Fortinet NSE4_FGT-6.0 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-6.0 Online Questions & Answers

• Question 91:

  An administrator wants to create a policy-based IPsec VPN tunnel betweeb two FortiGate devices. Which configuration steps must be performed on both devices to support this scenario? (Choose three.)

  A. Define the phase 1 parameters, without enabling IPsec interface mode
  B. Define the phase 2 parameters.
  C. Set the phase 2 encapsulation method to transport mode
  D. Define at least one firewall policy, with the action set to IPsec.
  E. Define a route to the remote network over the IPsec tunnel.
  A. Define the phase 1 parameters, without enabling IPsec interface mode
  B. Define the phase 2 parameters.
  D. Define at least one firewall policy, with the action set to IPsec.

• Question 92:

  Which configuration objects can be selected for the Source field of a firewall policy? (Choose two.)

  A. Firewall service
  B. User or user group
  C. IP Pool
  D. FQDN address
  B. User or user group
  C. IP Pool

• Question 93:

  Examine the network diagram and the existing FGTI routing table shown in the exhibit, and then answer the following question:

  

  An administrator has added the following static route on FGTI.

  

  Since the change, the new static route is not showing up in the routing table. Given the information provided, which of the following describes the cause of this problem?

  A. The new route's destination subnet overlaps an existing route.
  B. The new route's Distance value should be higher than 10.
  C. The Gateway IP address is not in the same subnet as port1.
  D. The Priority is 0, which means that this route will remain inactive.
  C. The Gateway IP address is not in the same subnet as port1.

• Question 94:

  What files are sent to FortiSandbox for inspection in flow-based inspection mode?

  A. All suspicious files that do not have their hash value in the FortiGuard antivirus signature database.
  B. All suspicious files that are above the defined oversize limit value in the protocol options.
  C. All suspicious files that match patterns defined in the antivirus profile.
  D. All suspicious files that are allowed to be submitted to FortiSandbox in the antivirus profile.
  C. All suspicious files that match patterns defined in the antivirus profile.

• Question 95:

  Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.

  

  When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?

  A. SMTP.Login.Brute.Force
  B. IMAP.Login.brute.Force
  C. ip_src_session
  D. Location: server Protocol: SMTP
  B. IMAP.Login.brute.Force

• Question 96:

  Which is a requirement for creating an inter-VDOM link between two VDOMs?

  A. The inspection mode of at least one VDOM must be proxy-based.
  B. At least one of the VDOMs must operate in NAT mode.
  C. The inspection mode of both VDOMs must match.
  D. Both VDOMs must operate in NAT mode.
  B. At least one of the VDOMs must operate in NAT mode.

• Question 97:

  What FortiGate configuration is required to actively prompt users for credentials?

  A. You must enable one or more protocols that support active authentication on a firewall policy.
  B. You must position the firewall policy for active authentication before a firewall policy for passive authentication
  C. You must assign users to a group for active authentication
  D. You must enable the Authentication setting on the firewall policy
  C. You must assign users to a group for active authentication

• Question 98:

  Examine the IPS sensor configuration shown in the exhibit, and then answer the question below.

  

  

  An administrator has configured the WINDOS_SERVERS IPS sensor in an attempt to determine

  whether the influx of HTTPS traffic is an attack attempt or not. After applying the IPS sensor, FortiGate is still not generating any IPS logs for the HTTPS traffic.

  What is a possible reason for this?

  A. The IPS filter is missing the Protocol: HTTPS option.
  B. The HTTPS signatures have not been added to the sensor.
  C. A DoS policy should be used, instead of an IPS sensor.
  D. The firewall policy is not using a full SSL inspection profile.
  D. The firewall policy is not using a full SSL inspection profile.

• Question 99:

  Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

  A. To detect intermediary NAT devices in the tunnel path.
  B. To dynamically change phase 1 negotiation mode aggressive mode.
  C. To encapsulation ESP packets in UDP packets using port 4500.
  D. To force a new DH exchange with each phase 2 rekey.
  A. To detect intermediary NAT devices in the tunnel path.
  C. To encapsulation ESP packets in UDP packets using port 4500.

• Question 100:

  Which of the following statements about policy-based IPsec tunnels are true? (Choose two.)

  A. They can be configured in both NAT/Route and transparent operation modes.
  B. They support L2TP-over-IPsec.
  C. They require two firewall policies: one for each directions of traffic flow.
  D. They support GRE-over-IPsec.
  A. They can be configured in both NAT/Route and transparent operation modes.
  B. They support L2TP-over-IPsec.