[Q33-Q48] Real SAP C-HRHFC-2311 Exam Questions [Updated 2024]

4.5/5 - (4 votes)

Real SAP C-HRHFC-2311 Exam Questions [Updated 2024]

C-HRHFC-2311 Exam Dumps Pass with Updated 2024 Fortinet NSE 4 – FortiOS 7.2

SAP C-HRHFC-2311 Exam Syllabus Topics:

Topic	Details
Topic 1	Cost Center Replication from SAP ERP to SAP SuccessFactors Employee Central Organizational Data Replication from SAP SuccessFactors Employee Central to SAP ERP
Topic 2	Configure settings you make in Customizing to prepare SAP ERP HCM system Determine when to use the appropriate API
Topic 3	Extensibility (BadIs) for SAP ERP Employee Data Replication with SAP SuccessFactors Employee Central SAP SuccessFactors Employee Central Integration Overview and Basic Settings
Topic 4	Implement and configure the extensibility of SAP ERP employee data to SAP SuccessFactors Implement and configure the replication of Employee Central data from SAP SuccessFactors and SAP ERP HCM

Q33. What are two characteristics of FortiGate HA cluster virtual IP addresses? (Choose two.)

Virtual IP addresses are used to distinguish between cluster members.

Heartbeat interfaces have virtual IP addresses that are manually assigned.

The primary device in the cluster is always assigned IP address 169.254.0.1.

A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.

Fortigate Infrastructure 7.2 Study Guide page 301
FortiGate Infrastructure 7.2 Study Guide (p.301):
“FGCP automatically assigns the heartbeat IP addresses based on the serial number of each device. The IP address 169.254.0.1 is assigned to the device with the highest serial number.”
“A change in the heartbeat IP addresses may happen when a FortiGate device joins or leaves the cluster.”
“The HA cluster uses the heartbeat IP addresses to distinguish the cluster members and synchronize data.”
https://networkinterview.com/fortigate-ha-high-availability/

Q34. An administrator has a requirement to keep an application session from timing out on port 80. What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)

Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy.

Create a new service object for HTTP service and set the session TTL to never

Set the TTL value to never under config system-ttl

Set the session TTL on the HTTP policy to maximum

Q35. FortiGuard categories can be overridden and defined in different categories. To create a web rating override for example.com home page, the override must be configured using a specific syntax.
Which two syntaxes are correct to configure web rating for the home page? (Choose two.)

www.example.com:443

www.example.com

example.com

www.example.com/index.html

When using FortiGuard category filtering to allow or block access to a website, one option is to make a web rating override and define the website in a different category. Web ratings are only for host names – no URLs or wildcard characters are allowed.
OK: google.com or www.google.com
NO OK: www.google.com/index.html or google.*
FortiGate_Security_6.4 page 384
When using FortiGuard category filtering to allow or block access to a website, one option is to make a web rating override and define the website in a different category. Web ratings are only for host names– “no URLs or wildcard characters are allowed”.

Q36. Refer to the exhibit.

Which contains a network diagram and routing table output.
The Student is unable to access Webserver.
What is the cause of the problem and what is the solution for the problem?

The first packet sent from Student failed the RPF check.
This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

The first reply packet for Student failed the RPF check.
This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

The first reply packet for Student failed the RPF check .
This issue can be resolved by adding a static route to 203.0. 114.24/32 through port3.

The first packet sent from Student failed the RPF check.
This issue can be resolved by adding a static route to 203.0. 114.24/32 through port3.

Q37. Which two statements ate true about the Security Fabric rating? (Choose two.)

It provides executive summaries of the four largest areas of security focus.

Many of the security issues can be fixed immediately by clicking Apply where available.

The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.

The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.

Q38. Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).

Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

The firewall policy performs the full content inspection on the file.

The flow-based inspection is used, which resets the last packet to the user.

The volume of traffic being inspected is too high for this model of FortiGate.

The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.

* “ONLY” If the virus is detected at the “START” of the connection, the IPS engine sends the block replacement message immediately
* When a virus is detected on a TCP session (FIRST TIME), but where “SOME PACKETS” have been already forwarded to the receiver, FortiGate “resets the connection” and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can’t be opened. The IPS engine also caches the URL of the infected file, so that if a “SECOND ATTEMPT” to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.
In flow mode, the FortiGate drops the last packet killing the file. But because of that the block replacement message cannot be displayed. If the file is attempted to download again the block message will be shown.

Q39. Which statement is correct regarding the security fabric?

FortiManager is one of the required member devices.

FortiGate devices must be operating in NAT mode.

A minimum of two Fortinet devices is required.

FortiGate Cloud cannot be used for logging purposes.

FortiGate Security 7.2 Study Guide (p.428): “You must have a minimum of two FortiGate devices at the core of the Security Fabric, plus one FortiAnalyzer or cloud logging solution. FortiAnalyzer Cloud or FortiGate Cloud can act as the cloud logging solution. The FortiGate devices must be running in NAT mode.”

Q40. Refer to the exhibits.
Exhibit A shows a network diagram. Exhibit B shows the firewall policy configuration and a VIP object configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.

If the host 10.200.3.1 sends a TCP SYN packet on port 10443 to 10.200.1.10, what will the source address, destination address, and destination port of the packet be, after FortiGate forwards the packet to the destination?

10.0.1.254, 10.0.1.10, and 443, respectively

10.0.1.254, 10.200.1.10, and 443, respectively

10.200.3.1, 10.0.1.10, and 443, respectively

10.0.1.254, 10.0.1.10, and 10443, respectively

The host 10.200.3.1 sends a TCP SYN packet on port 10443 to 10.200.1.10, which is the external IP address of the VIP object named VIP in Exhibit B1. The VIP object maps the external IP address and port to the internal IP address and port of the server 10.0.1.10 and 443, respectively1. The VIP object also enables NAT, which means that the source address of the packet will be translated to the IP address of the outgoing interface2.
The firewall policy ID 1 in Exhibit B allows traffic from WAN (port1) to LAN (port3) with the destination address of VIP and the service of HTTPS1. The policy also enables NAT, which means that the source address of the packet will be translated to the IP address of the outgoing interface2.
Therefore, after FortiGate forwards the packet to the destination, the source address, destination address, and destination port of the packet will be 10.200.3.1, 10.0.1.10, and 443, respectively.
You can find more information about VIP objects and firewall policies in the Fortinet Documentation

Q41. When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?

Log ID

Universally Unique Identifier

Policy ID

Sequence ID

FortiGate Security 7.2 Study Guide (p.67): “When creating firewall objects or policies, a universally unique identifier (UUID) attribute is added so that logs can record these UUIDs and improve functionality when integrating with FortiManager or FortiAnalyzer.”

Q42. Refer to the exhibit.

The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.
The WAN (port1) interface has the IP address 10.200. 1. 1/24.
The LAN (port3) interface has the IP address 10 .0.1.254. /24.
The first firewall policy has NAT enabled using IP Pool.
The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0. 1. 10?

10.200. 1. 1

10.200.3. 1

10.200. 1. 100

10.200. 1. 10

Policy 1 is applied on outbound (LAN-WAN) and policy 2 is applied on inbound (WAN-LAN). question is asking SNAT for outbound traffic so policy 1 will take place and NAT overload is in effect.

Q43. Refer to the exhibit.

The exhibit shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

The sensor will allow attackers matching the Microsoft Windows.iSCSI.Target.DoS signature.

The sensor will block all attacks aimed at Windows servers.

The sensor will reset all connections that match these signatures.

The sensor will gather a packet log for all matched traffic.

Q44. Examine this FortiGate configuration:

How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

It always authorizes the traffic without requiring authentication.

It drops the traffic.

It authenticates the traffic using the authentication scheme SCHEME2.

It authenticates the traffic using the authentication scheme SCHEME1.

“What happens to traffic that requires authorization, but does not match any authentication rule? The active and passive SSO schemes to use for those cases is defined under config authentication setting”

Q45. Refer to the exhibits.
Exhibit A

Exhibit B

The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration.
How will FortiGate handle user authentication for traffic that arrives on the LAN interface?

If there is a fall-through policy in place, users will not be prompted for authentication.

Authentication is enforced at a policy level; all users will be prompted for authentication.

All users will be prompted for authentication, users from the Sales group can authenticate successfully with the correct credentials.

All users will be prompted for authentication, users from the HR group can authenticate successfully with the correct credentials.

Q46. Refer to the exhibits.

Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)

Administrators can access FortiGate only through the console port.

FortiGate has entered conserve mode.

FortiGate will start sending all files to FortiSandbox for inspection.

Administrators cannot change the configuration.

Reference:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Conserve-mode-changes/ta-p/198502 configurable thresholds Though it is recommended to keep the default memory threshold, a new CLI command has been added to allow administrators to adjust the thresholds.
Default values are :
– red : 88% of total memory is considered “used memory”
– extreme : 95% of total memory is considered “used memory”
– green : 82% of total memory is considered “used memory”

Q47. Refer to the exhibits.
Exhibit A shows a network diagram. Exhibit B shows the firewall policy configuration and a VIP object configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
The administrator disabled the WebServer firewall policy.

Which IP address will be used to source NAT the traffic, if a user with address 10.0.1.10 connects over SSH to the host with address 10.200.3.1?

10.200.1.10

10.0.1.254

10.200.1.1

10.200.3.1

Traffic is coming from LAN to WAN, matches policy Full_Access which has NAT enable, so traffic uses source IP address of outgoing interface. Simple SNAT.

Q48. Refer to the exhibit.

Based on the raw log, which two statements are correct? (Choose two.)