Fortinet NSE4_FGT-5.6 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-5.6 Online Questions & Answers

• Question 31:

  View the exhibit.

  

  Which of the following statements are correct?

  (Choose two.)

  Response:

  A. This is a redundant IPsec setup.
  B. The TunnelB route is the primary one for searching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
  C. This setup requires at least two firewall policies with action set to IPsec.
  D. Dead peer detection must be disabled to support this type of IPsec setup.
  A. This is a redundant IPsec setup.
  B. The TunnelB route is the primary one for searching the remote site. The TunnelA route is used only if the TunnelB VPN is down.

• Question 32:

  Which statements correctly describe transparent mode operation?

  (Choose three.)

  Response:

  A. All interfaces of the transparent mode FortiGate device must be on different IP subnets.
  B. The transparent FortiGate is visible to network hosts in an IP traceroute.
  C. It permits inline traffic inspection and firewalling without changing the IP scheme of the network.
  D. Ethernet packets are forwarded based on destination MAC addresses, not IP addresses.
  E. The FortiGate acts as transparent bridge and forwards traffic at Layer-2.
  C. It permits inline traffic inspection and firewalling without changing the IP scheme of the network.
  D. Ethernet packets are forwarded based on destination MAC addresses, not IP addresses.
  E. The FortiGate acts as transparent bridge and forwards traffic at Layer-2.

• Question 33:

  You have enabled a web filter security profile in a firewall policy to log all blocked websites. What options do you have to either actively or passively monitor these logs? (Choose two.) Response:

  A. Alert Message console
  B. FortiView menu
  C. Alert email
  D. Monitor menu
  A. Alert Message console
  C. Alert email

• Question 34:

  View the exhibit. Which statement is true regarding the configuration on the SSL-VPN Monitor page?

  

  Response:

  A. FortiGate assigns the IP address in .15-t r. n .1 to the Student SSL-VPN user.
  B. FortiGate assigns the IP address 10.200.3.1 - to the Student2 SSL-VPN user.
  C. FortiGate assigns IP address 10.212.134.200 to the Student2 SSL-VPN user.
  D. The Student SSL-VPN user is disconnected from the SSL-VPN and doesn't show any IP addresses under Active Connections.
  C. FortiGate assigns IP address 10.212.134.200 to the Student2 SSL-VPN user.

• Question 35:

  Which statement about the firewall policy authentication timeout is true? Response:

  A. It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after this times expires.
  B. It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address after this times expires.
  C. It is an idle timeout. The FortiGate considers a user to be idle if it does not see any packets coming from the user's source MAC address.
  D. It is an idle timeout. The FortiGate considers a user to be idle if it does not see any packets coming from the user's source IP.
  D. It is an idle timeout. The FortiGate considers a user to be idle if it does not see any packets coming from the user's source IP.

• Question 36:

  Which of the following protocols can you use for secure administrative access to a FortiGate?

  (Choose two.)

  Response:

  A. HTTPS
  B. Telnet
  C. SSH
  D. FortiTelemetry
  A. HTTPS
  C. SSH

• Question 37:

  Which of the following statements are true regarding the SD-WAN feature on FortiGate?

  (Choose two.)

  Response:

  A. An SD-WAN static route does not require a next-hop gateway IP address.
  B. Each member interface requires its own firewall policy to allow traffic.
  C. SD-WAN provides route failover protection, but cannot load-balance traffic.
  D. FortiGate supports only one SD-WAN interface per VDOM.
  A. An SD-WAN static route does not require a next-hop gateway IP address.
  D. FortiGate supports only one SD-WAN interface per VDOM.

• Question 38:

  Which statements about FortiGate inspection modes are true?

  (Choose two.)

  Response:

  A. The default inspection mode is proxy based.
  B. Switching from proxy-based mode to flow-based, then back to proxy-based mode, will not result in the original configuration.
  C. Proxy-based inspection is not available in VDOMs operating in transparent mode.
  D. Flow-based profiles must be manually converted to proxy-based profiles before changing the inspection mode from flow based to proxy based.
  A. The default inspection mode is proxy based.
  C. Proxy-based inspection is not available in VDOMs operating in transparent mode.

• Question 39:

  View the exhibit.

  

  Based on this output, which statements are correct?

  (Choose two.)

  Response:

  A. FortiGate generated an event log for system conserve mode.
  B. FortiGate has entered in to system conserve mode.
  C. By default, the FortiGate blocks new sessions.
  D. FortiGate changed the global av-failopen settings to idledrop.
  B. FortiGate has entered in to system conserve mode.
  C. By default, the FortiGate blocks new sessions.

• Question 40:

  How does FortiGate select the central SNAT policy that is applied to a TCP session? Response:

  A. It selects the SNAT policy specified in the configuration of the outgoing interface.
  B. It selects the first matching central-SNAT policy from top to bottom.
  C. It selects the central-SNAT policy with the lowest priority.
  D. It selects the SNAT policy specified in the configuration of the firewall policy that matches the traffic.
  B. It selects the first matching central-SNAT policy from top to bottom.