Fortinet NSE4_FGT-5.6 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-5.6 Online Questions & Answers

• Question 21:

  Which statement about data leak prevention (DLP) on a FortiGate is true? Response:

  A. Traffic shaping can be applied to DLP sensors.
  B. It can be applied to a firewall policy in a flow-based VDOM.
  C. Files can be sent to FortiSandbox for detecting DLP threats.
  D. It can archive files and messages.
  D. It can archive files and messages.

• Question 22:

  An administrator needs to be able to view logs for application usage on your network. What configurations are required to ensure that FortiGate generates logs for application usage activity?

  (Choose two.)

  Response:

  A. Enable a web filtering profile on the firewall policy.
  B. Create an application control policy.
  C. Enable logging on the firewall policy.
  D. Enable an application control security profile on the firewall policy.
  C. Enable logging on the firewall policy.
  D. Enable an application control security profile on the firewall policy.

• Question 23:

  An administrator needs to inspect all web traffic (including Internet web traffic) coming from users connecting to SSL VPN. How can this be achieved? Response:

  A. Disabling split tunneling
  B. Configuring web bookmarks
  C. Assigning public IP addresses to SSL VPN clients
  D. Using web-only mode
  A. Disabling split tunneling

• Question 24:

  Which statements about One-to-One IP pool are true?

  (Choose two.)

  Response:

  A. It allows configuration of ARP replies.
  B. It allows fixed mapping of an internal address range to an external address range.
  C. It is used for destination NAT.
  D. It does not use port address translation.
  B. It allows fixed mapping of an internal address range to an external address range.
  D. It does not use port address translation.

• Question 25:

  Examine the exhibit, which shows the output of a web filtering real time debug.

  

  Why is the site www.bing.com being blocked? Response:

  A. The web server IP address 204.79.197.200 is categorized by FortiGuard as Malicious Websites.
  B. The rating for the web site www.bing.com has been locally overridden to a category that is being blocked.
  C. The web site www.bing.com is categorized by FortiGuard as Malicious Websites.
  D. The user has not authenticated with the FortiGate yet.
  A. The web server IP address 204.79.197.200 is categorized by FortiGuard as Malicious Websites.

• Question 26:

  Examine this output from a debug flow:

  

  Which statements about the output are correct?

  (Choose two.)

  Response:

  A. FortiGate received a TCP SYN/ACK packet.
  B. The source IP address of the packet was translated to 10.0.1.10.
  C. FortiGate routed the packet through port 3.
  D. The packet was allowed by the firewall policy with the ID 00007fc0.
  B. The source IP address of the packet was translated to 10.0.1.10.
  C. FortiGate routed the packet through port 3.

• Question 27:

  What is the Unknown Applications category option in the application control profile? Response:

  A. Any traffic that does not match the RFC pattern for its protocol.
  B. Any traffic that does not match an application control signature.
  C. Any traffic whose packet fails the CRC check.
  D. Any traffic that matches custom application control signatures.
  B. Any traffic that does not match an application control signature.

• Question 28:

  An administrator has configured a route-based IPsec VPN between two FortiGates. Which statement about this IPsec VPN configuration is true? Response:

  A. A phase 2 configuration is not required.
  B. This VPN cannot be used as part of a hub and spoke topology.
  C. The IPsec firewall policies must be placed at the top of the list.
  D. A virtual IPsec interface is automatically created after the phase 1 configuration is completed.
  D. A virtual IPsec interface is automatically created after the phase 1 configuration is completed.

• Question 29:

  How does FortiGate verify the login credentials of a remote LDAP user? Response:

  A. FortiGate sends the user entered credentials to the LDAP server for authentication.
  B. FortiGate re-generates the algorithm based on the login credentials and compares it against the algorithm stored on the LDAP server.
  C. FortiGate queries its own database for credentials.
  D. FortiGate queries the LDAP server for credentials.
  A. FortiGate sends the user entered credentials to the LDAP server for authentication.

• Question 30:

  Which of the following IPsec parameters is a phase 2 configuration setting? Response:

  A. Peer ID
  B. eXtended Authentication (XAuth)
  C. Quick mode selectors
  D. Authentication method
  C. Quick mode selectors