Fortinet NSE4-5.4 Online Practice Questions and Exam Preparation

Fortinet NSE4-5.4 Online Questions & Answers

• Question 421:

  Which of the following fields contained in the IP/TCP/UDP headers can be used to make a routing decision when using policy-based routing? (Choose three)

  A. Source IP address.
  B. TCP flags
  C. Source TCP/UDP ports
  D. Type of service.
  E. Checksum
  A. Source IP address.
  C. Source TCP/UDP ports
  D. Type of service.

• Question 422:

  Which statement best describes the objective of the SYN proxy feature available in SP processors?

  A. Accelerate the TCP 3-way handshake
  B. Collect statistics regarding traffic sessions
  C. Analyze the SYN packet to decide if the new session can be offloaded to the SP processor
  D. Protect against SYN flood attacks.
  D. Protect against SYN flood attacks.

• Question 423:

  Which of the following statements regarding Banned Words are correct? (Select all that apply.)

  A. The FortiGate unit can scan web pages and email messages for instances of banned words.
  B. When creating a banned word list, an administrator can indicate either specific words or patterns.
  C. Banned words can be expressed as wildcards or regular expressions.
  D. Content is automatically blocked if a single instance of a banned word appears.
  E. The FortiGate unit includes a pre-defined library of common banned words.
  A. The FortiGate unit can scan web pages and email messages for instances of banned words.
  B. When creating a banned word list, an administrator can indicate either specific words or patterns.
  C. Banned words can be expressed as wildcards or regular expressions.

• Question 424:

  An end user logs into the full-access SSL VPN portal and selects the Tunnel Mode option by clicking on the "Connect" button. The administrator has enabled split tunneling.

  

  Given that the user authenticates against the SSL VPN policy shown in the image below, which statement below identifies the route that is added to the client's routing table.

  A. A route to destination matching the `WIN2K3' address object.
  B. A route to the destination matching the `all' address object.
  C. A default route.
  D. No route is added.
  A. A route to destination matching the `WIN2K3' address object.

• Question 425:

  Which of the following statements best describes what a Public Certificate Authority (CA) is?

  A. A service that provides a digital certificate each time a user is authenticating
  B. An entity that certifies that the information contained in a digital certificate is valid and true.
  C. The FortiGate process in charge of generating digital certificates on the fly for SSL inspection purposes D. A service that validates digital certificates for certificate-based authentication purposes
  D

• Question 426:

  Which of the following is true regarding Switch Port Mode?

  A. Allows all internal ports to share the same subnet.
  B. Provides separate routable interfaces for each internal port.
  C. An administrator can select ports to be used as a switch.
  D. Configures ports to be part of the same broadcast domain.
  A. Allows all internal ports to share the same subnet.

• Question 427:

  Which of the following statements are correct differences between NAT/route and transparent mode? (Choose two.)

  A. In transparent mode, interfaces do not have IP addresses.
  B. Firewall polices are only used in NAT/ route mode.
  C. Static routers are only used in NAT/route mode.
  D. Only transparent mode permits inline traffic inspection at layer 2.
  A. In transparent mode, interfaces do not have IP addresses.
  C. Static routers are only used in NAT/route mode.

• Question 428:

  Your Linux email server runs on a non-standard port number, port 2525. Which statement is true?

  A. IPS cannot scan that traffic for SMTP anomalies because of the non-standard port number. You must reconfigure the server to run on port 2.
  B. To apply IPS to traffic to that server, you must configure FortiGate SMTP proxy to listen on port 2525
  C. IPS will apply all SMTP signatures, regardless of whether they apply to clients or servers.
  D. Protocol decoders automatically detect SMTP and scan for matches with appropriate IPS signature.
  B. To apply IPS to traffic to that server, you must configure FortiGate SMTP proxy to listen on port 2525

• Question 429:

  Shown below is a section of output from the debug command diag ip arp list.

  

  In the output provided, which of the following best describes the IP address 172.20.187.150?

  A. It is the primary IP address of the port1 interface.
  B. It is one of the secondary IP addresses of the port1 interface.
  C. It is the IP address of another network device located in the same LAN segment as the FortiGate unit's port1 interface.
  C. It is the IP address of another network device located in the same LAN segment as the FortiGate unit's port1 interface.

• Question 430:

  An administrator needs to offload logging to FortiAnalyzer from a FortiGate with an internal hard drive. Which statements are true? (Choose two.)

  A. Logs must be stored on FortiGate first, before transmitting to FortiAnalyzer
  B. FortiGate uses port 8080 for log transmission
  C. Log messages are transmitted as plain text in LZ4 compressed format (store-and-upload method).
  D. FortiGate can encrypt communications using SSL encrypted OFTP traffic.
  A. Logs must be stored on FortiGate first, before transmitting to FortiAnalyzer
  C. Log messages are transmitted as plain text in LZ4 compressed format (store-and-upload method).