Fortinet Fortinet Certifications NSE4-5.4 Questions & Answers

• Question 431:

  An administrator is examining the attack logs and notices the following entry:

  

  Based on the information displayed in this entry, which of the following statements are correct? (Select all that apply.)

  A. This is an HTTP server attack.

  B. The attack was detected and blocked by the FortiGate unit.

  C. The attack was against a FortiGate unit at the 192.168.1.100 IP address.

  D. The attack was detected and passed by the FortiGate unit.

  Correct Answer: CD

• Question 432:

  What advantages are there in using a hub-and-spoke IPSec VPN configuration instead of a fully- meshed set of IPSec tunnels? (Select all that apply.)

  A. Using a hub and spoke topology is required to achieve full redundancy.

  B. Using a hub and spoke topology simplifies configuration.

  C. Using a hub and spoke topology provides stronger encryption.

  D. Using a hub and spoke topology reduces the number of tunnels.

  Correct Answer: BD

• Question 433:

  In which of the following report templates would you configure the charts to be included in the report?

  A. Layout Template

  B. Data Filter Template

  C. Output Template

  D. Schedule Template

  Correct Answer: A

• Question 434:

  A DLP rule with an action of Exempt has been matched against traffic passing through the FortiGate unit. Which of the following statements is correct regarding how this transaction will be handled by the FortiGate unit?

  A. Any other matched DLP rules will be ignored with the exception of Archiving.

  B. Future files whose characteristics match this file will bypass DLP scanning.

  C. The traffic matching the DLP rule will bypass antivirus scanning.

  D. The client IP address will be added to a white list.

  Correct Answer: A

• Question 435:

  Review the CLI configuration below for an IPS sensor and identify the correct statements regarding this configuration from the choices below. (Select all that apply.)

  

  A. The sensor will log all server attacks for all operating systems.

  B. The sensor will include a PCAP file with a trace of the matching packets in the log message of any matched signature.

  C. The sensor will match all traffic from the address object `LINUX_SERVER'.

  D. The sensor will reset all connections that match these signatures.

  E. The sensor only filters which IPS signatures to apply to the selected firewall policy.

  Correct Answer: BE

• Question 436:

  In Transparent Mode, forward-domain is an attribute of _______.

  A. an interface

  B. a firewall policy

  C. a static route

  D. a virtual domain

  Correct Answer: A

• Question 437:

  With FSSO, a domain user could authenticate either against the domain controller running the Collector Agent and Domain Controller Agent, or a domain controller running only the Domain Controller Agent. If you attempt to authenticate with the Secondary Domain Controller running only the Domain Controller Agent, which of the following statements are correct? (Select all that apply.)

  A. The login event is sent to the Collector Agent.

  B. The FortiGate unit receives the user information from the Domain Controller Agent of the Secondary Controller.

  C. The Collector Agent performs the DNS lookup for the authenticated client's IP address.

  D. The user cannot be authenticated with the FortiGate device in this manner because each Domain Controller Agent requires a dedicated Collector Agent.

  Correct Answer: AC

• Question 438:

  The eicar test virus is put into a zip archive, which is given the password of "Fortinet" in order to open the archive. Review the configuration in the exhibits shown below; then answer the question that follows. Exhibit A - Antivirus Profile:

  

  Exhibit B - Non-default UTM Proxy Options Profile:

  

  Exhibit C - DLP Profile: Which of one the following profiles could be enabled in order to prevent the file from passing through the FortiGate device over HTTP on the standard port for that protocol?

  

  A. Only Exhibit A

  B. Only Exhibit B

  C. Only Exhibit C with default UTM Proxy settings.

  D. All of the Exhibits (A, B and C)

  E. Only Exhibit C with non-default UTM Proxy settings (Exhibit B).

  Correct Answer: C

• Question 439:

  What advantages are there in using a hub-and-spoke IPSec VPN configuration instead of a fully- meshed set of IPSec tunnels? (Select all that apply.)

  A. Using a hub and spoke topology is required to achieve full redundancy.

  B. Using a hub and spoke topology simplifies configuration because fewer tunnels are required.

  C. Using a hub and spoke topology provides stronger encryption.

  D. The routing at a spoke is simpler, compared to a meshed node.

  Correct Answer: BD

• Question 440:

  What are the requirements for a cluster to maintain TCP connections after device or link failover? (Select all that apply.)

  A. Enable session pick-up.

  B. Only applies to connections handled by a proxy.

  C. Only applies to UDP and ICMP connections.

  D. Connections must not be handled by a proxy.

  Correct Answer: AD