WatchGuard Fireware Essentials ESSENTIALS Questions & Answers

• Question 61:

  You have a privately addressed email server behind your Firebox. If you want to make sure that all traffic from this server to the Internet appears to come from the public IP address 203.0.113.25, regardless of policies, which from of NAT would you use? (Select one.)

  A. In the SMTP policy that handles traffic from the email server, select the option to apply dynamic NAT to all traffic in the policy and set the source IP address 203.0.113.25.

  B. Create a global dynamic NAT rule for traffic from the email server and set the source IP address to

  203.0.113.25.

  C. Create a static NAT action for traffic to the email server, and set the source IP address to 203.0.113.25.

  Correct Answer: B

• Question 62:

  Match each type of NAT with the correct description:

  Conserves IP addresses and hides the internal topology of your network. (Choose one)

  A. 1-to1 NAT

  B. Dynamic NAT

  C. NAT Loopback

  Correct Answer: B

  Dynamic NAT is also known as IP masquerading. With dynamic NAT many computers can connect to the Internet from one public IP address. Dynamic NAT gives more security for internal hosts that use the Internet, because it hides the IP addresses of hosts on your network.

  Reference: http://www.watchguard.com/help/docs/wsm/xtm_11/en-US/index.html#en-US/nat/ nat_dynamic_use_c.html%3FTocPath%3DNetwork%2520Address%2520Translation%2520(NAT)% 7CAbout%2520Dynamic%2520NAT%7C_____0

• Question 63:

  Clients on the trusted network need to connect to a server behind a router on the optional network. Based on this image, what static route must be added to the Firebox for traffic from clients on the trusted network to reach a server at 10.0.20.100? (Select one.)

  

  A. Route to 10.0.20.0/24, Gateway 10.0.2.1

  B. Route to 10.0.20.0/24, Gateway 10.0.2.254

  C. Route to 10.0.20.0, Gateway 10.0.2.254

  D. Route to 10.0.10.0/24, Gateway 10.0.10.1

  Correct Answer: B

  We must add a trusted static route to the 10.0.20.0/24 network through the 10.0.2.254 gateway.

• Question 64:

  Which of these options are private IPv4 addresses you can assign to a trusted interface, as described in RFC 1918, Address Allocation for Private Internets? (Select three.)

  A. 192.168.50.1/24

  B. 10.50.1.1/16

  C. 198.51.100.1/24

  D. 172.16.0.1/16

  E. 192.0.2.1/24

  Correct Answer: ABD

• Question 65:

  The policies in a default Firebox configuration do not allow outgoing traffic from optional interfaces.

  A. True

  B. False

  Correct Answer: B

• Question 66:

  When you examine the log messages In Traffic Monitor, you see that some network packets are denied with an unhandled packet log message. What does this log massage mean? (Select one.)

  A. The packet is denied because the site is on the Blocked Sites List.

  B. The packet is denied because it matched a policy.

  C. The packet is denied because it matched an IPS signature.

  D. The packet is denied because it does not match any firewall policies.

  Correct Answer: D

• Question 67:

  In the default Firebox configuration file, which policies control management access to the device? (Select two.)

  A. WatchGuard

  B. FTP

  C. Ping

  D. WatchGuard Web UI

  E. Outgoing

  Correct Answer: AD

• Question 68:

  To use the Web Setup Wizard or Quick Setup Wizard to configure your Firebox or XTM device, your computer must have an IP address on which subnet? (Select one.)

  A. 10.0.10.0/24

  B. 10.0.1.0/24

  C. 172.16.10.0/24

  D. 192.168.1.0/24

  Correct Answer: B

• Question 69:

  What is the best method to downgrade the version of Fireware OS on your Firebox without losing all device configuration settings? (Select one.)

  A. Restore a saved backup image that was created for the device before the last Fireware OS upgrade.

  B. Use the Upgrade OS feature in Fireware Web UI to install the sysa_dl file for an order version of Fireware OS.

  C. Change the OS compatibility setting in Policy Manager to downgrade the device. Then use Policy Manager to save the configuration to the device.

  D. Use the downgrade feature on Policy Manager to select a previous of Fireware OS.

  Correct Answer: A

• Question 70:

  You configured four Device Administrator user accounts for your Firebox. To see a report of witch Device Management users have made changes to the device configuration, what must you do? (Select two.)

  A. Start Firebox System Manager for the device and review the activity for the Management Users on the Authentication List tab.

  B. Connect to Report Manager or Dimension and view the Audit Trail report for your device.

  C. Open WatchGuard Server Center and review the configuration history for managed devices.

  D. Configure your device to send audit trail log messages to your WatchGuard Log Server or Dimension Log Server.

  Correct Answer: BC