Fortinet Fortinet Certifications NSE4 Questions & Answers

• Question 71:

  When firewall policy authentication is enabled, which protocols can trigger an authentication challenge? (Choose two.)

  A. SMTP

  B. POP3

  C. HTTP

  D. FTP

  Correct Answer: CD

• Question 72:

  What information is synchronized between two FortiGate units that belong to the same HA cluster? (Choose three)

  A. IP addresses assigned to DHCP enabled interface.

  B. The master devices hostname.

  C. Routing configured and state.

  D. Reserved HA management interface IP configuration.

  E. Firewall policies and objects.

  Correct Answer: ACE

• Question 73:

  Which of the following FSSO agents are required for a DC agent mode solution? (Choose two.)

  A. FSSO agent

  B. DC agent

  C. Collector agent

  D. Radius server

  Correct Answer: BC

• Question 74:

  Where are most of the security events logged?

  A. Security log

  B. Forward Traffic log

  C. Event log

  D. Alert log

  E. Alert Monitoring Console

  Correct Answer: C

• Question 75:

  In an IPSec gateway-to-gateway configuration, two FortiGate units create a VPN tunnel between two separate private networks. Which of the following configuration steps must be performed on both FortiGate units to support this configuration?

  A. Create firewall policies to control traffic between the IP source and destination address.

  B. Configure the appropriate user groups on the FortiGate units to allow users access to the IPSec VPN connection.

  C. Set the operating mode of the FortiGate unit to IPSec VPN mode.

  D. Define the Phase 2 parameters that the FortiGate unit needs to create a VPN tunnel with the remote peer.

  E. Define the Phase 1 parameters that the FortiGate unit needs to authenticate the remote peers.

  Correct Answer: ADE

• Question 76:

  In "diag debug flow" output, you see the message "Allowed by Policy-1: SNAT". Which is true?

  A. The packet matched the topmost policy in the list of firewall policies.

  B. The packet matched the firewall policy whose policy ID is 1.

  C. The packet matched a firewall policy, which allows the packet and skips UTM checks

  D. The policy allowed the packet and applied session NAT.

  Correct Answer: B

• Question 77:

  Which define device identification? (Choose two.)

  A. Device identification is enabled by default on all interfaces.

  B. Enabling a source device in a firewall policy enables device identification on the source interfaces of that policy.

  C. You cannot combine source user and source device in the same firewall policy.

  D. FortiClient can be used as an agent based device identification technique.

  E. Only agentless device identification techniques are supported.

  Correct Answer: BD

• Question 78:

  Which statements are true regarding the use of a PAC file to configure the web proxy settings in an Internet browser? (Choose two.)

  A. Only one proxy is supported.

  B. Can be manually imported to the browser.

  C. The browser can automatically download it from a web server.

  D. Can include a list of destination IP subnets where the browser can connect directly to without using a proxy.

  Correct Answer: CD

• Question 79:

  Which of the following traffic shaping functions can be offloaded to a NP processor? (Choose two.)

  A. Que prioritization

  B. Traffic cap (bandwidth limit)

  C. Differentiated services field rewriting

  D. Guarantee bandwidth

  Correct Answer: CD

• Question 80:

  Which is the following statement are true regarding application control? (choose two)

  A. Application control is based on TCP destination port numbers.

  B. Application control is proxy based.

  C. Encrypted traffic can be identified by application control.

  D. Traffic Shaping can be applied to the detected application traffic.

  Correct Answer: CD