STUDY QUESTIONS2

Question 1

Why use block-session timer?

Answer 1

Denied packets can consume more CPU. If you add a session for denied packets, it will consume less

Question 2

how do you enable sessions for denied packets?

Answer 2

Config system settings –> set ses-denied-traffic enable

Question 3

what is the default value for “set block-session-time” in System Global

Answer 3

30 seconds

Question 4

FSSO- What are the different config modes?

Answer 4

DC Mode, Polling Mode and Terminal Server

Question 5

FSSO - There are 2 sub-types of Polling mode - mention them

Answer 5

Collector agent-based and Agentless

Question 6

FSSO - DC - What are the requirements for DC Mode?

Answer 6

One DC agent per domain controller, one collector agent on a windowes server

Question 7

FSSO - DC - what is the responsibility of a COLLECTOR AGENT (CA) in DC mode?

Answer 7

Group verification, workstation checks, update login records on FG, send domain local security group, OU

Question 8

FSSO - DC - How does it work?

Answer 8

1) user auth 2)DC agent sees log event and forwards to CA 3)CA sends it to FG

Question 9

FSSO - DC - What ports are used?

Answer 9

UDP 8002 (CA-DC) and TCP8000 (CA and FG)

Question 10

FSSO - POLLING - With AGENT —- What is required?

Answer 10

Only CA

Question 11

FSSO - POLLING - With AGENT —- How does it work?

Answer 11

Agent polls each DOMAIN CONTROLLER for log event

Question 12

FSSO - POLLING - With AGENT —- What ports are used?

Answer 12

SMB/tcp 445, TCP 135,137,139

Question 13

FSSO - POLLING - With AGENT —- What methods exist to pull info?

Answer 13

1) WMI 2)WinSec 3)NETAPI

Question 14

FSSO - POLLING - With AGENT —- Describe WMI

Answer 14

dc returns REQUESTED login events every 3 seconds (can read selected logs), reduceds network

Question 15

FSSO - POLLING - With AGENT —- Describe WinSecLog

Answer 15

CA polls all sec events every 10 sec (slower, latency, but sees all)

Question 16

FSSO - POLLING - With AGENT —- Describe NetAPI

Answer 16

CA agent polls temporary sessions

Question 17

FSSO - POLLING - Agentless — How does it work?

Answer 17

FG polls info from DOMAIN CONTROLLER. More CPU / Ram required in fortigate

Question 18

FSSO - FOR ALL - What are the requirements?

Answer 18

1) DNS-WORKSTATION 2) Log must contain NAMES, not IP 3) CA reach workstations (is it logged in?)

Question 19

CERTIFICATES - What contains information about FQDN of server

Answer 19

Common Name

Question 20

CERTIFICATES - How can you tell if a CERT is issued to a USER or SERVER

Answer 20

by looking at the SUBJETCT CN.. = If it’s a name you’ll know

Question 21

CERTIFICATES - What fields can be used to determine the server’s name

Answer 21

1) Subject Field in server cert (in common Name) 2)client Hello Message (SNI extension) 3)SAN (“ALTERNATIVE”)

Question 22

CERTIFICATES - What are the requirements for a cert to be an “Issuer as well”

Answer 22

1) Key Usage extension = Key cert sign 2) CA extension set to “true”

Question 23

In debug flow - what does “msg=”Denied by forward policy check (policy 0)” mean?

Answer 23

packet is dropped because it found no policy (implicit deny)