FCP_FGT_AD-7.6 Online Practice Questions

Explanation:
In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.
Flow-based inspection allows real-time scanning of files as they are being transmitted, with minimal impact on performance.
In proxy-based inspection mode antivirus scanning buffers the whole file for scanning, before sending it to the client.
Proxy-based inspection mode holds the file completely, scans it for threats, and only sends the file to the client if no threats are detected.

Explanation:
The type of logs on FortiGate that records information about traffic directly to and from the FortiGate nmanagement IP addresses is:
A. Local traffic logs
Local traffic logs include information about traffic that is directed to and from the FortiGate unit itself, including traffic to and from the FortiGate management IP addresses. These logs provide details about communication involving the FortiGate device.
So, the correct choice is A.

Explanation:
The IPS sensor configuration shows that:
The Microsoft.Windows.iSCSI.Target.DoS signature is set to "Monitor" with packet logging enabled, meaning that while traffic matching this signature will be allowed, it will also be logged for further analysis.
The generic Windows filter is set to "Block," meaning that all other attacks matching this filter will be blocked. However, the sensor will not reset connections or log packets unless specified.
Therefore, the sensor will allow attackers matching the specific DoS signature while blocking other
attacks against Windows.
Reference: FortiOS 7.4.1 Administration Guide: IPS Configuration

Explanation:
B. Strict RPF checks the best route back to the source using the incoming interface.
Strict: In this mode, Fortigate also verifies that the matching route is the best route in the routing table. That is, if the route in table contains a matching route for the source address and the incoming interface, but there is a better route for the source address through another interface the RPF check fails.
The Strict Reverse Path Forwarding (RPF) check is a security feature that helps prevent source IP address spoofing. When enabled, the FortiGate unit checks the source IP address of each incoming packet and compares it to the routing table to ensure that the packet arrives on the expected interface. Here's an explanation of the statement:
B. Strict RPF checks the best route back to the source using the incoming interface.
When the FortiGate unit receives a packet, it checks the source IP address and verifies that the packet arrives on the expected interface based on the routing table. The "best route back to the source" refers to the route in the routing table that would be used to send packets back to the source IP address. If the incoming interface matches the expected interface based on the routing table, the check passes. If not, the packet may be considered as potentially spoofed, and it might be dropped or subjected to further security measures.
This strict RPF check helps in preventing IP address spoofing, which is a common technique used in various network attacks.
Loose RPF checks for any route and Strict RPF check for best route