QUESTION: 13

When you examine the log messages In Traffic Monitor, you see that some network packets are denied with an unhandled packet log message. What does this log massage mean?

The packet is denied because the site is on the Blocked Sites List.
The packet is denied because it matched a policy.
The packet is denied because it matched an IPS signature.
The packet is denied because it does not match any firewall policies.

Answer(s): D

Reveal Solution Next Question

QUESTION: 14

Which of these actions adds a host to the temporary or permanent blocked sites list? (Select three.)

Enable the AUTO-block sites that attempt to connect option in a deny policy.
Add the site to the Blocked Sites Exceptions list.
On the Firebox System Manager >Blocked Sites tab, select Add.
In Policy Manager, select Setup> Default Threat Protection > Blocked Sites and click Add.

Answer(s): A,C,D

Explanation:

A: You can configure a deny policy to automatically block sites that originate traffic that does not comply with the policy rulese
1. From Policy Manager, double-click the PCAnywhere policy.
2. Click the Properties tab. Select the Auto-block sites that attempt to connect checkbox.

Reference:

https://www.watchguard.com/training/fireware/80/defense8.htm
C: The blocked sites list shows all the sites currently blocked as a result of the rules defined in Policy Manager. From this tab, you can add sites to the temporary blocked sites list, or remove temporary blocked sites.

http://www.watchguard.com/training/fireware/82/monitoa6.htm
D: You can use Policy Manager to permanently add sites to the Blocked Sites list.
1. select Setup > Default Threat Protection > Blocked Sites.
2. Click Add.
The Add Site dialog box appears.

http://www.watchguard.com/help/docs/wsm/xtm_11/en-US/index.html#cshid=en-US/intrusionprevention/blocked_sites_permanent_c.html

Reveal Solution Next Question

QUESTION: 15

Which of these threats can the Firebox prevent with the default packet handling settings? (Select four.)

Access to inappropriate websites
Denial of service attacks
Flood attacks
Malware in downloaded files
Port scans
Viruses in email messages
IP spoofing

Answer(s): B,C,E,G

Explanation:

B: The default configuration of the XTM device is to block DDoS attacks.
C: In a flood attack, attackers send a very high volume of traffic to a system so it cannot examine and allow permitted network traffic. For example, an ICMP flood attack occurs when a system receives too many ICMP ping commands and must use all of its resources to send reply commands. The XTM device can protect against these types of flood attacks: IPSec, IKE, ICMP. SYN, and UDP.
E: When the Block Port Space Probes (port scans) and Block Address Space Probes check boxes are selected, all incoming traffic on all interfaces is examined by the XTM device.
CG: Default packet handling can reject a packet that could be a security risk, including packets that could be part of a spoofing attack or SYN flood attack

Reference:

http://www.watchguard.com/help/docs/wsm/xtm_11/en-US/index.html#en-US/intrusionprevention/default_pkt_handling_opt_about_c.html%3FTocPath%3DDefault%2520Threat%2520Protection%7CAbout%2520Default%2520Packet%2520Handling%2520Options%7C_____0

Reveal Solution Next Question

QUESTION: 16

Users on the trusted network cannot browse Internet websites. Based on the configuration shown in this image, what could be the problem with this policy configuration?

The default Outgoing policy has been removed and there is no policy to allow DNS traffic.
The HTTP-proxy policy has higher precedence than the HTTPS-proxy policy.
The HTTP-proxy policy is configured for the wrong port.
The HTTP-proxy allows Any-Trusted and Any-Optional to Any-External.

Answer(s): A

Reveal Solution Next Question

Free Essentials Exam Braindumps (page: 4)

QUESTION: 13

QUESTION: 14

Explanation:

Reference:

QUESTION: 15

Explanation:

Reference:

QUESTION: 16