Fortinet NSE4-5.4 Online Practice Questions and Exam Preparation

Fortinet NSE4-5.4 Online Questions & Answers

• Question 141:

  Which of the following statements correctly describes the deepscan option for HTTPS?

  A. When deepscan is disabled, only the web server certificate is inspected; no decryption of content occurs.
  B. Enabling deepscan will perform further checks on the server certificate.
  C. Deepscan is only applicable to mail protocols, where all IP addresses in the header are checked.
  D. With deepscan enabled, archived files will be decompressed before scanning for a more comprehensive file inspection.
  A. When deepscan is disabled, only the web server certificate is inspected; no decryption of content occurs.

• Question 142:

  What are valid options for handling DNS requests sent directly to a FortiGates interface IP? (Choose three.)

  A. Conditional-forward.
  B. Forward-only.
  C. Non-recursive.
  D. Iterative.
  E. Recursive.
  B. Forward-only.
  C. Non-recursive.
  E. Recursive.

• Question 143:

  Which condition must be met to offload the encryption and decryption of IPsec traffic to an NP6 processor?

  A. Phase 2 must use an encryption algorithm supported by the NP6.
  B. Anti-replay must be disabled.
  C. IPsec traffic must not be inspected by a session helper.
  D. No content inspection can be applied to traffic that is going to be encrypted.
  A. Phase 2 must use an encryption algorithm supported by the NP6.

• Question 144:

  Which of the following spam filtering methods are supported on the FortiGate unit? (Select all that apply.)

  A. IP Address Check
  B. Open Relay Database List (ORDBL)
  C. Black/White List
  D. Return Email DNS Check
  E. Email Checksum Check
  A. IP Address Check
  B. Open Relay Database List (ORDBL)
  C. Black/White List
  D. Return Email DNS Check
  E. Email Checksum Check

• Question 145:

  Files reported as "suspicious" were subject to which Antivirus check"?

  A. Grayware
  B. Virus
  C. Sandbox
  D. Heuristic
  D. Heuristic

• Question 146:

  Which authentication scheme is not supported by the RADIUS implementation on FortiGate?

  A. CHAP
  B. MSCHAP2
  C. PAP
  D. FSSO
  D. FSSO

• Question 147:

  Why must you use aggressive mode when a local FortiGate IPsec gateway hosts multiple dialup tunnels?

  A. The FortiGate is able to handle NATed connections only with aggressive mode.
  B. FortiClient supports aggressive mode.
  C. The remote peers are able to provide their peer IDs in the first message with aggressive mode.
  D. Main mode does not support XAuth for user authentication.
  C. The remote peers are able to provide their peer IDs in the first message with aggressive mode.

• Question 148:

  Which profile could IPS engine use on an interface that is in sniffer mode? (Choose three)

  A. Antivirus (flow based
  B. Web filtering (PROXY BASED)
  C. Intrusion Protection
  D. Application Control
  E. Endpoint control
  A. Antivirus (flow based
  B. Web filtering (PROXY BASED)
  D. Application Control

• Question 149:

  What is not true of configuring disclaimers on the FortiGate?

  A. Disclaimers can be used in conjunction with captive portal.
  B. Disclaimers appear before users authenticate.
  C. Disclaimers can be bypassed through security exemption lists.
  D. Disclaimers must be accepted in order to continue to the authentication login or originally intended destination.
  C. Disclaimers can be bypassed through security exemption lists.

• Question 150:

  A network administrator needs to implement dynamic route redundancy between a FortiGate unit located in a remote office and a FortiGate unit located in the central office.

  The remote office accesses central resources using IPSec VPN tunnels through two different Internet providers.

  What is the best method for allowing the remote office access to the resources through the FortiGate unit used at the central office?

  A. Use two or more route-based IPSec VPN tunnels and enable OSPF on the IPSec virtual interfaces.
  B. Use two or more policy-based IPSec VPN tunnels and enable OSPF on the IPSec virtual interfaces.
  C. Use route-based VPNs on the central office FortiGate unit to advertise routes with a dynamic routing protocol and use a policy-based VPN on the remote office with two or more static default routes.
  D. Dynamic routing protocols cannot be used over IPSec VPN tunnels.
  A. Use two or more route-based IPSec VPN tunnels and enable OSPF on the IPSec virtual interfaces.