IBM C2150-620 - IBM Security Network Protection (XGS) V5.3.2 System Administration Exam
Page: 3 / 12
Total 60 questions
Question #11 (Topic: Topic 1)
One XGS appliance in a financial company was running firmware version 5.2 for 2 years. The System Administrator upgraded the firmware to 5.3.2.3 because
version 5.2 is no longer supported and enabled Any-Any-Any-Inspect rule in Outbound SSL Inspection Policy according to new company audit policy. After that,
several users complain that their workstations cannot get Windows Update any more.
What should the System Administrator do to resolve this issue?
version 5.2 is no longer supported and enabled Any-Any-Any-Inspect rule in Outbound SSL Inspection Policy according to new company audit policy. After that,
several users complain that their workstations cannot get Windows Update any more.
What should the System Administrator do to resolve this issue?
A. Use the Microsoft domain certificate application object and create an outbound SSL ignore rule with priority higher than Any-Any-Any-Inspect.
B. Enable Any-Any-Any- Privacy-sensitive Information-Ignore rule in Outbound SSL Inspection Policy and make sure the priority of this rule is higher than Any- Any-Any-Inspect.
C. Create a domain certificate category application specifying *.update.microsoft.com in CN List and create an outbound SSL ignore rule with priority higher than Any-Any-Any-Inspect.
D. Enable the Any-Any-Microsoft domain certificate-Ignore built-in rule in Outbound SSL Inspection Policy and male sure the priority of this rule is higher than Any-Any-Any-Inspect
Answer: A
Question #12 (Topic: Topic 1)
The System Administrator has configured Outbound SSL Inspection Policy for five SSL-enabled web sites.
How can the SSL decryption errors for each web site be detected?
How can the SSL decryption errors for each web site be detected?
A. By looking at System Events Logs
B. By first enabling Alert on Failure
C. By looking at Network Access Events Logs
D. By looking at the SSL Connection Statistics Network Graph
Answer: B
Question #13 (Topic: Topic 1)
The System Administrator of an oil and gas company has an XGS appliance deployed in the network below:
[IBM-C2150-620-1.0/xmlfile-9_1.jpg]
The appliance was working in Inline simulation mode and suddenly there was a power failure on the switch which causes link 1.2 on XGS to go down, However,
port 1.1 on XGS remains up and hence the firewall keeps on sending the traffic to XGS appliance without realizing failure in the path.
Which setting should be corrected in the Protection Interface policy to avoid this behavior?
[IBM-C2150-620-1.0/xmlfile-9_1.jpg]
The appliance was working in Inline simulation mode and suddenly there was a power failure on the switch which causes link 1.2 on XGS to go down, However,
port 1.1 on XGS remains up and hence the firewall keeps on sending the traffic to XGS appliance without realizing failure in the path.
Which setting should be corrected in the Protection Interface policy to avoid this behavior?
A. Ensure that Propagate link is set to No.
B. Ensure that Propagate link is set to Yes.
C. Ensure that hardware bypass mode is set to Fail Open.
D. Ensure that hardware bypass mode is set to Fail Closed.
Answer: D
Question #14 (Topic: Topic 1)
A System Administrator is planning to implement SSL Inspection for both outbound user traffic and inbound traffic to a company web server.
The requirements are as follows:
? SSL Inspection should protect users from connections to fraudulent servers
? Outbound SSL Inspection should be limited to select web site categories
? Avoid having to deploy files, configurations, or certificates to user workstations
The steps to implement this plan are as follows:
? Obtain an Inspection license for the XGS
? Obtain a certificate from a public CA and upload it to the XGS via Outbound SSL Certificates
? Obtain the certificate and private key of the internal web server and upload it to the XGS via Inbound SSL Certificates
? Add internal CA certificates for the company intranet to the trusted Certificate Authorities tab in Outbound SSL Inspection Settings
? Configure Outbound SSL Inspection Settings to block connections if the server certificate is self-signed or invalid
? Create Outbound SSL Inspection rules that inspect only specific Domain Certificate Categories
? Create Inbound SSL Inspection rules that only decrypt traffic destined for the internal web server II address
What will happen if an internal user attempts to access the company intranet?
The requirements are as follows:
? SSL Inspection should protect users from connections to fraudulent servers
? Outbound SSL Inspection should be limited to select web site categories
? Avoid having to deploy files, configurations, or certificates to user workstations
The steps to implement this plan are as follows:
? Obtain an Inspection license for the XGS
? Obtain a certificate from a public CA and upload it to the XGS via Outbound SSL Certificates
? Obtain the certificate and private key of the internal web server and upload it to the XGS via Inbound SSL Certificates
? Add internal CA certificates for the company intranet to the trusted Certificate Authorities tab in Outbound SSL Inspection Settings
? Configure Outbound SSL Inspection Settings to block connections if the server certificate is self-signed or invalid
? Create Outbound SSL Inspection rules that inspect only specific Domain Certificate Categories
? Create Inbound SSL Inspection rules that only decrypt traffic destined for the internal web server II address
What will happen if an internal user attempts to access the company intranet?
A. The connection will be blocked.
B. The connection will be successful and traffic will be decrypted.
C. The connection will be successful and the traffic will be blocked.
D. The connection will be successful and the traffic will not be decrypted.
Answer: B
Question #15 (Topic: Topic 1)
A System Administrator wants to install the XGS license files during the first time configuration of the appliance.
How should the first time configuration wizard on the appliance be accessed?
How should the first time configuration wizard on the appliance be accessed?
A. Use the LCD front panel.
B. Use a console cable connection.
C. Use the Command Line Interface over SSH.
D. Use the web-based Local Management Interface.
Answer: D
