Fortinet Fortinet Certifications NSE4 Questions & Answers

• Question 21:

  Which statement is not correct regarding SSL VPN Tunnel mode?

  A. IP traffic is encapsulated over HTTPS.

  B. The standalone FortiClient SSL VPN client can be used to establish a Tunnel mode SSL VPN.

  C. A limited amount of IP applications are supported.

  D. The FortiGate device will dynamically assign an IP address to the SSL VPN network adapter.

  Correct Answer: C

• Question 22:

  Which of the following statements best describes the role of a DC agents in an FSSO DC?

  A. Captures the login events and forward them to the collector agent.

  B. Captures the user IP address and workstation name and forward that information to the FortiGate devices.

  C. Captures the login and logoff events and forward them to the collector agent.

  D. Captures the login events and forward them to the FortiGate devices.

  Correct Answer: C

• Question 23:

  Which statement best describes the objective of the SYN proxy feature available in SP processors?

  A. Accelerate the TCP 3-way handshake

  B. Collect statistics regarding traffic sessions

  C. Analyze the SYN packet to decide if the new session can be offloaded to the SP processor

  D. Protect against SYN flood attacks.

  Correct Answer: D

• Question 24:

  A FortiGate unit has multiple VDOMs in NAT/route mode with multiple VLAN interfaces in each VDOM. Which of the following statements is correct regarding the IP addresses assigned to each VLAN interface?

  A. Different VLANs can share the same IP address as long as they have different VLAN IDs.

  B. Different VLANs can share the same IP address as long as they are in different physical interface.

  C. Different VLANs can share the same IP address as long as they are in different VDOMs.

  D. Different VLANs can never share the same IP addresses.

  Correct Answer: C

• Question 25:

  You are creating a custom signature. Which has incorrect syntax?

  A. F-SBID(--attack_id 1842,--name "Ping.Death";--protocol icmp; --data_size>32000;)

  B. F-SBID(--name "Block.SMTP.VRFY.CMD";--pattern "vrfy";-- service SMTP; --no_case;-- context header;)

  C. F-SBID(--name "Ping.Death";--protocol icmp;--data_size>32000;)

  D. F-SBID(--name "Block".HTTP.POST"; --protocol tcp;-- service HTTP;-- flow from_client; --pattern "POST"; -- context uri;--within 5,context;)

  Correct Answer: A

• Question 26:

  Which statement best describes what SSL VPN Client Integrity Check does?

  A. Blocks SSL VPN connection attempts from users that has been blacklisted.

  B. Detects the Windows client security applications running in the SSL VPN client's PCs.

  C. Validates the SSL VPN user credential.

  D. Verifies which SSL VPN portal must be presented to each SSL VPN user.

  E. Verifies that the latest SSL VPN client is installed in the client's PC.

  Correct Answer: B

• Question 27:

  Which best describes the mechanism of a TCP SYN flood?

  A. The attackers keeps open many connections with slow data transmission so that other clients cannot start new connections.

  B. The attackers sends a packets designed to sync with the FortiGate

  C. The attacker sends a specially crafted malformed packet, intended to crash the target by exploiting its parser.

  D. The attacker starts many connections, but never acknowledges to fully form them.

  Correct Answer: D

• Question 28:

  What protocol cannot be used with the active authentication type?

  A. Local

  B. RADIUS

  C. LDAP

  D. RSSO

  Correct Answer: D

• Question 29:

  A client can establish a secure connection to a corporate network using SSL VPN in tunnel mode. Which of the following statements are correct regarding the use of tunnel mode SSL VPN? (Select all that apply.)

  A. Split tunneling can be enabled when using tunnel mode SSL VPN.

  B. Client software is required to be able to use a tunnel mode SSL VPN.

  C. Users attempting to create a tunnel mode SSL VPN connection must be authenticated by at least one SSL VPN policy.

  D. The source IP address used by the client for the tunnel mode SSL VPN is assigned by the FortiGate unit.

  Correct Answer: ABCD

• Question 30:

  How do you configure a FortiGate to apply traffic shaping to P2P traffic, such as BitTorrent?

  A. Apply a traffic shaper to a BitTorrent entry in an application control list, which is then applied to a firewall policy.

  B. Enable the shape option in a firewall policy with service set to BitTorrent.

  C. Define a DLP rule to match against BitTorrent traffic and include the rule in a DLP sensor with traffic shaping enabled.

  D. Apply a traffic shaper to a protocol options profile.

  Correct Answer: A