Fortinet NSE4_FGT-6.2 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-6.2 Online Questions & Answers

• Question 41:

  View the exhibit:

  

  The client cannot connect to the HTTP web server. The administrator ran the FortiGate built-in sniffer and got the following output:

  

  What should be done next to troubleshoot the problem?

  A. Run a sniffer in the web server.
  B. Execute another sniffer in the FortiGate, this time with the filter "host 10.0.1.10".
  C. Capture the traffic using an external sniffer connected to port1.
  D. Execute a debug flow.
  D. Execute a debug flow.

• Question 42:

  Which is the correct description of a hash result as it relates to digital certificates?

  A. A unique value used to verify the input data
  B. An output value that is used to identify the person or device that authored the input data.
  C. An obfuscation used to mask the input data.
  D. An encrypted output value used to safe-guard the input data
  A. A unique value used to verify the input data

• Question 43:

  View the exhibit.

  

  Which of the following statements are correct? (Choose two.)

  A. This setup requires at least two firewall policies with the action set to IPsec.
  B. Dead peer detection must be disabled to support this type of IPsec setup.
  C. The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
  D. This is a redundant IPsec setup.
  C. The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
  D. This is a redundant IPsec setup.

• Question 44:

  Which of the following FortiGate configuration tasks will create a route in the policy route table? (Choose two.)

  A. Static route created with a Named Address object
  B. Static route created with an Internet Services object
  C. SD-WAN route created for individual member interfaces
  D. SD-WAN rule created to route traffic based on link latency
  B. Static route created with an Internet Services object
  D. SD-WAN rule created to route traffic based on link latency

• Question 45:

  By default, when logging to disk, when does FortiGate delete logs?

  A. 30 days
  B. 1 year
  C. Never
  D. 7 days
  D. 7 days

• Question 46:

  Which of the following statements about converse mode are true? (Choose two.)

  A. FortiGate stops sending files to FortiSandbox for inspection.
  B. FortiGate stops doing RPF checks over incoming packets.
  C. Administrators cannot change the configuration.
  D. Administrators can access the FortiGate only through the console port.
  A. FortiGate stops sending files to FortiSandbox for inspection.
  C. Administrators cannot change the configuration.

• Question 47:

  Which is a requirement for creating an inter-VDOM link between two VDOMs?

  A. The inspection mode of at least one VDOM must be proxy-based.
  B. At least one of the VDOMs must operate in NAT mode.
  C. The inspection mode of both VDOMs must match.
  D. Both VDOMs must operate in NAT mode.
  B. At least one of the VDOMs must operate in NAT mode.

• Question 48:

  An administrator is running the following sniffer command: diagnose sniffer packet any "host 10.0.2.10" 3

  What information will be included in the sniffer output? (Choose three.)

  A. IP header
  B. Ethernet header
  C. Packet payload
  D. Application header
  E. Interface name
  A. IP header
  B. Ethernet header
  C. Packet payload

• Question 49:

  Which statements about antivirus scanning mode are true? (Choose two.)

  A. In proxy-based inspection mode antivirus buffers the whole file for scarring before sending it to the client.
  B. In flow-based inspection mode, you can use the CLI to configure antivirus profiles to use protocol option profiles.
  C. In proxy-based inspection mode, if a virus is detected, a replacement message may not be displayed immediately.
  D. In quick scan mode, you can configure antivirus profiles to use any of the available signature data bases.
  A. In proxy-based inspection mode antivirus buffers the whole file for scarring before sending it to the client.
  B. In flow-based inspection mode, you can use the CLI to configure antivirus profiles to use protocol option profiles.

• Question 50:

  Which statement is true regarding SSL VPN timers? (Choose two.)

  A. Allow to mitigate DoS attacks from partial HTTP requests.
  B. SSL VPN settings do not have customizable timers.
  C. Disconnect idle SSL VPN users when a firewall policy authentication timeout occurs.
  D. Prevent SSL VPN users from being logged out because of high network latency.
  A. Allow to mitigate DoS attacks from partial HTTP requests.
  D. Prevent SSL VPN users from being logged out because of high network latency.