Fortinet Fortinet Certifications NSE4_FGT-6.0 Questions & Answers

• Question 101:

  Which one of the following processes is involved in updating IPS from FortiGuard?

  A. FortiGate IPS update requests are sent using UDP port 443.

  B. Protocol decoder update requests are sent to service.fortiguard.net.

  C. IPS signature update requests are sent to update.fortiguard.net.

  D. IPS engine updates can only be obtained using push updates.

  Correct Answer: C

• Question 102:

  View the exhibit.

  

  Which of the following statements are correct? (Choose two.)

  A. This setup requires at least two firewall policies with the action set to IPsec.

  B. Dead peer detection must be disabled to support this type of IPsec setup.

  C. The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.

  D. This is a redundant IPsec setup.

  Correct Answer: CD

• Question 103:

  Which statements correctly describe transparent mode operation? (Choose three.)

  A. All interfaces of the transparent mode FortiGate device must be on different IP subnets.

  B. Ethernet packets are forwarded based on destination MAC addresses, not IP addresses.

  C. The transparent FortiGate is visible to network hosts in an IP traceroute.

  D. It permits inline traffic inspection and firewalling without changing the IP scheme of the network.

  E. FortiGate acts as transparent bridge and forwards traffic at Layer 2.

  Correct Answer: BDE

• Question 104:

  What FortiGate components are tested during the hardware test? (Choose three.)

  A. Administrative access

  B. HA heartbeat

  C. CPU

  D. Hard disk

  E. Network interfaces

  Correct Answer: CDE

• Question 105:

  You are configuring the root FortiGate to implement the security fabric. You are configuring port10 to communicate with a downstream FortiGate. View the default Edit Interface in the exhibit below: When configuring the root FortiGate to communicate with a downstream FortiGate, which settings are required to be configured? (Choose two.)

  

  A. Device detection enabled.

  B. Administrative Access: FortiTelemetry.

  C. IP/Network Mask.

  D. Role: Security Fabric.

  Correct Answer: BC

• Question 106:

  Which of the following statements about virtual domains (VDOMs) are true? (Choose two.)

  A. The root VDOM is the management VDOM by default.

  B. A FortiGate device has 64 VDOMs, created by default.

  C. Each VDOM maintains its own system time.

  D. Each VDOM maintains its own routing table.

  Correct Answer: AD

• Question 107:

  An administrator has configured two VLAN interfaces:

  

  A DHCP server is connected to the VLAN10 interface. A DHCP client is connected to the VLAN5 interface. However, the DHCP client cannot get a dynamic IP address from the DHCP server. What is the cause of the problem?

  A. Both interfaces must belong to the same forward domain.

  B. The role of the VLAN10 interface must be set to server.

  C. Both interfaces must have the same VLAN ID.

  D. Both interfaces must be in different VDOMs.

  Correct Answer: A

• Question 108:

  Which statements about DNS filter profiles are true? (Choose two.)

  A. They can inspect HTTP traffic.

  B. They can redirect blocked requests to a specific portal.

  C. They can block DNS requests to known botnet command and control servers.

  D. They must be applied in firewall policies with SSL inspection enabled.

  Correct Answer: BC

• Question 109:

  An administrator has configured a dialup IPsec VPN with XAuth. Which statement best describes what occurs during this scenario?

  A. Phase 1 negotiations will skip preshared key exchange.

  B. Only digital certificates will be accepted as an authentication method in phase 1.C

  C. Dialup clients must provide a username and password for authentication.

  D. Dialup clients must provide their local ID during phase 2 negotiations.

  Correct Answer: C

• Question 110:

  Which of the following services can be inspected by the DLP profile? (Choose three.)

  A. NFS

  B. FTP

  C. IMAP

  D. CIFS

  E. HTTP-POST

  Correct Answer: BCE