Exam NSE7_EFW-7.0 topic 1 question 34 discussion

Actual exam question from Fortinet's NSE7_EFW-7.0

Question #: 34
Topic #: 1

Which action will FortiGate take when using the default settings for SSL certificate inspection, where the server name indication (SNI) does not match either the common name (CN) or any of the subject altemative names (SAN) in the server certificate?

A. FortiGate uses the CN information from the Subject field in the server certificate.
B. FortiGate uses the first entry listed in the SAN field in the server certificate.
C. FortiGate uses the SNI from the user's web browser.
D. FortiGate closes the connection because this represents an invalid SSL/TLS configuration.

Show Suggested Answer

Suggested Answer: A 🗳️

by MrMaxe at Jan. 11, 2023, 11:37 p.m.

Comments

Submit Cancel

LiliRose

Highly Voted 1 year, 5 months ago

Answer: A #Config firewall ssl-ssh-profile edit <profile_name> config https set sni-server-cert-check [enable* | strict | disable] Enable: If the SNI does NOT match the CN or SAN fields in the returned server's certificate, FG uses the CN field instead of the SNI to obtain the FQDN. Strict: If the SNI does NOT match the CN or SAN fields in the returned server's certificate, FG closes the connection. Disable: FG does not check the SNI.

upvoted 8 times

...