Fortinet Fortinet Certifications NSE4-5.4 Questions & Answers

• Question 411:

  Which of the following statements are correct regarding the configuration of a FortiGate unit as an SSL VPN gateway? (Select all that apply.)

  A. Tunnel mode can only be used if the SSL VPN user groups have at least one Host Check option enabled.

  B. The specific routes needed to access internal resources through an SSL VPN connection in tunnel mode from the client computer are defined in the routing widget associated with the SSL VPN portal.

  C. In order to apply a portal to a user, that user must belong to an SSL VPN user group.

  D. The portal settings specify whether the connection will operate in web-only or tunnel mode.

  Correct Answer: CD

• Question 412:

  If Open Shortest Path First (OSPF) has already been configured on a FortiGate unit, which of the following statements is correct if the routes learned through OSPF need to be announced by Border Gateway Protocol (BGP)?

  A. The FortiGate unit will automatically announce all routes learned through OSPF to its BGP peers if the FortiGate unit is configured as an OSPF Autonomous System Boundary Router (ASBR).

  B. The FortiGate unit will automatically announce all routes learned through OSPF to its BGP peers if the FortiGate unit is configured as an OSPF Area Border Router (ABR).

  C. At a minimum, the network administrator needs to enable Redistribute OSPF in the BGP settings.

  D. The BGP local AS number must be the same as the OSPF area number of the routes learned that need to be redistributed into BGP.

  E. By design, BGP cannot redistribute routes learned through OSPF.

  Correct Answer: C

• Question 413:

  Which of the following cannot be used in conjunction with the endpoint compliance check?

  A. HTTP Challenge Redirect to a Secure Channel (HTTPS) in the Authentication Settings.

  B. Any form of firewall policy authentication.

  C. WAN optimization.

  D. Traffic shaping.

  Correct Answer: A

• Question 414:

  An administrator configures a VPN and selects the Enable IPSec Interface Mode option in the phase 1 settings. Which of the following statements are correct regarding the IPSec VPN configuration?

  A. To complete the VPN configuration, the administrator must manually create a virtual IPSec interface in Web Config under System > Network.

  B. The virtual IPSec interface is automatically created after the phase1 configuration.

  C. The IPSec policies must be placed at the top of the list.

  D. This VPN cannot be used as part of a hub and spoke topology.

  E. Routes were automatically created based on the address objects in the firewall policies.

  Correct Answer: B

• Question 415:

  Which of the following items are considered to be advantages of using the application control features on the FortiGate unit? Application control allows an administrator to:

  A. set a unique session-ttl for select applications.

  B. customize application types in a similar way to adding custom IPS signatures.

  C. check which applications are installed on workstations attempting to access the network.

  D. enable AV scanning per application rather than per policy.

  Correct Answer: A

• Question 416:

  Which of the following DLP actions will always be performed if it is selected?

  A. Archive

  B. Quarantine Interface

  C. Ban Sender

  D. Block

  E. None

  F. Ban

  G. Quarantine IP Address

  Correct Answer: A

• Question 417:

  A FortiGate administrator configures a Virtual Domain (VDOM) for a new customer. After creating the VDOM, the administrator is unable to reassign the dmz interface to the new VDOM as the option is greyed out in Web Config in the

  management VDOM.

  What would be a possible cause for this problem?

  A. The dmz interface is referenced in the configuration of another VDOM.

  B. The administrator does not have the proper permissions to reassign the dmz interface.

  C. Non-management VDOMs can not reference physical interfaces.

  D. The dmz interface is in PPPoE or DHCP mode.

  E. Reassigning an interface to a different VDOM can only be done through the CLI.

  Correct Answer: A

• Question 418:

  In order to load-share traffic using multiple static routes, the routes must be configured with ...

  A. the same distance and same priority.

  B. the same distance and the same weight.

  C. the same distance but each of them must be assigned a unique priority.

  D. a distance equal to its desired weight for ECMP but all must have the same priority.

  Correct Answer: A

• Question 419:

  Which of the following statements is correct about how the FortiGate unit verifies username and password during user authentication?

  A. If a remote server is included in a user group, it will be checked before local accounts.

  B. An administrator can define a local account for which the password must be verified by querying a remote server.

  C. If authentication fails with a local password, the FortiGate unit will query the authentication server if the local user is configured with both a local password and an authentication server.

  D. The FortiGate unit will only attempt to authenticate against Active Directory if Fortinet Server Authentication Extensions are installed and configured.

  Correct Answer: B

• Question 420:

  SSL Proxy is used to decrypt the SSL-encrypted traffic. After decryption, where is the traffic buffered in preparation for content inspection?

  A. The file is buffered by the application proxy.

  B. The file is buffered by the SSL proxy.

  C. In the upload direction, the file is buffered by the SSL proxy. In the download direction, the file is buffered by the application proxy.

  D. No file buffering is needed since a stream-based scanning approach is used for SSL content inspection.

  Correct Answer: A