Fortinet NSE4_FGT-5.6 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-5.6 Online Questions & Answers

• Question 51:

  Which of the following settings and protocols can be used to provide secure and restrictive administrative access to FortiGate?

  (Choose three.)

  Response:

  A. Trusted host
  B. HTTPS
  C. Trusted authentication
  D. SSH
  E. FortiTelemetry
  A. Trusted host
  B. HTTPS
  D. SSH

• Question 52:

  When using firewall policy NAT, which statements are true regarding virtual IP (VIP)?

  (Choose two.)

  Response:

  A. The default type is static NAT, which applies one-to-one mappings for incoming and outgoing connections.
  B. The static NAT VIP can be restricted to forward only certain ports.
  C. FortiGate does not respond to ARP requests for VIP, as ARP responses are non configurable for VIP.
  D. The VIP is selected in the firewall policy source address field.
  A. The default type is static NAT, which applies one-to-one mappings for incoming and outgoing connections.
  B. The static NAT VIP can be restricted to forward only certain ports.

• Question 53:

  How are the application control signatures updated on a FortiGate device? Response:

  A. By running the application control auto-learning feature.
  B. Through FortiGuard updates.
  C. By upgrading the FortiOS firmware to a newer release.
  D. By clicking Update Signatures in the application control profile.
  B. Through FortiGuard updates.

• Question 54:

  View the exhibit.

  

  In this scenario, FGT1 has the following routing table: S*0. 0. 0. 0/0 [10/0] via 10. 40.

  72. 2, port1 C172. 16. 32. 0/24 is directly connected, port2

  C10. 40. 72. 0/30 is directly connected, port1

  A user at 192.168.32.15 is trying to access the web server at 172.16.32.254. Which of the following statements best describe how the FortiGate will perform reverse path forwarding checks on this traffic?

  (Choose two.)

  Response:

  A. Strict RPF check will deny the traffic.
  B. Strict RPF check will allow the traffic.
  C. Loose RPF check will allow the traffic.
  D. Loose RPF check will deny the traffic.
  B. Strict RPF check will allow the traffic.
  D. Loose RPF check will deny the traffic.

• Question 55:

  Which of the following statements are true regarding tunnel mode SSL VPN?

  (Choose two.)

  Response:

  A. You must be logged into web-only mode SSL VPN to activate tunnel mode.
  B. You need an SSL VPN client (FortiClient) to connect to tunnel mode SSL VPN.
  C. Tunnel mode SSL VPN is configured between two FortiGate devices.
  D. FortiGate will dynamically assign an IP address to the SSL VPN network adapter on the host PC.
  A. You must be logged into web-only mode SSL VPN to activate tunnel mode.
  B. You need an SSL VPN client (FortiClient) to connect to tunnel mode SSL VPN.

• Question 56:

  Which of the following statements is true regarding the configuration settings? Response:

  A. When a remote user accesses https://10.200.1.1:443, the FortiGate login page appears.
  B. When a remote user accesses https://10.200.1.1:443, the FortiGate login page appears.
  C. When a remote user accesses http: //10.200.1.1 :443, the FortiGate login page appears.
  D. When a remote user accesses http: /110.200.1.1:443, the SSL VPN login page appears.
  E. The settings are invalid. The administrator settings and the SSL VPN settings cannot use the same port.
  B. When a remote user accesses https://10.200.1.1:443, the FortiGate login page appears.

• Question 57:

  If antivirus, grayware, and heuristic scans are enabled on FortiGate, in which order does FortiGate apply the scanning? Response:

  A. heuristics -> grayware -> antivirus
  B. antivirus -> grayware -> heuristics
  C. antivirus -> heuristics -> grayware
  D. grayware -> antivirus -> heuristics
  B. antivirus -> grayware -> heuristics

• Question 58:

  When does the FortiGate enter into fail-open session mode? Response:

  A. When CPU usage goes above the red threshold.
  B. When a proxy (for proxy-based inspection) runs out of connections.
  C. When memory usage goes above the red threshold.
  D. When memory usage goes above the extreme threshold.
  B. When a proxy (for proxy-based inspection) runs out of connections.

• Question 59:

  An administrator is using the FortiGate built-in sniffer to capture HTTP traffic between a client and a server, however, the sniffer output shows only the packets related with TCP session setups and disconnections. Why? Response:

  A. The administrator is running the sniffer on the internal interface only.
  B. The filter used in the sniffer matches the traffic only in one direction.
  C. The FortiGate is doing content inspection.
  D. TCP traffic is being offloaded to an NP6.
  D. TCP traffic is being offloaded to an NP6.

• Question 60:

  A FortiGate interface is configured with the following commands:

  

  What statements about the configuration are correct?

  (Choose two.)

  Response:

  A. IPv6 clients connected to port1 can use SLAAC to generate their IPv6 addresses.
  B. FortiGate can provide DNS settings to IPv6 clients.
  C. FortiGate can send IPv6 router advertisements (RAs.)
  D. FortiGate can provide IPv6 addresses to DHCPv6 client.
  A. IPv6 clients connected to port1 can use SLAAC to generate their IPv6 addresses.
  C. FortiGate can send IPv6 router advertisements (RAs.)