Fortinet NSE4_FGT-6.0 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-6.0 Online Questions & Answers

• Question 61:

  View the exhibit.

  

  Based on this output, which statements are correct? (Choose two.)

  A. The all VDOM is not synchronized between the primary and secondary FortiGate devices.
  B. The root VDOM is not synchronized between the primary and secondary FortiGate devices.
  C. The global configuration is synchronized between the primary and secondary FortiGate devices.
  D. The FortiGate devices have three VDOMs.
  B. The root VDOM is not synchronized between the primary and secondary FortiGate devices.
  C. The global configuration is synchronized between the primary and secondary FortiGate devices.

• Question 62:

  Which of the following conditions are required for establishing an IPSec VPN between two FortiGate devices? (Choose two.)

  A. If XAuth is enabled as a server in one peer, it must be enabled as a client in the other peer.
  B. If the VPN is configured as route-based, there must be at least one firewall policy with the action set to IPSec.
  C. If the VPN is configured as DialUp User in one peer, it must be configured as either Static IP Address or Dynamic DNS in the other peer.
  D. If the VPN is configured as a policy-based in one peer, it must also be configured as policy-based in the other peer.
  B. If the VPN is configured as route-based, there must be at least one firewall policy with the action set to IPSec.
  C. If the VPN is configured as DialUp User in one peer, it must be configured as either Static IP Address or Dynamic DNS in the other peer.

• Question 63:

  A company needs to provide SSL VPN access to two user groups. The company also needs to display different welcome messages on the SSL VPN login screen for both user groups. What is required in the SSL VPN configuration to meet these requirements?

  A. Different SSL VPN realms for each group.
  B. Two separate SSL VPNs in different interfaces mapping the same ssl.root.
  C. Two firewall policies with different captive portals.
  D. Different virtual SSL VPN IP addresses for each group.
  A. Different SSL VPN realms for each group.

• Question 64:

  When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?

  A. remote user's public IP address
  B. The public IP address of the FortiGate device.
  C. The remote user's virtual IP address.
  D. The internal IP address of the FortiGate device.
  D. The internal IP address of the FortiGate device.

• Question 65:

  If the Services field is configured in a Virtual IP (VIP), which of the following statements is true when central NAT is used?

  A. The Services field removes the requirement of creating multiple VIPs for different services.
  B. The Services field is used when several VIPs need to be bundled into VIP groups.
  C. The Services field does not allow source NAT and destination NAT to be combined in the same policy.
  D. The Services field does not allow multiple sources of traffic, to use multiple services, to connect to a single computer.
  A. The Services field removes the requirement of creating multiple VIPs for different services.

• Question 66:

  How does FortiGate verify the login credentials of a remote LDAP user?

  A. FortiGate regenerates the algorithm based on the login credentials and compares it to the algorithm stored on the LDAP server.
  B. FortiGate sends the user-entered credentials to the LDAP server for authentication.
  C. FortiGate queries the LDAP server for credentials.
  D. FortiGate queries its own database for credentials.
  B. FortiGate sends the user-entered credentials to the LDAP server for authentication.

• Question 67:

  You are configuring the root FortiGate to implement the security fabric. You are configuring port10 to communicate with a downstream FortiGate. View the default Edit Interface in the exhibit below:

  

  When configuring the root FortiGate to communicate with a downstream FortiGate, which settings are required to be configured? (Choose two.)

  A. Device detection enabled.
  B. Administrative Access: FortiTelemetry.
  C. IP/Network Mask.
  D. Role: Security Fabric.
  B. Administrative Access: FortiTelemetry.
  C. IP/Network Mask.

• Question 68:

  Which of the following are valid actions for FortiGuard category based filter in a web filter profile in proxy-based inspection mode? (Choose two.)

  A. Warning
  B. Exempt
  C. Allow
  D. Learn
  A. Warning
  C. Allow

• Question 69:

  View the exhibit.

  

  Based on the configuration shown in the exhibit, what statements about application control behavior are true? (Choose two.)

  A. Access to all unknown applications will be allowed.
  B. Access to browser-based Social.Media applications will be blocked.
  C. Access to mobile social media applications will be blocked.
  D. Access to all applications in Social.Media category will be blocked.
  A. Access to all unknown applications will be allowed.
  B. Access to browser-based Social.Media applications will be blocked.

• Question 70:

  Which statements about HA for FortiGate devices are true? (Choose two.)

  A. Sessions handled by proxy-based security profiles cannot be synchronized.
  B. Virtual clustering can be configured between two FortiGate devices that have multiple VDOMs.
  C. HA management interface settings are synchronized between cluster members.
  D. Heartbeat interfaces are not required on the primary device.
  B. Virtual clustering can be configured between two FortiGate devices that have multiple VDOMs.
  C. HA management interface settings are synchronized between cluster members.