Fortinet NSE4_FGT-5.6 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-5.6 Online Questions & Answers

• Question 91:

  View the exhibit.

  

  The client cannot connect to the HTTP web server. The administrator run the FortiGate built-in sniffer and got the following output:

  What should be done next to troubleshoot the problem?

  Response:

  A. Execute another sniffer in the FortiGate, this time with the filter "host 10.0.1.10".
  B. Run a sniffer in the web server.
  C. Capture the traffic using an external sniffer connected to port1.
  D. Execute a debug flow.
  D. Execute a debug flow.

• Question 92:

  When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request? Response:

  A. The FortiGate unit's public IP address
  B. The FortiGate unit's internal IP address
  C. The remote user's virtual IP address
  D. The remote user's public IP address
  B. The FortiGate unit's internal IP address

• Question 93:

  Examine the exhibit, which shows a FortiGate device with two VDOMs: VDOM1 and VDOM2. Both VDOMs are operating in NAT/route mode. The subnet 10.0.1.0/24 is connected to VDOM1. The subnet 10.0.2.0/24 is connected to VDOM2. There is an inter-VDOM link between VDOM1 and VDOM2.

  

  What is required in the FortiGate configuration to route traffic between both subnets through an inter-VDOM link? Response:

  A. A firewall policy in VDOM1 to allow the traffic from 10.0.1.0/24 to 10.0.2.0/24 with port1 as the source interface and port2 as the destination interface.
  B. A static route in VDOM1 for the destination subnet of 10.0.1.0/24.
  C. A static route in VDOM2 with the destination subnet matching the subnet assigned to the inter-VDOM link.
  D. A static route in VDOM2 for the destination subnet 10.0.1.0/24.
  D. A static route in VDOM2 for the destination subnet 10.0.1.0/24.

• Question 94:

  A FortiGate has multiple VDOMs operating in NAT mode with multiple VLAN interfaces in each VDOM. Which of the following statements is true regarding the IP addresses assigned to each VLAN interface? Response:

  A. Different VLANs can never share the same IP address on the same physical device.
  B. Different VLANs can share the same IP address as long as they are in different VDOMs.
  C. Different VLANs can share the same IP address as long as they have different VLAN tag IDs.
  D. Different VLANs can share the same IP address as long as they are in different physical interfaces.
  B. Different VLANs can share the same IP address as long as they are in different VDOMs.

• Question 95:

  Which actions can be configured in an application control profile?

  (Choose three.)

  Response:

  A. Monitor
  B. Block
  C. Warning
  D. Authenticate
  E. Quarantine
  A. Monitor
  B. Block
  E. Quarantine

• Question 96:

  Which statements are true regarding active authentication?

  (Choose two.)

  Response:

  A. Active authentication prompts the user for login credentials.
  B. Active authentication is always used before passive authentication.
  C. The firewall policy must allow the HTTP, HTTPS, FTP, and/or Telnet protocols.
  D. Enabling authentication on a policy always enforces active authentication.
  A. Active authentication prompts the user for login credentials.
  C. The firewall policy must allow the HTTP, HTTPS, FTP, and/or Telnet protocols.

• Question 97:

  Which statements are true of public key infrastracture (PKI) users on FortiGate?

  (Choose two.)

  Response:

  A. FortiGate must include the CA certificate that issued the PKI peer user certificate.
  B. PKI users can belong to firewall user groups.
  C. PKI users must authenticate with both a certificate and a password.
  D. The first PKI user must be added to FortiGate through the GUI.
  A. FortiGate must include the CA certificate that issued the PKI peer user certificate.
  B. PKI users can belong to firewall user groups.

• Question 98:

  View the exhibit.

  

  Which statements about the exhibit are true?

  (Choose two.)

  Response:

  A. port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.
  B. port1-VLAN1 is the native VLAN for the port1 physical interface.
  C. Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.
  D. Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.
  A. port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.
  D. Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.

• Question 99:

  Examine this output from the diagnose sys top command:

  

  Which statements about the output are true?

  (Choose two.)

  Response:

  A. sshd is the process consuming most memory
  B. sshd is the process consuming most CPU
  C. All the processes listed are in sleeping state
  D. The sshd process is using 123 pages of memory
  B. sshd is the process consuming most CPU
  C. All the processes listed are in sleeping state

• Question 100:

  Which statements best describe auto discovery VPN (ADVPN).

  (Choose two.)

  Response:

  A. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
  B. ADVPN is only supported with IKEv2.
  C. Tunnels are negotiated dynamically between spokes.
  D. Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.
  A. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
  C. Tunnels are negotiated dynamically between spokes.