WatchGuard Fireware Essentials ESSENTIALS Questions & Answers

• Question 41:

  To prevent certificate error warnings in your browser when you use deep content inspection with the HTTPS proxy, you can export the proxy authority certificate from the Firebox and import that certificate to all client devices.

  A. True

  B. False

  Correct Answer: A

• Question 42:

  Which of these options must you configure in an HTTPS-proxy policy to detect credit card numbers in HTTP traffic that is encrypted with SSL? (Select two.)

  A. WebBlocker

  B. Gateway AntiVirus

  C. Application Control

  D. Deep inspection of HTTPS content

  E. Data Loss Prevention

  Correct Answer: DE

• Question 43:

  Match each WatchGuard Subscription Service with its function.

  Uses full-system emulation analysis to identify characteristics and behavior of zero-day malware. (Choose one).

  A. Reputation Enable Defense RED

  B. Gateway / Antivirus

  C. Data Loss Prevention DLP

  D. Spam Blocker

  E. WebBlocker

  F. Intrusion Prevention Server IPS

  G. Application Control

  H. Quarantine Server

  I. APT Blocker

  Correct Answer: I

  APT Blocker is intended to stop malware and zero-day threats that are trying to invade an organization's network. APT Blocker uses a next-gen sandbox to get detailed views into the execution of a malware program. After first running through other security services, files are fingerprinted and checked against an existing database – first on the appliance and then in the cloud. If the file has never been seen before, it is analyzed using the system emulator, which monitors the execution of all instructions. It can spot the evasion techniques that other sandboxes miss.

  Reference: http://www.watchguard.com/wgrd-products/security-modules/apt-blocker

• Question 44:

  When you configure the Global Application Control action, it is automatically applied to all policies.

  A. True

  B. False

  Correct Answer: B

• Question 45:

  Which WatchGuard Subscription Service must be enabled in a proxy policy before you can use APT Blocker? (Select one.)

  A. RED

  B. Application Control

  C. Gateway Antivirus

  D. WebBlocker

  E. IPS

  Correct Answer: C

• Question 46:

  What settings must you device configuration file include for Gateway AntiVirus to protect users on your network? (Select two.)

  A. Configure a policy to use a proxy action that has AntiVirus settings configured.

  B. Install the Gateway AntiVirus server on your network.

  C. Configure Gateway AntiVirus settings for a proxy action.

  D. Disable automatic signature updates.

  E. Decrease the scan limits

  Correct Answer: AC

  When you enable Gateway AntiVirus, you must set the actions to be taken if a virus or error is found in an email message (SMTP or POP3 proxies), web page download or upload post (HTTP proxy), or uploaded or downloaded file (FTP proxy). When Gateway AntiVirus is enabled, it scans each file up to a specified kilobyte count. Any additional bytes in the file are not scanned. This allows the proxy to partially scan very large files without a large effect on performance.

  Reference: http://watchguard.com/help/docs/webui/xtm_11/en-us/content/en-us/services/gateway_av/ av_actions_config_c.html

• Question 47:

  After you enable spamBlocker, your users experience no reduction in the amount of spam they receive. What could explain this? (Select three.)

  A. Connections cannot be resolved to the spamBlocker servers because DNS is not configured on the Firebox.

  B. The spamBlocker action for Confirmed Spam is set to Allow.

  C. The Maximum File Size to Scan option is set too high.

  D. A spamBlocker exception is configured to allow traffic from sender *.

  E. spamBlocker Virus Outbreak Detection is not enabled.

  Correct Answer: ABD

  A: Spamblocker requires DNS to be configured on your XTM device

  B: If you use spamBlocker with the POP3 proxy, you have only two actions to choose from: Add Subject Tag and Allow. Allow lets spam email messages go through the Firebox without a tag.

  D: The Firebox might sometimes identify a message as spam when it is not spam. If you know the address of the sender, you can configure the Firebox with an exception that tells it not to examine messages from that source address or domain.

  Reference: Fireware Basics, Courseware: WatchGuard System Manager 10, page 138

• Question 48:

  If your Firebox has a single public IP address, and you want to forward inbound traffic to internal hosts based on the destination port, which type of NAT should you use? (Select one.)

  A. Static NAT

  B. 1-to-1 NAT

  C. Dynamic NAT

  Correct Answer: B

• Question 49:

  You need to create an HTTP-proxy policy to a specific domain for software updates (example.com). The update site has multiple subdomains and dynamic IP addresses on a content delivery network. Which of these options is the best way to define the destination in your HTTP-proxy policy? (Select one.)

  A. Configure a host name for update.example.com.

  B. Configure an FQDN for *.example.com.

  C. Add IP addresses that correspond to each software update server in the domain.

  D. Create an alias for all subdomains and known IP addresses for example.com.

  Correct Answer: B

• Question 50:

  From the SMTP proxy action settings in this image, which of these options is configured for outgoing SMTP traffic? (Select one.)

  

  A. Rewrite the Mail From header for the example.comdomain.

  B. Deny incoming mail from the example.comdomain.

  C. Prevent mail relay for the example.comdomain.

  D. Deny outgoing mail from the example.comdomain.

  Correct Answer: B