Fortinet Fortinet Certifications NSE4_FGT-5.6 Questions & Answers

• Question 91:

  Which statements about IP-based explicit proxy authentication are true?

  (Choose two.)

  Response:

  A. IP-based authentication is best suited to authenticating users behind a NAT device.

  B. Sessions from the same source address are treated as a single user.

  C. IP-based authentication consumes less FortiGate's memory than session-based authentication.

  D. FortiGate remembers authenticated sessions using browser cookies.

  Correct Answer: BC

• Question 92:

  Why must you use aggressive mode when a local FortiGate IPsec gateway hosts multiple dialup tunnels? Response:

  A. The FortiGate is able to handle NATed connections only with aggressive mode.

  B. FortiClient supports aggressive mode.

  C. The remote peers are able to provide their peer IDs in the first message with aggressive mode.

  D. Main mode does not support XAuth for user authentication.

  Correct Answer: C

• Question 93:

  How does FortiGate select the central SNAT policy that is applied to a TCP session? Response:

  A. It selects the SNAT policy specified in the configuration of the outgoing interface.

  B. It selects the first matching central-SNAT policy from top to bottom.

  C. It selects the central-SNAT policy with the lowest priority.

  D. It selects the SNAT policy specified in the configuration of the firewall policy that matches the traffic.

  Correct Answer: B

• Question 94:

  If antivirus, grayware, and heuristic scans are enabled on FortiGate, in which order does FortiGate apply the scanning?

  Response:

  A. heuristics -> grayware -> antivirus

  B. antivirus -> grayware -> heuristics

  C. antivirus -> heuristics -> grayware

  D. grayware -> antivirus -> heuristics

  Correct Answer: B

• Question 95:

  You've enabled disk logging and configured the firewall policy as illustrated in the exhibit.

  

  What is FortiGate's logging behavior with this configuration?

  (Choose two.)

  Response:

  A. A forward traffic log generates for every single session.

  B. A forward traffic log generates for packets causing a security event.

  C. Security log events appear in the forward traffic log and security log

  D. No forward traffic or security logs will appear.

  Correct Answer: AC

• Question 96:

  An administrator has configured central DNAT and Virtual IPs. Which of the following can be selected in the

  firewall policy Destination Address field?

  (Choose two.)

  Response:

  A. VIP object

  B. Mapped IP address object of the VIP

  C. Address object all

  D. IP pool

  Correct Answer: BC

• Question 97:

  View the exhibit.

  

  Which statements about the exhibit are true?

  (Choose two.)

  Response:

  A. port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.

  B. port1-VLAN1 is the native VLAN for the port1 physical interface.

  C. Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.

  D. Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.

  Correct Answer: AD

• Question 98:

  Which of the following configuration settings are global settings?

  (Choose two.)

  Response:

  A. FortiGuard settings

  B. HA settings

  C. Firewall policies

  D. Security profiles

  Correct Answer: AB

• Question 99:

  Examine this partial output from the diagnose sys session list CLI command:

  diagnose sys session list

  session info: proto=6 proto_state=05 duration=2 expire=78 timeout=3600 flags=00000000

  sockflag=00000000 sockport=0 av_idx=0 use=3

  What does this output state?

  Response:

  A. proto_state=05 is the ICMP state

  B. proto_state=05 is the UDP state

  C. proto_state=05 is the TCP state

  D. proto_state=05 means there is only one-way traffic

  Correct Answer: C

• Question 100:

  Which traffic inspection features can be executed by a security processor (SP)?

  (Choose three.)

  Response:

  A. TCP SYN proxy

  B. SIP session helper

  C. Proxy-based antivirus

  D. Attack signature matching

  E. Flow-based web filtering

  Correct Answer: ADE