Fortinet Fortinet Certifications NSE4_FGT-6.4 Questions & Answers

• Question 71:

  Examine the two static routes shown in the exhibit, then answer the following question.

  

  Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?

  A. FortiGate will load balance all traffic across both routes.

  B. FortiGate will use the port1 route as the primary candidate.

  C. FortiGate will route twice as much traffic to the port2 route

  D. FortiGate will only actuate the port1 route in the routing table

  Correct Answer: B

  "If multiple static routes have the same distance, they are all active; however, only the one with the lowest priority is considered the best path."

• Question 72:

  Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)

  A. This is known as many-to-one NAT.

  B. Source IP is translated to the outgoing interface IP.

  C. Connections are tracked using source port and source MAC address.

  D. Port address translation is not used.

  Correct Answer: BD

• Question 73:

  Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?

  A. By default, FortiGate uses WINS servers to resolve names.

  B. By default, the SSL VPN portal requires the installation of a client's certificate.

  C. By default, split tunneling is enabled.

  D. By default, the admin GUI and SSL VPN portal use the same HTTPS port.

  Correct Answer: D

• Question 74:

  Refer to the exhibit showing a debug flow output.

  

  Which two statements about the debug flow output are correct? (Choose two.)

  A. The debug flow is of ICMP traffic.

  B. A firewall policy allowed the connection.

  C. A new traffic session is created.

  D. The default route is required to receive a reply.

  Correct Answer: AC

• Question 75:

  Which two statements are correct about NGFW Policy-based mode? (Choose two.)

  A. NGFW policy-based mode does not require the use of central source NAT policy

  B. NGFW policy-based mode can only be applied globally and not on individual VDOMs

  C. NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy

  D. NGFW policy-based mode policies support only flow inspection

  Correct Answer: CD

• Question 76:

  How does FortiGate act when using SSL VPN in web mode?

  A. FortiGate acts as an FDS server.

  B. FortiGate acts as an HTTP reverse proxy.

  C. FortiGate acts as DNS server.

  D. FortiGate acts as router.

  Correct Answer: B

  Reference: https://pub.kb.fortinet.com/ksmcontent/Fortinet-Public/current/Fortigate_v4.0MR3/fortigatesslvpn-40-mr3.pdf

• Question 77:

  What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

  A. It limits the scope of application control to the browser-based technology category only.

  B. It limits the scope of application control to scan application traffic based on application category only.

  C. It limits the scope of application control to scan application traffic using parent signatures only

  D. It limits the scope of application control to scan application traffic on DNS protocol only.

  Correct Answer: B

• Question 78:

  Which two statements are true about collector agent advanced mode? (Choose two.)

  A. Advanced mode uses Windows convention--NetBios: Domain\Username.

  B. FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate

  C. Advanced mode supports nested or inherited groups

  D. Security profiles can be applied only to user groups, not individual users.

  Correct Answer: BC

• Question 79:

  Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)

  A. Shut down/reboot a downstream FortiGate device.

  B. Disable FortiAnalyzer logging for a downstream FortiGate device.

  C. Log in to a downstream FortiSwitch device.

  D. Ban or unban compromised hosts.

  Correct Answer: AB

• Question 80:

  An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.

  Which DPD mode on FortiGate will meet the above requirement?

  A. Disabled

  B. On Demand

  C. Enabled

  D. On Idle

  Correct Answer: D