Fortinet NSE4-5.4 Online Practice Questions and Exam Preparation

Fortinet NSE4-5.4 Online Questions & Answers

• Question 151:

  The FortiGate Web Config provides a link to update the firmware in the System > Status window.Clicking this link will perform which of the following actions?

  A. It will connect to the Fortinet support site where the appropriate firmware version can be selected.
  B. It will send a request to the FortiGuard Distribution Network so that the appropriate firmware version can be pushed down to the FortiGate unit.
  C. It will present a prompt to allow browsing to the location of the firmware file.
  D. It will automatically connect to the Fortinet support site to download the most recent firmware version for the FortiGate unit.
  C. It will present a prompt to allow browsing to the location of the firmware file.

• Question 152:

  If a FortiGate unit has a dmz interface IP address of 210.192.168.2 with a subnet mask of 255.255.255.0, what is a valid dmz DHCP addressing range?

  A. 172.168.0.1 - 172.168.0.10
  B. 210.192.168.3 - 210.192.168.10
  C. 210.192.168.1 - 210.192.168.4
  D. All of the above.
  B. 210.192.168.3 - 210.192.168.10

• Question 153:

  In order to match an identity-based policy, the FortiGate unit checks the IP information. Once inside the policy, the following logic is followed:

  A. First, a check is performed to determine if the user's login credentials are valid. Next, the user is checked to determine if they belong to any of the groups defined for that policy. Finally, user restrictions are determined and port, time, and UTM profiles are applied.
  B. First, user restrictions are determined and port, time, and UTM profiles are applied. Next, a check is performed to determine if the user's login credentials are valid. Finally, the user is checked to determine if they belong to any of the groups defined for that policy.
  C. First, the user is checked to determine if they belong to any of the groups defined for that policy. Next, user restrictions are determined and port, time, and UTM profiles are applied. Finally, a check is performed to determine if the user's login credentials are valid.
  A. First, a check is performed to determine if the user's login credentials are valid. Next, the user is checked to determine if they belong to any of the groups defined for that policy. Finally, user restrictions are determined and port, time, and UTM profiles are applied.

• Question 154:

  What action does an IPsec Gateway take with the user traffic routed to an IPsec VPN when it does not match any phase 2 quick mode selector?

  A. Traffic is dropped
  B. Traffic is routed across the default phase 2.
  C. Traffic is routed to the next available route in the routing table.
  D. Traffic is routed unencrypted to the interface where the IPsec VPN is terminating.
  A. Traffic is dropped

• Question 155:

  A FortiGate unit is configured with multiple VDOMs. An administrative account on the device has been assigned a Scope value of VDOM:root. Which of the following items would an administrator logging in using this account NOT be able to configure?

  A. Firewall addresses
  B. DHCP servers
  C. FortiGuard Distribution Network configuration
  D. PPTP VPN configuration
  C. FortiGuard Distribution Network configuration

• Question 156:

  Which of the following statements are true about the SSL Proxy certificate that must be used for SSL Content Inspection? (Choose two.)

  A. It cannot be signed by a private CA
  B. It must have either the field "CA=True" or the filed "Key Usage=KeyCertSign"
  C. It must be installed in the FortiGate device
  D. The subject filed must contain either the FQDN, or the IP address of the FortiGate device
  C. It must be installed in the FortiGate device
  D. The subject filed must contain either the FQDN, or the IP address of the FortiGate device

• Question 157:

  An administrator has configured a route-based site-to-site IPsec VPN. Which statement is correct regarding this IPsec VPN configuration?

  A. The IPsec firewall policies must be placed at the top of the list.
  B. This VPN cannot be used as part of a hub and spoke topology.
  C. Routes are automatically created based on the quick mode selectors.
  D. A virtual IPsec interface is automatically created after the Phase 1 configuration is completed.
  D. A virtual IPsec interface is automatically created after the Phase 1 configuration is completed.

• Question 158:

  Which one of the following statements is correct about raw log messages?

  A. Logs have a header and a body section. The header will have the same layout for every log message. The body section will change layout from one type of log message to another.
  B. Logs have a header and a body section. The header and body will change layout from one type of log message to another.
  C. Logs have a header and a body section. The header and body will have the same layout for every log message.
  A. Logs have a header and a body section. The header will have the same layout for every log message. The body section will change layout from one type of log message to another.

• Question 159:

  Which IPsec mode includes the peer id information in the first packet?

  A. Main mode.
  B. Quick mode.
  C. Aggressive mode.
  D. IKEv2 mode.
  C. Aggressive mode.

• Question 160:

  Which of the following options can you use to update the virus definitions on a FortiGate unit? (Select all that apply.)

  A. Push update.
  B. Scheduled update
  C. Manual update
  D. FTP update
  A. Push update.
  B. Scheduled update
  C. Manual update