Exam NSE7_EFW-7.2 topic 1 question 75 discussion

Actual exam question from Fortinet's NSE7_EFW-7.2

Question #: 75
Topic #: 1

Refer to the exhibit, which shows an SSL certification inspection configuration.

SSL certification inspection configuration

While testing, the administrator updated the ssl-ssh-profile configuration with the command set sni-server-cert-check strict.

The administrator found that the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate.

With respect to the set sni-server-cert-check strict command, which action does FortiGate take?

A. FortiGate uses the first entry listed in the SAN field in the server certificate.
B. FortiGate closes the connection because this represents an invalid SSL/TLS header.
C. FortiGate uses the CN information from the Subject field in the server certificate.
D. FortiGate uses the SNI from the user’s web browser.

Show Suggested Answer

Suggested Answer: B 🗳️

by Alexander101 at Feb. 24, 2025, 4 a.m.

Comments

Submit Cancel

Alexander101

4 days, 11 hours ago

Selected Answer: B

B is correct, strict mode causes FortiGate to close the connection if the SNI does not match the CN or SAN fields as per the FortiGuard and Security Profiles chapter on SSL Certificate inspection and SNI check

upvoted 2 times

...

Exam NSE7_EFW-7.2 All Questions

View all questions & answers for the NSE7_EFW-7.2 exam

Exam NSE7_EFW-7.2 topic 1 question 75 discussion

Comments

Alexander101

SY0-701