An administrator received a FortiAnalyzer alert that a 1 ТВ disk filled up in a day. Upon investigation, they found thousands of unusual DNS log requests, such as JHCMQK.website.com, with no answers. They later discovered that DNS exfiltration was occurring through both UDP and TLS.How can the administrator prevent this data theft technique?
Answer(s): D
The excessive DNS log requests with random subdomains suggest a DNS exfiltration attack, where attackers encode and transmit data via DNS queries. Since this technique can use both UDP and TLS (DoH - DNS over HTTPS), a comprehensive security approach is needed.Using an IPS profile with DNS exfiltration-specific signatures allows FortiGate to:●Detect and block abnormal DNS query patterns often used in exfiltration.●Inspect encrypted DNS (DoH, DoT) traffic if SSL inspection is enabled.●Identify known exfiltration domains and techniques based on FortiGuard threat intelligence.
An administrator configured the FortiGate devices in an enterprise network to join the Fortinet Security Fabric. The administrator has a list of IP addresses that must be blocked by the data center firewall. This list is updated daily.How can the administrator automate a firewall policy with the daily updated list?
The best way to automate a firewall policy using a daily updated list of IP addresses is by using an external connector from Threat Feeds. This allows FortiGate to dynamically retrieve real-time threat intelligence from external sources and apply it directly to security policies.By configuring Threat Feeds, the administrator can:●Automatically update firewall policies with the latest malicious IPs daily.●Block traffic from those IPs in real-time without manual intervention.●Integrate with FortiGuard, third-party threat intelligence sources, or custom feeds (CSV, STIX/TAXII, etc.).
Refer to the exhibit, which shows an OSPF network.Which configuration must the administrator apply to optimize the OSPF database?
Answer(s): B
The OSPF database optimization is necessary to reduce unnecessary routing information and improve network performance. In the given topology, Area 0.0.0.1 is a non-backbone area connected to Area 0.0.0.0 (the backbone area) through an Area Border Router (ABR).To optimize OSPF in this scenario, configuring Area 0.0.0.1 as a Stub Area will:●Reduce the size of the OSPF database by preventing external routes (from outside OSPF) from being injected into Area 0.0.0.1.●Allow only intra-area and inter-area routes, meaning routers in Area 0.0.0.1 will rely on a default route for external destinations.●Improve convergence time and reduce router processing load since fewer LSAs (Link-State Advertisements) are exchanged.
The IT department discovered during the last network migration that all zero phase selectors in phase 2 IPsec configurations impacted network operations.What are two valid approaches to prevent this during future migrations? (Choose two.)
Answer(s): A,C
Zero phase selectors in IPsec Phase 2 mean that no specific traffic selectors (subnets) are defined, allowing any traffic to be encrypted through the VPN tunnel. This can cause unintended traffic forwarding issues and disrupt network operations.To prevent this from happening during future migrations:●Using routing protocols ensures that only specific subnets are advertised over the tunnel. Dynamic routing (such as OSPF or BGP) helps define which networks should use the tunnel, preventing unintended traffic from being encrypted.●Clearly defining phase 2 selectors avoids the problem of encrypting all traffic by explicitly stating the allowed source and destination subnets. This prevents the tunnel from affecting unrelated network traffic.
How will configuring set tcp-mss-sender and set tcp-mss-receiver in a firewall policy affect the size and handling of TCP packets in the network?
The set tcp-mss-sender and set tcp-mss-receiver commands in a firewall policy allow an administrator to adjust the Maximum Segment Size (MSS) of TCP packets.This setting controls the largest payload size that a device can handle in a single TCP segment, ensuring that packets do not exceed the allowed MTU (Maximum Transmission Unit) along the network path.●set tcp-mss-sender adjusts the MSS value for outgoing TCP traffic.●set tcp-mss-receiver adjusts the MSS value for incoming TCP traffic.This helps prevent issues with fragmentation and MTU mismatches, improving network performance and avoiding retransmissions.
Post your Comments and Discuss Fortinet FCSS_EFW_AD-7.6 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the FCSS_EFW_AD-7.6 content, but please register or login to continue.