Fortinet NSE4_FGT-5.6 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-5.6 Online Questions & Answers

• Question 101:

  Which statement best describes the role of a DC agent in an FSSO DC agent mode solution? Response:

  A. Captures the logon events and forwards them to FortiGate.
  B. Captures the logon events and forwards them to the collector agent.
  C. Captures the logon and logoff events and forwards them to the collector agent.
  D. Captures the user IP address and workstation name and forwards them to FortiGate.
  B. Captures the logon events and forwards them to the collector agent.

• Question 102:

  An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that?

  (Choose three.) Response:

  A. The interface has been configured for one-arm sniffer.
  B. The interface is a member of a virtual wire pair.
  C. The operation mode is transparent.
  D. The interface is a member of a zone.
  E. Captive portal is enabled in the interface.
  A. The interface has been configured for one-arm sniffer.
  B. The interface is a member of a virtual wire pair.
  C. The operation mode is transparent.

• Question 103:

  Which of the following are differences between IPsec main mode and IPsec aggressive mode?

  (Choose two.)

  Response:

  A. Aggressive mode supports XAuth, while main mode does not.
  B. Six packets are usually exchanged during main mode, while only three packets are exchanged during aggressive mode.
  C. The first packet of aggressive mode contains the peer ID, while the first packet of main mode does not.
  D. Main mode cannot be used for dialup VPNs, while aggressive mode can.
  B. Six packets are usually exchanged during main mode, while only three packets are exchanged during aggressive mode.
  C. The first packet of aggressive mode contains the peer ID, while the first packet of main mode does not.

• Question 104:

  Which of the following configuration settings are global settings?

  (Choose two.)

  Response:

  A. FortiGuard settings
  B. HA settings
  C. Firewall policies
  D. Security profiles
  A. FortiGuard settings
  B. HA settings

• Question 105:

  Which of the following network settings can an IPsec gateway assign to an IPsec client using IP config mode?

  (Choose two.)

  Response:

  A. Quick mode selectors
  B. DNS IP address
  C. NAT-T
  D. IP address
  B. DNS IP address
  D. IP address

• Question 106:

  Under which circumstance is the IPsec ESP traffic encapsulated over UDP? Response:

  A. When using IKE version 2 (IKEv2)
  B. When the phase 1 is configured to use aggressive mode
  C. When the IPsec VPN is configured as dial-up
  D. When NAT-T detects there is a device between both IPsec peers doing NAT over the IPsec traffic
  D. When NAT-T detects there is a device between both IPsec peers doing NAT over the IPsec traffic

• Question 107:

  Which of the following are IP pool types supported by FortiGate?

  (Choose three.)

  Response:

  A. Overload
  B. One-to-One
  C. Transparent
  D. Outgoing interface
  E. Port block allocation
  A. Overload
  B. One-to-One
  C. Transparent

• Question 108:

  Which statement about the HA override setting in FortiGate HA clusters is true? Response:

  A. Configuring the HA override will reboot the FortiGate device.
  B. It synchronizes device priority on all cluster members.
  C. It is used to enable monitored ports.
  D. You must configure override settings manually and separately for each cluster member.
  D. You must configure override settings manually and separately for each cluster member.

• Question 109:

  Which of the following actions are available under the System Information widget for system configuration?

  (Choose two.)

  Response:

  A. Backup
  B. Upload
  C. Checkpoint
  D. Configuration Recovery
  E. Restore
  A. Backup
  B. Upload

• Question 110:

  Which statements about an IPv6-over-IPv4 IPsec configuration are correct?

  (Choose two.)

  Response:

  A. The remote gateway IP must be an IPv6 address.
  B. The source quick mode selector must be an IPv4 address.
  C. The local gateway IP must an IPv4 address.
  D. The destination quick mode selector must be an IPv6 address.
  C. The local gateway IP must an IPv4 address.
  D. The destination quick mode selector must be an IPv6 address.