IBM C2150-620 問題集

質問 1：
The requirements are as follows:
*
Avoid having to push certificates to all workstations
*
Protect users from fraudulent web sites
*
Protect all internal server from malicious attacks
The steps to implement this plan are as follows:
*
Obtain an SSL Inspection license for the XGS
*
Obtain a certificate from a public CA and upload it to the XGS via Outbound SSL Certificates
*
Obtain the certificate and private key of the internal public-facing web server and upload it to the XGS via Inbound SSL Certificates
*
Configure Outbound SSL Inspection Settings to block connections if the server certificate is invalid or self-signed
*
Create Outbound SSL Inspection rules that inspect all traffic
*
Create Inbound SSL Inspection rules that only decrypt traffic destined for the internal web server IP address After implementing the plan, the System Administrator finds that users are blocked when trying to access the private company intranet site.
What should the System Administrator do to allow the users to access the intranet?
A. Add an inbound SSL Inspection rule to ignore the traffic to the intranet site.
B. Add intranet CA certificates to trusted Certificate Authorities.
C. Disable the self-signed certificate option in Outbound SSL Inspection Settings.
D. Add intranet CA certificates to the Inbound SSL Certificates store.
正解：B

質問 2：
The System Administrator has configured the Advanced Tuning Parameter
alpsd.ssl.inverse=1 (Man-in-the-Middle (MitM) approach) to allow Diffie-Hellman key exchange usage so traffic to their internal web portal can be decrypted.
Which additional steps need to be taken to configure the XGS?
A. Configure Outbound SSL Certificates and Outbound SSL Inspection Policy.
B. Configure Inbound SSL Certificates and Inbound SSL Inspection Policy.
C. Configure Inbound SSL Certificates and Outbound SSL Inspection Policy.
D. Configure Outbound SSL Certificates and Inbound SSL Inspection Policy.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 3：
When registering an XGS appliance to the Site Protector, a System Administrator decided to use a strict cryptography level.
Which protocol is allowed in this configuration?
A. SP 800-131A
B. TLS v2.1
C. SSLv3
D. TKS v1.1
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 4：
The System Administrator for a financial organization wants to register an XGS appliance to SiteProtector. There are two SiteProtector Sites:
*
SiteProtector_1 in Strict mode has AgentManager_1 installed in it.
*
SiteProtector_2 in Compatible mode has AgentManager_2 installed in it.
The System Administrator has configured XGS SiteProtector Management policy as follows:

In which SiteProtector instance should this XGS appear as Active based on the above policy given that there are no other network issues?
A. XGS should be seen as Active in both SiteProtector sites.
B. XGS should be seen as Active in SiteProtector_1 only.
C. XGS should not be active in any of the SiteProtector sites.
D. XGS should be seen as Active in SiteProtector_2 only.
正解：D

質問 5：
The System Administrator has configured the XGS devices shown in the following topology diagram. Outbound SSL inspection is configured on XGS1. All XGS devices are licensed for SSL inspection, Identity and Application Control, and IP Reputation.

Which of the XGS devices will block PC1 from accessing a known malware web site via SSL?
A. XGS1 in protection mode
B. XGS3 in protection mode
C. XGS2 connected to s read-only tap port
D. XGS4 connected to a read-only tap port
正解：A

質問 6：
The System Administrator has configured the XGS devices shown in the following topology diagram.
+

Which XGS devices will block a Cross Site Scripting (XSS) attack coming from an SSL enabled public web site on the Internet to the internal network?
A. XGS2 in monitoring mode using TCP RST
B. XGS1 in protection mode
C. XGS3 in protection mode
D. XGS4 in monitoring mode using TCP RST
正解：C