NSE4_FGT-5.6 Practice Questions Preview

Question 1

Multiple choice

Which statements about IP-based explicit proxy authentication are true?

(Choose two.)

Response:

A
IP-based authentication is best suited to authenticating users behind a NAT device.
B
Sessions from the same source address are treated as a single user.
C
IP-based authentication consumes less FortiGate's memory than session-based authentication.
D
FortiGate remembers authenticated sessions using browser cookies.

Question 2

Multiple choice

Which of the following settings and protocols can be used to provide secure and restrictive administrative access to FortiGate?

(Choose three.)

Response:

A
Trusted host
B
HTTPS
C
Trusted authentication
D
SSH
E
FortiTelemetry

Question 3

Multiple choice

You have enabled a web filter security profile in a firewall policy to log all blocked websites. What options do you have to either actively or passively monitor these logs? (Choose two.)

Response:

A
Alert Message console
B
FortiView menu
C
Alert email
D
Monitor menu

Question 4

Multiple choice

Which statements best describe auto discovery VPN (ADVPN).

(Choose two.)

Response:

A
It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
B
ADVPN is only supported with IKEv2.
C
Tunnels are negotiated dynamically between spokes.
D
Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Question 5

Single choice

What is the purpose of the Policy Lookup feature?

Response:

A
It searches the matching policy based on input criteria.
B
It creates packet flow over FortiGate by sending real-time traffic.
C
It finds duplicate objects in firewall policies.
D
It creates a new firewall policy based on input criteria.

Question 6

Multiple choice

Which statements are true of public key infrastracture (PKI) users on FortiGate?

(Choose two.)

Response:

A
FortiGate must include the CA certificate that issued the PKI peer user certificate.
B
PKI users can belong to firewall user groups.
C
PKI users must authenticate with both a certificate and a password.
D
The first PKI user must be added to FortiGate through the GUI.

Question 7

Multiple choice

Examine this output from a debug flow:

Which statements about the output are correct?

(Choose two.)

Response:

A
FortiGate received a TCP SYN/ACK packet.
B
The source IP address of the packet was translated to 10.0.1.10.
C
FortiGate routed the packet through port 3.
D
The packet was allowed by the firewall policy with the ID 00007fc0.

Question 8

Single choice

View the exhibit.

When a user attempts to connect to an HTTPS site, what is the expected result with this configuration?

Response:

A
The user is required to authenticate before accessing sites with untrusted SSL certificates.
B
The user is presented with certificate warnings when connecting to sites that have untrusted SSL certificates.
C
The user is allowed access all sites with untrusted SSL certificates, without certificate warnings.
D
The user is blocked from connecting to sites that have untrusted SSL certificates (no exception provided).

Question 9

Single choice

How are the application control signatures updated on a FortiGate device?

Response:

A
By running the application control auto-learning feature.
B
Through FortiGuard updates.
C
By upgrading the FortiOS firmware to a newer release.
D
By clicking Update Signatures in the application control profile.

Question 10

Single choice

An administrator has enabled the DHCP Server on the port1 interface and configured the following based on the exhibit.

Which statement is correct based on this configuration?

Response:

A
The MAC address 00:0c:29:29:38:da belongs to the port1 interface.
B
Access to the network is blocked for the devices with the MAC address 00:0c:29:29:38:da and the IP address 10.0.1.254.
C
00:0c:29:29:38:da is the virtual MAC address assigned to the secondary IP address (10.0.1.254) of the port1 interface.
D
The IP address 10.0.1.254 is reserves for the device with the MAC address 00:0c:29:29:38:da.

Question 11

Multiple choice

Which of the following statements are true regarding the SD-WAN feature on FortiGate?

(Choose two.)

Response:

A
An SD-WAN static route does not require a next-hop gateway IP address.
B
Each member interface requires its own firewall policy to allow traffic.
C
SD-WAN provides route failover protection, but cannot load-balance traffic.
D
FortiGate supports only one SD-WAN interface per VDOM.

Question 12

Single choice

What FortiGate feature can be used to block a ping sweep scan from an attacker?

Response:

A
Web application firewall (WAF)
B
Rate based IPS signatures
C
One-arm sniffer
D
DoS policies

Question 13

Multiple choice

An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that?

(Choose three.)

Response:

A
The interface has been configured for one-arm sniffer.
B
The interface is a member of a virtual wire pair.
C
The operation mode is transparent.
D
The interface is a member of a zone.
E
Captive portal is enabled in the interface.

Question 14

Multiple choice

Which ways can FortiGate deliver one-time passwords (OTPs) to two-factor authentication users in your network?

(Choose three.)

Response:

A
Hardware FortiToken
B
Web portal
C
SMS
D
USB FortiToken
E
FortiToken Mobile

Question 15

Single choice

What is the purpose of the Policy Lookup feature?

Response:

A
It searches the matching policy based on an input criteria.
B
It enables hidden security profiles with full logging capabilities and generates Learning Reports based on an input criteria.
C
It finds duplicate objects in firewall policies.
D
It creates a new firewall policy based on an input criteria.

Question 16

Multiple choice

Which of the following statements about the FortiGate application control database are true?

(Choose two.)

Response:

A
The application control database uses TCP port 53 for downloads.
B
The application control database uses a hierarchical structure to organize application signatures.
C
The application control database is part of the IPS signatures database.
D
The application control database updates are included in the free FortiGuard service.

Question 17

Multiple choice

An administrator wants to monitor their network for any probing attempts aimed to exploit existing vulnerabilities in their servers. What must they configure on their FortiGate to accomplish this?

(Choose two.)

Response:

A
An application control profile and set all application signatures to monitor.
B
A DoS policy, and log all UDP and TCP scan attempts.
C
An IPS sensor to monitor all signatures applicable to the server.
D
A web application firewall profile to check protocol constraints.

Question 18

Single choice

A FortiGate has multiple VDOMs operating in NAT mode with multiple VLAN interfaces in each VDOM.

Which of the following statements is true regarding the IP addresses assigned to each VLAN interface?

Response:

A
Different VLANs can never share the same IP address on the same physical device.
B
Different VLANs can share the same IP address as long as they are in different VDOMs.
C
Different VLANs can share the same IP address as long as they have different VLAN tag IDs.
D
Different VLANs can share the same IP address as long as they are in different physical interfaces.