Fortinet Certified Network Security Professional (FCNSP v4.2) Sample Questions:

1. An administrator is configuring a DLP rule for FTP traffic. When adding the rule to a DLP sensor, the administrator notes that the Ban Sender action is not available (greyed-out), as shown in the exhibit.

Which of the following is the best explanation for the Ban Sender action NOT being available?

A) The Ban Sender action is only available for known domains. No domains have yet been added to the domain list.
B) Firewall policy authentication is required before the Ban Sender action becomes available.
C) The Ban Sender action is never available for FTP traffic.
D) The Ban Sender action needs to be enabled globally for FTP traffic on the FortiGate unit before configuring the sensor.

2. The transfer of encrypted files or the use of encrypted protocols between users and servers on the internet can frustrate the efforts of administrators attempting to monitor traffic passing through the FortiGate unit and ensuring user compliance to corporate rules.
Which of the following items will allow the administrator to control the transfer of encrypted data through the FortiGate unit? (Select all that apply.)

A) DLP rules can be used to block the transmission of encrypted files.
B) Firewall authentication can be enabled in the firewall policy, preventing the use of encrypted communications channels.
C) Application control can be used to monitor the use of encrypted protocols; alerts can be sent to the administrator through email when the use of encrypted protocols is attempted.
D) Encrypted protocols can be scanned through the use of the SSL proxy.

3. Which of the following statements is correct regarding the NAC Quarantine feature?

A) With NAC quarantine, files can be quarantined not only as a result of antivirus scanning, but also for other forms of content inspection such as IPS and DLP.
B) NAC quarantine does a client check on workstations before they are permitted to have administrative access to FortiGate.
C) If you chose the quarantine action, you must decide whether the quarantine type is NAC quarantine or File quarantine.
D) NAC quarantine allows administrators to isolate clients whose network activity poses a security risk.

4. In a High Availability cluster operating in Active-Active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a subordinate unit?

A) Request: Internal Host; Master FortiGate; Slave FortiGate; Master FortiGate; Internet; Web Server
B) Request: Internal Host; Master FortiGate; Slave FortiGate; Internet; Web Server
C) Request: Internal Host; Slave FortiGate; Internet; Web Server
D) Request: Internal Host; Slave FortiGate; Master FortiGate; Internet; Web Server

5. When viewing the Banned User monitor in Web Config, the administrator notes the entry illustrated in the exhibit.

Which of the following statements is correct regarding this entry?

A) The entry displays a ban that has been added as a result of traffic triggering a configured DLP rule.
B) This entry displays a ban entry that was added manually by the administrator on June11th.
C) The entry displays a quarantine, which could have been added by either IPS or DLP.
D) The entry displays a ban that was triggered by HTTP traffic matching an IPS signature. This client is banned from receiving or sending any traffic through the FortiGate.

Solutions: