Watchguard ActualTests Essentials
Questions with 100% Correct Solutions
QUESTION 1
Which of these actions adds a host to the temporary or permanent blocked sites
list? (Select four.)
A. Enable the AUTO-block sites that attempt to connect option in a deny policy.
B. Add the site to the Blocked Sites Exceptions list.
C. On the Firebox System Manager > Blocked Sites tab, select Add
D. In Policy Manager, select Setup > Default Threat Protection > Blocked Sites and click
Add.
E. In the Firebox System Manager Traffic Monitor tab, right click a connection, select the
source or destination IP address, then click Block Site: [ip address] - ANSWER A, C, D, E
Permanent Blocked Sites — These are IP addresses that you manually add to your
device configuration file because you want all connections to and from the IP
address blocked. If an IP address consistently and repeatedly tries to violate your
security policies, you can add it to the Permanent Blocked Sites list.
You can add blocked sites in several ways:
In Policy Manager, select Setup > Default Threat Protection > Blocked Sites and click Add
In Firebox System Manager, on the Blocked Sites tab, click Add.
In the Firebox System Manager Traffic Monitor tab, right click a connection, select
the source or destination IP address, then click Block Site: [ip address].
Auto-blocked sites — These are IP addresses that the device adds to, and removes
from, a list of sites that are temporarily blocked based on the packet handling
,rules specified in your device configuration. These IP addresses are blocked for a
period of time you select. This feature is known as the Temporary Blocked Sites
list. For example, if you configure the auto-block option for a policy set to deny
traffic, the device can add the denied IP addresses to the Temporary Blocked Sites
list. If a connection is blocked by your default packet handling rules, the source
IP address is also added to the Temporary Blocked Sites list.
Which of these threats can the Firebox prevent with the default packet
handling settings? (Select four.)
A. Denial of service attacks.
B. Flood attacks.
C. Malware in downloaded files.
D. Port scans
E. .Virus' in email messages.
F. IP spoofing - ANSWER A, B, D, F
http://www.watchguard.com/training/fireware/82/defense3.htm
Users on the trusted network cannot browse Internet websites. Based on the
configuration shown in this image, what could be the problem with this policy
configuration? (Select one.)
<!--add policies here-->
1 FTP | Any-Tr,Any-Opt | External | tcp:21
2 HTTP-proxy | Any-Tr,Any-Opt | Any-Ext | tcp:80
3 HTTPS-proxy|Any-Tr,Any-Opt|Any-Ext|tcp:443
4 WG-Auth|Any-Tr,Any-Opt|Firebox|tcp:4100
5 WG Web UI|Any-Tr,Any-Opt|Firebox |tcp:8080
6 Ping|Any-Tr,Any-Opt|Any|ICMP (type:8,code:255)
, 7 WG-FireboxMgmt|Any-Tr,Any-Opt|Firebox|tcp:4105,tcp:4117
A. The default Outgoing policy has been removed and there is no policy to allow
DNS traffic.
B. The HTTP-proxy policy has higher precedence than the HTTPS-proxy policy.
C. The HTTP-proxy policy is configured for the wrong port.
D. The HTTP-proxy allows Any-Trusted and Any-Optional to Any-External. -
ANSWER Correct Answer: A
About the Outgoing Policy
The default Outgoing policy is a packet filter policy that is automatically added to your
Firebox configuration when you run the Quick Setup Wizard to set up your device and
create a basic device configuration file. The Outgoing policy allows all TCP and UDP
connections from any trusted or optional source on your network to any external
network. Because it is a packet filter policy, not a proxy policy, the Outgoing policy
does not filter content when it examines the traffic through your Firebox.
If you remove the Outgoing policy from your device configuration file, you must
add policies to your configuration that allow outbound traffic. You can
either add a separate policy for each type of traffic that you want to allow out through
your firewall, or you can add the TCP-UDP packet filter or TCP-UDP-proxy policy. For
example, if you have removed the Outgoing policy, and you want to allow trusted users
on your network to connect to web sites, you must create an HTTP-proxy policy for port
80, HTTPS-proxy policy for port 443, and a DNS policy for port 53 to allow DNS query
resolution.
If you disable the Outgoing policy, which policies must you add to allow trusted interface
users to use in order to connect to commonly used websites? (Select three.)
A. HTTP port 80
B. NAT policy
C. FTP 21
D. HTTPS port 443
E. DNS 53 - ANSWER A,D,E
Questions with 100% Correct Solutions
QUESTION 1
Which of these actions adds a host to the temporary or permanent blocked sites
list? (Select four.)
A. Enable the AUTO-block sites that attempt to connect option in a deny policy.
B. Add the site to the Blocked Sites Exceptions list.
C. On the Firebox System Manager > Blocked Sites tab, select Add
D. In Policy Manager, select Setup > Default Threat Protection > Blocked Sites and click
Add.
E. In the Firebox System Manager Traffic Monitor tab, right click a connection, select the
source or destination IP address, then click Block Site: [ip address] - ANSWER A, C, D, E
Permanent Blocked Sites — These are IP addresses that you manually add to your
device configuration file because you want all connections to and from the IP
address blocked. If an IP address consistently and repeatedly tries to violate your
security policies, you can add it to the Permanent Blocked Sites list.
You can add blocked sites in several ways:
In Policy Manager, select Setup > Default Threat Protection > Blocked Sites and click Add
In Firebox System Manager, on the Blocked Sites tab, click Add.
In the Firebox System Manager Traffic Monitor tab, right click a connection, select
the source or destination IP address, then click Block Site: [ip address].
Auto-blocked sites — These are IP addresses that the device adds to, and removes
from, a list of sites that are temporarily blocked based on the packet handling
,rules specified in your device configuration. These IP addresses are blocked for a
period of time you select. This feature is known as the Temporary Blocked Sites
list. For example, if you configure the auto-block option for a policy set to deny
traffic, the device can add the denied IP addresses to the Temporary Blocked Sites
list. If a connection is blocked by your default packet handling rules, the source
IP address is also added to the Temporary Blocked Sites list.
Which of these threats can the Firebox prevent with the default packet
handling settings? (Select four.)
A. Denial of service attacks.
B. Flood attacks.
C. Malware in downloaded files.
D. Port scans
E. .Virus' in email messages.
F. IP spoofing - ANSWER A, B, D, F
http://www.watchguard.com/training/fireware/82/defense3.htm
Users on the trusted network cannot browse Internet websites. Based on the
configuration shown in this image, what could be the problem with this policy
configuration? (Select one.)
<!--add policies here-->
1 FTP | Any-Tr,Any-Opt | External | tcp:21
2 HTTP-proxy | Any-Tr,Any-Opt | Any-Ext | tcp:80
3 HTTPS-proxy|Any-Tr,Any-Opt|Any-Ext|tcp:443
4 WG-Auth|Any-Tr,Any-Opt|Firebox|tcp:4100
5 WG Web UI|Any-Tr,Any-Opt|Firebox |tcp:8080
6 Ping|Any-Tr,Any-Opt|Any|ICMP (type:8,code:255)
, 7 WG-FireboxMgmt|Any-Tr,Any-Opt|Firebox|tcp:4105,tcp:4117
A. The default Outgoing policy has been removed and there is no policy to allow
DNS traffic.
B. The HTTP-proxy policy has higher precedence than the HTTPS-proxy policy.
C. The HTTP-proxy policy is configured for the wrong port.
D. The HTTP-proxy allows Any-Trusted and Any-Optional to Any-External. -
ANSWER Correct Answer: A
About the Outgoing Policy
The default Outgoing policy is a packet filter policy that is automatically added to your
Firebox configuration when you run the Quick Setup Wizard to set up your device and
create a basic device configuration file. The Outgoing policy allows all TCP and UDP
connections from any trusted or optional source on your network to any external
network. Because it is a packet filter policy, not a proxy policy, the Outgoing policy
does not filter content when it examines the traffic through your Firebox.
If you remove the Outgoing policy from your device configuration file, you must
add policies to your configuration that allow outbound traffic. You can
either add a separate policy for each type of traffic that you want to allow out through
your firewall, or you can add the TCP-UDP packet filter or TCP-UDP-proxy policy. For
example, if you have removed the Outgoing policy, and you want to allow trusted users
on your network to connect to web sites, you must create an HTTP-proxy policy for port
80, HTTPS-proxy policy for port 443, and a DNS policy for port 53 to allow DNS query
resolution.
If you disable the Outgoing policy, which policies must you add to allow trusted interface
users to use in order to connect to commonly used websites? (Select three.)
A. HTTP port 80
B. NAT policy
C. FTP 21
D. HTTPS port 443
E. DNS 53 - ANSWER A,D,E
