Fortinet Fortinet Certifications NSE4-5.4 Questions & Answers

• Question 71:

  View the exhibit.

  

  The client cannot connect to the HTTP web server. The administrator run the FortiGate built-in sniffer and got the following output:

  

  What should be done next to troubleshoot the problem?

  A. Execute another sniffer in the FortiGate, this time with the filter "host 10.0.1.10".

  B. Run a sniffer in the web server.

  C. Capture the traffic using an external sniffer connected to port1.

  D. Execute a debug flow.

  Correct Answer: B

• Question 72:

  View the exhibit.

  

  A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting.Games). Based on this configuration, which statement is true?

  A. Addicting.Games is allowed based on the Application Overrides configuration.

  B. Addicting.Games is blocked based on the Filter Overrides configuration.

  C. Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.

  D. Addicting.Games is allowed based on the Categories configuration.

  Correct Answer: A

• Question 73:

  An administrator has configured two VLAN interfaces: A DHCP server is connected to the VLAN10 interface. A DHCP client is connected to the VLAN5 interface. However, the DHCP client cannot get a dynamic IP address from the DHCP server. What is the cause of the problem?

  

  A. Both interfaces must be in different VDOMs

  B. Both interfaces must have the same VLAN ID.

  C. The role of the VLAN10 interface must be set to server.

  D. Both interfaces must belong to the same forward domain.

  Correct Answer: D

• Question 74:

  An administrator needs to inspect all web traffic (including Internet web traffic) coming from users connecting to SSL VPN. How can this be achieved?

  A. Disabling split tunneling

  B. Configuring web bookmarks

  C. Assigning public IP addresses to SSL VPN clients

  D. Using web-only mode

  Correct Answer: A

• Question 75:

  Which traffic inspection features can be executed by a security processor (SP)? (Choose three.)

  A. TCP SYN proxy

  B. SIP session helper

  C. Proxy-based antivirus

  D. Attack signature matching

  E. Flow-based web filtering

  Correct Answer: CDE

• Question 76:

  View the exhibit.

  

  When Role is set to Undefined, which statement is true?

  A. The GUI provides all the configuration options available for the port1 interface.

  B. You cannot configure a static IP address for the port1 interface because it allows only DHCP addressing mode.

  C. Firewall policies can be created from only the port1 interface to any interface.

  D. The port1 interface is reserved for management only.

  Correct Answer: A

• Question 77:

  Which statement is true regarding the policy ID numbers of firewall policies?

  A. Change when firewall policies are re-ordered.

  B. Defines the order in which rules are processed.

  C. Are required to modify a firewall policy from the CLI.

  D. Represent the number of objects used in the firewall policy.

  Correct Answer: C

• Question 78:

  Examine the routing database.

  

  Which of the following statements are correct? (Choose two.)

  A. The port3 default route has the lowest metric, making it the best route.

  B. There will be eight routes active in the routing table.

  C. The port3 default has a higher distance than the port1 and port2 default routes.

  D. Both port1 and port2 default routers are active in the routing table.

  Correct Answer: CD

• Question 79:

  View the exhibit.

  

  When a user attempts to connect to an HTTPS site, what is the expected result with this configuration?

  A. The user is required to authenticate before accessing sites with untrusted SSL certificates.

  B. The user is presented with certificate warnings when connecting to sites that have untrusted SSL certificates.

  C. The user is allowed access all sites with untrusted SSL certificates, without certificate warnings.

  D. The user is blocked from connecting to sites that have untrusted SSL certificates (no exception provided).

  Correct Answer: B

• Question 80:

  A company needs to provide SSL VPN access to two user groups. The company also needs to display different welcome messages on the SSL VPN login screen for both user groups.

  What is required in the SSL VPN configuration to meet these requirements?

  A. Two separated SSL VPNs in different interfaces of the same VDOM

  B. Different SSL VPN realms for each group

  C. Different virtual SSLVPN IP addresses for each group

  D. Two firewall policies with different captive portals

  Correct Answer: B