional best practice can an administrator implement?
- A. Configure different SSL VPN realms.
- B. Configure Source IP Pools.
- C. Configure split tunneling in tunnel mode.
- D. Configure host check .
Answer: D
NEW QUESTION # 62
Refer to the exhibit, which contains a static route configuration.
An administrator created a static route for Amazon Web Services.
Which CLI command must the administrator use to view the route?
- A. diagnose firewall proute list
- B. get router info routing-table database
- C. get internet-service route list
- D. get router info routing-table all
Answer: A
Explanation:
ISDB static route will not create entry directly in routing-table. Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creating-a-static-route-for-Predefined-Internet/ta-p/198756 and here https://community.fortinet.com/t5/FortiGate/Technical-Tip-Verify-the-matching-policy-route/ta-p/190640 FortiGate Infrastructure 7.2 Study Guide (p.16 and p.59): "Even though they are configured as static routes, ISDB routes are actually policy routes and take precedence over any other routes in the routing table. As such, ISDB routes are added to the policy routing table." "FortiOS maintains a policy route table that you can view by running the diagnose firewall proute list command."
NEW QUESTION # 63
FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy. Which two other security profiles can you apply to the security policy? (Choose two.)
- A. File filter
- B. Antivirus scanning
- C. Intrusion prevention
- D. DNS filter
Answer: B,C
NEW QUESTION # 64
A team manager has decided that, while some members of the team need access to a particular website, the majority of the team does not Which configuration option is the most effective way to support this request?
- A. Implement a web filter category override for the specified website
- B. Implement web filter quotas for the specified website
- C. Implement a DNS filter for the specified website.
- D. Implement web filter authentication for the specified website.
Answer: D
NEW QUESTION # 65
Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up. but phase 2 fails to come up.
Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?
- A. On HQ-FortiGate, enable Auto-negotiate.
- B. On Remote-FortiGate, set Seconds to 43200.
- C. On HQ-FortiGate, set Encryption to AES256.
- D. On HQ-FortiGate, enable Diffie-Hellman Group 2.
Answer: C
Explanation:
Reference:
Encryption and authentication algorithm needs to match in order for IPSEC be successfully established.
NEW QUESTION # 66
In an explicit proxy setup, where is the authentication method and database configured?
- A. Proxy Policy
- B. Authentication scheme
- C. Firewall Policy
- D. Authentication Rule
Answer: B
NEW QUESTION # 67
Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)
- A. Only secondary FortiGate devices are rebooted.
- B. Traffic load balancing is temporally disabled while upgrading the firmware.
- C. Uninterruptable upgrade is enabled by default.
- D. The firmware image must be manually uploaded to each FortiGate.
Answer: B,C
NEW QUESTION # 68
Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)
- A. Shut down/reboot a downstream FortiGate device.
- B. Log in to a downstream FortiSwitch device.
- C. Ban or unban compromised hosts.
- D. Disable FortiAnalyzer logging for a downstream FortiGate device.
Answer: A,D
NEW QUESTION # 69
Refer to the exhibit.
The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check . Which interface will be selected as an outgoing interface?
- A. port1
- B. port4
- C. port3
- D. port2
Answer: A
Explanation:
Port 1 shows the lowest latency.
NEW QUESTION # 70
Refer to the exhibit.
Based on the raw log, which two statements are correct? (Choose two.)
- A. Log severity is set to error on FortiGate.
- B. This is a security log.
- C. Traffic belongs to the root VDOM.
- D. Traffic is blocked because Action is set to DENY in the firewall policy.
Answer: B,C
NEW QUESTION # 71
Which statement about the policy ID number of a firewall policy is true?
- A. It defines the order in which rules are processed.
- B. It changes when firewall policies are reordered.
- C. It is required to modify a firewall policy using the CLI.
- D. It represents the number of objects used in the firewall policy.
Answer: C
NEW QUESTION # 72
......
SAP Dumps - Learn How To Deal With The Exam Anxiety: https://www.exam-killer.com/C_HRHFC_2311-valid-questions.html
Now, get the Latest C_HRHFC_2311 dumps in Test Engine from : https://drive.google.com/open?id=1ZGhNCU-rX0Syv9EDVB_UHLwKfh79EKFG
