Fortinet Fortinet Certifications NSE4-5.4 Questions & Answers

• Question 321:

  Which statement is not correct regarding SSL VPN Tunnel mode?

  A. IP traffic is encapsulated over HTTPS.

  B. The standalone FortiClient SSL VPN client can be used to establish a Tunnel mode SSL VPN.

  C. A limited amount of IP applications are supported.

  D. The FortiGate device will dynamically assign an IP address to the SSL VPN network adapter.

  Correct Answer: C

• Question 322:

  When configuring LDAP on the FortiGate as a remote database for users, what is not a part of the configuration?

  A. The name of the attribute that identifies each user (Common Name Identifier).

  B. The user account or group element names (user DN).

  C. The server secret to allow for remote queries (Primary server secret).

  D. The credentials for an LDAP administrator (password).

  Correct Answer: C

• Question 323:

  Which of the following statements best describes what a Public Certificate Authority (CA) is?

  A. A service that provides a digital certificate each time a user is authenticating

  B. An entity that certifies that the information contained in a digital certificate is valid and true.

  C. The FortiGate process in charge of generating digital certificates on the fly for SSL inspection purposes

  D. A service that validates digital certificates for certificate-based authentication purposes

  Correct Answer: D

• Question 324:

  What is the FortiGate password recovery process?

  A. Interrupt boot sequence, modify the boot registry and reboot. After changing the password, reset the boot registry.

  B. Log in through the console port using the ''maintainer'' account within several seconds of physically power cycling the FortiGate.

  C. Hold down the CTRL + Esc (Escape) keys during reboot, then reset the admin password.

  D. Interrupt the boot sequence and restore a configuration file for which the password has been modified.

  Correct Answer: B

• Question 325:

  Which of the following are benefits of using web caching? (Choose three.)

  A. Decrease bandwidth utilization

  B. Reduce server load

  C. Reduce FortiGate CPU usage

  D. Reduce FortiGate memory usage

  E. Decrease traffic delay

  Correct Answer: ABE

• Question 326:

  Which methods can FortiGate use to send a One Time Password (OTP) to Two-Factor Authentication users? (Choose three.)

  A. Hardware FortiToken

  B. Web Portal

  C. Email

  D. USB Token

  E. Software FortiToken (FortiToken mobile)

  Correct Answer: ACE

• Question 327:

  When an administrator attempts to manage FortiGate from an IP address that is not a trusted host, what happens?

  A. FortiGate will still subject that person's traffic to firewall policies; it will not bypass them.

  B. FortiGate will drop the packets and not respond.

  C. FortiGate responds with a block message, indicating that it will not allow that person to log in.

  D. FortiGate responds only if the administrator uses a secure protocol. Otherwise, it does not respond

  Correct Answer: B

• Question 328:

  Which of the following statements describes the objectives of the gratuitous ARP packets sent by an HA cluster?

  A. To synchronize the ARp tables in all the FortiGate Unis that are part of the HA cluster.

  B. To notify the network switches that a new HA master unit has been elected.

  C. To notify the master unit that the slave devices are still up and alive.

  D. To notify the master unit about the physical MAC addresses of the slave units.

  Correct Answer: B

• Question 329:

  How do application control signatures update on a FortiGate device?

  A. Through FortiGuard updates.

  B. Upgrade the FortiOS firmware to a newer release.

  C. By running the Application Control auto-learning feature.

  D. Signatures are hard coded to the device and cannot be updated.

  Correct Answer: A

• Question 330:

  In FortiOS session table output, what is the correct `proto_state' number for an established, non- proxied TCP connection?

  A. 00

  B. 11

  C. 01

  D. 05

  Correct Answer: C