Fireware-Essentials · PDF fileExam A QUESTION 1 Which items are included in a Firebox backup image? (Select four.) A. Support snapshot B. Fireware OS C. Configuration file D. Log

Fireware-Essentials

Number: Fireware EssentialsPassing Score: 800Time Limit: 120 minFile Version: 7.0

http://www.gratisexam.com/

Fireware Essentials

Fireware Essentials Exam

Exam A

QUESTION 1Which items are included in a Firebox backup image? (Select four.)

A. Support snapshotB. Fireware OSC. Configuration fileD. Log fileE. Feature keysF. Certificates

Correct Answer: ACDESection: (none)Explanation

Explanation/Reference:

QUESTION 2Only 50 clients on the trusted network of your Firebox can connect to the Internet at the same time. What could cause this? (Select one.)


A. TheLiveSecurity feature key is expired.B. The device feature key allows a maximum of 50 client connections.C. The DHCP address pool on the trusted interface has only 50 IP addresses.D. The Outgoing policy allows a maximum of 50 client connections.

Correct Answer: CSection: (none)Explanation


QUESTION 3The IP address for the trusted interface on your Firebox is 10.0.40.1/24, but you want to change the IP address for this interface. How can you avoid a networkoutage for clients on the trusted network when you change the interface IP address to 10.0.50.1/24? (Select one.)

A. Create a 1-to-1 NAT rule for traffic from the 10.0.40.0/24 subnet to addresses on the 10.0.50.0/24 subnet.B. Add 10.0.40.1/24 as a secondary IP address for the interface.C. Add IP addresses on the 10.0.40.0/24 subnet to the DHCP Server IP address pool for this interface.D. Add a route to 10.0.40.0/24 with the gateway 10.0.50.1.

Correct Answer: BSection: (none)Explanation


QUESTION 4In the network configuration in this image, which aliases is Eth2 a member of? (Select three.)

A. Any-optionalB. Any-ExternalC. Optional-1D. AnyE. Any-Trusted

Correct Answer: ACDSection: (none)Explanation


QUESTION 5Clients on the trusted network need to connect to a server behind a router on the optional network.


Based on this image, what static route must be added to the Firebox for traffic from clients on the trusted network to reach a server at 10.0.20.100? (Select one.)

A. Route to 10.0.20.0/24,Gateway 10.0.2.1B. Route to 10.0.20.0/24,Gateway 10.0.2.254C. Route to 10.0.20.0, Gateway 10.0.2.254D. Route to 10.0.10.0/24, Gateway 10.0.10.1



QUESTION 6Which of these options are private IPv4 addresses you can assign to a trusted interface, as described in RFC 1918, Address Allocation for Private Internets?(Select three.)

A. 192.168.50.1/24B. 10.50.1.1/16C. 198.51.100.1/24D. 172.16.0.1/16E. 192.0.2.1/24

Correct Answer: ABDSection: (none)Explanation


QUESTION 7The policies in a default Firebox configuration do not allow outgoing traffic from optional interfaces.


A. TrueB. False



QUESTION 8When you examine the log messages In Traffic Monitor, you see that some network packets are denied with an unhandled packet log message. What doesthis log massage mean? (Select one.)

A. The packet is denied because the site is on the Blocked Sites List.B. The packet is denied because it matched a policy.C. The packet is denied because it matched an IPS signature.D. The packet is denied because it does not match any firewall policies.



QUESTION 9Which of these actions adds a host to the temporary or permanent blocked sites list? (Select three.)

A. Enable the AUTO-block sites that attempt to connect option in a deny policy.

B. Add the site to the Blocked Sites Exceptions list.C. On the Firebox System Manager >Blocked Sites tab, select Add.D. In Policy Manager, select Setup> Default Threat Protection > Blocked Sites and click Add.



QUESTION 10Which of these threats can the Firebox prevent with the default packet handling settings? (Select four.)

A. Access to inappropriate websitesB. Denial of service attacksC. Flood attacksD. Malware in downloaded filesE. Port scansF. Viruses in email messagesG. IP spoofing

Correct Answer: BCEGSection: (none)Explanation


QUESTION 11Users on the trusted network cannot browse Internet websites.

Based on the configuration shown in this image, what could be the problem with this policy configuration? (Select one.)

A. The default Outgoing policy has been removed and there is no policy to allow DNS traffic.B. The HTTP-proxy policy has higher precedence than the HTTPS-proxy policy.C. The HTTP-proxy policy is configured for the wrong port.D. The HTTP-proxy allows Any-Trusted and Any-Optional to Any-External.



QUESTION 12If you disable the Outgoing policy, which policies must you add to allow trusted users to connect to commonly used websites? (Select three.)

A. HTTP port 80B. NAT policyC. FTP port 21D. HTTPS port 443E. DNS port 53



QUESTION 13How is a proxy policy different from a packet filter policy? (Select two.)

A. Only a proxy policy examines information in the IP header.B. Only a proxy policy uses the IP source, destination, and port to control network traffic.C. Only a proxy policy can prevent specific threats without blocking the entire connection.D. Only a proxy works ta the application, network, and transport layers to examine all connection data.

Correct Answer: BDSection: (none)Explanation


QUESTION 14Which authentication servers can you use with your Firebox? (Select four.)

A. Active DirectoryB. RADIUSC. LDAPD. Linux AuthenticationE. KerberosF. TACACS+G. Firebox databases

Correct Answer: ABCGSection: (none)Explanation


QUESTION 15When your users connect to the Authentication Portal page to authenticate, they see a security warning message in their browses, which they must accept beforethey can authenticate. How can you make sure they do not see this security warning message in their browsers? (Select one.)

A. Import a custom self-signed certificate or a third-party certificate to your Firebox and import the same certificate to all client computers or web browsers.B. Replace the Firebox certificate with the trusted certificate from your web server.C. Add the user accounts for your users who use the Authentication Portal to a list of trusted users on your Firebox.D. Instruct them to disable security warning message in their preferred browsers.



QUESTION 16You can configure your Firebox to automatically redirect users to the Authentication Portal page.

A. TrueB. False



QUESTION 17For which of these third party authentication methods must you specify a search base? (Select two.)

A. RADIUSB. Active DirectoryC. SecurIDD. LDAP

Correct Answer: BDSection: (none)Explanation


QUESTION 18You have a privately addressed email server behind your Firebox. If you want to make sure that all traffic from this server to the Internet appears to come from thepublic IP address 203.0.113.25, regardless of policies, which from of NAT would you use? (Select one.)


A. In the SMTP policy that handles traffic from the email server, select the option to apply dynamic NAT to all traffic in the policy and set the source IP address203.0.113.25.

B. Create a global dynamic NAT rule for traffic from the email server and set the source IP address to 203.0.113.25.C. Create a static NAT action for traffic to the email server, and set the source IP address to 203.0.113.25.



QUESTION 19HOTSPOTMatch each type of NAT with the correct description:

Hot Area:

Correct Answer:

Section: (none)Explanation


QUESTION 20If your Firebox has a single public IP address, and you want to forward inbound traffic to internal hosts based on the destination port, which type of NAT should youuse? (Select one.)

A. Static NATB. 1-to-1 NATC. Dynamic NAT



QUESTION 21You need to create an HTTP-proxy policy to a specific domain for software updates (example.com). The update site has multiple subdomains and dynamic IPaddresses on a content delivery network. Which of these options is the best way to define the destination in your HTTP-proxy policy? (Select one.)


A. Configure a host name for update.example.com.

B. Configure an FQDN for *.example.com.

C. Add IP addresses that correspond to each software update server in the domain.D. Create an alias for all subdomains and known IP addresses for example.com.



QUESTION 22From the SMTP proxy action settings in this image, which of these options is configured for outgoing SMTP traffic? (Select one.)

A. Rewrite the Mail From header for the example.com domain.

B. Deny incoming mail from the example.com domain.

C. Prevent mail relay for the example.com domain.

D. Deny outgoing mail from the example.com domain.

Correct Answer: DSection: (none)Explanation


QUESTION 23You can configure the SMTP-proxy policy to restrict email messages and email content based on which of these message characteristics? (Select four.)

A. Sender Mail From addressB. Check URLs in message with WebBlockerC. Email message sizeD. Attachment file name and content typeE. Maximum email recipients

Correct Answer: ABCESection: (none)Explanation


QUESTION 24After you enable spamBlocker, your users experience no reduction in the amount of spam they receive. What could explain this? (Select three.)

A. Connections cannot be resolved to the spamBlocker servers because DNS is not configured on the Firebox.B. The spamBlocker action for Confirmed Spam is set to Allow.

C. The Maximum File Size to Scan option is set too high.D. A spamBlocker exception is configured to allow traffic from sender *.E. spamBlocker Virus Outbreak Detection is not enabled.

Correct Answer: ABDSection: (none)Explanation


QUESTION 25An email newsletter about sales from an external company is sometimes blocked by spamBlocker. What option could you choose to make sure the newsletter isdelivered to your users? (Select one.)

A. Add a spamBlocker exception based on the From field of the newsletter email.B. Set the spamBlocker action to quarantine the email for later retrieval.C. Add a spamBlocker subject tag for bulk email messages.D. Set the spamBlocker virus outbreak detection action to allow emails from the newsletter source.



QUESTION 26Your company denies downloads of executable files from all websites. What can you do to allow users on the network to download executable files from thecompany's remote website? (Select one.)

A. Add an HTTP proxy exception for the company's remote website.B. Create a WebBlocker exception to allow access to the company's remote website.C. Create an IPS exception.D. Create a Blocked Sites exception.E. Configure HTTP Request > URL Paths to allow the company's remote website.

Correct Answer: A



QUESTION 27A user receives a deny message that the installation file (install.exe) is blocked by the HTTP- proxy policy and cannot be downloaded. Which HTTP proxy actionrule must you modify to allow download of the installation file? (Select one.)

A. HTTP Request > Request MethodsB. HTTP Response > Body Content TypesC. HTTP Response > Header FieldsD. WebBlockerE. HTTP Request > Authorization

Correct Answer: ESection: (none)Explanation


QUESTION 28Which takes precedence: WebBlocker category match or a WebBlocker exception?

A. WebBlocker exceptionB. WebBlocker category match



QUESTION 29To prevent certificate error warnings in your browser when you use deep content inspection with the HTTPS proxy, you can export the proxy authority certificatefrom the Firebox and import that certificate to all client devices.

A. TrueB. False

Correct Answer: ASection: (none)Explanation


QUESTION 30Which of these options must you configure in an HTTPS-proxy policy to detect credit card numbers in HTTP traffic that is encrypted with SSL? (Select two.)

A. WebBlockerB. Gateway AntiVirusC. Application ControlD. Deep inspection of HTTPS contentE. Data Loss Prevention



QUESTION 31HOTSPOTMatch each WatchGuard Subscription Service with its function:

Hot Area:

Correct Answer:



QUESTION 32When you configure the Global Application Control action, it is automatically applied to all policies.


A. TrueB. False



QUESTION 33Which WatchGuard Subscription Service must be enabled in a proxy policy before you can use APT Blocker? (Select one.)

A. REDB. Application ControlC. Gateway AntivirusD. WebBlockerE. IPS

Correct Answer: CSection: (none)

Explanation


QUESTION 34What settings must you device configuration file include for Gateway AntiVirus to protect users on your network? (Select two.)

A. Configure a policy to use a proxy action that has AntiVirus settings configured.B. Install the Gateway AntiVirus server on your network.C. Configure Gateway AntiVirus settings for a proxy action.D. Disable automatic signature updates.E. Decrease the scan limits

Correct Answer: ACSection: (none)Explanation


QUESTION 35After you enable Gateway AntiVirus, IPS, or Application control, how can you make sure the services protect your network from the latest known threats? (Selectone.)

A. Enable default packet handling.B. Configure reputation Enabled Defense.C. Enable automatic signature updates.D. Enable HTTPS deep inspection.



QUESTION 36Which policies can use the Intrusion Prevention Service to block network attacks? (Select one?)

A. Only HTTP and HTTPS Proxy policiesB. Only proxy policiesC. All policiesD. Only packet filter policiesE. Only inbound policies



QUESTION 37Which of these services would you use to allow the use of P2P programs for a specific department in your organization? (Select one.)


A. Reputation Enabled DefenseB. Application ControlC. Data Loss PreventionD. IPS



QUESTION 38You can use Firebox System Manager to download a PCAP file that includes packet information about the protocols that manage traffic on your network.

A. TrueB. False



QUESTION 39From the Firebox System Manager >Authentication List tab, you can view all of the authenticated users connected to your Firebox and disconnect any of them.

A. TrueB. False



QUESTION 40HOTSPOTMatch the monitoring tool to the correct task:

Hot Area:

Correct Answer:



QUESTION 41Which diagnostic tasks can you run from the Traffic Monitor tab of Firebox System Manager? (Select four.)

A. DNS lookupB. MAC address lookupC. TracerouteD. Reputation lookupE. PingF. TCP dump

Correct Answer: ACDESection: (none)Explanation


QUESTION 42How can you include log messages from more than one Firebox in a single report generated by Dimension? (Select two.)

A. You cannot see report data in Dimension for more than one device.B. Create a device group and view the reports for that group.C. Create a report schedule that includes all the devices you want to include in the report.D. E. Export report data as a single PDF file for all the devices you want to include in the report.

Correct Answer: BCSection: (none)Explanation


QUESTION 43To enable remote devices to send log messages to Dimension through the gateway Firebox, what must you verify is included in your gateway Fireboxconfiguration? (Select one.)

A. You can only send log messages to Dimension from a computer that is on the network behind your gateway Firebox.B. You must change the connection settings in Dimension, not on the gateway Firebox.C. You must add a policy to the remote device configuration file to allow traffic to a Dimension.D. You must make sure that either the WG-Logging packet filter policy, or another policy that allows external connections to Dimension over port 4115, is included

in the configuration file.



QUESTION 44Which WatchGuard tools can you use to review the log messages generated by your Firebox? (Select three).

A. Firebox System Manager > Traffic MonitorB. Fireware XTM Web UI > Traffic MonitorC. Firebox System Manager > Status ReportD. Dimension > Log managerE. WatchGuard System Manager > Policy Manager



QUESTION 45You can configure your Firebox to send log messages to how many WatchGuard Log Servers at the same time? (Select one.)

A. OneB. TwoC. As many as you have configured on your network.



QUESTION 46With the policies configured as shown in this image, HTTP traffic can be sent and received through branch office VPN tunnel.1 and tunnel.2.

A. TrueB. False

Correct Answer: ASection: (none)

Explanation


QUESTION 47A local branch office VPN tunnel route is configured as shown in this image.

On the remote peer device, what must be configured as the remote network address for this tunnel route? (Select one.)

A. 10.0.1.0/24B. 10.0.10.0/24C. 10.0.20.0/24



QUESTION 48While troubleshooting a branch office VPN tunnel, you see this log message:

2014-07-23 12:29:15 iked (203.0.113.10<->203.0.113.20) Peer proposes phase one encryption 3DES, expecting AES

What settings could you modify in the local device configuration to resolve this issue? (Select one.)

A. BOVPN Gateway settingsB. BOVPN-Allow policiesC. BOVPN Tunnel settingsD. BOVPN Tunnel Route settings


Explanation/Reference:The WatchGuard BOVPN settings error in this example states phase one encryption. Only the BOVPN Gateway settings can specify phase one settings. BOVPNTunnel settings specify phase 2 settings.

QUESTION 49If you use an external authentication server for mobile VPN, which option must you complete before remote users can authenticate? (Select one.)

A. Create aliases for each remote user's virtual IP address.B. Reboot the authentication server.C. Add the Mobile VPN user group and remote users to your authentication server.D. Add the remote users to a Mobile VPN user group on your Firebox.



QUESTION 50In a Mobile VPN configuration, why would you choose default route VPN over split tunnel VPN? (Select one.)

A. Default route VPN allows your Firebox to examine all remote user trafficB. Default route VPN uses less bandwidthC. Default route VPN uses less processing powerD. Default route VPN automatically allows dynamic NAT




Documents

Fireware-Essentials · PDF fileExam A QUESTION 1 Which items are included in a Firebox backup image? (Select four.) A. Support snapshot B. Fireware OS C. Configuration file D. Log