サンプル問題 1： Which two statements about DHCP snooping enabled on a FortiSwitch VLAN are true? (Choose two.)
A: Enabling DHCP snooping on a FortiSwitch VLAN ensures requests and replies are seen by all DHCP servers.
B: switch-controller-dhcp-snooping-verify-mac verifies the destination MAC address to protect against DHCP exhaustion attacks.
C: By default, all FortiSwitch ports are set to forward client DHCP requests to untrusted ports.
D: Settings related to DHCP option 82 are only configurable through the CLI
正解：B, D
Explanation: Switch-controller-dhcp-snooping-verify-mac verifies the destination MAC address to protect against DHCP exhaustion attacks (B): This feature of DHCP snooping helps prevent DHCP exhaustion attacks by ensuring that the destination MAC addresses in DHCP packets match the MAC addresses learned by the switch. This check helps prevent attackers from overwhelming the DHCP server with requests from spoofed MAC addresses. Settings related to DHCP option 82 are only configurable through the CLI (D): DHCP Option 82 is used for "agent information, " and it's typically used in network environments where additional information between DHCP clients and servers is necessary for policy and billing purposes. Configuration of these settings in FortiSwitch is only available through the Command Line Interface (CLI), not the Graphical User Interface (GUI )
サンプル問題 2： Which statement about the quarantine VLAN on FortiSwitch is true?
A: Quarantine VLAN has no DHCP server
B: Users who fail 802.1X authentication can be placed on the quarantine VLA
C: It is only used for quarantined devices if global setting is set to quarantine by VLA
D: FortiSwitch can block devices without configuring quarantine VLAN to be part of the allowed VLANs.
正解：B
Explanation: The correct statement about the quarantine VLAN on FortiSwitch is: B. Users who fail 802.1X authentication can be placed on the quarantine VLAN. This feature allows network administrators to isolate devices that do not meet the network’s security criteria as determined through 802.1X authentication. Placing these devices in a quarantine VLAN restricts their network access, thereby protecting the network from potential security threats posed by unauthorized or compromised devices. Option A is incorrect as the presence of a DHCP server in a quarantine VLAN depends on specific network configurations. Option C is incorrect without more context regarding global settings, and option D misstates the functionality of quarantine VLANs, as their primary use is to restrict, not block, devices without additional VLAN configuration changes.
サンプル問題 3： Which is a requirement to enable SNMP v2c on a managed FortiSwitch?
A: Create an SNMP user to use for authentication and encryption.
B: Specify an SNMP host to send traps to.
C: Enable an SNMP v3 to handle traps messages with SNMP hosts.
D: Configure SNMP agent and communities.
正解：D
Explanation: To enable SNMP v2c on a managed FortiSwitch, the essential requirement involves configuring the SNMP agent and community strings: Configure SNMP Agent and Communities (D): SNMP Agent: Activating the SNMP agent on FortiSwitch allows it to respond to SNMP requests. Community Strings: SNMP v2c uses community strings for authentication. These strings function as passwords to grant read-only or read-write access to the SNMP data. Understanding Other Options: Create an SNMP user (A) is necessary for SNMP v3, not v2c, as it involves user-based authentication and encryption. Specify an SNMP host (B) is typically a part of SNMP configuration but not a requirement just to enable SNMP. Enable SNMP v3 (C) is not related to enabling SNMP v2c. Reference: For detailed instructions on configuring SNMP on FortiSwitch, you can refer to the SNMP configuration section in the FortiSwitch administration guide available on: Fortinet Product Documentation
