Fortinet Fortinet Certifications NSE4_FGT-6.2 Questions & Answers

• Question 61:

  Refer to the following exhibit.

  

  

  

  Why is FortiGate not blocking the test file over FTP download?

  A. Deep-inspection must be enabled for FortiGate to fully scan FTP traffic.

  B. FortiGate needs to be operating in flow-based inspection mode in order to scan FTP traffic.

  C. The FortiSandbox signature database is required to successfully scan FTP traffic.

  D. The proxy options profile needs to scan FTP traffic on a non-standard port.

  Correct Answer: D

• Question 62:

  View the following exhibit, which shows the firewall policies and the object uses in the firewall policies.

  

  

  The administrator is using the Policy Lookup feature and has entered the search create shown in the following exhibit.

  

  Which of the following will be highlighted based on the input criteria?

  A. Policy with ID1.

  B. Policies with ID 2 and 3.

  C. Policy with ID 5.

  D. Policy with ID 4.

  Correct Answer: A

• Question 63:

  Examine the two static routes shown in the exhibit, then answer the following question.

  

  Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?

  A. FortiGate will load balance all traffic across both routes.

  B. FortiGate will use the port1 route as the primary candidate.

  C. FortiGate will route twice as much traffic to the port2 route

  D. FortiGate will only actuate the port1 route in the routing table

  Correct Answer: B

• Question 64:

  An administrator is configuring an Ipsec between site A and siteB. The Remotes Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24. How must the administrator configure the local quick mode selector for site B?

  A. 192.168.3.0/24

  B. 192.168.2.0/24

  C. 192.168.1.0/24

  D. 192.168.0.0/8

  Correct Answer: B

• Question 65:

  Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

  A. To detect intermediary NAT devices in the tunnel path.

  B. To dynamically change phase 1 negotiation mode aggressive mode.

  C. To encapsulation ESP packets in UDP packets using port 4500.

  D. To force a new DH exchange with each phase 2 rekey.

  Correct Answer: AC

• Question 66:

  In a high availability (HA) cluster operating in active-active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a secondary FortiGate?

  A. Client > primary FortiGate> secondary FortiGate> primary FortiGate> web server.

  B. Client > secondary FortiGate> web server.

  C. Clinet >secondary FortiGate> primary FortiGate> web server.

  D. Client> primary FortiGate> secondary FortiGate> web server.

  Correct Answer: D

• Question 67:

  Examine this output from a debug flow: Which statements about the output are correct? (Choose two.)

  

  A. FortiGate received a TCP SYN/ACK packet.

  B. The source IP address of the packet was translated to 10.0.1.10.

  C. FortiGate routed the packet through port 3.

  D. The packet was allowed by the firewall policy with the ID 00007fc0.

  Correct Answer: AC

• Question 68:

  Which statements about antivirus scanning mode are true? (Choose two.)

  A. In proxy-based inspection mode antivirus buffers the whole file for scarring before sending it to the client.

  B. In flow-based inspection mode, you can use the CLI to configure antivirus profiles to use protocol option profiles.

  C. In proxy-based inspection mode, if a virus is detected, a replacement message may not be displayed immediately.

  D. In quick scan mode, you can configure antivirus profiles to use any of the available signature data bases.

  Correct Answer: AB

• Question 69:

  A team manager has decided that while some members of the team need access to particular website, the majority of the team does not. Which configuration option is the most effective option to support this request?

  A. Implement a web filter category override for the specified website.

  B. Implement web filter authentication for the specified website

  C. Implement web filter quotas for the specified website.

  D. Implement DNS filter for the specified website.

  Correct Answer: A

• Question 70:

  Examine the network diagram shown in the exhibit, then answer the following question:

  

  Which one of the following routes is the best candidate route for FGT1 to route traffic from the Workstation to the Web server?

  A. 172.16.0.0/16 [50/0] via 10.4.200.2, port2 [5/0]

  B. 0.0.0.0/0 [20/0] via 10.4.200.2, port2

  C. 10.4.200.0/30 is directly connected, port2

  D. 172.16.32.0/24 is directly connected, port1

  Correct Answer: D