Fortinet Fortinet Certifications NSE4-5.4 Questions & Answers

• Question 101:

  In which order are firewall policies processed on a FortiGate unit?

  A. From top to down, according with their sequence number.

  B. From top to down, according with their policy ID number.

  C. Based on best match.

  D. Based on the priority value.

  Correct Answer: A

• Question 102:

  Which statements are true regarding local user authentication? (Choose two.)

  A. Two-factor authentication can be enabled on a per user basis.

  B. Local users are for administration accounts only and cannot be used to authenticate network users.

  C. Administrators can create the user accounts is a remote server and store the user passwords locally in the FortiGate.

  D. Both the usernames and passwords can be stored locally on the FortiGate

  Correct Answer: AD

• Question 103:

  A FortiGate interface is configured with the following commands:

  

  What statements about the configuration are correct? (Choose two.)

  A. IPv6 clients connected to port1 can use SLAAC to generate their IPv6 addresses.

  B. FortiGate can provide DNS settings to IPv6 clients.

  C. FortiGate can send IPv6 router advertisements (RAs.)

  D. FortiGate can provide IPv6 addresses to DHCPv6 client.

  Correct Answer: AC

• Question 104:

  Which of the following Fortinet hardware accelerators can be used to offload flow-based antivirus inspection? (Choose two.)

  A. SP3

  B. CP8

  C. NP4

  D. NP6

  Correct Answer: AB

• Question 105:

  Under what circumstance would you enable LEARN as the Action on a firewall policy?

  A. You want FortiGate to compile security feature activity from various security-related logs, such as virus and attack logs.

  B. You want FortiGate to monitor a specific security profile in a firewall policy, and provide recommendations for that profile.

  C. You want to capture data across all traffic and security vectors, and receive learning logs and a report with recommendations.

  D. You want FortiGate to automatically modify your firewall policies as it learns your networking behavior.

  Correct Answer: C

• Question 106:

  What methods can be used to deliver the token code to a user who is configured to use two-factor authentication? (Choose three.)

  A. Code blocks

  B. SMS phone message

  C. FortiToken

  D. Browser pop-up window

  E. Email

  Correct Answer: BCE

• Question 107:

  You are tasked to architect a new IPsec deployment with the following criteria:

  -There are two HQ sites that all satellite offices must connect to.

  -The satellite offices do not need to communicate directly with other satellite offices.

  -No dynamic routing will be used.

  -The design should minimize the number of tunnels being configured.

  Which topology should be used to satisfy all of the requirements?

  A. Redundant

  B. Hub-and-spoke

  C. Partial mesh

  D. Fully meshed

  Correct Answer: B

• Question 108:

  What is the maximum number of FortiAnalyzer/FortiManager devices a FortiGate unit can be configured to send logs to?

  A. 1

  B. 2

  C. 3

  D. 4

  Correct Answer: C

• Question 109:

  Regarding the header and body sections in raw log messages, which statement is correct?

  A. The header and body section layouts change depending on the log type.

  B. The header section layout is always the same regardless of the log type. The body section layout changes depending on the log type.

  C. Some log types include multiple body sections.

  D. Some log types do not include a body section.

  Correct Answer: B

• Question 110:

  In HA, the option Reserve Management Port for Cluster Member is selected as shown in the exhibit below.

  

  Which statements are correct regarding this setting? (Choose two.)

  A. Interface settings on port7 will not be synchronized with other cluster members.

  B. The IP address assigned to this interface must not overlap with the IP address subnet assigned to another interface.

  C. When connecting to port7 you always connect to the master device.

  D. A gateway address may be configured for port7.

  Correct Answer: AD