A vulnerability scan report has revealed that a user has generated traffic to the website example.com (10.10.10.10) using a weak SSL/TLS version supported by the HTTPS web server.What can the firewall administrator do to block all outdated SSL/TLS versions on any HTTPS web server to prevent possible attacks on user traffic?
Answer(s): A
The best way to block outdated SSL/TLS versions is to configure the SSL/SSH inspection profile to enforce a minimum SSL/TLS version and disable weak SSL versions.By setting the minimum allowed SSL version in the HTTPS settings of the SSL/SSH inspection profile, FortiGate will:●Block any connection using outdated SSL/TLS versions (such as SSLv3, TLS 1.0, or TLS 1.1).●Enforce secure communication using only strong SSL/TLS versions (such as TLS 1.2 or TLS 1.3).●Protect users from man-in-the-middle (MITM) and downgrade attacks that exploit weak encryption.
Refer to the exhibit, which contains the partial output of an OSPF command.An administrator is checking the OSPF status of a FortiGate device and receives the output shown in the exhibit.Which statement on this FortiGate device is correct?
From the OSPF status output, the key information is:●"This router is an ASBR" →This means the FortiGate is acting as an Autonomous System Boundary Router (ASBR).●An ASBR is responsible for injecting external routing information into OSPF from another routing protocol (such as BGP, static routes, or connected networks).
An administrator is setting up an ADVPN configuration and wants to ensure that peer IDs are not exposed during VPN establishment.Which protocol can the administrator use to enhance security?
In ADVPN (Auto-Discovery VPN) configurations, security concerns include protecting peer IDs during VPN establishment. Peer IDs are exchanged in the IKE (Internet Key Exchange) negotiation phase, and their exposure could lead to privacy risks or targeted attacks.●IKEv2 encrypts peer IDs, making it more secure compared to IKEv1, where peer IDs can be exposed in plaintext in aggressive mode.●IKEv2 also provides better performance and flexibility while supporting dynamic tunnel establishment in ADVPN.
Refer to the exhibits. The exhibits show a network topology, a firewall policy, and an SSL/SSH inspection profile configuration.Why is FortiGate unable to detect HTTPS attacks on firewall policy ID 3 targeting the Linux server?
Answer(s): C
The FortiGate SSL/SSH inspection profile is configured for Full SSL Inspection, which is necessary to analyze encrypted HTTPS traffic. However, the firewall policy is protecting an SSL server (the Linux server hosting the website), and currently, the SSL/SSH profile only applies to client-side SSL inspection.To detect HTTPS-based attacks targeting the Linux server:●FortiGate must act as an SSL intermediary to inspect encrypted traffic destined for the web server.●The administrator must upload the SSL certificate of the Linux web server to FortiGate so that the server-side SSL inspection can decrypt incoming HTTPS traffic before analyzing it.
An administrator must minimize CPU and RAM use on a FortiGate firewall while also enabling essential security features, such as web filtering and application control for HTTPS traffic.Which SSL inspection setting helps reduce system load while also enabling security features, such as web filtering and application control for encrypted HTTPS traffic?
Answer(s): D
To minimize CPU and RAM usage while still enforcing security features like web filtering and application control, SSL certificate inspection mode is the best choice.●SSL certificate inspection allows FortiGate to inspect only the SSL/TLS handshake, including the Server Name Indication (SNI) and certificate details, without decrypting the full encrypted payload.●This enables features like web filtering and application control because FortiGate can determine the destination website or application based on SNI and certificate information.●It significantly reduces system load compared to full SSL inspection, which requires full decryption and re-encryption of traffic.
Post your Comments and Discuss Fortinet FCSS_EFW_AD-7.6 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the FCSS_EFW_AD-7.6 content, but please register or login to continue.