VCEdump

NSE4_FGT-6.0 Fortinet NSE 4 - FortiOS 6.0

PDF question preview Back to product

Free preview

19 sample questions

The complete product contains 126 questions.

Question formats

Single choice12

Multiple choice7

Compare study plans

Fortinet · NSE4_FGT-6.0

NSE4_FGT-6.0 questions and answers

Review the question wording, option layout, and available explanations before choosing a study plan.

Question 1

Single choice

Which statement is true regarding the policy ID number of a firewall policy?

A
Defines the order in which rules are processed.
B
Represents the number of objects used in the firewall policy.
C
Required to modify a firewall policy using the CLI.
D
Changes when firewall policies are reordered.

Question 2

Multiple choice

An administrator has configured the following settings:

What does the configuration do? (Choose two.)

A
Reduces the amount of logs generated by denied traffic.
B
Enforces device detection on all interfaces for 30 minutes.
C
Blocks denied users for 30 minutes.
D
Creates a session for traffic being denied.

Question 3

Single choice

An administrator has configured a route-based IPsec VPN between two FortiGate devices.

Which statement about this IPsec VPN configuration is true?

A
A phase 2 configuration is not required.
B
This VPN cannot be used as part of a hub-and-spoke topology.
C
A virtual IPsec interface is automatically created after the phase 1 configuration is completed.
D
The IPsec firewall policies must be placed at the top of the list.

Question 4

Multiple choice

View the exhibit.

What does this raw log indicate? (Choose two.)

A
FortiGate blocked the traffic.
B
type indicates that a security event was recorded.
C
10.0.1.20 is the IP address for lavito.tk.
D
policyid indicates that traffic went through the IPS firewall policy.

Question 5

Single choice

Which of the following statements about the FSSO collector agent timers is true?

A
The workstation verify interval is used to periodically check if a workstation is still a domain member.
B
The IP address change verify interval monitors the server IP address where the collector agent is installed, and the updates the collector agent configuration if it changes.
C
The user group cache expiry is used to age out the monitored groups.
D
The dead entry timeout interval is used to age out entries with an unverified status.

Question 6

Single choice

Examine this FortiGate configuration:

Examine the output of the following debug command:

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?

A
It is allowed, but with no inspection
B
It is allowed and inspected as long as the inspection is flow based
C
It is dropped.
D
It is allowed and inspected, as long as the only inspection required is antivirus.

Question 7

Single choice

View the certificate shown to the exhibit, and then answer the following question:

The CA issued this certificate to which entity?

A
A root CA
B
A person
C
A bridge CA
D
A subordinate CA

Question 8

Single choice

How do you format the FortiGate flash disk?

A
Load a debug FortiOS image.
B
Load the hardware test (HQIP) image.
C
Execute the CLI command execute formatlogdisk.
D
Select the format boot device option from the BIOS menu.

Question 9

Single choice

Which of the following static routes are not maintained in the routing table?

A
Named Address routes
B
Dynamic routes
C
ISDB routes
D
Policy routes

Question 10

Single choice

What information is flushed when the chunk-size value is changed in the config dlp settings?

A
The database for DLP document fingerprinting
B
The supported file types in the DLP filters
C
The archived files and messages
D
The file name patterns in the DLP filters

Question 11

Multiple choice

What FortiGate components are tested during the hardware test? (Choose three.)

A
Administrative access
B
HA heartbeat
C
CPU
D
Hard disk
E
Network interfaces

Question 12

Single choice

An administrator is configuring an antivirus profiles on FortiGate and notices that Proxy Options is not listed under Security Profiles on the GUI.

What can cause this issue?

A
FortiGate needs to be switched to NGFW mode.
B
Proxy options section is hidden by default and needs to be enabled from the Feature Visibility menu.
C
Proxy options are no longer available starting in FortiOS 5.6.
D
FortiGate is in flow-based inspection mode.

Question 13

Multiple choice

Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)

A
Log downloads from the GUI are limited to the current filter view
B
Log backups from the CLI cannot be restored to another FortiGate.
C
Log backups from the CLI can be configured to upload to FTP as a scheduled time
D
Log downloads from the GUI are stored as LZ4 compressed files.

Question 14

Multiple choice

Which of the following FortiGate configuration tasks will create a route in the policy route table? (Choose two.)

A
Static route created with a Named Address object
B
Static route created with an Internet Services object
C
SD-WAN route created for individual member interfaces
D
SD-WAN rule created to route traffic based on link latency

Question 15

Single choice

An administrator wants to block HTTP uploads. Examine the exhibit, which contains the proxy address created for that purpose.

Where must the proxy address be used?

A
As the source in a firewall policy.
B
As the source in a proxy policy.
C
As the destination in a firewall policy.
D
As the destination in a proxy policy.

Question 16

Multiple choice

Examine this output from a debug flow:

Which statements about the output are correct? (Choose two.)

A
FortiGate received a TCP SYN/ACK packet.
B
The source IP address of the packet was translated to 10.0.1.10.
C
FortiGate routed the packet through port 3.
D
The packet was allowed by the firewall policy with the ID 00007fc0.

Question 17

Single choice

An administration wants to throttle the total volume of SMTP sessions to their email server.

Which of the following DoS sensors can be used to achieve this?

A
tcp_port_scan
B
ip_dst_session
C
udp_flood
D
ip_src_session

Question 18

Single choice

A team manager has decided that while some members of the team need access to particular website, the majority of the team does not.

Which configuration option is the most effective option to support this request?

A
Implement a web filter category override for the specified website.
B
Implement web filter authentication for the specified website
C
Implement web filter quotas for the specified website.
D
Implement DNS filter for the specified website.

Question 19

Multiple choice

View the exhibit.

Based on this output, which statements are correct? (Choose two.)

A
The all VDOM is not synchronized between the primary and secondary FortiGate devices.
B
The root VDOM is not synchronized between the primary and secondary FortiGate devices.
C
The global configuration is synchronized between the primary and secondary FortiGate devices.
D
The FortiGate devices have three VDOMs.