Fortinet Fortinet Certifications NSE4_FGT-6.4 Questions & Answers

• Question 121:

  Examine this FortiGate configuration:

  

  Examine the output of the following debug command:

  

  Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?

  A. It is allowed, but with no inspection

  B. It is allowed and inspected as long as the inspection is flow based

  C. It is dropped.

  D. It is allowed and inspected, as long as the only inspection required is antivirus.

  Correct Answer: C

• Question 122:

  Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).

  

  

  Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

  A. The firewall policy performs the full content inspection on the file.

  B. The flow-based inspection is used, which resets the last packet to the user.

  C. The volume of traffic being inspected is too high for this model of FortiGate.

  D. The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.

  Correct Answer: B

• Question 123:

  Refer to the exhibit.

  

  The exhibits show a network diagram and the explicit web proxy configuration.

  In the command diagnose sniffer packet, what filter can you use to capture the traffic between the client and the explicit web proxy?

  A. `host 192.168.0.2 and port 8080'

  B. `host 10.0.0.50 and port 80'

  C. `host 192.168.0.1 and port 80'

  D. `host 10.0.0.50 and port 8080'

  Correct Answer: A

• Question 124:

  FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy.

  Which two other security profiles can you apply to the security policy? (Choose two.)

  A. Antivirus scanning

  B. File filter

  C. DNS filter

  D. Intrusion prevention

  Correct Answer: AD

• Question 125:

  Refer to the exhibit.

  

  The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.

  The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access the Internet. The To_Internet VDOM is the only VDOM with internet access and is directly connected to ISP modem.

  Which two statements are true? (Choose two.)

  A. Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.

  B. A static route is required on the To_Internet VDOM to allow LAN users to access the internet.

  C. Inter-VDOM links are required to allow traffic between the Local and DMZ VDOMs.

  D. Inter-VDOM links are not required between the Root and To_Internet VDOMs because the Root VDOM is used only as a management VDOM.

  Correct Answer: AD

• Question 126:

  Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)

  A. The firmware image must be manually uploaded to each FortiGate.

  B. Only secondary FortiGate devices are rebooted.

  C. Uninterruptable upgrade is enabled by default.

  D. Traffic load balancing is temporally disabled while upgrading the firmware.

  Correct Answer: CD

• Question 127:

  Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

  A. To detect intermediary NAT devices in the tunnel path.

  B. To dynamically change phase 1 negotiation mode aggressive mode.

  C. To encapsulation ESP packets in UDP packets using port 4500.

  D. To force a new DH exchange with each phase 2 rekey.

  Correct Answer: AC

• Question 128:

  Refer to the exhibit, which contains a static route configuration.

  

  An administrator created a static route for Amazon Web Services. What CLI command must the administrator use to view the route?

  A. get router info routing-table all

  B. get internet service route list

  C. get router info routing-table database

  D. diagnose firewall proute list

  Correct Answer: D

  Reference: https://docs.fortinet.com/document/fortigate/latest/administration-guide/139692/routingconcepts

• Question 129:

  Which two statements are correct about a software switch on FortiGate? (Choose two.)

  A. It can be configured only when FortiGate is operating in NAT mode

  B. Can act as a Layer 2 switch as well as a Layer 3 router

  C. All interfaces in the software switch share the same IP address

  D. It can group only physical interfaces

  Correct Answer: AC

• Question 130:

  Examine the exhibit, which contains a virtual IP and firewall policy configuration.

  

  

  The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address 10.0.1.254/24.

  The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.

  Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

  A. 10.200.1.10

  B. Any available IP address in the WAN (port1) subnet 10.200.1.0/24

  C. 10.200.1.1

  D. 10.0.1.254

  Correct Answer: A

  https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Firewall%20Objects/Virtual% 20IPs.htm