Watchguard ActualTests Essentials
Questions with 100% Correct Solutions
QUESTION 1
Which of these threats can the Firebox prevent with the default packet
handling settings? (Select four.)
A. Denial of service attacks.
B. Flood attacks.
C. Malware in downloaded files.
D. Port scans
E. .Virus' in email messages.
F. IP spoofing - ANSWER A, B, D, F
http://www.watchguard.com/training/fireware/82/defense3.htm
Users on the trusted network cannot browse Internet websites. Based on the
configuration shown in this image, what could be the problem with this policy
configuration? (Select one.)
<!--add policies here-->
1 FTP | Any-Tr,Any-Opt | External | tcp:21
2 HTTP-proxy | Any-Tr,Any-Opt | Any-Ext | tcp:80
3 HTTPS-proxy|Any-Tr,Any-Opt|Any-Ext|tcp:443
4 WG-Auth|Any-Tr,Any-Opt|Firebox|tcp:4100
5 WG Web UI|Any-Tr,Any-Opt|Firebox |tcp:8080
6 Ping|Any-Tr,Any-Opt|Any|ICMP (type:8,code:255)
,7 WG-FireboxMgmt|Any-Tr,Any-Opt|Firebox|tcp:4105,tcp:4117
A. The default Outgoing policy has been removed and there is no policy to allow
DNS traffic.
B. The HTTP-proxy policy has higher precedence than the HTTPS-proxy policy.
C. The HTTP-proxy policy is configured for the wrong port.
D. The HTTP-proxy allows Any-Trusted and Any-Optional to Any-External. -
ANSWER Correct Answer: A
About the Outgoing Policy
The default Outgoing policy is a packet filter policy that is automatically added to your
Firebox configuration when you run the Quick Setup Wizard to set up your device and
create a basic device configuration file. The Outgoing policy allows all TCP and UDP
connections from any trusted or optional source on your network to any external
network. Because it is a packet filter policy, not a proxy policy, the Outgoing policy
does not filter content when it examines the traffic through your Firebox.
If you remove the Outgoing policy from your device configuration file, you must
add policies to your configuration that allow outbound traffic. You can
either add a separate policy for each type of traffic that you want to allow out through
your firewall, or you can add the TCP-UDP packet filter or TCP-UDP-proxy policy. For
example, if you have removed the Outgoing policy, and you want to allow trusted users
on your network to connect to web sites, you must create an HTTP-proxy policy for port
80, HTTPS-proxy policy for port 443, and a DNS policy for port 53 to allow DNS query
resolution.
If you disable the Outgoing policy, which policies must you add to allow trusted interface
users to use in order to connect to commonly used websites? (Select three.)
A. HTTP port 80
B. NAT policy
C. FTP 21
D. HTTPS port 443
E. DNS 53 - ANSWER A,D,E
, About the Outgoing Policy
The default Outgoing policy is a packet filter policy that is automatically added to your
Firebox configuration when you run the Quick Setup Wizard to set up your device and
create a basic device configuration file. The Outgoing policy allows all TCP and UDP
connections from any trusted or optional source on your network to any external
network. Because it is a packet filter policy, not a proxy policy, the Outgoing policy
does not filter content when it examines the traffic through your Firebox.
If you remove the Outgoing policy from your device configuration file, you must add
policies to your configuration that allow outbound traffic. You can either add a separate
policy for each type of traffic that you want to allow out through your firewall, or you can
add the TCP-UDP packet filter or TCP-UDP-proxy policy. For example, if you have removed
the Outgoing policy, and you want to allow trusted users on your network to connect to
web sites, you must create an HTTP-proxy policy for port 80, HTTPS-proxy policy for port
443, and a DNS policy for port 53 to allow DNS query resolution.
How is a proxy policy different from a packet filter policy? (Select two.)
A. Only a proxy policy examines information in the IP header.
B. Only a proxy policy uses the IP source, destination, and port to control
network traffic.
C. Only a proxy policy can prevent specific threats without blocking the
entire connection.
D. Only a proxy works at the application, network, and transport layers to examine all
connection data. - ANSWER C,D
Packet Filter Policy
A packet filterexamines the IP header of each packet to control the network traffic
into and out of your network. It is the most basic feature of a firewall. If the IP header
information is valid, then the Firebox allows the packet. If the packet header
information is not valid, the device drops the packet.
Proxy Policy
A proxy monitors and scans the entire connection, from the protocol commands to
the data inside the packet. It examines the commands used in the connection to
Questions with 100% Correct Solutions
QUESTION 1
Which of these threats can the Firebox prevent with the default packet
handling settings? (Select four.)
A. Denial of service attacks.
B. Flood attacks.
C. Malware in downloaded files.
D. Port scans
E. .Virus' in email messages.
F. IP spoofing - ANSWER A, B, D, F
http://www.watchguard.com/training/fireware/82/defense3.htm
Users on the trusted network cannot browse Internet websites. Based on the
configuration shown in this image, what could be the problem with this policy
configuration? (Select one.)
<!--add policies here-->
1 FTP | Any-Tr,Any-Opt | External | tcp:21
2 HTTP-proxy | Any-Tr,Any-Opt | Any-Ext | tcp:80
3 HTTPS-proxy|Any-Tr,Any-Opt|Any-Ext|tcp:443
4 WG-Auth|Any-Tr,Any-Opt|Firebox|tcp:4100
5 WG Web UI|Any-Tr,Any-Opt|Firebox |tcp:8080
6 Ping|Any-Tr,Any-Opt|Any|ICMP (type:8,code:255)
,7 WG-FireboxMgmt|Any-Tr,Any-Opt|Firebox|tcp:4105,tcp:4117
A. The default Outgoing policy has been removed and there is no policy to allow
DNS traffic.
B. The HTTP-proxy policy has higher precedence than the HTTPS-proxy policy.
C. The HTTP-proxy policy is configured for the wrong port.
D. The HTTP-proxy allows Any-Trusted and Any-Optional to Any-External. -
ANSWER Correct Answer: A
About the Outgoing Policy
The default Outgoing policy is a packet filter policy that is automatically added to your
Firebox configuration when you run the Quick Setup Wizard to set up your device and
create a basic device configuration file. The Outgoing policy allows all TCP and UDP
connections from any trusted or optional source on your network to any external
network. Because it is a packet filter policy, not a proxy policy, the Outgoing policy
does not filter content when it examines the traffic through your Firebox.
If you remove the Outgoing policy from your device configuration file, you must
add policies to your configuration that allow outbound traffic. You can
either add a separate policy for each type of traffic that you want to allow out through
your firewall, or you can add the TCP-UDP packet filter or TCP-UDP-proxy policy. For
example, if you have removed the Outgoing policy, and you want to allow trusted users
on your network to connect to web sites, you must create an HTTP-proxy policy for port
80, HTTPS-proxy policy for port 443, and a DNS policy for port 53 to allow DNS query
resolution.
If you disable the Outgoing policy, which policies must you add to allow trusted interface
users to use in order to connect to commonly used websites? (Select three.)
A. HTTP port 80
B. NAT policy
C. FTP 21
D. HTTPS port 443
E. DNS 53 - ANSWER A,D,E
, About the Outgoing Policy
The default Outgoing policy is a packet filter policy that is automatically added to your
Firebox configuration when you run the Quick Setup Wizard to set up your device and
create a basic device configuration file. The Outgoing policy allows all TCP and UDP
connections from any trusted or optional source on your network to any external
network. Because it is a packet filter policy, not a proxy policy, the Outgoing policy
does not filter content when it examines the traffic through your Firebox.
If you remove the Outgoing policy from your device configuration file, you must add
policies to your configuration that allow outbound traffic. You can either add a separate
policy for each type of traffic that you want to allow out through your firewall, or you can
add the TCP-UDP packet filter or TCP-UDP-proxy policy. For example, if you have removed
the Outgoing policy, and you want to allow trusted users on your network to connect to
web sites, you must create an HTTP-proxy policy for port 80, HTTPS-proxy policy for port
443, and a DNS policy for port 53 to allow DNS query resolution.
How is a proxy policy different from a packet filter policy? (Select two.)
A. Only a proxy policy examines information in the IP header.
B. Only a proxy policy uses the IP source, destination, and port to control
network traffic.
C. Only a proxy policy can prevent specific threats without blocking the
entire connection.
D. Only a proxy works at the application, network, and transport layers to examine all
connection data. - ANSWER C,D
Packet Filter Policy
A packet filterexamines the IP header of each packet to control the network traffic
into and out of your network. It is the most basic feature of a firewall. If the IP header
information is valid, then the Firebox allows the packet. If the packet header
information is not valid, the device drops the packet.
Proxy Policy
A proxy monitors and scans the entire connection, from the protocol commands to
the data inside the packet. It examines the commands used in the connection to
