Fortinet NSE4_FGT-6.2 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-6.2 Online Questions & Answers

• Question 1:

  Examine the network diagram shown in the exhibit, and then answer the following question:

  

  A firewall administrator must configure equal cost multipath (ECMP) routing on FGT1 to ensure both port1 and port3 links are used at the same time for all traffic destined for 172.20.2.0/24. Which of the following static routes will satisfy this requirement on FGT1? (Choose two.)

  A. 172.20.2.0/24 (1/0) via 10.10.1.2, port1 [0/0]
  B. 172.20.2.0/24 (25/0) via 10.30.3.2, port3 [5/0]
  C. 172.20.2.0/24 (25/0) via 10.10.1.2, port1 [5/0]
  D. 172.20.2.0/24 (1/150) via 10.30.3.2, port3 [10/0]
  B. 172.20.2.0/24 (25/0) via 10.30.3.2, port3 [5/0]
  C. 172.20.2.0/24 (25/0) via 10.10.1.2, port1 [5/0]

• Question 2:

  Examine the two static routes shown in the exhibit, then answer the following question.

  

  Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?

  A. FortiGate will load balance all traffic across both routes.
  B. FortiGate will use the port1 route as the primary candidate.
  C. FortiGate will route twice as much traffic to the port2 route
  D. FortiGate will only actuate the port1 route in the routing table
  B. FortiGate will use the port1 route as the primary candidate.

• Question 3:

  Which of the following are valid actions for FortiGuard category based filter in a web filter profile in proxy-based inspection mode? (Choose two.)

  A. Warning
  B. Exempt
  C. Allow
  D. Learn
  A. Warning
  C. Allow

• Question 4:

  If the Services field is configured in a Virtual IP (VIP), which of the following statements is true when central NAT is used?

  A. The Services field removes the requirement of creating multiple VIPs for different services.
  B. The Services field is used when several VIPs need to be bundled into VIP groups.
  C. The Services field does not allow source NAT and destination NAT to be combined in the same policy.
  D. The Services field does not allow multiple sources of traffic, to use multiple services, to connect to a single computer.
  A. The Services field removes the requirement of creating multiple VIPs for different services.

• Question 5:

  View the exhibit.

  

  Based on the configuration shown in the exhibit, what statements about application control behavior are true? (Choose two.)

  A. Access to all unknown applications will be allowed.
  B. Access to browser-based Social.Media applications will be blocked.
  C. Access to mobile social media applications will be blocked.
  D. Access to all applications in Social.Media category will be blocked.
  A. Access to all unknown applications will be allowed.
  B. Access to browser-based Social.Media applications will be blocked.

• Question 6:

  View the following exhibit, which shows the firewall policies and the object uses in the firewall policies.

  

  The administrator is using the Policy Lookup feature and has entered the search create shown in the following exhibit.

  

  Which of the following will be highlighted based on the input criteria?

  A. Policy with ID1.
  B. Policies with ID 2 and 3.
  C. Policy with ID 5.
  D. Policy with ID 4.
  A. Policy with ID1.

• Question 7:

  View the certificate shown to the exhibit, and then answer the following question:

  

  The CA issued this certificate to which entity?

  A. A root CA
  B. A person
  C. A bridge CA
  D. A subordinate CA
  A. A root CA

• Question 8:

  You have tasked to design a new IPsec deployment with the following criteria:

  1.

  There are two HQ sues that all satellite offices must connect to

  2.

  The satellite offices do not need to communicate directly with other satellite offices

  3.

  No dynamic routing will be used

  4.

  The design should minimize the number of tunnels being configured. Which topology should be used to satisfy all of the requirements?

  A. Partial mesh
  B. Hub-and-spoke
  C. Fully meshed
  D. Redundant
  B. Hub-and-spoke

• Question 9:

  An administrator has configured a route-based IPsec VPN between two FortiGate devices. Which statement about this IPsec VPN configuration is true?

  A. A phase 2 configuration is not required.
  B. This VPN cannot be used as part of a hub-and-spoke topology.
  C. A virtual IPsec interface is automatically created after the phase 1 configuration is completed.
  D. The IPsec firewall policies must be placed at the top of the list.
  C. A virtual IPsec interface is automatically created after the phase 1 configuration is completed.

• Question 10:

  Which statement about the IP authentication header (AH) used by IPsec is true?

  A. AH does not provide any data integrity or encryption.
  B. AH does not support perfect forward secrecy.
  C. AH provides data integrity bur no encryption.
  D. AH provides strong data integrity but weak encryption.
  C. AH provides data integrity bur no encryption.