Fortinet NSE4 NSE4_FGT-6.4 Questions & Answers

• Question 1:

  Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?

  A. The public key of the web server certificate must be installed on the browser.

  B. The web-server certificate must be installed on the browser.

  C. The CA certificate that signed the web-server certificate must be installed on the browser.

  D. The private key of the CA certificate that signed the browser certificate must be installed on the browser.

  Correct Answer: C

• Question 2:

  In which two ways can RPF checking be disabled? (Choose two )

  A. Enable anti-replay in firewall policy.

  B. Disable the RPF check at the FortiGate interface level for the source check

  C. Enable asymmetric routing.

  D. Disable strict-arc-check under system settings.

  Correct Answer: CD

• Question 3:

  An administrator is configuring an IPsec VPN between site A and site B. The Remote Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24.

  Which subnet must the administrator configure for the local quick mode selector for site B?

  A. 192.168.1.0/24

  B. 192.168.0.0/24

  C. 192.168.2.0/24

  D. 192.168.3.0/24

  Correct Answer: C

• Question 4:

  Refer to the exhibit.

  

  Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?

  A. Custom permission for Network

  B. Read/Write permission for Log and Report

  C. CLI diagnostics commands permission

  D. Read/Write permission for Firewall

  Correct Answer: C

  https://kb.fortinet.com/kb/documentLink.do?externalID=FD50220

• Question 5:

  Which feature in the Security Fabric takes one or more actions based on event triggers?

  A. Fabric Connectors

  B. Automation Stitches

  C. Security Rating

  D. Logical Topology

  Correct Answer: C

• Question 6:

  Refer to the exhibit, which contains a session diagnostic output.

  

  Which statement is true about the session diagnostic output?

  A. The session is a UDP unidirectional state.

  B. The session is in TCP ESTABLISHED state.

  C. The session is a bidirectional UDP connection.

  D. The session is a bidirectional TCP connection.

  Correct Answer: C

• Question 7:

  Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

  A. System time

  B. FortiGuaid update servers

  C. Operating mode

  D. NGFW mode

  Correct Answer: CD

  C: "Operating mode is per-VDOM setting. You can combine transparent mode VDOM's with NAT mode VDOMs on the same physical Fortigate.

  D: "Inspection-mode selection has moved from VDOM to firewall policy, and the default inspection-mode is flow, so NGFW Mode can be changed from Profile-base (Default) to Policy-base directly in System > Settings from the VDOM" Page 125 of FortiGate_Infrastructure_6.4_Study_Guide

• Question 8:

  Refer to the exhibit.

  

  Which contains a Performance SLA configuration.

  An administrator has configured a performance SLA on FortiGate. Which failed to generate any traffic. Why is FortiGate not generating any traffic for the performance SLA?

  A. Participants configured are not SD-WAN members.

  B. There may not be a static route to route the performance SLA traffic.

  C. The Ping protocol is not supported for the public servers that are configured.

  D. You need to turn on the Enable probe packets switch.

  Correct Answer: D

  Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/478384/performance-sla-linkmonitoring

• Question 9:

  A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.

  What is the reason for the certificate warning errors?

  A. The browser requires a software update.

  B. FortiGate does not support full SSL inspection when web filtering is enabled.

  C. The CA certificate set on the SSL/SSH inspection profile has not been imported into the browser.

  D. There are network connectivity issues.

  Correct Answer: C

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD41394

• Question 10:

  Examine the IPS sensor configuration shown in the exhibit, and then answer the question below.

  

  

  An administrator has configured the WINDOWS_SERVERS IPS sensor in an attempt to determine whether the influx of HTTPS traffic is an attack attempt or not. After applying the IPS sensor, FortiGate is still not generating any IPS logs for the HTTPS traffic.

  What is a possible reason for this?

  A. The IPS filter is missing the Protocol: HTTPS option.

  B. The HTTPS signatures have not been added to the sensor.

  C. A DoS policy should be used, instead of an IPS sensor.

  D. A DoS policy should be used, instead of an IPS sensor.

  E. The firewall policy is not using a full SSL inspection profile.

  Correct Answer: E