Fortinet Fortinet Certifications NSE4-5.4 Questions & Answers

• Question 501:

  Which of the following statements are correct differences between NAT/route and transparent mode? (Choose two.)

  A. In transparent mode, interfaces do not have IP addresses.

  B. Firewall polices are only used in NAT/ route mode.

  C. Static routers are only used in NAT/route mode.

  D. Only transparent mode permits inline traffic inspection at layer 2.

  Correct Answer: AC

• Question 502:

  Which statement best describes what SSL.root is?

  A. The name of the virtual network adapter required in each user's PC for SSL VPN Tunnel mode.

  B. The name of a virtual interface in the root VDOM where all the SSL VPN user traffic comes from.

  C. A Firewall Address object that contains the IP addresses assigned to SSL VPN users.

  D. The virtual interface in the root VDOM that the remote SSL VPN tunnels connect to.

  Correct Answer: B

• Question 503:

  The exhibit shows a part output of the diagnostic command 'diagnose debug application ike 255', taken during establishment of a VPN. Which of the following statement are correct concerning this output? (Choose two) A. The quick mode selectors negotiated between both IPsec VPN peers is 0.0.0.0/32 for both source and destination addresses.

  

  B. The output corresponds to a phase 2 negotiation

  C. NAT-T enabled and there is third device in the path performing NAT of the traffic between both IPsec VPN peers.

  D. The IP address of the remote IPsec VPN peer is 172.20.187.114

  Correct Answer: BD

• Question 504:

  Regarding the use of web-only mode SSL VPN, which statement is correct?

  A. It support SSL version 3 only.

  B. It requires a Fortinet-supplied plug-in on the web client.

  C. It requires the user to have a web browser that suppports 64-bit cipher length.

  D. The JAVA run-time environment must be installed on the client.

  Correct Answer: C

• Question 505:

  Which of the following network protocols can be inspected by the Data Leak Prevention scanning? (Choose three.)

  A. SMTP

  B. HTTP-POST

  C. AIM

  D. MAPI

  E. ICQ

  Correct Answer: ABD

• Question 506:

  Which of the following IPsec configuration modes can be used when the FortiGate is running in NAT mode?

  A. Policy-based VPN only

  B. Both policy-based and route-based VPN.

  C. Route-based VPN only.

  D. IPSec VPNs are not supported when the FortiGate is running in NAT mode.

  Correct Answer: B

• Question 507:

  You have configured the DHCP server on a FortiGate's port1 interface (or internal, depending on the model) to offer IPs in a range of 192.168.1.65-192.168.1.253.

  When the first host sends a DHCP request, what IP will the DHCP offer?

  A. 192.168.1.99

  B. 192.168.1.253

  C. 192.168.1.65

  D. 192.168.1.66

  Correct Answer: C

• Question 508:

  How many packets are interchanged between both IPSec ends during the negotiation of a main- mode phase 1?

  A. 5

  B. 3

  C. 2

  D. 6

  Correct Answer: D

• Question 509:

  Which is NOT true about the settings for an IP pool type port block allocation?

  A. A Block Size defines the number of connections.

  B. Blocks Per User defines the number of connection blocks for each user.

  C. An Internal IP Range defines the IP addresses permitted to use the pool.

  D. An External IP Range defines the IP addresses in the pool.

  Correct Answer: B

• Question 510:

  Which authentication methods does FortiGate support for firewall authentication? (Choose two.)

  A. Remote Authentication Dial in User Service (RADIUS)

  B. Lightweight Directory Access Protocol (LDAP)

  C. Local Password Authentication

  D. POP3

  E. Remote Password Authentication

  Correct Answer: AC