FCSS-EFW-AD-7-6: Fortinet NSE 7 - Enterprise Firewall 7.6 AdministratorDemo

By Fortinet · Question Mode

QuestionQ48

Security profiles

Refer to the exhibit.

Question Image

The packet capture output for a client hello message is displayed. You are updating a firewall policy that includes SSL certificate inspection and capturing packets from traffic that passes through this firewall policy.

Which two statements about the packet capture are correct?

Choose two
  • A You can effectively apply an antivirus security profile to this traffic.
  • B You can effectively apply a web filtering profile to this traffic.
  • C The subject alternative name (SAN) is necessary to apply security profiles.
  • D The client supports only TLS versions 1.2 and 1.3.
Explanation

Certificate inspection can use TLS handshake and certificate information to control website access, so a web filtering profile can be applied effectively without decrypting the payload. Antivirus inspection of encrypted content requires deep inspection, which decrypts the session content. The ClientHello supported_versions extension advertises only TLS 1.3 and TLS 1.2; the legacy version fields do not add supported protocol versions.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!