Fortinet NSE4_FGT-5.6 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-5.6 Online Questions & Answers

• Question 71:

  What step is required to configure an SSL VPN to access to an internal server using port forward mode? Response:

  A. Configure the virtual IP addresses to be assigned to the SSL VPN users.
  B. Install FortiClient SSL VPN client
  C. Create a SSL VPN realm reserved for clients using port forward mode.
  D. Configure the client application to forward IP traffic to a Java applet proxy.
  D. Configure the client application to forward IP traffic to a Java applet proxy.

• Question 72:

  Which component of FortiOS performs application control inspection? Response:

  A. Kernel
  B. Antivirus engine
  C. IPS engine
  D. Application control engine
  C. IPS engine

• Question 73:

  Which of the following statements are true about route-based IPsec VPNs?

  (Choose two.)

  Response:

  A. A virtual IPsec interface is automatically created after a phase 1 is added to the configuration
  B. They require firewall policies with the Action set to IPsec
  C. They support L2TP-over-IPsec tunnels
  D. They can be created in transparent mode VDOMs
  A. A virtual IPsec interface is automatically created after a phase 1 is added to the configuration
  C. They support L2TP-over-IPsec tunnels

• Question 74:

  If you've lost your password for the admin account on your FortiGate, how can you reset it? Response:

  A. Hard reboot the FortiGate. Click Reset Password on the login window.
  B. Hard reboot the FortiGate. Run the execute reset-password command from the CLI.
  C. Hard reboot the FortiGate. Through the local console, interrupt the boot loader by pressing any key and then log in as maintainer. Enter the CLI commands required to set the password for the admin account.
  D. Hard reboot the FortiGate. Through the local console, once the FortiGate is booted up, log in as maintainer. Enter the CLI commands to set the password for the admin account.
  D. Hard reboot the FortiGate. Through the local console, once the FortiGate is booted up, log in as maintainer. Enter the CLI commands to set the password for the admin account.

• Question 75:

  Which statements about high availability (HA) for FortiGates are true?

  (Choose two.)

  Response:

  A. Virtual clustering can be configured between two FortiGate devices with multiple VDOM.
  B. Heartbeat interfaces are not required on the primary device.
  C. HA management interface settings are synchronized between cluster members.
  D. Sessions handled by UTM proxy cannot be synchronized.
  A. Virtual clustering can be configured between two FortiGate devices with multiple VDOM.
  C. HA management interface settings are synchronized between cluster members.

• Question 76:

  Why must you use aggressive mode when a local FortiGate IPsec gateway hosts multiple dialup tunnels? Response:

  A. The FortiGate is able to handle NATed connections only with aggressive mode.
  B. FortiClient supports aggressive mode.
  C. The remote peers are able to provide their peer IDs in the first message with aggressive mode.
  D. Main mode does not support XAuth for user authentication.
  C. The remote peers are able to provide their peer IDs in the first message with aggressive mode.

• Question 77:

  What statement is true regarding web profile overrides? Response:

  A. It is not possible to completely override a web filter profile.
  B. Configured users can activate this setting through an override link on the FortiGuard block page.
  C. This feature is available only in flow-based inspection.
  D. It is used to change the website category
  B. Configured users can activate this setting through an override link on the FortiGuard block page.

• Question 78:

  View the Exhibit.

  

  The administrator needs to confirm that FortiGate 2 is properly routing that traffic to the 10.0.1.0/24 subnet. The administrator needs to confirm it by sending ICMP pings to FortiGate 2 from the CLI of FortiGate 1.

  What ping option needs to be enabled before running the ping?

  Response:

  A. Execute ping-options source port1
  B. Execute ping-options source 10.200.1.1.
  C. Execute ping-options source 10.200.1.2
  D. Execute ping-options source 10.0.1.254
  D. Execute ping-options source 10.0.1.254

• Question 79:

  Examine this FortiGate configuration: config system global set av-failopen pass set fail-open disable end Examine the output of the following debug command: # diagnose hardware sysinfo conserve memory conserve mode: on total RAM: 3040 MB memory used: 2706 MB 89% of total RAM memory used threshold extreme: 2887 MB 95% of total RAM memory used threshold red: 2675 MB 88% of total RAM memory used threshold green: 2492 MB 82% of total RAM Based on the diagnostics outputs above, how is the FortiGate handling packets that require IPS inspection? Response:

  A. They are dropped.
  B. They are allowed and inspected.
  C. They are allowed, but with no inspection.
  D. They are allowed and inspected as long as no additional proxy-based inspection is required.
  D. They are allowed and inspected as long as no additional proxy-based inspection is required.

• Question 80:

  Which firewall authentication methods does FortiGate support?

  (Choose three.)

  Response:

  A. Local password authentication
  B. Out-of-band authentication
  C. Server-based password authentication
  D. Two-factor authentication
  E. Biometric authentication
  A. Local password authentication
  B. Out-of-band authentication
  C. Server-based password authentication