NSE4_FGT-5.6 Practice Questions Preview

Question 1

Multiple choice

Which statements about IP-based explicit proxy authentication are true?

(Choose two.)

Response:

A
IP-based authentication is best suited to authenticating users behind a NAT device.
B
Sessions from the same source address are treated as a single user.
C
IP-based authentication consumes less FortiGate's memory than session-based authentication.
D
FortiGate remembers authenticated sessions using browser cookies.

Reveal answer details Close answer details

Correct answersB, C

Question 2

Multiple choice

Which of the following settings and protocols can be used to provide secure and restrictive administrative access to FortiGate?

(Choose three.)

Response:

A
Trusted host
B
HTTPS
C
Trusted authentication
D
SSH
E
FortiTelemetry

Reveal answer details Close answer details

Correct answersA, B, D

Question 3

Multiple choice

You have enabled a web filter security profile in a firewall policy to log all blocked websites. What options do you have to either actively or passively monitor these logs? (Choose two.)

Response:

A
Alert Message console
B
FortiView menu
C
Alert email
D
Monitor menu

Reveal answer details Close answer details

Correct answersA, C

Question 4

Multiple choice

Which statements best describe auto discovery VPN (ADVPN).

(Choose two.)

Response:

A
It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
B
ADVPN is only supported with IKEv2.
C
Tunnels are negotiated dynamically between spokes.
D
Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Reveal answer details Close answer details

Correct answersA, C

Question 5

Single choice

What is the purpose of the Policy Lookup feature?

Response:

A
It searches the matching policy based on input criteria.
B
It creates packet flow over FortiGate by sending real-time traffic.
C
It finds duplicate objects in firewall policies.
D
It creates a new firewall policy based on input criteria.

Reveal answer details Close answer details

Correct answerA

Question 6

Multiple choice

Which statements are true of public key infrastracture (PKI) users on FortiGate?

(Choose two.)

Response:

A
FortiGate must include the CA certificate that issued the PKI peer user certificate.
B
PKI users can belong to firewall user groups.
C
PKI users must authenticate with both a certificate and a password.
D
The first PKI user must be added to FortiGate through the GUI.

Reveal answer details Close answer details

Correct answersA, B

Question 7

Multiple choice

Examine this output from a debug flow:

Which statements about the output are correct?

(Choose two.)

Response:

A
FortiGate received a TCP SYN/ACK packet.
B
The source IP address of the packet was translated to 10.0.1.10.
C
FortiGate routed the packet through port 3.
D
The packet was allowed by the firewall policy with the ID 00007fc0.

Reveal answer details Close answer details

Correct answersB, C

Question 8

Single choice

View the exhibit.

When a user attempts to connect to an HTTPS site, what is the expected result with this configuration?

Response:

A
The user is required to authenticate before accessing sites with untrusted SSL certificates.
B
The user is presented with certificate warnings when connecting to sites that have untrusted SSL certificates.
C
The user is allowed access all sites with untrusted SSL certificates, without certificate warnings.
D
The user is blocked from connecting to sites that have untrusted SSL certificates (no exception provided).

Reveal answer details Close answer details

Correct answerB

Question 9

Single choice

How are the application control signatures updated on a FortiGate device?

Response:

A
By running the application control auto-learning feature.
B
Through FortiGuard updates.
C
By upgrading the FortiOS firmware to a newer release.
D
By clicking Update Signatures in the application control profile.

Reveal answer details Close answer details

Correct answerB

Question 10

Single choice

An administrator has enabled the DHCP Server on the port1 interface and configured the following based on the exhibit.

Which statement is correct based on this configuration?

Response:

A
The MAC address 00:0c:29:29:38:da belongs to the port1 interface.
B
Access to the network is blocked for the devices with the MAC address 00:0c:29:29:38:da and the IP address 10.0.1.254.
C
00:0c:29:29:38:da is the virtual MAC address assigned to the secondary IP address (10.0.1.254) of the port1 interface.
D
The IP address 10.0.1.254 is reserves for the device with the MAC address 00:0c:29:29:38:da.

Reveal answer details Close answer details

Correct answerD

Question 11

Multiple choice

Which of the following statements are true regarding the SD-WAN feature on FortiGate?

(Choose two.)

Response:

A
An SD-WAN static route does not require a next-hop gateway IP address.
B
Each member interface requires its own firewall policy to allow traffic.
C
SD-WAN provides route failover protection, but cannot load-balance traffic.
D
FortiGate supports only one SD-WAN interface per VDOM.

Reveal answer details Close answer details

Correct answersA, D

Question 12

Single choice

What FortiGate feature can be used to block a ping sweep scan from an attacker?

Response:

A
Web application firewall (WAF)
B
Rate based IPS signatures
C
One-arm sniffer
D
DoS policies

Reveal answer details Close answer details

Correct answerB

Question 13

Multiple choice

An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that?

(Choose three.)

Response:

A
The interface has been configured for one-arm sniffer.
B
The interface is a member of a virtual wire pair.
C
The operation mode is transparent.
D
The interface is a member of a zone.
E
Captive portal is enabled in the interface.

Reveal answer details Close answer details

Correct answersA, B, C

Question 14

Multiple choice

Which ways can FortiGate deliver one-time passwords (OTPs) to two-factor authentication users in your network?

(Choose three.)

Response:

A
Hardware FortiToken
B
Web portal
C
SMS
D
USB FortiToken
E
FortiToken Mobile

Reveal answer details Close answer details

Correct answersA, C, E

Question 15

Single choice

What is the purpose of the Policy Lookup feature?

Response:

A
It searches the matching policy based on an input criteria.
B
It enables hidden security profiles with full logging capabilities and generates Learning Reports based on an input criteria.
C
It finds duplicate objects in firewall policies.
D
It creates a new firewall policy based on an input criteria.

Reveal answer details Close answer details

Correct answerA

Question 16

Multiple choice

Which of the following statements about the FortiGate application control database are true?

(Choose two.)

Response:

A
The application control database uses TCP port 53 for downloads.
B
The application control database uses a hierarchical structure to organize application signatures.
C
The application control database is part of the IPS signatures database.
D
The application control database updates are included in the free FortiGuard service.

Reveal answer details Close answer details

Correct answersB, D

Question 17

Multiple choice

An administrator wants to monitor their network for any probing attempts aimed to exploit existing vulnerabilities in their servers. What must they configure on their FortiGate to accomplish this?

(Choose two.)

Response:

A
An application control profile and set all application signatures to monitor.
B
A DoS policy, and log all UDP and TCP scan attempts.
C
An IPS sensor to monitor all signatures applicable to the server.
D
A web application firewall profile to check protocol constraints.

Reveal answer details Close answer details

Correct answersB, C

Question 18

Single choice

A FortiGate has multiple VDOMs operating in NAT mode with multiple VLAN interfaces in each VDOM.

Which of the following statements is true regarding the IP addresses assigned to each VLAN interface?

Response:

A
Different VLANs can never share the same IP address on the same physical device.
B
Different VLANs can share the same IP address as long as they are in different VDOMs.
C
Different VLANs can share the same IP address as long as they have different VLAN tag IDs.
D
Different VLANs can share the same IP address as long as they are in different physical interfaces.

Reveal answer details Close answer details

Correct answerB