Fortinet NSE4_FGT-6.0 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-6.0 Online Questions & Answers

• Question 31:

  Which of the following statements about central NAT are true? (Choose two.)

  A. IP tool references must be removed from existing firewall policies before enabling central NAT.
  B. Central NAT can be enabled or disabled from the CLI only.
  C. Source NAT, using central NAT does not require a central SNAT policy.
  D. Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.
  A. IP tool references must be removed from existing firewall policies before enabling central NAT.
  B. Central NAT can be enabled or disabled from the CLI only.

• Question 32:

  A team manager has decided that while some members of the team need access to particular website, the majority of the team does not. Which configuration option is the most effective option to support this request?

  A. Implement a web filter category override for the specified website.
  B. Implement web filter authentication for the specified website
  C. Implement web filter quotas for the specified website.
  D. Implement DNS filter for the specified website.
  A. Implement a web filter category override for the specified website.

• Question 33:

  Which of the following SD-WAN load 璪alancing method use interface weight value to distribute traffic? (Choose two.)

  A. Source IP
  B. Spillover
  C. Volume
  D. Session
  C. Volume
  D. Session

• Question 34:

  An administrator is configuring an antivirus profiles on FortiGate and notices that Proxy Options is not listed under Security Profiles on the GUI. What can cause this issue?

  A. FortiGate needs to be switched to NGFW mode.
  B. Proxy options section is hidden by default and needs to be enabled from the Feature Visibility menu.
  C. Proxy options are no longer available starting in FortiOS 5.6.
  D. FortiGate is in flow-based inspection mode.
  D. FortiGate is in flow-based inspection mode.

• Question 35:

  An administrator is configuring an Ipsec between site A and siteB. The Remotes Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24. How must the administrator configure the local quick mode selector for site B?

  A. 192.168.3.0/24
  B. 192.168.2.0/24
  C. 192.168.1.0/24
  D. 192.168.0.0/8
  B. 192.168.2.0/24

• Question 36:

  View the following exhibit, which shows the firewall policies and the object uses in the firewall policies.

  

  The administrator is using the Policy Lookup feature and has entered the search create shown in the following exhibit.

  

  Which of the following will be highlighted based on the input criteria?

  A. Policy with ID1.
  B. Policies with ID 2 and 3.
  C. Policy with ID 5.
  D. Policy with ID 4.
  A. Policy with ID1.

• Question 37:

  Examine this output from a debug flow:

  

  Which statements about the output are correct? (Choose two.)

  A. FortiGate received a TCP SYN/ACK packet.
  B. The source IP address of the packet was translated to 10.0.1.10.
  C. FortiGate routed the packet through port 3.
  D. The packet was allowed by the firewall policy with the ID 00007fc0.
  A. FortiGate received a TCP SYN/ACK packet.
  C. FortiGate routed the packet through port 3.

• Question 38:

  An administration wants to throttle the total volume of SMTP sessions to their email server. Which of the following DoS sensors can be used to achieve this?

  A. tcp_port_scan
  B. ip_dst_session
  C. udp_flood
  D. ip_src_session
  A. tcp_port_scan

• Question 39:

  Examine this output from a debug flow:

  

  Why did the FortiGate drop the packet?

  A. The next-hop IP address is unreachable.
  B. It failed the RPF check.
  C. It matched an explicitly configured firewall policy with the action DENY.
  D. It matched the default implicit firewall policy.
  D. It matched the default implicit firewall policy.

• Question 40:

  Which statements about DNS filter profiles are true? (Choose two.)

  A. They can inspect HTTP traffic.
  B. They can redirect blocked requests to a specific portal.
  C. They can block DNS requests to known botnet command and control servers.
  D. They must be applied in firewall policies with SSL inspection enabled.
  B. They can redirect blocked requests to a specific portal.
  C. They can block DNS requests to known botnet command and control servers.