Fortinet Fortinet Certifications NSE4_FGT-5.6 Questions & Answers

• Question 81:

  View the exhibit.

  

  In this scenario, FGT1 has the following routing table: S*0. 0. 0. 0/0 [10/0] via 10. 40.

  72. 2, port1 C172. 16. 32. 0/24 is directly connected, port2

  C10. 40. 72. 0/30 is directly connected, port1

  A user at 192.168.32.15 is trying to access the web server at 172.16.32.254. Which of the following

  statements best describe how the FortiGate will perform reverse path forwarding checks on this traffic?

  (Choose two.)

  Response:

  A. Strict RPF check will deny the traffic.

  B. Strict RPF check will allow the traffic.

  C. Loose RPF check will allow the traffic.

  D. Loose RPF check will deny the traffic.

  Correct Answer: BD

• Question 82:

  What statement is true regarding web profile overrides? Response:

  A. It is not possible to completely override a web filter profile.

  B. Configured users can activate this setting through an override link on the FortiGuard block page.

  C. This feature is available only in flow-based inspection.

  D. It is used to change the website category

  Correct Answer: B

• Question 83:

  How can you format the FortiGate flash disk? Response:

  A. Load the hardware test (HQIP) image.

  B. Execute the CLI command execute formatlogdisk.

  C. Load a debug FortiOS image.

  D. Select the format boot device option from the BIOS menu.

  Correct Answer: D

• Question 84:

  What protocol can be used to dynamically assign an IP address to a physical interface? Response:

  A. PPPoE

  B. IP Config

  C. BOOTP

  D. ICMP

  Correct Answer: A

• Question 85:

  A FortiGate interface is configured with the following commands:

  

  What statements about the configuration are correct?

  (Choose two.)

  Response:

  A. IPv6 clients connected to port1 can use SLAAC to generate their IPv6 addresses.

  B. FortiGate can provide DNS settings to IPv6 clients.

  C. FortiGate can send IPv6 router advertisements (RAs.)

  D. FortiGate can provide IPv6 addresses to DHCPv6 client.

  Correct Answer: AC

• Question 86:

  An administrator needs to inspect all web traffic (including Internet web traffic) coming from users connecting to SSL VPN. How can this be achieved?

  Response:

  A. Disabling split tunneling

  B. Configuring web bookmarks

  C. Assigning public IP addresses to SSL VPN clients

  D. Using web-only mode

  Correct Answer: A

• Question 87:

  Which statements are true of public key infrastracture (PKI) users on FortiGate?

  (Choose two.)

  Response:

  A. FortiGate must include the CA certificate that issued the PKI peer user certificate.

  B. PKI users can belong to firewall user groups.

  C. PKI users must authenticate with both a certificate and a password.

  D. The first PKI user must be added to FortiGate through the GUI.

  Correct Answer: AB

• Question 88:

  An administrator has enabled the DHCP Server on the port1 interface and configured the following based on the exhibit.

  

  Which statement is correct based on this configuration? Response:

  A. The MAC address 00:0c:29:29:38:da belongs to the port1 interface.

  B. Access to the network is blocked for the devices with the MAC address 00:0c:29:29:38:da and the IP address 10.0.1.254.

  C. 00:0c:29:29:38:da is the virtual MAC address assigned to the secondary IP address (10.0.1.254) of the port1 interface.

  D. The IP address 10.0.1.254 is reserves for the device with the MAC address 00:0c:29:29:38:da.

  Correct Answer: D

• Question 89:

  An administrator needs to offload logging to FortiAnalyzer from a FortiGate with an internal hard drive.

  Which statements are true?

  (Choose two.)

  Response:

  A. Logs must be stored on FortiGate first, before transmitting to FortiAnalyzer

  B. FortiGate uses port 8080 for log transmission

  C. Log messages are transmitted as plain text in LZ4 compressed format (store-and-upload method).

  D. FortiGate can encrypt communications using SSL encrypted OFTP traffic.

  Correct Answer: CD

• Question 90:

  Which statement about the HA override setting in FortiGate HA clusters is true? Response:

  A. Configuring the HA override will reboot the FortiGate device.

  B. It synchronizes device priority on all cluster members.

  C. It is used to enable monitored ports.

  D. You must configure override settings manually and separately for each cluster member.

  Correct Answer: D