Exam NSE7_NST-7.2 topic 1 question 1 discussion

Actual exam question from Fortinet's NSE7_NST-7.2

Question #: 1
Topic #: 1

Consider the scenario where the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate.
Which action will FortiGate take when using the default settings for SSL certificate inspection?

A. FortiGate closes the connection because this represents an invalid SSL/TLS configuration.
B. FortiGate uses the CN information from the Subject field in the server certificate.
C. FortiGate uses the first entry listed in the SAN field in the server certificate.
D. FortiGate uses the SNI from the user’s web browser.

Show Suggested Answer

Suggested Answer: B 🗳️

by Cyn0wn at Dec. 11, 2024, 9:49 a.m.

Comments

Submit Cancel

PabloSL

6 days, 11 hours ago

Selected Answer: D

D, it will not look at CN or SAN while it can see the SNI

upvoted 1 times

...

Cyn0wn

2 weeks, 3 days ago

Selected Answer: D

FortiGate, by default, evaluates the SNI (Server Name Indication) field in the SSL/TLS handshake for certificate inspection. The SNI is compared against rules in the web filter or policies to determine access permissions or actions. It does not prioritize the CN (Common Name) field from the certificate unless explicitly configured to do so. This aligns with standard behavior where the SNI is used for identifying the target host when dealing with HTTPS traffic https://community.fortinet.com/t5/Support-Forum/website-access-problems/m-p/266814

upvoted 2 times

...

Exam NSE7_NST-7.2 All Questions

View all questions & answers for the NSE7_NST-7.2 exam

Exam NSE7_NST-7.2 topic 1 question 1 discussion

Comments

PabloSL

Cyn0wn

SY0-701